better-supabase 0.13.0 → 0.15.0

package/dist/resolve-B0mW2m7f.js

@@ -0,0 +1,932 @@
+import { n as dbError } from "./errors-BVFgt8BZ.js";
+import { t as consoleLogger } from "./logger-glM28NVN.js";
+import { n as decodeJwtPayload, r as fromBase64, t as base64ToText } from "./base64-B9Wlsdj7.js";
+import { a as invalidActorError, n as actorOf } from "./actor-go7p9-CJ.js";
+import { DEFAULT_COOKIE_OPTIONS, createChunks, isChunkLike, parseCookieHeader, serializeCookieHeader, stringFromBase64URL, stringToBase64URL } from "@supabase/ssr";
+import { extractCredentials, verifyCredentials } from "@supabase/server/core";
+//#region src/auth/session.ts
+const DEFAULT_SESSION_ENCODING = "user-and-tokens";
+const BASE64_PREFIX = "base64-";
+/** Headers that keep responses carrying session cookies out of shared caches. */
+const AUTH_CACHE_HEADERS = {
+	"Cache-Control": "private, no-cache, no-store, must-revalidate, max-age=0",
+	Expires: "0",
+	Pragma: "no-cache"
+};
+/** `sb-<first label of the hostname>-auth-token`, the supabase-js default. */
+function sessionCookieName(url) {
+	let name = cookieNames.get(url);
+	if (name === void 0) {
+		name = `sb-${new URL(url).hostname.split(".")[0] ?? ""}-auth-token`;
+		if (cookieNames.size < 16) cookieNames.set(url, name);
+	}
+	return name;
+}
+/** Project URLs come from configuration, so a handful of entries suffice. */
+const cookieNames = /* @__PURE__ */ new Map();
+function parseCookies(header) {
+	return header ? parseCookieHeader(header) : [];
+}
+function serializeCookie(write) {
+	return serializeCookieHeader(write.name, write.value, write.options);
+}
+/**
+* Cookie values by name, per parsed cookie list: one request reads its session
+* more than once.
+*/
+const cookieMaps = /* @__PURE__ */ new WeakMap();
+function byNameOf(cookies) {
+	let byName = cookieMaps.get(cookies);
+	if (!byName) {
+		byName = new Map(cookies.map((cookie) => [cookie.name, cookie.value]));
+		cookieMaps.set(cookies, byName);
+	}
+	return byName;
+}
+function parseSession(raw) {
+	try {
+		const json = raw.startsWith(BASE64_PREFIX) ? stringFromBase64URL(raw.slice(7)) : raw;
+		const parsed = JSON.parse(json);
+		return isStoredSession(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+const readParts = /* @__PURE__ */ new WeakMap();
+/**
+* The whole cookie, else the `.0`, `.1`, ... chunks. When the joined chunks
+* don't parse (a stale `.2` left by a longer session), the longest prefix that
+* parses wins, so one leftover chunk never signs the user out.
+*/
+function readSessionParts(cookies, name) {
+	let memo = readParts.get(cookies);
+	const known = memo?.get(name);
+	if (known) return known;
+	const byName = byNameOf(cookies);
+	let result = {
+		session: null,
+		used: []
+	};
+	const whole = byName.get(name);
+	if (whole) result = {
+		session: parseSession(whole),
+		used: [name]
+	};
+	else {
+		const parts = [];
+		for (let index = 0;; index += 1) {
+			const part = byName.get(`${name}.${index}`);
+			if (!part) break;
+			parts.push(part);
+		}
+		for (let length = parts.length; length > 0; length -= 1) {
+			const session = parseSession(parts.slice(0, length).join(""));
+			if (session) {
+				result = {
+					session,
+					used: Array.from({ length }, (_, index) => `${name}.${index}`)
+				};
+				break;
+			}
+		}
+	}
+	if (!memo) {
+		memo = /* @__PURE__ */ new Map();
+		readParts.set(cookies, memo);
+	}
+	memo.set(name, result);
+	return result;
+}
+function isStoredSession(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const session = value;
+	return typeof session["access_token"] === "string" && typeof session["refresh_token"] === "string";
+}
+/**
+* Reads the session written by `@supabase/ssr` (plain or `base64-`, whole or
+* chunked, `user-and-tokens` or `tokens-only`). Trailing chunks a shorter
+* session no longer uses are ignored; chunks that never form a session read as
+* no session.
+*/
+function readSession(cookies, name) {
+	return readSessionParts(cookies, name).session;
+}
+/**
+* `Max-Age=0` writes for the session's chunk-like cookies that the readable
+* session doesn't use: a leftover `.2` after a shorter rewrite, chunks next to
+* a whole cookie, or chunks past a gap. Empty when no session reads.
+*/
+function pruneSessionChunks(cookies, name, options = {}) {
+	const { session, used } = readSessionParts(cookies, name);
+	if (!session) return [];
+	const kept = new Set(used);
+	const base = {
+		...DEFAULT_COOKIE_OPTIONS,
+		...options
+	};
+	return cookies.filter((cookie) => isChunkLike(cookie.name, name) && !kept.has(cookie.name)).map((cookie) => ({
+		name: cookie.name,
+		value: "",
+		options: {
+			...base,
+			maxAge: 0
+		}
+	}));
+}
+/**
+* The encoding a stored session was written with: `tokens-only` without a
+* `user`.
+*/
+function sessionEncoding(session) {
+	return session.user === void 0 || session.user === null ? "tokens-only" : "user-and-tokens";
+}
+function encoded(session, encode) {
+	switch (encode) {
+		case "user-and-tokens": return JSON.stringify(session);
+		case "tokens-only": {
+			const { user: _user, ...tokens } = session;
+			return JSON.stringify(tokens);
+		}
+		default: return encode;
+	}
+}
+/**
+* Cookie writes that store `session` (or clear it with `null`) exactly like
+* `@supabase/ssr` with the same `encode`, and expire chunks the new value no
+* longer uses.
+*/
+function writeSession(existing, name, session, options = {}, { encode = DEFAULT_SESSION_ENCODING } = {}) {
+	const base = {
+		...DEFAULT_COOKIE_OPTIONS,
+		...options
+	};
+	const chunks = session ? createChunks(name, BASE64_PREFIX + stringToBase64URL(encoded(session, encode))) : [];
+	const kept = new Set(chunks.map((chunk) => chunk.name));
+	return [...existing.filter((cookie) => isChunkLike(cookie.name, name) && !kept.has(cookie.name)).map((cookie) => ({
+		name: cookie.name,
+		value: "",
+		options: {
+			...base,
+			maxAge: 0
+		}
+	})), ...chunks.map((chunk) => ({
+		name: chunk.name,
+		value: chunk.value,
+		options: base
+	}))];
+}
+/**
+* `Max-Age=0` writes for every chunk of the session cookie at each of `scopes`,
+* like `clearAuthCookiesAtScopes` from `@supabase/ssr`. Use it once the cookie
+* `domain` or `path` changed, for the scopes earlier deploys wrote: browsers
+* ignore writes for scopes the host doesn't own, but a scope equal to the
+* current one clears the live session.
+*/
+function clearSessionAtScopes(existing, name, scopes) {
+	if (scopes.length === 0) return [];
+	const chunks = existing.map((cookie) => cookie.name).filter((cookie) => isChunkLike(cookie, name));
+	return scopes.flatMap((scope) => {
+		const options = {
+			...DEFAULT_COOKIE_OPTIONS,
+			...scope.domain === void 0 ? {} : { domain: scope.domain },
+			...scope.path === void 0 ? {} : { path: scope.path },
+			maxAge: 0
+		};
+		return chunks.map((chunk) => ({
+			name: chunk,
+			value: "",
+			options
+		}));
+	});
+}
+/** Applies cookie writes to a cookie list, as the next request would see it. */
+function applyCookieWrites(cookies, writes) {
+	const next = new Map(cookies.map((cookie) => [cookie.name, cookie.value]));
+	for (const write of writes) if (write.options.maxAge === 0) next.delete(write.name);
+	else next.set(write.name, write.value);
+	return [...next].map(([name, value]) => ({
+		name,
+		value
+	}));
+}
+//#endregion
+//#region src/auth/ended.ts
+const DEFAULT_TIMEOUT_MS$1 = 5e3;
+function accessTokenOf(request, options) {
+	const bearer = extractCredentials(request).token;
+	if (bearer) return bearer;
+	return readSession(parseCookies(request.headers.get("cookie")), options.cookieName ?? sessionCookieName(options.url))?.access_token;
+}
+async function sessionStatus(input, options) {
+	const token = typeof input === "string" ? input : accessTokenOf(input, options);
+	if (!token) return "unknown";
+	const exp = decodeJwtPayload(token)?.["exp"];
+	if (typeof exp === "number" && exp * 1e3 <= (options.now ?? Date.now)()) return "unknown";
+	const doFetch = options.fetch ?? fetch;
+	try {
+		const response = await doFetch(`${options.url}/auth/v1/user`, {
+			headers: {
+				apikey: options.publishableKey,
+				authorization: `Bearer ${token}`
+			},
+			signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS$1)
+		});
+		if (response.status === 401 || response.status === 403) return (await response.json().catch(() => null))?.["error_code"] === "user_banned" ? "banned" : "ended";
+		await response.body?.cancel();
+		return response.ok ? "active" : "unknown";
+	} catch {
+		return "unknown";
+	}
+}
+function clearSessionCookies(request, response, options) {
+	const writes = writeSession(parseCookies(request.headers.get("cookie")), options.cookieName ?? sessionCookieName(options.url), null, options.cookie);
+	if (writes.length === 0) return response;
+	for (const write of writes) response.headers.append("set-cookie", serializeCookie(write));
+	for (const [key, value] of Object.entries(AUTH_CACHE_HEADERS)) response.headers.set(key, value);
+	return response;
+}
+//#endregion
+//#region src/auth/hs256.ts
+let encoderInstance;
+const encoder = { encode: (text) => (encoderInstance ??= new TextEncoder()).encode(text) };
+/** The most HMAC keys kept at once; the oldest goes first. */
+const KEYS_SIZE = 64;
+const keys = /* @__PURE__ */ new Map();
+function keyFor(secret) {
+	let key = keys.get(secret);
+	if (!key) {
+		key = crypto.subtle.importKey("raw", encoder.encode(secret), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["verify"]);
+		keys.set(secret, key);
+		if (keys.size > KEYS_SIZE) {
+			const oldest = keys.keys().next();
+			if (!oldest.done) keys.delete(oldest.value);
+		}
+	}
+	return key;
+}
+function parseJson(part) {
+	try {
+		const parsed = JSON.parse(base64ToText(part));
+		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Whether the token is HS256 without a `kid`, the shape Supabase Lite (and
+* legacy shared-secret projects) issue.
+*/
+function isSharedSecretToken(token) {
+	const part = token.split(".", 1)[0];
+	const header = part ? parseJson(part) : void 0;
+	return header?.["alg"] === "HS256" && header["kid"] === void 0;
+}
+function fail(message) {
+	return {
+		ok: false,
+		code: "INVALID_JWT",
+		message
+	};
+}
+function matches(claim, expected) {
+	const wanted = typeof expected === "string" ? [expected] : expected;
+	return (Array.isArray(claim) ? claim : [claim]).some((value) => typeof value === "string" && wanted.includes(value));
+}
+/**
+* Verifies an HS256 user token against a shared secret with WebCrypto: the
+* signature, `exp`, `nbf`, and `aud` and `iss` when they are given.
+*/
+async function verifyHs256(token, secret, options) {
+	const parts = token.split(".");
+	const [encodedHeader, encodedPayload, encodedSignature] = parts;
+	if (parts.length !== 3 || !encodedHeader || !encodedPayload || encodedSignature === void 0) return fail("The token is not a JWT");
+	if (parseJson(encodedHeader)?.["alg"] !== "HS256") return fail("The token is not signed with HS256");
+	let signature;
+	try {
+		signature = fromBase64(encodedSignature);
+	} catch {
+		return fail("The token signature is not base64url");
+	}
+	if (!await crypto.subtle.verify("HMAC", await keyFor(secret), signature, encoder.encode(`${encodedHeader}.${encodedPayload}`))) return fail("The token signature does not match the JWT secret");
+	const payload = parseJson(encodedPayload);
+	if (!payload) return fail("The token payload is not a JSON object");
+	const { exp, nbf, sub } = payload;
+	if (typeof exp === "number" && exp <= options.now) return fail("The token has expired");
+	if (typeof nbf === "number" && nbf > options.now) return fail("The token is not valid yet");
+	if (options.audience !== void 0 && !matches(payload["aud"], options.audience)) return fail("The token audience does not match");
+	if (options.issuer !== void 0 && !matches(payload["iss"], options.issuer)) return fail("The token issuer does not match");
+	if (typeof sub !== "string") return fail("The token has no sub claim, so it identifies no user");
+	const claims = payload;
+	return {
+		ok: true,
+		claims,
+		user: {
+			id: sub,
+			...typeof claims.role === "string" ? { role: claims.role } : {},
+			...typeof claims.email === "string" ? { email: claims.email } : {},
+			...claims.app_metadata ? { appMetadata: claims.app_metadata } : {},
+			...claims.user_metadata ? { userMetadata: claims.user_metadata } : {}
+		}
+	};
+}
+//#endregion
+//#region src/auth/refresh.ts
+/**
+* How long a finished refresh is reused for requests still carrying the old
+* refresh token (parallel page loads, prefetches). Matches the default
+* refresh-token reuse interval of Supabase Auth.
+*/
+const REUSE_MS = 1e4;
+const DEFAULT_TIMEOUT_MS = 5e3;
+/**
+* Finished refreshes kept for reuse; a burst of sign-ins can't grow it past
+* this.
+*/
+const RECENT_MAX = 1e3;
+const inflight = /* @__PURE__ */ new Map();
+const recent = /* @__PURE__ */ new Map();
+function shared(outcome) {
+	return outcome.ok ? {
+		...outcome,
+		shared: true
+	} : outcome;
+}
+function prune(now) {
+	for (const [token, entry] of recent) {
+		if (entry.until > now) return;
+		recent.delete(token);
+	}
+}
+async function request(refreshToken, options, now) {
+	const doFetch = options.fetch ?? fetch;
+	const signal = AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+	let response;
+	try {
+		response = await doFetch(`${options.url}/auth/v1/token?grant_type=refresh_token`, {
+			method: "POST",
+			headers: {
+				apikey: options.forwardedFor?.secretKey ?? options.publishableKey,
+				"content-type": "application/json",
+				...options.forwardedFor ? { "sb-forwarded-for": options.forwardedFor.ip } : {}
+			},
+			body: JSON.stringify({ refresh_token: refreshToken }),
+			signal
+		});
+	} catch (cause) {
+		return {
+			ok: false,
+			reason: "network",
+			cause: signal.aborted ? "timeout" : "fetch",
+			message: cause instanceof Error ? cause.message : "fetch failed"
+		};
+	}
+	const body = await response.json().catch(() => null);
+	if (signal.aborted) return {
+		ok: false,
+		reason: "network",
+		cause: "timeout",
+		message: "refresh timed out"
+	};
+	if (!response.ok || !body || typeof body["access_token"] !== "string" || typeof body["refresh_token"] !== "string") {
+		const message = typeof body?.["msg"] === "string" ? body["msg"] : typeof body?.["error_description"] === "string" ? body["error_description"] : `Refresh failed with ${String(response.status)}`;
+		const outage = response.status >= 500 || response.status === 429;
+		const code = typeof body?.["error_code"] === "string" ? body["error_code"] : void 0;
+		return {
+			ok: false,
+			reason: outage ? "network" : code === RACED_CODE ? "raced" : "rejected",
+			...outage ? { cause: "status" } : {},
+			status: response.status,
+			...typeof body?.["error_code"] === "string" ? { code: body["error_code"] } : {},
+			message
+		};
+	}
+	const expiresIn = typeof body["expires_in"] === "number" ? body["expires_in"] : void 0;
+	return {
+		ok: true,
+		session: {
+			...body,
+			access_token: body["access_token"],
+			refresh_token: body["refresh_token"],
+			...typeof body["expires_at"] !== "number" && expiresIn !== void 0 ? { expires_at: Math.floor(now / 1e3) + expiresIn } : {}
+		}
+	};
+}
+/** The Auth error when a request tries a refresh token another request used. */
+const RACED_CODE = "refresh_token_already_used";
+/**
+* Exchanges a refresh token for a new session. Concurrent calls with the same
+* token share one request, and a successful result is reused for a short window
+* so parallel requests carrying the old cookie converge on one session.
+*/
+function refreshSession(refreshToken, options) {
+	const clock = options.now ?? Date.now;
+	const now = clock();
+	prune(now);
+	const key = `${options.url}\n${refreshToken}`;
+	const cached = recent.get(key);
+	if (cached) return Promise.resolve(shared(cached.outcome));
+	const pending = inflight.get(key);
+	if (pending) return pending.then(shared);
+	const promise = request(refreshToken, options, now).then((outcome) => {
+		if (outcome.ok || outcome.reason === "rejected") {
+			recent.delete(key);
+			recent.set(key, {
+				outcome,
+				until: clock() + REUSE_MS
+			});
+			if (recent.size > RECENT_MAX) {
+				const oldest = recent.keys().next();
+				if (!oldest.done) recent.delete(oldest.value);
+			}
+		}
+		return outcome;
+	}).finally(() => {
+		inflight.delete(key);
+	});
+	inflight.set(key, promise);
+	return promise;
+}
+//#endregion
+//#region src/auth/resolve.ts
+function expiryOf(session) {
+	if (typeof session.expires_at === "number") return session.expires_at;
+	const exp = decodeJwtPayload(session.access_token)?.["exp"];
+	return typeof exp === "number" ? exp : void 0;
+}
+/** An empty key set: `auth.jwks: false` verifies against it and fetches nothing. */
+const NO_KEYS = { keys: [] };
+/** `auth.jwks`, then `env.jwks` (`SUPABASE_JWKS`), then `env.jwksUrl`. */
+function jwksOf(options) {
+	if (options.jwks === false || options.jwks === null) return NO_KEYS;
+	return options.jwks ?? options.env.jwks ?? options.env.jwksUrl;
+}
+function serverEnv(options) {
+	const { env } = options;
+	return {
+		url: env.url,
+		publishableKeys: { default: env.publishableKey },
+		secretKeys: env.secretKeys ?? (env.secretKey ? { default: env.secretKey } : {}),
+		jwks: jwksOf(options)
+	};
+}
+const MEMO_SIZE = 256;
+const memoByUrl = /* @__PURE__ */ new Map();
+let memoByJwks = /* @__PURE__ */ new WeakMap();
+/** The most JWT secrets remembered at once; the oldest goes first. */
+const SECRET_IDS_SIZE = 64;
+/**
+* A number per JWT secret, so memo keys tell secrets apart. Bounded, and never
+* reuses a number.
+*/
+const secretIds = /* @__PURE__ */ new Map();
+let nextSecretId = 1;
+function secretId(secret) {
+	if (secret === void 0) return null;
+	let id = secretIds.get(secret);
+	if (id === void 0) {
+		id = nextSecretId;
+		nextSecretId += 1;
+		secretIds.set(secret, id);
+		if (secretIds.size > SECRET_IDS_SIZE) {
+			const oldest = secretIds.keys().next();
+			if (!oldest.done) secretIds.delete(oldest.value);
+		}
+	}
+	return id;
+}
+/**
+* Tokens that already verified, until they expire. Every private-cache scope
+* and island resolves the same token again; this skips the signature check. A
+* hit skips the audience and issuer checks too, so both are part of the key.
+*/
+function memoFor(options) {
+	const jwks = jwksOf(options);
+	const inline = !(jwks instanceof URL);
+	const key = JSON.stringify([
+		inline ? null : String(jwks),
+		options.env.url,
+		options.audience ?? null,
+		options.issuer ?? null,
+		secretId(options.jwtSecret)
+	]);
+	if (inline) {
+		let byKey = memoByJwks.get(jwks);
+		if (!byKey) memoByJwks.set(jwks, byKey = /* @__PURE__ */ new Map());
+		let memo = byKey.get(key);
+		if (!memo) byKey.set(key, memo = /* @__PURE__ */ new Map());
+		return memo;
+	}
+	let memo = memoByUrl.get(key);
+	if (!memo) memoByUrl.set(key, memo = /* @__PURE__ */ new Map());
+	return memo;
+}
+function remembered(memo, token, now) {
+	const hit = memo.get(token);
+	if (!hit) return;
+	memo.delete(token);
+	if (hit.expiresAt === null || hit.expiresAt <= now) return;
+	memo.set(token, hit);
+	return hit;
+}
+const NO_SCHEMA = {};
+const checkedByMemo = /* @__PURE__ */ new WeakMap();
+/**
+* Tokens that already passed (or failed) the claims and `userMetadata` schemas,
+* per verification memo and schema pair, so a memo hit skips validation too.
+*/
+function checkedFor(memo, options) {
+	const claims = options.claims ?? NO_SCHEMA;
+	const metadata = options.userMetadata ?? NO_SCHEMA;
+	let byClaims = checkedByMemo.get(memo);
+	if (!byClaims) checkedByMemo.set(memo, byClaims = /* @__PURE__ */ new WeakMap());
+	let byMetadata = byClaims.get(claims);
+	if (!byMetadata) byClaims.set(claims, byMetadata = /* @__PURE__ */ new WeakMap());
+	let checked = byMetadata.get(metadata);
+	if (!checked) byMetadata.set(metadata, checked = /* @__PURE__ */ new Map());
+	return checked;
+}
+function withoutSource(state) {
+	if (state.kind !== "user") return state;
+	const { source: _source, ...rest } = state;
+	return rest;
+}
+function remember(memo, token, user, expiresAt) {
+	if (expiresAt === null) return;
+	memo.set(token, user);
+	if (memo.size > MEMO_SIZE) memo.delete(memo.keys().next().value);
+}
+async function verify(credentials, modes, options, source) {
+	const token = modes.length === 1 && modes[0] === "user" && credentials.token;
+	const memo = token ? memoFor(options) : void 0;
+	if (token && memo) {
+		const hit = remembered(memo, token, Math.floor((options.now ?? Date.now)() / 1e3));
+		if (hit) {
+			const checked = checkedFor(memo, options);
+			const known = checked.get(token);
+			if (known) return known.kind === "user" ? {
+				...known,
+				source
+			} : known;
+			const state = await checkUser({
+				...hit,
+				source
+			}, options);
+			remember(checked, token, withoutSource(state), hit.expiresAt);
+			return state;
+		}
+	}
+	const state = await verifyOnce(credentials, modes, options, source);
+	if (token && memo && state.kind === "user") remember(memo, token, {
+		kind: "user",
+		token: state.token,
+		claims: state.claims,
+		user: state.user,
+		expiresAt: state.expiresAt
+	}, state.expiresAt);
+	const checked = await checkUser(state, options);
+	if (token && memo && state.kind === "user") remember(checkedFor(memo, options), token, withoutSource(checked), state.expiresAt);
+	return checked;
+}
+/** Validates a user's claims against `options.claims`, keeping every JWT claim. */
+async function checkClaims(state, options) {
+	if (state.kind !== "user") return state;
+	if (!actorOf(state.claims).ok) return {
+		kind: "invalid",
+		reason: "actor",
+		error: invalidActorError()
+	};
+	if (!options.claims) return state;
+	let outcome = options.claims["~standard"].validate(state.claims);
+	if (outcome instanceof Promise) outcome = await outcome;
+	if (outcome.issues) {
+		const issues = outcome.issues.map((issue) => {
+			const path = issue.path?.map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join(".");
+			return path ? `${path}: ${issue.message}` : issue.message;
+		}).join("; ");
+		return {
+			kind: "invalid",
+			reason: "claims",
+			error: dbError("unauthorized", `The token claims are invalid (${issues})`, { code: "CLAIMS_INVALID" })
+		};
+	}
+	const extra = outcome.value;
+	return typeof extra === "object" && extra !== null ? {
+		...state,
+		claims: {
+			...state.claims,
+			...extra
+		}
+	} : state;
+}
+const warnedMetadata = /* @__PURE__ */ new WeakSet();
+/**
+* Claims first, then `user_metadata`, whose failure never invalidates the
+* session.
+*/
+async function checkUser(state, options) {
+	const checked = await checkClaims(state, options);
+	const schema = options.userMetadata;
+	if (checked.kind !== "user" || !schema) return checked;
+	const { profile: _untrusted, ...user } = checked;
+	let outcome = schema["~standard"].validate(checked.user.userMetadata ?? checked.claims.user_metadata ?? {});
+	if (outcome instanceof Promise) outcome = await outcome;
+	if (!outcome.issues) return {
+		...user,
+		profile: outcome.value
+	};
+	if (!warnedMetadata.has(schema)) {
+		warnedMetadata.add(schema);
+		(options.logger ?? consoleLogger).warn("user_metadata does not match betterSupabase.userMetadata(schema); session.profile is undefined", { paths: outcome.issues.map((issue) => issue.path?.map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join(".") ?? "") });
+	}
+	return user;
+}
+/** A token whose `kid` matches no key: verifying it loads the JWKS and fails. */
+const PREFETCH_TOKEN = `${base64url(JSON.stringify({
+	alg: "ES256",
+	kid: "better-supabase-prefetch",
+	typ: "JWT"
+}))}.e30.AA`;
+function base64url(text) {
+	return btoa(text).replaceAll("+", "-").replaceAll("/", "_").replace(/[=]+$/, "");
+}
+/**
+* Loads the remote JWKS into the verifier's cache so the first request doesn't
+* wait for it. Never throws; a failure leaves the first request to fetch it as
+* before.
+*/
+function prefetchJwks(options) {
+	if (!(jwksOf(options) instanceof URL)) return Promise.resolve();
+	return verifyCredentials({
+		token: PREFETCH_TOKEN,
+		apikey: null
+	}, {
+		auth: ["user"],
+		env: serverEnv(options)
+	}).then(() => {}, () => {});
+}
+async function verifyOnce(credentials, modes, options, source) {
+	const token = credentials.token;
+	if (options.jwtSecret !== void 0 && token && modes.length === 1 && modes[0] === "user" && isSharedSecretToken(token)) {
+		const verified = await verifyHs256(token, options.jwtSecret, {
+			now: Math.floor((options.now ?? Date.now)() / 1e3),
+			...options.audience === void 0 ? {} : { audience: options.audience },
+			...options.issuer === void 0 ? {} : { issuer: options.issuer }
+		});
+		if (!verified.ok) return {
+			kind: "invalid",
+			reason: "token",
+			error: dbError("unauthorized", verified.message, { code: verified.code })
+		};
+		return {
+			kind: "user",
+			token,
+			claims: verified.claims,
+			user: verified.user,
+			source,
+			expiresAt: typeof verified.claims.exp === "number" ? verified.claims.exp : null
+		};
+	}
+	const { data, error } = await verifyCredentials(credentials, {
+		auth: modes,
+		env: serverEnv(options),
+		...options.audience === void 0 ? {} : { audience: options.audience },
+		...options.issuer === void 0 ? {} : { issuer: options.issuer }
+	});
+	if (error) {
+		const kind = error.code === "JWKS_FETCH_FAILED" ? "network" : error.status >= 500 ? "unexpected" : "unauthorized";
+		return {
+			kind: "invalid",
+			reason: "token",
+			error: dbError(kind, error.message, { code: error.code })
+		};
+	}
+	if (data.authMode === "secret") return {
+		kind: "service",
+		keyName: data.keyName ?? "default"
+	};
+	if (data.authMode === "user" && data.token && data.jwtClaims && data.userClaims) return {
+		kind: "user",
+		token: data.token,
+		claims: data.jwtClaims,
+		user: data.userClaims,
+		source,
+		expiresAt: typeof data.jwtClaims.exp === "number" ? data.jwtClaims.exp : null
+	};
+	return {
+		kind: "anon",
+		reason: "none"
+	};
+}
+function resolution(auth, cookies, writes = [], ended, outage) {
+	const headers = writes.length > 0 ? AUTH_CACHE_HEADERS : {};
+	let requestCookies;
+	return {
+		auth,
+		...ended ? {
+			sessionEnded: true,
+			sessionEndedReason: ended
+		} : {},
+		...outage ? { outage } : {},
+		cookies: writes,
+		headers,
+		/** Parsed on first read: bearer requests rarely need their cookies. */
+		get requestCookies() {
+			requestCookies ??= writes.length > 0 ? applyCookieWrites(cookies(), writes) : cookies();
+			return requestCookies;
+		},
+		apply(response) {
+			if (writes.length === 0) return response;
+			let target = response;
+			try {
+				for (const write of writes) target.headers.append("set-cookie", serializeCookie(write));
+			} catch {
+				target = new Response(response.body, response);
+				for (const write of writes) target.headers.append("set-cookie", serializeCookie(write));
+			}
+			for (const [name, value] of Object.entries(headers)) target.headers.set(name, value);
+			return target;
+		}
+	};
+}
+const IP = /^[0-9a-f:.]+$/i;
+/**
+* The last `x-forwarded-for` hop, the one your own edge appended. Hops to its
+* left come from the client and can be forged. Behind more than one proxy, pass
+* your own reader to `clientIp`.
+*/
+function clientIp(request) {
+	const last = request.headers.get("x-forwarded-for")?.split(",").at(-1)?.trim();
+	return last && IP.test(last) ? last : void 0;
+}
+/**
+* Resolves who is calling: custom resolvers, then `Authorization: Bearer`
+* (APIs, MCP, mobile), then the `@supabase/ssr` session cookie (browsers).
+*
+* A valid token costs no network call: it is verified locally against the
+* cached JWKS. An expiring cookie session is refreshed only when `refresh` is
+* set, through a single-flight request, and only then are cookies written.
+*/
+/**
+* The access token `resolveAuth` would verify for `request`, without verifying
+* it: the bearer token, else the session cookie's. `null` when there is none.
+*/
+function requestToken(request, cookieName, cookies = true) {
+	const credentials = extractCredentials(request);
+	if (credentials.token) return credentials.token;
+	if (!cookies) return null;
+	return readSession(parseCookies(request.headers.get("cookie")), cookieName)?.access_token ?? null;
+}
+async function timed(options, phase, work) {
+	if (!options.onTiming) return work();
+	const started = performance.now();
+	try {
+		return await work();
+	} finally {
+		options.onTiming(phase, performance.now() - started);
+	}
+}
+async function resolveAuth(request, options) {
+	let parsed;
+	const cookies = () => parsed ??= parseCookies(request.headers.get("cookie"));
+	const verifyTimed = (...args) => timed(options, "verify", () => verify(...args));
+	const statusTimed = (...args) => timed(options, "ended", () => sessionStatus(...args));
+	const refreshTimed = (...args) => timed(options, "refresh", () => refreshSession(...args));
+	for (const resolver of options.resolvers ?? []) {
+		const state = await resolver.resolve(request);
+		if (!state) continue;
+		return resolution(state.kind === "invalid" ? {
+			kind: "invalid",
+			reason: state.reason ?? "token",
+			error: state.error
+		} : await checkUser(state, options), cookies);
+	}
+	const credentials = extractCredentials(request);
+	if (credentials.token) return resolution(await verifyTimed({
+		token: credentials.token,
+		apikey: null
+	}, ["user"], options, "bearer"), cookies);
+	if (options.secret && credentials.apikey?.startsWith("sb_secret_")) return resolution(await verifyTimed({
+		token: null,
+		apikey: credentials.apikey
+	}, options.secret === true ? ["secret"] : options.secret.map((name) => `secret:${name}`), options, "bearer"), cookies);
+	if (options.cookies === false) return resolution({
+		kind: "anon",
+		reason: "none"
+	}, cookies);
+	const name = options.cookie?.name ?? sessionCookieName(options.env.url);
+	const encoding = options.cookie?.encode === void 0 ? {} : { encode: options.cookie.encode };
+	const parseStarted = options.onTiming ? performance.now() : 0;
+	const session = readSession(cookies(), name);
+	options.onTiming?.("parse", performance.now() - parseStarted);
+	if (!session) {
+		const stale = cookies().some((cookie) => cookie.name === name || cookie.name.startsWith(`${name}.`));
+		const writes = stale && options.refresh ? writeSession(cookies(), name, null, options.cookie?.options, encoding) : [];
+		return resolution({
+			kind: "anon",
+			reason: stale ? "signed_out" : "none"
+		}, cookies, writes);
+	}
+	const pruned = options.refresh && options.pruneChunks !== false ? pruneSessionChunks(cookies(), name, options.cookie?.options) : [];
+	const now = Math.floor((options.now ?? Date.now)() / 1e3);
+	const expiry = expiryOf(session);
+	const leeway = options.refresh ? options.leeway ?? 60 : 0;
+	const fresh = expiry !== void 0 && expiry - leeway > now;
+	if (fresh) {
+		const state = await verifyTimed({
+			token: session.access_token,
+			apikey: null
+		}, ["user"], options, "cookie");
+		const status = state.kind === "user" && options.checkSession ? await statusTimed(state.token, {
+			url: options.env.url,
+			publishableKey: options.env.publishableKey,
+			...options.fetch ? { fetch: options.fetch } : {},
+			...options.refreshTimeoutMs === void 0 ? {} : { timeoutMs: options.refreshTimeoutMs },
+			...options.now ? { now: options.now } : {}
+		}) : void 0;
+		if (status === "ended" || status === "banned") return resolution({
+			kind: "anon",
+			reason: "signed_out"
+		}, cookies, options.refresh ? writeSession(cookies(), name, null, options.cookie?.options, encoding) : [], status);
+		if (state.kind !== "invalid" || state.reason !== "token" || state.error.kind === "network") return resolution(state, cookies, pruned);
+		if (!options.refresh) return resolution({
+			kind: "anon",
+			reason: "signed_out"
+		}, cookies);
+	} else if (!options.refresh) return resolution({
+		kind: "anon",
+		reason: "expired"
+	}, cookies);
+	const secretKey = options.env.secretKey;
+	const ip = secretKey && options.clientIp !== false ? (options.clientIp ?? clientIp)(request) : void 0;
+	const started = performance.now();
+	const outcome = await refreshTimed(session.refresh_token, {
+		url: options.env.url,
+		publishableKey: options.env.publishableKey,
+		...secretKey && ip ? { forwardedFor: {
+			ip,
+			secretKey
+		} } : {},
+		...options.fetch ? { fetch: options.fetch } : {},
+		...options.now ? { now: options.now } : {},
+		...options.refreshTimeoutMs === void 0 ? {} : { timeoutMs: options.refreshTimeoutMs }
+	});
+	const durationMs = performance.now() - started;
+	options.onRefresh?.({
+		ok: outcome.ok,
+		shared: outcome.ok && outcome.shared === true,
+		durationMs,
+		...outcome.ok ? {} : {
+			reason: outcome.reason,
+			...outcome.status === void 0 ? {} : { status: outcome.status },
+			...outcome.code === void 0 ? {} : { code: outcome.code }
+		}
+	});
+	if (!outcome.ok) {
+		if (outcome.reason === "network") {
+			const outage = (kept) => ({
+				cause: outcome.cause === "timeout" ? "timeout" : outcome.cause === "status" ? "status" : "network",
+				...outcome.status === void 0 ? {} : { status: outcome.status },
+				kept,
+				durationMs
+			});
+			if (!fresh && expiry !== void 0 && expiry > now) {
+				const state = await verifyTimed({
+					token: session.access_token,
+					apikey: null
+				}, ["user"], options, "cookie");
+				if (state.kind !== "invalid") return resolution(state, cookies, pruned, void 0, outage(true));
+			}
+			return resolution({
+				kind: "anon",
+				reason: "refresh_failed"
+			}, cookies, pruned, void 0, outage(false));
+		}
+		if (outcome.reason === "raced") {
+			if (!fresh && expiry !== void 0 && expiry > now) {
+				const state = await verifyTimed({
+					token: session.access_token,
+					apikey: null
+				}, ["user"], options, "cookie");
+				if (state.kind !== "invalid") return resolution(state, cookies, pruned);
+			}
+			return resolution({
+				kind: "anon",
+				reason: "expired"
+			}, cookies, pruned);
+		}
+		return resolution({
+			kind: "anon",
+			reason: "signed_out"
+		}, cookies, writeSession(cookies(), name, null, options.cookie?.options, encoding), outcome.code === "user_banned" ? "banned" : void 0);
+	}
+	const writes = writeSession(cookies(), name, outcome.session, options.cookie?.options, encoding);
+	return resolution(await verifyTimed({
+		token: outcome.session.access_token,
+		apikey: null
+	}, ["user"], options, "cookie"), cookies, writes);
+}
+//#endregion
+export { sessionEncoding as _, refreshSession as a, AUTH_CACHE_HEADERS as c, clearSessionAtScopes as d, parseCookies as f, sessionCookieName as g, serializeCookie as h, resolveAuth as i, DEFAULT_SESSION_ENCODING as l, readSession as m, prefetchJwks as n, clearSessionCookies as o, pruneSessionChunks as p, requestToken as r, sessionStatus as s, clientIp as t, applyCookieWrites as u, writeSession as v };