better-supabase 0.14.0 → 0.15.0

package/dist/next/index.js

@@ -1,27 +1,28 @@
 import { t as DbException } from "../db-exception-Lngc1W49.js";
-import { n as dbError } from "../errors-03ysrOt4.js";
-import { r as err } from "../result-B3m7xtRY.js";
+import { n as dbError } from "../errors-BVFgt8BZ.js";
 import { t as isList } from "../guards-6F2bCtQR.js";
-import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-qCEV5M3B.js";
-import { o as isReadSet } from "../read-set-BAR84kPC.js";
-import { n as validate } from "../standard-DtkpFGkS.js";
-import { o as problemResponse } from "../problem-BWElIgIb.js";
+import { r as err } from "../result-ntFBW2p2.js";
+import { o as isReadSet } from "../read-set-BnKnofIj.js";
+import { n as validate } from "../standard-BA3mLh6w.js";
+import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-BHl1-zj9.js";
+import { o as problemResponse } from "../problem-Bf0cJ7tk.js";
 import { i as claimsOf } from "../claims-Bp9My7XP.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { n as createBlockClient } from "../create-blocks-kPUhCvje.js";
-import { a as recordCan, c as recordWriteInput, f as loadSections, i as plainData, l as runSectionWrite, n as featureWrites, o as recordPermissionKeys, r as findSectionWrite, s as recordSubject } from "../feature-BBLdbGu7.js";
-import { n as methodOf } from "../block-method-Bvsao626.js";
-import { t as tenantOf } from "../tenant-DnMqeNIM.js";
-import { t as loadTimeline } from "../timeline-0_hTBH0-.js";
-import { T as serverCore, b as isPrefetch, c as extendServer, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as outageResponse } from "../adapter-BCFAg58A.js";
-import { a as checkAal, n as toSession } from "../view-BtgqxQLM.js";
-import { o as settle, r as guard, t as defaultExpose } from "../respond-z_yfyitp.js";
-import { t as supportSessions } from "../support-Ds1-UCN4.js";
-import { r as defineAction } from "../resource-Dk_JYsOt.js";
-import { r as tagFor, t as cacheTagsOf } from "../tags-C_ym1yDM.js";
-import { i as requireCaller, n as formDataObject, t as authorizeCaller } from "../kit-Ct4Z6GIO.js";
+import { n as createBlockClient } from "../create-blocks-Bu4H5TXw.js";
+import { a as recordCan, c as recordWriteInput, i as plainData, l as runBindingWrite, o as recordPermissionKeys, p as loadBindings, r as findBindingWrite, s as recordSubject, t as bindingWrites } from "../record-type-DRbnlj5q.js";
+import { n as methodOf } from "../block-method-C9hWdHom.js";
+import { t as tenantOf } from "../tenant-BgIiMQpo.js";
+import { t as loadTimeline } from "../timeline--VU3A1e4.js";
+import { T as serverCore, b as isPrefetch, c as extendServer, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as outageResponse } from "../adapter-B0b6MXYS.js";
+import { g as sessionCookieName, t as clientIp, v as writeSession } from "../resolve-B0mW2m7f.js";
+import { a as isSessionSnapshot, f as checkAal, i as authzVersionOf, n as toSession, o as issuedAtOf, s as sessionCacheKey } from "../view-C8Ve14ja.js";
+import { o as settle, r as guard, t as defaultExpose } from "../respond-C3CcOZlA.js";
+import { i as supportSessions, n as passwordGrant, r as safeRedirectPath, t as needsMfa } from "../sign-in-DNCdrk05.js";
+import { i as defineAction } from "../resource-DV2GC2dB.js";
+import { r as tagFor, t as cacheTagsOf } from "../tags-CIZTqtlY.js";
+import { i as requireCaller, n as formDataObject, t as authorizeCaller } from "../kit-5l-o8RxL.js";
 import { t as withExtra } from "../extra-CGQ2_q3S.js";
-import { n as resourceRouter } from "../resources-BV6j5TTD.js";
+import { n as resourceRouter } from "../resources-C02l_YBJ.js";
 import { cache } from "react";
 import { cacheLife, cacheTag, io, revalidateTag, updateTag } from "next/cache.js";
 import { cookies, headers } from "next/headers.js";
@@ -30,9 +31,9 @@ import { forbidden } from "next/dist/client/components/forbidden.js";
 import { notFound } from "next/dist/client/components/not-found.js";
 import { unauthorized } from "next/dist/client/components/unauthorized.js";
 //#region src/next/cache.ts
-/** The tag `bs.cached()` adds to entries rendered in a support session. */
+/** The tag `bsb.cached()` adds to entries rendered in a support session. */
 function supportTag(sessionId) {
-	return `bs:support:${sessionId}`;
+	return `bsb:support:${sessionId}`;
 }
 /** The shortest time the Next.js client router keeps a prefetched entry. */
 const MIN_CLIENT_STALE = 30;
@@ -59,9 +60,16 @@ function sessionStale(session, options = {}, now = Date.now()) {
 		default: return session;
 	}
 }
-/** The tag `bs.cached()` puts on a user's entries. */
+/** The tag `bsb.cached()` puts on a user's entries. */
 function sessionTag(userId) {
-	return `bs:session:${userId}`;
+	return `bsb:session:${userId}`;
+}
+/**
+* The tag `bsb.cached()` puts on the entries of one Auth session
+* (`SessionSnapshot.sessionId`): invalidate it to drop one device's entries.
+*/
+function sessionIdTag(sessionId) {
+	return `bsb:session-id:${sessionId}`;
 }
 /**
 * The table tags of a read: the tenant's and every tenant's, or the table's. A
@@ -90,9 +98,9 @@ function invalidateAll(tags, profile = EXPIRE_NOW) {
 	} catch {}
 }
 /**
-* Invalidates `bs:<table>` for every table in the target, the tenant's
-* `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has no
-* tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
+* Invalidates `bsb:<table>` for every table in the target, the tenant's
+* `bsb:<table>@<tenant>` (every tenant's `bsb:<table>@*` when the mutation has
+* no tenant) and `bsb:<table>:<id>` for the changed rows. Reads another tenant
 * tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
 */
 function nextCache(options = {}) {
@@ -113,7 +121,7 @@ const nextCacheAttached = /* @__PURE__ */ new WeakSet();
 //#endregion
 //#region src/next/collector.ts
 /** Forwarded by the proxy so every scope of one render shares an id. */
-const REQUEST_ID_HEADER = "x-bs-request-id";
+const REQUEST_ID_HEADER = "x-bsb-request-id";
 var CollectedRecorder = class extends StatsRecorder {
 	#onIdle;
 	constructor(onIdle) {
@@ -263,8 +271,8 @@ const REQUEST_PREFIX = "x-middleware-request-";
 /** A response whose headers can be changed (`Response.redirect()`'s cannot). */
 function mutableResponse(response) {
 	try {
-		response.headers.append("x-bs-probe", "1");
-		response.headers.delete("x-bs-probe");
+		response.headers.append("x-bsb-probe", "1");
+		response.headers.delete("x-bsb-probe");
 		return response;
 	} catch {
 		return new NextResponse(response.body, {
@@ -295,7 +303,7 @@ function overrideRequestHeaders(response, request, set) {
 	response.headers.set(OVERRIDE, [...current.keys()].join(","));
 	for (const [name, value] of current) response.headers.set(`${REQUEST_PREFIX}${name}`, value);
 }
-/** `bs-proxy;dur=1.2, bs-verify;dur=0.4`, per W3C Server Timing. */
+/** `bsb-proxy;dur=1.2, bsb-verify;dur=0.4`, per W3C Server Timing. */
 function serverTimingValue(metrics) {
 	return Object.entries(metrics).map(([name, ms]) => `${name};dur=${ms.toFixed(1)}`).join(", ");
 }
@@ -303,22 +311,150 @@ function serverTimingValue(metrics) {
 //#region src/next/records.ts
 /**
 * The cache tag of a record's header and tab badges (`record_summary`):
-* `bs:record@<tenant>:<type>:<id>`, or `bs:record:<type>:<id>` without a
+* `bsb:record@<tenant>:<type>:<id>`, or `bsb:record:<type>:<id>` without a
 * tenant.
 */
 function recordTag(subject, options = {}) {
-	return `bs:record${options.tenant === void 0 || options.tenant === null ? "" : `@${options.tenant}`}:${subject.type}:${subject.id}`;
+	return `bsb:record${options.tenant === void 0 || options.tenant === null ? "" : `@${options.tenant}`}:${subject.type}:${subject.id}`;
 }
-/** The cache tag of one section of a record, such as its comments. */
-function sectionTag(subject, section, options = {}) {
-	return `${recordTag(subject, options)}#${section}`;
+/** The cache tag of one binding of a record, such as its comments. */
+function bindingTag(subject, binding, options = {}) {
+	return `${recordTag(subject, options)}#${binding}`;
 }
 /**
-* Drops the cached section and the record's header, whose counts change with
+* Drops the cached binding and the record's header, whose counts change with
 * it: `updateTag` in a Server Action, else `revalidateTag`.
 */
-function invalidateSection(subject, section, options = {}) {
-	invalidateAll([sectionTag(subject, section, options), recordTag(subject, options)], options.revalidate);
+function invalidateBinding(subject, binding, options = {}) {
+	invalidateAll([bindingTag(subject, binding, options), recordTag(subject, options)], options.revalidate);
+}
+//#endregion
+//#region src/next/record.ts
+/**
+* The options every block client of the record type is built with: the
+* generated config, and the caller's storage for the blocks that keep files.
+*/
+function clientOptions(feature, ctx) {
+	const storage = ctx.supabase?.storage;
+	return {
+		...feature.config === void 0 ? {} : { config: feature.config },
+		...storage === void 0 ? {} : { storage }
+	};
+}
+function clientsOf(feature, ctx) {
+	const options = clientOptions(feature, ctx);
+	return Object.fromEntries(Object.entries(feature.blocks).map(([key, block]) => [key, createBlockClient(ctx.db, block, options)]));
+}
+async function permissionsOf(feature, db) {
+	const keys = recordPermissionKeys(feature);
+	if (feature.access === void 0 || keys.length === 0) return { set: void 0 };
+	const result = await createBlockClient(db, feature.access, feature.config === void 0 ? {} : { config: feature.config }).permissions(keys);
+	return result.ok ? { set: result.data } : {
+		set: null,
+		error: result.error
+	};
+}
+function readableSections(can) {
+	return new Map(Object.entries(can).map(([name, entry]) => [name, entry.read]));
+}
+/**
+* The server half of a generated record type for Next.js: a loader for Server
+* Components and one Server Action per binding write. Each action builds the
+* block's client over the caller's `Db` (its tenant), runs the write, and drops
+* the binding's and the record's cache tags (`invalidateBinding`).
+*
+* ```ts
+* const customer = bsb.record(customerRecord);
+* const view = await customer.load(id, { bindings: ["comments"] });
+* ```
+*/
+function recordServer(bsb, feature) {
+	const actionOf = (binding, write) => {
+		const found = findBindingWrite(feature, binding, write);
+		const block = found === void 0 ? void 0 : feature.blocks[found.key];
+		if (found === void 0 || block === void 0) throw new TypeError(`bsb.record: binding "${binding}" has no write "${write}"`);
+		return bsb.action({
+			input: recordWriteInput(found.write.input),
+			requireOrganization: true
+		}, async ({ id, input }, ctx) => {
+			const subject = recordSubject(feature, id);
+			const result = await runBindingWrite(feature, { [found.key]: createBlockClient(ctx.db, block, clientOptions(feature, ctx)) }, binding, write, subject, input);
+			if (!result.ok) return result;
+			invalidateBinding(subject, binding, { tenant: ctx.tenant });
+			return {
+				...result,
+				data: plainData(result.data)
+			};
+		});
+	};
+	return {
+		async load(id, options = {}) {
+			const ctx = await bsb.context();
+			const subject = recordSubject(feature, id);
+			const permissions = await permissionsOf(feature, ctx.db);
+			const can = recordCan(feature, permissions.set);
+			const readable = readableSections(can);
+			const names = options.bindings ?? feature.bindings;
+			const loaded = await loadBindings({
+				blocks: feature.blocks,
+				clients: clientsOf(feature, ctx)
+			}, subject, names, {
+				can: ({ binding }) => readable.get(binding) ?? true,
+				...options.options === void 0 ? {} : { options: options.options }
+			});
+			return {
+				subject,
+				bindings: plainData(loaded),
+				can,
+				...permissions.error === void 0 ? {} : { permissionsError: permissions.error }
+			};
+		},
+		async timeline(id, options = {}) {
+			const ctx = await bsb.context();
+			const permissions = await permissionsOf(feature, ctx.db);
+			const readable = readableSections(recordCan(feature, permissions.set));
+			const timeline = await loadTimeline({
+				blocks: feature.blocks,
+				clients: clientsOf(feature, ctx)
+			}, recordSubject(feature, id), {
+				...options,
+				can: ({ binding }) => readable.get(binding) ?? true
+			});
+			return plainData(timeline);
+		},
+		actions: Object.fromEntries(bindingWrites(feature).map(([binding, writes]) => [binding, Object.fromEntries(writes.map((write) => [write, actionOf(binding, write)]))])),
+		tags(id, tenant) {
+			const subject = recordSubject(feature, id);
+			const scope = { tenant };
+			return [recordTag(subject, scope), ...feature.bindings.map((binding) => bindingTag(subject, binding, scope))];
+		}
+	};
+}
+/**
+* The server half of a `defineRecordList` for Next.js: it builds the record
+* type's block clients and the caller's permissions, then runs
+* `recordList.load`.
+*
+* ```ts
+* const customers = recordListServer(bsb, customerRecordList);
+* const view = await customers.load(await searchParams);
+* ```
+*/
+function recordListServer(bsb, recordList) {
+	const { feature } = recordList;
+	return { async load(input, options) {
+		const ctx = await bsb.context();
+		const permissions = await permissionsOf(feature, ctx.db);
+		const result = await recordList.load({
+			db: ctx.db,
+			clients: clientsOf(feature, ctx),
+			...permissions.set === void 0 ? {} : { permissions: permissions.set }
+		}, input, options);
+		return result.ok ? {
+			...result,
+			data: plainData(result.data)
+		} : result;
+	} };
 }
 //#endregion
 //#region src/next/resources.ts
@@ -333,9 +469,45 @@ function resourceRoutes(serve) {
 	};
 }
 //#endregion
+//#region src/next/sign-in.ts
+/**
+* Signs in on the server, writes the session cookies through the request's
+* cookie jar and returns the same-origin path to go to next.
+*/
+async function signInWithPassword(credentials, options, deps) {
+	const { env, auth } = deps;
+	const secretKey = env.secretKey;
+	const ip = secretKey && auth?.clientIp !== false ? (auth?.clientIp ?? clientIp)(deps.request) : void 0;
+	const granted = await passwordGrant({
+		email: credentials.email,
+		password: credentials.password
+	}, {
+		url: env.url,
+		publishableKey: env.publishableKey,
+		...secretKey && ip ? { forwardedFor: {
+			ip,
+			secretKey
+		} } : {},
+		...auth?.fetch ? { fetch: auth.fetch } : {},
+		...auth?.refreshTimeoutMs === void 0 ? {} : { timeoutMs: auth.refreshTimeoutMs }
+	});
+	if (!granted.ok) return granted;
+	const writes = writeSession(deps.jar.getAll(), auth?.cookie?.name ?? sessionCookieName(env.url), granted.data, auth?.cookie?.options, auth?.cookie?.encode === void 0 ? {} : { encode: auth.cookie.encode });
+	for (const write of writes) deps.jar.set(write.name, write.value, write.options);
+	await deps.seed(granted.data.access_token);
+	return {
+		ok: true,
+		data: {
+			redirectTo: safeRedirectPath(credentials.next, options.fallback ?? "/"),
+			mfa: needsMfa(granted.data)
+		},
+		error: null
+	};
+}
+//#endregion
 //#region src/next/support.ts
-/** Response header with the URL of the request's totals on `bs.debugRoute()`. */
-const STATS_URL_HEADER = "x-bs-stats";
+/** Response header with the URL of the request's totals on `bsb.debugRoute()`. */
+const STATS_URL_HEADER = "x-bsb-stats";
 function endedRedirect(request, path, reason) {
 	const target = new URL(path, request.url);
 	target.searchParams.set("reason", reason);
@@ -343,9 +515,16 @@ function endedRedirect(request, path, reason) {
 }
 function shouldCheckSession(request, options = {}) {
 	if (request.method !== "GET" && request.method !== "HEAD") return false;
-	if (isPrefetch(request)) return false;
-	if (request.headers.get("sec-fetch-dest") === "document") return true;
-	return options.paths?.includes(request.nextUrl.pathname) ?? false;
+	if (isPrefetch(request) || !isDocument(request)) return false;
+	return options.paths?.includes(request.nextUrl.pathname) ?? true;
+}
+/** A top-level page load, not an RSC request, a fetch or an iframe. */
+function isDocument(request) {
+	const h = request.headers;
+	if (h.get("rsc") === "1") return false;
+	const dest = h.get("sec-fetch-dest");
+	if (dest) return dest === "document";
+	return h.get("accept")?.includes("text/html") ?? false;
 }
 /**
 * Page loads, client navigations and server actions; never prefetches or
@@ -367,7 +546,7 @@ function shouldRefresh(request) {
 * it with your sign-in redirect.
 *
 * ```ts
-* bs.proxy(request, {
+* bsb.proxy(request, {
 *   protect: requireAal("aal2", {
 *     redirect: "/mfa",
 *     match: (path) => path.startsWith("/settings"),
@@ -395,7 +574,7 @@ function requireAal(level, options = {}) {
 * and cache tags, on top of `createServer`.
 *
 * ```ts
-* export const bs = createNext(betterSupabase);
+* export const bsb = createNext(betterSupabase);
 * ```
 */
 function createNext(betterSupabase, options = {}) {
@@ -407,8 +586,8 @@ function createNext(betterSupabase, options = {}) {
 		betterSupabase.cache(nextCache());
 	}
 	const debug = options.debug;
-	const statsHeader = debug?.header ?? "x-bs-db-calls";
-	const statsRoute = debug?.route ?? "/api/bs-stats";
+	const statsHeader = debug?.header ?? "x-bsb-db-calls";
+	const statsRoute = debug?.route ?? "/api/bsb-stats";
 	const development = process.env["NODE_ENV"] === "development";
 	const collector = debug?.enabled ? sharedCollector({
 		logger: betterSupabase.events.logger,
@@ -416,7 +595,7 @@ function createNext(betterSupabase, options = {}) {
 		...debug.budget ? { budget: debug.budget } : {}
 	}) : void 0;
 	const statsFor = (request) => {
-		const id = collector && request.headers.get("x-bs-request-id");
+		const id = collector && request.headers.get("x-bsb-request-id");
 		return id ? { stats: collector.recorderFor(id) } : {};
 	};
 	const waitUntil = (work) => {
@@ -439,26 +618,43 @@ function createNext(betterSupabase, options = {}) {
 	};
 	const incomingRequest = async () => new Request("http://next.local/", { headers: new Headers(await headers()) });
 	/**
+	* The incoming request, once its dynamic APIs are awaited. Auth reads cookies
+	* and then the clock: `io()` marks that as I/O for Cache Components without
+	* blocking a prefetch the way `connection()` does, and awaiting `cookies()`
+	* first keeps the clock read out of the static shell.
+	*/
+	const requestScope = async () => {
+		await io();
+		await cookies();
+		return incomingRequest();
+	};
+	const forget = (userId) => {
+		base.forgetSession(userId).catch((cause) => {
+			betterSupabase.events.logger.warn("Could not evict the user's session", { cause });
+		});
+	};
+	/**
 	* One token verification per render scope backs `context()`, `session()` and
 	* `cached()`.
 	*/
 	const incoming = cache(async () => {
-		await io();
-		const request = await incomingRequest();
+		const request = await requestScope();
+		await base.snapshot(request);
 		return {
 			request,
 			resolution: await base.resolve(request, { refresh: false })
 		};
 	});
+	const getRequestSession = cache(async () => base.snapshot(await requestScope()));
 	const tenantClaim = claimsOf(betterSupabase.meta).tenant;
 	/** The tenant `scoped` resolved for a context, when it wasn't the claim. */
 	const scopedTenants = /* @__PURE__ */ new WeakMap();
 	const tenantFor = (ctx, view) => scopedTenants.get(ctx) ?? tenantOf(view, tenantClaim);
 	/**
-	* `requireTenant`, `roles`, `permission` and `authorize`, for the context's
-	* tenant.
+	* `requireOrganization`, `roles`, `permission` and `authorize`, for the
+	* context's tenant.
 	*/
-	const authorizeCaller$1 = (ctx, checks, input) => authorizeCaller(ctx.auth, checks, input, tenantFor(ctx, toSession(ctx.auth)), options.authorizer, ctx);
+	const authorizeCaller$1 = (ctx, checks, input) => authorizeCaller(ctx.auth, checks, input, tenantFor(ctx, toSession(ctx.auth)), base.authorizer, ctx);
 	/** `null` runs `NextOptions.tenant`; a string is the caller's explicit tenant. */
 	const scoped = cache(async (explicit) => {
 		const { request, resolution } = await incoming();
@@ -474,7 +670,7 @@ function createNext(betterSupabase, options = {}) {
 	const context = (first, contextOptions) => first instanceof Request ? base.context(first, contextOptions) : current(first?.tenant ?? contextOptions?.tenant);
 	/** In a support session, the target's view: `impersonator` names the admin. */
 	const session = cache(async () => toSession(options.support ? (await current()).auth : (await incoming()).resolution.auth));
-	const supportCookieName = options.support?.options.cookie?.name ?? "bs-support";
+	const supportCookieName = options.support?.options.cookie?.name ?? "bsb-support";
 	const supportCookieOptions = {
 		httpOnly: true,
 		sameSite: "lax",
@@ -495,19 +691,23 @@ function createNext(betterSupabase, options = {}) {
 		context,
 		deleteAccount: ((userId, deleteOptions) => base.deleteAccount(userId, deleteOptions).map((result) => {
 			invalidateAll([sessionTag(userId)]);
+			forget(userId);
 			return result;
 		})),
 		endSessions: ((userId) => base.endSessions(userId).map((result) => {
 			invalidateAll([sessionTag(userId)]);
+			forget(userId);
 			return result;
 		})),
 		suspendAccount: ((userId, suspendOptions) => base.suspendAccount(userId, suspendOptions).map((result) => {
 			invalidateAll([sessionTag(userId)]);
+			forget(userId);
 			return result;
 		}))
 	});
 	const next = extendServer(withAccounts, {
 		session,
+		getRequestSession,
 		contextForSession,
 		async cached(cachedOptions = {}) {
 			const [view, ctx] = await Promise.all([session(), current(cachedOptions.tenant)]);
@@ -521,8 +721,11 @@ function createNext(betterSupabase, options = {}) {
 			const tables = cachedOptions.tables ?? [];
 			const tenant = tables.length > 0 ? tenantFor(ctx, view) : void 0;
 			const first = tables[0];
+			const claimed = ctx.auth.kind === "user" ? ctx.auth.claims["session_id"] : void 0;
+			const sessionId = typeof claimed === "string" ? claimed : void 0;
 			const tags = [
 				...view.kind === "user" ? [sessionTag(view.user.id)] : [],
+				...sessionId === void 0 ? [] : [sessionIdTag(sessionId)],
 				...ctx.support ? [supportTag(ctx.support.session.id)] : [],
 				...cachedOptions.tags ?? [],
 				...tables.flatMap((table) => tableTags(table, tenant === void 0 ? {} : { tenant })),
@@ -533,6 +736,7 @@ function createNext(betterSupabase, options = {}) {
 		},
 		invalidateSession(userId, invalidateOptions = {}) {
 			invalidateAll([sessionTag(userId), ...invalidateOptions.tags ?? []]);
+			forget(userId);
 		},
 		async liveCount(spec, db) {
 			const result = await (db ?? (await current()).db).$run(spec);
@@ -545,16 +749,22 @@ function createNext(betterSupabase, options = {}) {
 		async proxy(request, proxyOptions = {}) {
 			const started = performance.now();
 			const id = collector ? crypto.randomUUID() : void 0;
-			let verifyMs = 0;
+			let authMs = 0;
+			const phases = {};
 			const sessionCheck = proxyOptions.endedSession === true ? {} : proxyOptions.endedSession;
 			const checkSession = sessionCheck !== void 0 && shouldCheckSession(request, sessionCheck);
 			const [early, resolution] = await Promise.all([proxyOptions.before?.(request), base.resolve(request, {
 				refresh: shouldRefresh(request),
-				...checkSession ? { checkSession } : {}
+				...checkSession ? { checkSession } : {},
+				...proxyOptions.refreshSkewSeconds === void 0 ? {} : { leeway: proxyOptions.refreshSkewSeconds },
+				...proxyOptions.serverTiming ? { onTiming: (phase, ms) => {
+					phases[phase] = (phases[phase] ?? 0) + ms;
+				} } : {}
 			}).then((resolved) => {
-				verifyMs = performance.now() - started;
+				authMs = performance.now() - started;
 				return resolved;
 			})]);
+			if (resolution.cookies.length > 0) await base.sessions.seed(resolution.auth);
 			const rendersSignedOut = proxyOptions.expiredPrefetch === "render" && resolution.auth.kind === "anon" && resolution.auth.reason === "expired" && isPrefetch(request);
 			const protectMethods = proxyOptions.protectMethods;
 			const runsProtect = protectMethods === true ? true : (protectMethods ?? ["GET", "HEAD"]).includes(request.method);
@@ -580,8 +790,9 @@ function createNext(betterSupabase, options = {}) {
 				if (replaced) response = mutableResponse(replaced);
 			}
 			if (proxyOptions.serverTiming) response.headers.append("server-timing", serverTimingValue({
-				"bs-proxy": performance.now() - started,
-				"bs-verify": verifyMs
+				"bsb-proxy": performance.now() - started,
+				"bsb-auth": authMs,
+				...Object.fromEntries(Object.entries(phases).map(([phase, ms]) => [`bsb-${phase}`, ms]))
 			}));
 			flushAfter();
 			return response;
@@ -623,7 +834,7 @@ function createNext(betterSupabase, options = {}) {
 			const { basePath, ...guardOptions } = resourcesOptions;
 			const router = resourceRouter(betterSupabase, map, {
 				...basePath === void 0 ? {} : { basePath },
-				...options.authorizer === void 0 ? {} : { authorizer: options.authorizer }
+				...base.authorizer === void 0 ? {} : { authorizer: base.authorizer }
 			});
 			return resourceRoutes(async (request) => {
 				const route = router.match(request);
@@ -703,7 +914,7 @@ function createNext(betterSupabase, options = {}) {
 		},
 		require: async (requireOptions = {}) => {
 			const ctx = await current(requireOptions.tenant);
-			const caller = await requireCaller(ctx.auth, requireOptions, tenantFor(ctx, toSession(ctx.auth)), options.authorizer, ctx);
+			const caller = await requireCaller(ctx.auth, requireOptions, tenantFor(ctx, toSession(ctx.auth)), base.authorizer, ctx);
 			if ("kind" in caller) interrupt(caller);
 			return withExtra(ctx, caller);
 		},
@@ -759,6 +970,19 @@ function createNext(betterSupabase, options = {}) {
 				error: stopped.error
 			};
 		},
+		async signIn(credentials, signInOptions = {}) {
+			const request = await incomingRequest();
+			return signInWithPassword(credentials, signInOptions, {
+				env: base.env,
+				auth: options.auth,
+				request,
+				jar: await cookies(),
+				seed: async (accessToken) => {
+					const verified = await base.resolve(bearerRequest(accessToken));
+					await base.sessions.seed(verified.auth);
+				}
+			});
+		},
 		cacheTag(table, id, tagOptions = {}) {
 			cacheTag(...tableTags(table, tagOptions), ...id === void 0 ? [] : [tagFor(table, id)]);
 		},
@@ -768,7 +992,7 @@ function createNext(betterSupabase, options = {}) {
 			for (const spec of specs) {
 				for (const table of betterSupabase.tablesOf(spec)) for (const tag of tableTags(table, tagOptions)) tags.add(tag);
 				const [id] = spec.args;
-				if (spec.method === "findById" && (typeof id === "string" || typeof id === "number")) tags.add(tagFor(spec.table, id));
+				if (spec.method === "get" && (typeof id === "string" || typeof id === "number")) tags.add(tagFor(spec.table, id));
 			}
 			cacheTag(...tags);
 		},
@@ -777,142 +1001,9 @@ function createNext(betterSupabase, options = {}) {
 				return methodOf(client(ctx), method)(...blockOptions.args?.(input, ctx) ?? [input]);
 			});
 		},
-		sectionAction: (client, method, sectionOptions) => {
-			return next.action(sectionOptions, async (input, ctx) => {
-				const result = await methodOf(client(ctx), method)(...sectionOptions.args?.(input, ctx) ?? [input]);
-				if (result.ok) invalidateSection(sectionOptions.subject(input, ctx), sectionOptions.section, { tenant: ctx.tenant });
-				return result;
-			});
-		}
+		record: (type) => recordServer(next, type)
 	});
 	return next;
 }
 //#endregion
-//#region src/next/feature.ts
-/**
-* The options every block client of the feature is built with: the generated
-* config, and the caller's storage for the blocks that keep files.
-*/
-function clientOptions(feature, ctx) {
-	const storage = ctx.supabase?.storage;
-	return {
-		...feature.config === void 0 ? {} : { config: feature.config },
-		...storage === void 0 ? {} : { storage }
-	};
-}
-function clientsOf(feature, ctx) {
-	const options = clientOptions(feature, ctx);
-	return Object.fromEntries(Object.entries(feature.blocks).map(([key, block]) => [key, createBlockClient(ctx.db, block, options)]));
-}
-async function permissionsOf(feature, db) {
-	const keys = recordPermissionKeys(feature);
-	if (feature.access === void 0 || keys.length === 0) return { set: void 0 };
-	const result = await createBlockClient(db, feature.access, feature.config === void 0 ? {} : { config: feature.config }).permissions(keys);
-	return result.ok ? { set: result.data } : {
-		set: null,
-		error: result.error
-	};
-}
-function readableSections(can) {
-	return new Map(Object.entries(can).map(([name, entry]) => [name, entry.read]));
-}
-/**
-* The server half of a generated feature for Next.js: a loader for Server
-* Components and one Server Action per section write. Each action builds the
-* block's client over the caller's `Db` (its tenant), runs the write, and drops
-* the section's and the record's cache tags (`invalidateSection`).
-*
-* ```ts
-* const customer = recordServer(bs, customerFeature);
-* const view = await customer.load(id, { sections: ["comments"] });
-* ```
-*/
-function recordServer(bs, feature) {
-	const actionOf = (section, write) => {
-		const found = findSectionWrite(feature, section, write);
-		const block = found === void 0 ? void 0 : feature.blocks[found.key];
-		if (found === void 0 || block === void 0) throw new TypeError(`recordServer: section "${section}" has no write "${write}"`);
-		return bs.action({
-			input: recordWriteInput(found.write.input),
-			requireTenant: true
-		}, async ({ id, input }, ctx) => {
-			const subject = recordSubject(feature, id);
-			const result = await runSectionWrite(feature, { [found.key]: createBlockClient(ctx.db, block, clientOptions(feature, ctx)) }, section, write, subject, input);
-			if (!result.ok) return result;
-			invalidateSection(subject, section, { tenant: ctx.tenant });
-			return {
-				...result,
-				data: plainData(result.data)
-			};
-		});
-	};
-	return {
-		async load(id, options = {}) {
-			const ctx = await bs.context();
-			const subject = recordSubject(feature, id);
-			const permissions = await permissionsOf(feature, ctx.db);
-			const can = recordCan(feature, permissions.set);
-			const readable = readableSections(can);
-			const names = options.sections ?? feature.sections;
-			const loaded = await loadSections({
-				blocks: feature.blocks,
-				clients: clientsOf(feature, ctx)
-			}, subject, names, {
-				can: ({ section }) => readable.get(section) ?? true,
-				...options.options === void 0 ? {} : { options: options.options }
-			});
-			return {
-				subject,
-				sections: plainData(loaded),
-				can,
-				...permissions.error === void 0 ? {} : { permissionsError: permissions.error }
-			};
-		},
-		async timeline(id, options = {}) {
-			const ctx = await bs.context();
-			const permissions = await permissionsOf(feature, ctx.db);
-			const readable = readableSections(recordCan(feature, permissions.set));
-			const timeline = await loadTimeline({
-				blocks: feature.blocks,
-				clients: clientsOf(feature, ctx)
-			}, recordSubject(feature, id), {
-				...options,
-				can: ({ section }) => readable.get(section) ?? true
-			});
-			return plainData(timeline);
-		},
-		actions: Object.fromEntries(featureWrites(feature).map(([section, writes]) => [section, Object.fromEntries(writes.map((write) => [write, actionOf(section, write)]))])),
-		tags(id, tenant) {
-			const subject = recordSubject(feature, id);
-			const scope = { tenant };
-			return [recordTag(subject, scope), ...feature.sections.map((section) => sectionTag(subject, section, scope))];
-		}
-	};
-}
-/**
-* The server half of a `defineRecordList` for Next.js: it builds the feature's
-* block clients and the caller's permissions, then runs `recordList.load`.
-*
-* ```ts
-* const customers = recordListServer(bs, customerRecordList);
-* const view = await customers.load(await searchParams);
-* ```
-*/
-function recordListServer(bs, recordList) {
-	const { feature } = recordList;
-	return { async load(input, options) {
-		const ctx = await bs.context();
-		const permissions = await permissionsOf(feature, ctx.db);
-		const result = await recordList.load({
-			db: ctx.db,
-			clients: clientsOf(feature, ctx),
-			...permissions.set === void 0 ? {} : { permissions: permissions.set }
-		}, input, options);
-		return result.ok ? {
-			...result,
-			data: plainData(result.data)
-		} : result;
-	} };
-}
-//#endregion
-export { REQUEST_ID_HEADER, STATS_URL_HEADER, createNext, defineAction, invalidateSection, nextCache, recordListServer, recordServer, recordTag, requireAal, sectionTag, sessionStale, sessionTag, shouldCheckSession, shouldRefresh, supportOf, supportSessions, supportTag, tagFor, tenantOf, toSession };
+export { REQUEST_ID_HEADER, STATS_URL_HEADER, authzVersionOf, bindingTag, createNext, defineAction, invalidateBinding, isSessionSnapshot, issuedAtOf, nextCache, recordListServer, recordTag, requireAal, safeRedirectPath, sessionCacheKey, sessionIdTag, sessionStale, sessionTag, shouldCheckSession, shouldRefresh, supportOf, supportSessions, supportTag, tagFor, tenantOf, toSession };