better-supabase 0.15.0 → 0.16.0

package/dist/server/index.d.ts

@@ -4,31 +4,36 @@ import { Ct as Events, lt as SupportEventData } from "../events-vcqenSYU.js";
 import { C as readSession, D as writeSession, T as sessionCookieName, _ as StoredSession, a as ResolveAuthOptions, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as CookieWrite, n as AuthResolver, r as AuthState, s as ResolvedState, t as AuthResolution, u as AUTH_CACHE_HEADERS } from "../resolve-CXX6DHv3.js";
 import { n as SqlClient } from "../executor-hGjrop3A.js";
 import { a as SessionActor, c as agentClaims, i as IDENTITY_SCOPES, l as delegationOf, n as ActorOutcome, o as SessionDelegation, r as AgentActOptions, s as actorOf, t as ActClaim } from "../actor-CoveJgya.js";
-import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DNwN8iGz.js";
+import { n as PERMISSION_CAP_CLAIM } from "../delegation-C7eWP2r8.js";
+import { a as ProblemFormat, c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DNwN8iGz.js";
 import { a as AuthorizationSubject, c as AuthzVersionCache, d as bindAuthorizer, f as defineAuthorizer, i as AuthorizationResource, l as PermissionRef, n as AuthorizationOutcome, o as Authorizer, p as requestMemo, r as AuthorizationRequest, s as AuthorizerRuntime, t as AnyAuthorizer, u as RequestMemo } from "../authorizer-B6X09otb.js";
-import { J as DbStats, t as BetterSupabase, v as Db } from "../define-DFBnQyYg.js";
-import { k as StorageApi } from "../bucket-CiNi8sIw.js";
-import { $ as SessionMemoStats, A as supportCookieValue, B as SupportSessionStore, C as SupportSessions, D as SupportCookieOptions, E as SUPPORT_COOKIE, F as SupportEndedBy, G as PRIMARY_COOKIE, H as sqlSupportStore, I as SupportListFilter, J as DeleteAccountOptions, K as ReplicaState, L as SupportRequest, M as SupportApprovalQuery, N as SupportApprover, O as clearSupportCookie, P as SupportCallerClaims, Q as SessionMemoOptions, R as SupportRequestInput, S as SupportPolicy, T as supportSessions, U as supportClaims, V as SupportStartInput, W as RequestIdOptions, X as deleteAccount, Y as DeleteAccountResult, Z as SessionMemo, _ as suspendAccount, a as ServerContext, at as sessionMemo, b as SupportExpireRouteOptions, c as ServerOptions, d as EndSessionsResult, et as SessionSnapshot, f as LastSignIn, g as lastSignIns, h as endSessions, i as ForContextOptions, it as sessionCacheKey, j as SqlSupportStoreOptions, k as supportCookie, m as SuspendAccountResult, n as BetterServer, nt as isSessionSnapshot, o as ServerDbOptions, ot as snapshotOf, p as SuspendAccountOptions, q as LiteDriver, r as ContextOptions, rt as issuedAtOf, s as ServerKeys, t as AdminDb, tt as authzVersionOf, u as TENANT_HEADER, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions, y as SupportApi, z as SupportSession } from "../server-types-CFtehAsr.js";
+import { J as DbStats, t as BetterSupabase, v as Db } from "../define-C5AcEkEJ.js";
+import { j as StorageApi } from "../bucket-vc-QRrva.js";
+import { A as isSessionSnapshot, C as DeleteAccountResult, D as SessionMemoStats, E as SessionMemoOptions, M as sessionCacheKey, N as sessionMemo, O as SessionSnapshot, P as snapshotOf, S as DeleteAccountOptions, T as SessionMemo, _ as suspendAccount, a as ServerContext, b as ReplicaState, c as ServerOptions, d as EndSessionsResult, f as LastSignIn, g as lastSignIns, h as endSessions, i as ForContextOptions, j as issuedAtOf, k as authzVersionOf, m as SuspendAccountResult, n as BetterServer, o as ServerDbOptions, p as SuspendAccountOptions, r as ContextOptions, s as ServerKeys, t as AdminDb, u as TENANT_HEADER, v as RequestIdOptions, w as deleteAccount, x as LiteDriver, y as PRIMARY_COOKIE } from "../server-types-CK8mUIUT.js";
 import { n as Impersonator, r as impersonatorOf, t as ImpersonationOptions } from "../impersonation-YTa9dZUv.js";
 import { a as checkAal, i as amrOf, n as AmrEntry, r as aalOf, t as Aal } from "../mfa-oIOYTpvc.js";
-import { _ as SupportAuthorize, a as AutomationHooks, b as TicketSubject, c as ChatActionHook, d as IdentityRef, f as IdentityTarget, g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, l as DelegationPermissions, m as Subscriber, n as Approver, o as AutomationRef, p as PrincipalByIdentity, r as ApproverOf, s as ChatAction, t as ApprovalRequestRef, u as DelegationRef, v as SupportAuthorizeInput, x as defineAuthorizationHooks, y as SupportDecision } from "../authorization-hooks-Cs1vP_ej.js";
+import { _ as SupportAuthorize, a as AutomationHooks, b as TicketSubject, c as ChatActionHook, d as IdentityRef, f as IdentityTarget, g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, l as DelegationPermissions, m as Subscriber, n as Approver, o as AutomationRef, p as PrincipalByIdentity, r as ApproverOf, s as ChatAction, t as ApprovalRequestRef, u as DelegationRef, v as SupportAuthorizeInput, x as defineAuthorizationHooks, y as SupportDecision } from "../authorization-hooks-D_pwXlBs.js";
+import { c as RealtimeClient } from "../topic-CZXHhZye.js";
 import { n as toSession, t as AuthSession } from "../view-DyFdMCqg.js";
-import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-CH0SKgIz.js";
+import { C as SupportSessionStore, E as supportClaims, S as SupportSession, T as sqlSupportStore, _ as SupportCallerClaims, a as SupportPolicy, b as SupportRequest, c as supportSessions, d as clearSupportCookie, f as supportCookie, g as SupportApprover, h as SupportApprovalQuery, i as SupportOptions, l as SUPPORT_COOKIE, m as SqlSupportStoreOptions, n as SupportApi, o as SupportSessions, p as supportCookieValue, r as SupportExpireRouteOptions, s as SupportStartRequest, t as ActiveSupport, u as SupportCookieOptions, v as SupportEndedBy, w as SupportStartInput, x as SupportRequestInput, y as SupportListFilter } from "../support-B4ZBVxt3.js";
+import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-DWmFv3vB.js";
 import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-Dn1_YhC1.js";
-import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-Dsxj7T5K.js";
+import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-CfYyU3vs.js";
 import { a as AuthorizedContext, c as ResourceLoaderContext, d as rolesAt, i as AuthorizeOptions, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as hasRole } from "../kit-DOwKpSkA.js";
-import { n as subjectReaders, t as SubjectReadersOptions } from "../subject-readers-BNSzkqw_.js";
+import { n as subjectReaders, t as SubjectReadersOptions } from "../subject-readers-8GySC9Z8.js";
 import { i as toCsv, n as csvColumns, t as CsvOptions } from "../csv-DhHQS2x_.js";
 import { i as JwsAlgorithm, n as Jwks, r as JwksOfOptions } from "../jws-D0toeQlA.js";
 import { i as ResourcePagination } from "../resource-D8pzB5Qf.js";
-import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-DnKiH4G2.js";
-import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-BjHflcHF.js";
+import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-pMeLs68X.js";
+import { a as claimsFingerprint, i as SessionWatchStatus, n as SessionStatusRouteOptions, o as sessionStatusRoute, r as SessionStatusServer, t as SessionStatusBody } from "../session-status-qQLm7jzh.js";
+import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-qvVk79pp.js";
 import { n as RefreshOutcome, r as refreshSession } from "../refresh-DT_ICaK-.js";
 import { n as passwordGrant, r as safeRedirectPath, t as PasswordGrantOptions } from "../sign-in-BAjR49fq.js";
 import { n as supportOf, t as SupportView } from "../support-view-BYOgwXsJ.js";
 import { a as sessionStatus, i as clearSessionCookies, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-gUsMZVNg.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware, SingleKeyEntry } from "@supabase/middleware";
+import { StandardSchemaV1 } from "@standard-schema/spec";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
 import { PostgresApi } from "@supabase/server/middleware/postgres";
 //#region src/server/csv.d.ts
@@ -193,6 +198,140 @@ interface SupportStorageOptions {
  */
 export declare function supportStorage(options: SupportStorageOptions): StorageApi;
 //#endregion
+//#region src/server/realtime-relay.d.ts
+/**
+ * A topic the relay serves: a `defineTopic(...)` topic, or `liveRelayTopic` for
+ * the `realtime-tables` channels behind `liveQuery` and `useLiveQuery`.
+ */
+interface RelayTopic {
+  readonly private: boolean;
+  /** Join with presence, so members' states reach the client. */
+  readonly presence?: boolean;
+  /** Whether clients may broadcast on it (`defineTopic`'s `send` option). */
+  readonly clientSend?: boolean;
+  /** Payload schemas per event; a send through the relay is validated. */
+  readonly events?: Readonly<Record<string, StandardSchemaV1>>;
+  /** Anything but `null` when `topic` is one of this topic's names. */
+  match(topic: string): unknown;
+}
+/** The channels `liveQuery` joins: `bsb:t:<schema>.<table>[:...]`, private. */
+export declare const liveRelayTopic: RelayTopic;
+/** What `authorize` decides on. */
+interface RelayAccessInput {
+  readonly topic: string;
+  readonly action: "receive" | "send";
+  /** The caller: in a support session, the viewed user. */
+  readonly auth: AuthState;
+  readonly support: ActiveSupport | undefined;
+  /** The claims the check runs with: the target's in a support session. */
+  readonly claims: Readonly<Record<string, unknown>>;
+}
+/**
+ * Decides whether the caller may receive or send on a topic. A throw or
+ * rejection denies.
+ */
+type RelayAuthorize = (input: RelayAccessInput) => boolean | PromiseLike<boolean>;
+/**
+ * The part of a server the relay uses: `createServer`, `createNext` and the
+ * other adapters fit.
+ */
+interface RelayServer {
+  context(request: Request, options?: {
+    readonly refresh?: boolean;
+  }): Promise<{
+    readonly auth: AuthState;
+    readonly resolution: {
+      readonly auth: AuthState;
+    };
+    readonly support?: ActiveSupport;
+    apply(response: Response): Response;
+  }>;
+  admin(): {
+    readonly $client: RealtimeClient;
+  };
+}
+/** A pool that runs a function in one transaction: `createPostgres()`. */
+interface RelayPostgres {
+  transaction<T>(fn: (client: SqlClient) => Promise<T>): Promise<T>;
+}
+interface RealtimeRelayOptions {
+  /** The topics the relay serves; any other name answers 404. */
+  readonly topics: readonly RelayTopic[];
+  /**
+   * Checks each join and send against the `realtime.messages` policies, run as
+   * the caller (the viewed user in a support session) the way Realtime checks a
+   * browser's join. Needs a pool whose role may assume `authenticated`, such as
+   * `createPostgres()`.
+   */
+  readonly postgres?: RelayPostgres;
+  /** Decides access instead of the policies. */
+  readonly authorize?: RelayAuthorize;
+  /**
+   * The client that joins upstream. Defaults to the server's secret-key client
+   * (`server.admin().$client`); joins of a topic share one channel per
+   * process.
+   */
+  readonly upstream?: RealtimeClient;
+  /** Milliseconds between keep-alive comments. Defaults to 25000. */
+  readonly heartbeatMs?: number;
+  /**
+   * Milliseconds a stream stays open before it ends with `max_duration` and the
+   * client reconnects, which checks access again. Defaults to 240000, under
+   * common serverless limits.
+   */
+  readonly maxDurationMs?: number;
+  /**
+   * Events a slow client may fall behind by before its stream ends with
+   * `overflow`; the reconnect reports a rejoin, so the client refetches.
+   * Defaults to 256.
+   */
+  readonly maxQueued?: number;
+  /** Milliseconds the client waits before reconnecting. Defaults to 1000. */
+  readonly retryMs?: number;
+  /**
+   * Refresh an expiring session cookie and send the new cookies. Defaults to
+   * false: the proxy refreshes, and an expired session answers 401.
+   */
+  readonly refresh?: boolean;
+  readonly problem?: ProblemFormat;
+}
+/** Why the relay ended a stream, in its `end` event. */
+type RelayEndReason = "expired" | "max_duration" | "overflow" | "closed" | "upstream_error";
+/**
+ * Whether `claims` may receive or send on `topic`, by the `realtime.messages`
+ * policies, checked the way Realtime checks a join: a probe message is
+ * inserted, then read (receive) or written (send) as the caller, and the
+ * transaction rolls back.
+ */
+export declare function realtimeTopicAccess(postgres: RelayPostgres, input: {
+  readonly claims: Readonly<Record<string, unknown>>;
+  readonly topic: string;
+  readonly action: "receive" | "send";
+  readonly extension?: "broadcast" | "presence";
+}): Promise<boolean>;
+/**
+ * Realtime for callers without a browser token of their own: a support session
+ * ("view as user"), or an app that keeps sessions in httpOnly cookies. `GET
+ * ?topic=<name>` resolves the caller, checks the topic's access as that caller
+ * (the viewed user in a support session), joins upstream with the secret key
+ * and streams the topic's broadcasts and presence as server-sent events. `POST
+ * { topic, event, payload }` broadcasts for the caller after the same check on
+ * the send policy; read-only support sessions can't send.
+ * `relayRealtimeClient(url)` from `better-supabase/realtime` is the client.
+ *
+ * ```ts
+ * // app/api/realtime/route.ts
+ * export const { GET, POST } = realtimeRelay(bsb, {
+ *   topics: [notifications, liveRelayTopic],
+ *   postgres,
+ * });
+ * ```
+ */
+export declare function realtimeRelay(server: RelayServer, options: RealtimeRelayOptions): {
+  readonly GET: (request: Request) => Promise<Response>;
+  readonly POST: (request: Request) => Promise<Response>;
+};
+//#endregion
 //#region src/server/entries/upstream.d.ts
 /** The `withSupabase` context keys `withBetterDb` and `withBetterPostgres` read. */
 interface SupabaseAuthContext {
@@ -499,4 +638,4 @@ export declare function withDbStats(options?: {
   };
 }, () => DbStats>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AccessTokenResolverOptions, type AccessTokenRevocation, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type ActorOutcome, type AdminDb, type AgentActOptions, type AmrEntry, type AnyAuthorizer, type ApprovalRequestRef, type Approver, type ApproverOf, type AuthKind, type AuthOutageHook, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationHooks, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type AuthorizerRuntime, type AuthzVersionCache, type AuthzVersionChannel, type AuthzVersionClient, type AuthzVersionSubscription, type AutomationHooks, type AutomationRef, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ChatAction, type ChatActionHook, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DelegationPermissions, type DelegationRef, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, IDENTITY_SCOPES, type IdentityRef, type IdentityTarget, type ImpersonationEvents, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PasswordGrantOptions, type PermissionRef, type PrincipalByIdentity, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RateLimitPolicy, type RateLimitState, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type RequestMemo, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourceLoaderContext, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionMemo, type SessionMemoOptions, type SessionMemoStats, type SessionSnapshot, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SubjectReadersOptions, type SubscribeAuthzVersionsOptions, type Subscriber, type SubscriberEvent, type SubscriberPolicy, type SupabaseAuthContext, type SupportApi, type SupportApprovalQuery, type SupportApprover, type SupportAuthorize, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportDecision, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportRequest, type SupportRequestInput, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, type TicketSubject, aalOf, actorOf, agentClaims, amrOf, authContext, authzVersionOf, bindAuthorizer, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, csvColumns, defineAuthorizationHooks, defineAuthorizer, delegationOf, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, isSessionSnapshot, issuedAtOf, lastSignIns, passwordGrant, problemResponse, readSession, refreshFor, refreshSession, requestMemo, resolveAuth, respond, rolesAt, safeRedirectPath, serverCore, sessionCacheKey, sessionCookieName, sessionMemo, sessionStatus, settle, shouldCheckSession, shouldRefresh, snapshotOf, sqlSupportStore, subjectReaders, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, type Aal, type AccessTokenResolverOptions, type AccessTokenRevocation, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type ActorOutcome, type AdminDb, type AgentActOptions, type AmrEntry, type AnyAuthorizer, type ApprovalRequestRef, type Approver, type ApproverOf, type AuthKind, type AuthOutageHook, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationHooks, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type AuthorizerRuntime, type AuthzVersionCache, type AuthzVersionChannel, type AuthzVersionClient, type AuthzVersionSubscription, type AutomationHooks, type AutomationRef, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ChatAction, type ChatActionHook, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DelegationPermissions, type DelegationRef, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, IDENTITY_SCOPES, type IdentityRef, type IdentityTarget, type ImpersonationEvents, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PERMISSION_CAP_CLAIM, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PasswordGrantOptions, type PermissionRef, type PrincipalByIdentity, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RateLimitPolicy, type RateLimitState, type RealtimeRelayOptions, type RefreshOutcome, type RefreshPolicy, type RelayAccessInput, type RelayAuthorize, type RelayEndReason, type RelayPostgres, type RelayServer, type RelayTopic, type ReplicaState, type RequestIdOptions, type RequestMemo, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourceLoaderContext, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionMemo, type SessionMemoOptions, type SessionMemoStats, type SessionSnapshot, type SessionStatus, type SessionStatusBody, type SessionStatusOptions, type SessionStatusRouteOptions, type SessionStatusServer, type SessionWatchStatus, type Settled, type SqlSupportStoreOptions, type StoredSession, type SubjectReadersOptions, type SubscribeAuthzVersionsOptions, type Subscriber, type SubscriberEvent, type SubscriberPolicy, type SupabaseAuthContext, type SupportApi, type SupportApprovalQuery, type SupportApprover, type SupportAuthorize, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportDecision, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportRequest, type SupportRequestInput, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, type TicketSubject, aalOf, actorOf, agentClaims, amrOf, authContext, authzVersionOf, bindAuthorizer, cacheTagsOf, checkAal, claimsFingerprint, clearSessionCookies, clearSupportCookie, clientIp, csvColumns, defineAuthorizationHooks, defineAuthorizer, delegationOf, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, isSessionSnapshot, issuedAtOf, lastSignIns, passwordGrant, problemResponse, readSession, refreshFor, refreshSession, requestMemo, resolveAuth, respond, rolesAt, safeRedirectPath, serverCore, sessionCacheKey, sessionCookieName, sessionMemo, sessionStatus, sessionStatusRoute, settle, shouldCheckSession, shouldRefresh, snapshotOf, sqlSupportStore, subjectReaders, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };

package/dist/server/index.js

@@ -1,24 +1,27 @@
 import { n as dbError } from "../errors-BVFgt8BZ.js";
 import { n as isRecord } from "../guards-6F2bCtQR.js";
 import { t as base64ToText } from "../base64-B9Wlsdj7.js";
+import { n as validate } from "../standard-BA3mLh6w.js";
 import { c as toProblem, i as isProblem, n as PROBLEM_TYPE_BASE, o as problemResponse, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-Bf0cJ7tk.js";
 import { i as delegationOf, n as actorOf, r as agentClaims, t as IDENTITY_SCOPES } from "../actor-go7p9-CJ.js";
 import { i as userContext, r as impersonatorOf } from "../impersonation-DM3oWNoD.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
+import { t as joinTopic } from "../channels-CfcFPuo_.js";
 import { r as toCsv, t as csvColumns } from "../csv-2rXGPNtP.js";
-import { A as suspendAccount, C as shouldRefresh, D as SERVER_EVENT_SOURCE, E as defineAuthorizationHooks, O as endSessions, S as shouldCheckSession, T as serverCore, a as unexpectedResponse, b as isPrefetch, c as extendServer, d as clearSupportCookie, f as supportCookie, h as TENANT_HEADER, i as resolveToken, j as deleteAccount, k as lastSignIns, l as supportStorage, m as supportCookieValue, n as flushEvents, o as withFlush, r as handle, s as createServer, u as SUPPORT_COOKIE, x as refreshFor, y as withSession } from "../adapter-B0b6MXYS.js";
+import { A as suspendAccount, C as shouldRefresh, D as SERVER_EVENT_SOURCE, E as defineAuthorizationHooks, O as endSessions, S as shouldCheckSession, T as serverCore, a as unexpectedResponse, b as isPrefetch, c as extendServer, d as clearSupportCookie, f as supportCookie, h as TENANT_HEADER, i as resolveToken, j as deleteAccount, k as lastSignIns, l as supportStorage, m as supportCookieValue, n as flushEvents, o as withFlush, r as handle, s as createServer, u as SUPPORT_COOKIE, x as refreshFor, y as withSession } from "../adapter-Dyks1lX1.js";
 import { n as PRIMARY_COOKIE } from "../replicas-Dyoh3CEg.js";
 import { t as authContext } from "../context-DBicfUNz.js";
+import { r as PERMISSION_CAP_CLAIM } from "../delegation-DGOIiT8k.js";
 import { a as refreshSession, c as AUTH_CACHE_HEADERS, g as sessionCookieName, i as resolveAuth, m as readSession, o as clearSessionCookies, s as sessionStatus, t as clientIp, v as writeSession } from "../resolve-B0mW2m7f.js";
 import { i as defineAuthorizer, o as requestMemo, t as bindAuthorizer } from "../authorizer-BGhXaDmo.js";
 import { a as isSessionSnapshot, c as sessionMemo, d as amrOf, f as checkAal, i as authzVersionOf, l as snapshotOf, n as toSession, o as issuedAtOf, s as sessionCacheKey, u as aalOf } from "../view-C8Ve14ja.js";
 import { a as respond, i as isResult, o as settle, r as guard } from "../respond-C3CcOZlA.js";
-import { a as sqlSupportStore, i as supportSessions, n as passwordGrant, o as supportClaims, r as safeRedirectPath } from "../sign-in-DNCdrk05.js";
+import { a as sqlSupportStore, i as supportSessions, n as passwordGrant, o as supportClaims, r as safeRedirectPath } from "../sign-in-B64114O4.js";
 import { n as event, t as defineEvents } from "../event-map-CtPFhcOp.js";
 import { t as subjectReaders } from "../subject-readers-B-pQ9Mmo.js";
 import { t as postgresExecutor } from "../executor-3qcMhg6R.js";
 import { n as jwtClaimsOf, r as userClaimsOf, t as authModeOf } from "../claims-DTy6R6my.js";
-import { n as withGuard, t as withBetterSupabase } from "../composite-BARuBEDE.js";
+import { n as withGuard, t as withBetterSupabase } from "../composite-B3TIjId4.js";
 import { c as verifyCompact, t as JwsError } from "../jws-DOgHJKHb.js";
 import { t as jwksSource } from "../jwks-cache-DEsKI0hJ.js";
 import { i as rateLimitPolicyHeader, n as periodSeconds, r as rateLimitHeader, t as isRateLimitPolicyName } from "../ratelimit-headers-kEcXyO3H.js";
@@ -56,6 +59,399 @@ const impersonationEvents = defineEvents({
 	"support.denied": event()
 });
 //#endregion
+//#region src/server/session-status.ts
+const VOLATILE_CLAIMS = [
+	"exp",
+	"iat",
+	"nbf",
+	"jti"
+];
+const HEADERS = {
+	"content-type": "application/json",
+	"cache-control": "no-store, private"
+};
+/** JSON with object keys sorted at every level, so equal claims hash alike. */
+function canonical(value) {
+	if (value === void 0) return "null";
+	if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+	if (value !== null && typeof value === "object") return `{${Object.entries(value).filter(([, each]) => each !== void 0).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, each]) => `${JSON.stringify(key)}:${canonical(each)}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+async function sha256Hex(text) {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(text));
+	return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+/**
+* The fingerprint `sessionStatusRoute` reports for a user's claims and support
+* session: a SHA-256 hex digest that changes when a claim that decides access
+* changes (role, tenant, memberships, `aal`) or the support target does.
+*/
+async function claimsFingerprint(claims, support, ignore = []) {
+	const skip = /* @__PURE__ */ new Set([...VOLATILE_CLAIMS, ...ignore]);
+	return sha256Hex(canonical({
+		claims: Object.fromEntries(Object.entries(claims).filter(([key]) => !skip.has(key))),
+		support: support ? {
+			session: support.session.id,
+			target: support.session.targetUserId,
+			readOnly: support.session.readOnly
+		} : null
+	}));
+}
+const statusOf = (resolution) => {
+	if (resolution.sessionEnded) return resolution.sessionEndedReason ?? "ended";
+	const { auth } = resolution;
+	if (auth.kind === "user") return "active";
+	return auth.kind === "anon" && auth.reason === "expired" ? "expired" : "signed_out";
+};
+/**
+* A `GET` handler that tells a browser whether its session still holds, for
+* apps that keep the session in httpOnly cookies and have no browser Supabase
+* client: `useSessionWatch()` from `better-supabase/next/client` polls it. It
+* answers `{ status, userId, fingerprint, expiresAt, support }` with
+* `Cache-Control: no-store`.
+*
+* ```ts
+* // app/api/session-status/route.ts
+* export const GET = sessionStatusRoute(bsb);
+* ```
+*/
+function sessionStatusRoute(server, options = {}) {
+	const checkSession = options.checkSession ?? true;
+	const refresh = options.refresh ?? false;
+	return async (request) => {
+		if (request.method !== "GET" && request.method !== "HEAD") return new Response(null, {
+			status: 405,
+			headers: { allow: "GET, HEAD" }
+		});
+		const resolution = await server.resolve(request, {
+			checkSession,
+			refresh
+		});
+		const status = statusOf(resolution);
+		const { auth } = resolution;
+		const user = auth.kind === "user" ? auth : void 0;
+		const support = user && status === "active" ? await server.support.current(request, user) : void 0;
+		const body = {
+			status,
+			userId: user?.user.id ?? null,
+			fingerprint: user && status === "active" ? await claimsFingerprint(user.claims, support, options.ignoreClaims) : null,
+			expiresAt: user?.expiresAt ?? null,
+			support: support ? {
+				sessionId: support.session.id,
+				targetUserId: support.session.targetUserId,
+				readOnly: support.session.readOnly
+			} : null
+		};
+		return resolution.apply(new Response(request.method === "HEAD" ? null : JSON.stringify(body), {
+			status: 200,
+			headers: HEADERS
+		}));
+	};
+}
+//#endregion
+//#region src/server/realtime-relay.ts
+/** The channels `liveQuery` joins: `bsb:t:<schema>.<table>[:...]`, private. */
+const liveRelayTopic = {
+	private: true,
+	match: (topic) => /^bsb:t:[^:]+\.[^:]+(?::.+)?$/.test(topic) ? {} : null
+};
+var Verdict = class extends Error {
+	allowed;
+	constructor(allowed) {
+		super(allowed ? "allowed" : "denied");
+		this.allowed = allowed;
+	}
+};
+const RLS_DENIED = "42501";
+function codeOf(cause) {
+	return typeof cause === "object" && cause !== null && "code" in cause ? cause.code : void 0;
+}
+/**
+* Whether `claims` may receive or send on `topic`, by the `realtime.messages`
+* policies, checked the way Realtime checks a join: a probe message is
+* inserted, then read (receive) or written (send) as the caller, and the
+* transaction rolls back.
+*/
+async function realtimeTopicAccess(postgres, input) {
+	const role = input.claims["role"] === "anon" ? "anon" : "authenticated";
+	const sub = input.claims["sub"];
+	const extension = input.extension ?? "broadcast";
+	const insert = "insert into realtime.messages (topic, extension, event, payload, private) values ($1, $2, 'bsb_relay_probe', '{}'::jsonb, true)";
+	const assume = async (sql) => {
+		await sql.queryRaw("select set_config('request.jwt.claims', $1, true), set_config('request.jwt.claim.sub', $2, true), set_config('request.jwt.claim.role', $3, true), set_config('realtime.topic', $4, true), set_config('role', $3, true)", [
+			JSON.stringify({
+				...input.claims,
+				role
+			}),
+			typeof sub === "string" ? sub : "",
+			role,
+			input.topic
+		]);
+	};
+	try {
+		await postgres.transaction(async (sql) => {
+			if (input.action === "receive") {
+				const [probe] = await sql.queryRaw(`${insert} returning id::text as id`, [input.topic, extension]);
+				await assume(sql);
+				const [row] = await sql.queryRaw("select exists (select 1 from realtime.messages m where m.id::text = $1) as allowed", [probe?.id ?? ""]);
+				throw new Verdict(row?.allowed === true);
+			}
+			await assume(sql);
+			try {
+				await sql.queryRaw(insert, [input.topic, extension]);
+			} catch (cause) {
+				if (codeOf(cause) === RLS_DENIED) throw new Verdict(false);
+				throw cause;
+			}
+			throw new Verdict(true);
+		});
+	} catch (cause) {
+		if (cause instanceof Verdict) return cause.allowed;
+		throw cause;
+	}
+	return false;
+}
+const encoder = new TextEncoder();
+const frame = (event, data) => encoder.encode(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`);
+const PING = encoder.encode(": ping\n\n");
+const STREAM_HEADERS = {
+	"content-type": "text/event-stream; charset=utf-8",
+	"cache-control": "no-store, no-transform",
+	"x-accel-buffering": "no"
+};
+function readOnlyError() {
+	return {
+		...dbError("forbidden", "The support session is read-only"),
+		code: "SUPPORT_READ_ONLY"
+	};
+}
+function isSendBody(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const body = value;
+	return typeof body.topic === "string" && typeof body.event === "string" && body.event !== "";
+}
+/**
+* Realtime for callers without a browser token of their own: a support session
+* ("view as user"), or an app that keeps sessions in httpOnly cookies. `GET
+* ?topic=<name>` resolves the caller, checks the topic's access as that caller
+* (the viewed user in a support session), joins upstream with the secret key
+* and streams the topic's broadcasts and presence as server-sent events. `POST
+* { topic, event, payload }` broadcasts for the caller after the same check on
+* the send policy; read-only support sessions can't send.
+* `relayRealtimeClient(url)` from `better-supabase/realtime` is the client.
+*
+* ```ts
+* // app/api/realtime/route.ts
+* export const { GET, POST } = realtimeRelay(bsb, {
+*   topics: [notifications, liveRelayTopic],
+*   postgres,
+* });
+* ```
+*/
+function realtimeRelay(server, options) {
+	const { postgres, authorize } = options;
+	if (!postgres && !authorize) throw new TypeError("realtimeRelay needs `postgres` to check the realtime.messages policies, or `authorize`");
+	const heartbeatMs = options.heartbeatMs ?? 25e3;
+	const maxDurationMs = options.maxDurationMs ?? 24e4;
+	const maxQueued = Math.max(1, options.maxQueued ?? 256);
+	const retryMs = options.retryMs ?? 1e3;
+	const refresh = options.refresh ?? false;
+	let upstream = options.upstream;
+	const upstreamClient = () => {
+		upstream ??= server.admin().$client;
+		return upstream;
+	};
+	const problem = (error) => problemResponse(error, { format: options.problem });
+	const topicOf = (name) => options.topics.find((each) => each.match(name) !== null);
+	const allowed = async (input) => {
+		try {
+			if (authorize) return await authorize(input);
+			if (input.auth.kind === "service") return true;
+			return postgres ? await realtimeTopicAccess(postgres, {
+				claims: input.claims,
+				topic: input.topic,
+				action: input.action
+			}) : false;
+		} catch {
+			return false;
+		}
+	};
+	const claimsOf = (auth, support) => {
+		if (support) return support.claims;
+		switch (auth.kind) {
+			case "user": return auth.claims;
+			case "apiKey": return auth.claims;
+			case "anon": return { role: "anon" };
+			case "service": return { role: "service_role" };
+			case "invalid": return { role: "anon" };
+			default: return auth;
+		}
+	};
+	/** Resolves the caller and checks `action` on `name`; a Response refuses. */
+	const admit = async (request, name, action) => {
+		const topic = topicOf(name);
+		if (!topic) return { refusal: problem(dbError("not_found", `No relayed topic "${name}"`)) };
+		const ctx = await server.context(request, { refresh });
+		const { auth, support } = ctx;
+		if (auth.kind === "invalid") return { refusal: ctx.apply(problem(auth.error)) };
+		if (!(auth.kind !== "anon") && (topic.private || action === "send")) return { refusal: ctx.apply(problem(dbError("unauthorized", "Sign in to join this topic"))) };
+		if (action === "send" && support?.session.readOnly === true) return { refusal: ctx.apply(problem(readOnlyError())) };
+		if (!(!topic.private && action === "receive" ? true : await allowed({
+			topic: name,
+			action,
+			auth,
+			support,
+			claims: claimsOf(auth, support)
+		}))) return { refusal: ctx.apply(problem(dbError("forbidden", `Not allowed to ${action} on "${name}"`))) };
+		return {
+			topic,
+			ctx
+		};
+	};
+	const expiryOf = (auth, support) => {
+		const times = [];
+		if (auth.kind === "user" && auth.expiresAt !== null) times.push(auth.expiresAt * 1e3);
+		if (support) times.push(support.session.expiresAt.epochMilliseconds);
+		return times.length === 0 ? void 0 : Math.min(...times);
+	};
+	const GET = async (request) => {
+		const name = new URL(request.url).searchParams.get("topic");
+		if (!name) return problem(dbError("invalid_request", "Pass ?topic=<name>"));
+		const admitted = await admit(request, name, "receive");
+		if ("refusal" in admitted) return admitted.refusal;
+		const { topic, ctx } = admitted;
+		const expiresAt = expiryOf(ctx.resolution.auth, ctx.support);
+		const client = upstreamClient();
+		let finish = () => void 0;
+		const stream = new ReadableStream({
+			start(controller) {
+				let closed = false;
+				let subscribed = false;
+				let leave;
+				const timers = [];
+				const enqueue = (chunk) => {
+					try {
+						controller.enqueue(chunk);
+					} catch {
+						finish(null);
+					}
+				};
+				const push = (chunk) => {
+					if (closed) return;
+					if ((controller.desiredSize ?? 1) <= 0) {
+						finish("overflow");
+						return;
+					}
+					enqueue(chunk);
+				};
+				finish = (reason) => {
+					if (closed) return;
+					closed = true;
+					for (const timer of timers) {
+						clearTimeout(timer);
+						clearInterval(timer);
+					}
+					request.signal.removeEventListener("abort", aborted);
+					leave?.();
+					if (reason !== null) enqueue(frame("end", { reason }));
+					try {
+						controller.close();
+					} catch {}
+				};
+				const aborted = () => {
+					finish(null);
+				};
+				const onStatus = (status) => {
+					switch (status) {
+						case "joining": return;
+						case "subscribed":
+							push(frame("status", {
+								status,
+								rejoin: subscribed
+							}));
+							subscribed = true;
+							return;
+						case "error":
+							if (subscribed) push(frame("status", { status }));
+							else finish("upstream_error");
+							return;
+						case "closed":
+							finish("closed");
+							return;
+						default: finish(status);
+					}
+				};
+				const subscriber = {
+					onStatus,
+					receive: (message) => {
+						push(frame("broadcast", {
+							event: message.event,
+							payload: message.payload
+						}));
+					},
+					...topic.presence ? { sync: (state) => {
+						push(frame("presence", state));
+					} } : {}
+				};
+				enqueue(encoder.encode(`retry: ${String(retryMs)}\n\n`));
+				if (request.signal.aborted) {
+					finish(null);
+					return;
+				}
+				request.signal.addEventListener("abort", aborted);
+				timers.push(setInterval(() => {
+					push(PING);
+				}, heartbeatMs), setTimeout(() => {
+					finish("max_duration");
+				}, maxDurationMs));
+				if (expiresAt !== void 0) timers.push(setTimeout(() => {
+					finish("expired");
+				}, Math.max(0, expiresAt - Date.now())));
+				try {
+					leave = joinTopic(client, name, topic.private, false, topic.presence === true, subscriber).leave;
+				} catch {
+					finish("upstream_error");
+				}
+			},
+			cancel() {
+				finish(null);
+			}
+		}, new CountQueuingStrategy({ highWaterMark: maxQueued }));
+		return ctx.apply(new Response(stream, {
+			status: 200,
+			headers: STREAM_HEADERS
+		}));
+	};
+	const POST = async (request) => {
+		const body = await request.json().catch(() => void 0);
+		if (!isSendBody(body)) return problem(dbError("invalid_request", "Send a JSON body with `topic`, `event` and `payload`"));
+		const known = topicOf(body.topic);
+		if (known && !known.clientSend) return problem(dbError("forbidden", `"${body.topic}" takes no client broadcasts`));
+		const admitted = await admit(request, body.topic, "send");
+		if ("refusal" in admitted) return admitted.refusal;
+		const { topic, ctx } = admitted;
+		const schema = topic.events?.[body.event];
+		const checked = schema ? await validate(schema, body.payload, "payload") : {
+			ok: true,
+			data: body.payload
+		};
+		if (!checked.ok) return ctx.apply(problem(checked.error));
+		const client = upstreamClient();
+		const open = client.getChannels().some((existing) => existing.topic === `realtime:${body.topic}`);
+		const channel = client.channel(body.topic, { config: { private: topic.private } });
+		try {
+			const sent = await channel.httpSend(body.event, checked.data);
+			return ctx.apply(sent.success ? new Response(null, { status: 202 }) : problem(dbError("network", sent.error)));
+		} finally {
+			if (!open) await client.removeChannel(channel);
+		}
+	};
+	return {
+		GET,
+		POST
+	};
+}
+//#endregion
 //#region src/server/entries/upstream.ts
 /** Repository context from a `@supabase/server` context. */
 function contextFromSupabase(ctx) {
@@ -451,4 +847,4 @@ function subscribeAuthzVersions(options) {
 	return subscription;
 }
 //#endregion
-export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, IDENTITY_SCOPES, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, accessTokenResolver, actorOf, agentClaims, amrOf, authContext, authModeOf, authzVersionOf, bindAuthorizer, cacheTagsOf, checkAal, checkSession, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, csvColumns, csvResponse, defineAuthorizationHooks, defineAuthorizer, defineResource, delegationOf, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonationEvents, impersonatorOf, isPrefetch, isProblem, isRateLimitPolicyName, isResult, isSessionSnapshot, issuedAtOf, jwtClaimsOf, lastSignIns, parseDbStats, passwordGrant, periodSeconds, problemResponse, rateLimitHeader, rateLimitPolicyHeader, readSession, refreshFor, refreshSession, requestMemo, resolveAuth, resolveToken, respond, rolesAt, safeRedirectPath, serverCore, sessionCacheKey, sessionCookieName, sessionMemo, sessionStatus, settle, shouldCheckSession, shouldRefresh, snapshotOf, sqlSupportStore, subjectReaders, subscribeAuthzVersions, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, supportStorage, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withFlush, withGuard, withServerTiming, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, IDENTITY_SCOPES, PERMISSION_CAP_CLAIM, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, accessTokenResolver, actorOf, agentClaims, amrOf, authContext, authModeOf, authzVersionOf, bindAuthorizer, cacheTagsOf, checkAal, checkSession, claimsFingerprint, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, csvColumns, csvResponse, defineAuthorizationHooks, defineAuthorizer, defineResource, delegationOf, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonationEvents, impersonatorOf, isPrefetch, isProblem, isRateLimitPolicyName, isResult, isSessionSnapshot, issuedAtOf, jwtClaimsOf, lastSignIns, liveRelayTopic, parseDbStats, passwordGrant, periodSeconds, problemResponse, rateLimitHeader, rateLimitPolicyHeader, readSession, realtimeRelay, realtimeTopicAccess, refreshFor, refreshSession, requestMemo, resolveAuth, resolveToken, respond, rolesAt, safeRedirectPath, serverCore, sessionCacheKey, sessionCookieName, sessionMemo, sessionStatus, sessionStatusRoute, settle, shouldCheckSession, shouldRefresh, snapshotOf, sqlSupportStore, subjectReaders, subscribeAuthzVersions, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, supportStorage, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withFlush, withGuard, withServerTiming, withSession, writeSession };