better-supabase 0.15.0 → 0.16.0

package/dist/storage/index.d.ts

@@ -1,4 +1,4 @@
 import { E as AccessPolicySql, T as AccessBucketPolicy, _t as BucketLifecycle, bt as VersioningStatus, vt as BucketLifecycleRule, yt as ObjectVersion } from "../types-DFdg_4yN.js";
-import { $ as TemplateValues, A as StorageBucketApi, B as StorageListV2Result, C as UploadOptions, D as TTL, E as parseSize, F as StorageFetchParameters, G as StorageSearchV2Options, H as StorageRemoveEntry, I as StorageFileOptions, J as StorageUrlOptions, K as StorageSignedUrlEntry, L as StorageListEntry, M as StorageDestinationOptions, N as StorageDownloadOptions, O as TtlPreset, P as StorageFailure, Q as TemplateParams, R as StorageListV2Folder, S as UploadBody, T as defineBucket, U as StorageResponse, V as StorageObjectInfo, W as StorageSearchOptions, X as StoragePath, Y as PathIn, Z as AppliedBucket, _ as StoredObject, a as BucketConnectOptions, b as TransferOptions, c as DownloadOptions, d as PathValues, f as PurgeCacheOptions, g as StorageAdminClient, h as Reservation, i as BucketConfig, j as StorageClient, k as StorageApi, l as ImageTransform, m as ReplaceResult, n as Bucket, o as BucketDrift, p as ReplaceOptions, q as StorageTransform, r as BucketClient, s as BucketPolicy, t as ActualBucket, u as ObjectTarget, v as SweepOptions, w as UrlOptions, x as TransformOptions, y as SweepResult, z as StorageListV2Object } from "../bucket-CiNi8sIw.js";
-import { A as StoredRef, C as AnyBucket, D as Buckets, E as BucketWithId, F as storageImageUrl, I as fromStorageError, M as StorageImageOptions, N as StorageImageSize, O as ConnectedRef, P as storageImageSrcSet, S as organizationLogoBucket, T as BucketMap, _ as IMAGE_TYPES, a as VectorHit, b as OrganizationLogoBucketOptions, c as VectorMetadata, d as defineVectorBucket, f as AnalyticsBucket, g as AvatarBucketOptions, h as defineAnalyticsBucket, i as VectorDistance, j as defineBuckets, k as ResolvedRef, l as VectorQueryOptions, m as AnalyticsCatalog, n as VectorBucketClient, o as VectorIndexClient, p as AnalyticsBucketClient, r as VectorBucketConfig, s as VectorIndexConfig, t as VectorBucket, u as VectorRecord, v as ImageBucketOptions, w as BucketIdOf, x as avatarBucket, y as ImageVariant } from "../index-Do2ChN_y.js";
-export { type AccessBucketPolicy, type AccessPolicySql, type ActualBucket, type AnalyticsBucket, type AnalyticsBucketClient, type AnalyticsCatalog, type AnyBucket, type AppliedBucket, type AvatarBucketOptions, type Bucket, type BucketClient, type BucketConfig, type BucketConnectOptions, type BucketDrift, type BucketIdOf, type BucketLifecycle, type BucketLifecycleRule, type BucketMap, type BucketPolicy, type BucketWithId, type Buckets, type ConnectedRef, type DownloadOptions, IMAGE_TYPES, type ImageBucketOptions, type ImageTransform, type ImageVariant, type ObjectTarget, type ObjectVersion, type OrganizationLogoBucketOptions, type PathIn, type PathValues, type PurgeCacheOptions, type ReplaceOptions, type ReplaceResult, type Reservation, type ResolvedRef, type StorageAdminClient, type StorageApi, type StorageBucketApi, type StorageClient, type StorageDestinationOptions, type StorageDownloadOptions, type StorageFailure, type StorageFetchParameters, type StorageFileOptions, type StorageImageOptions, type StorageImageSize, type StorageListEntry, type StorageListV2Folder, type StorageListV2Object, type StorageListV2Result, type StorageObjectInfo, type StoragePath, type StorageRemoveEntry, type StorageResponse, type StorageSearchOptions, type StorageSearchV2Options, type StorageSignedUrlEntry, type StorageTransform, type StorageUrlOptions, type StoredObject, type StoredRef, type SweepOptions, type SweepResult, TTL, type TemplateParams, type TemplateValues, type TransferOptions, type TransformOptions, type TtlPreset, type UploadBody, type UploadOptions, type UrlOptions, type VectorBucket, type VectorBucketClient, type VectorBucketConfig, type VectorDistance, type VectorHit, type VectorIndexClient, type VectorIndexConfig, type VectorMetadata, type VectorQueryOptions, type VectorRecord, type VersioningStatus, avatarBucket, defineAnalyticsBucket, defineBucket, defineBuckets, defineVectorBucket, fromStorageError, organizationLogoBucket, parseSize, storageImageSrcSet, storageImageUrl };
+import { $ as AppliedBucket, A as TtlPreset, B as StorageListV2Folder, C as TransformOptions, D as defineBucket, E as UrlOptions, F as StorageDownloadOptions, G as StorageResponse, H as StorageListV2Result, I as StorageFailure, J as StorageSignedUrlEntry, K as StorageSearchOptions, L as StorageFetchParameters, M as StorageBucketApi, N as StorageClient, O as parseSize, P as StorageDestinationOptions, Q as StoragePath, R as StorageFileOptions, S as TransferOptions, T as UploadOptions, U as StorageObjectInfo, V as StorageListV2Object, W as StorageRemoveEntry, X as StorageUrlOptions, Y as StorageTransform, Z as PathIn, _ as ResumableReservation, a as BucketConnectOptions, b as SweepOptions, c as DownloadOptions, d as PathValues, et as TemplateParams, f as PurgeCacheOptions, g as ReserveResumableOptions, h as Reservation, i as BucketConfig, j as StorageApi, k as TTL, l as ImageTransform, m as ReplaceResult, n as Bucket, o as BucketDrift, p as ReplaceOptions, q as StorageSearchV2Options, r as BucketClient, s as BucketPolicy, t as ActualBucket, tt as TemplateValues, u as ObjectTarget, v as StorageAdminClient, w as UploadBody, x as SweepResult, y as StoredObject, z as StorageListEntry } from "../bucket-vc-QRrva.js";
+import { A as ConnectedRef, C as avatarBucket, D as BucketMap, E as BucketIdOf, F as StorageImageSize, I as storageImageSrcSet, L as storageImageUrl, M as StoredRef, N as defineBuckets, O as BucketWithId, P as StorageImageOptions, R as fromStorageError, S as OrganizationLogoBucketOptions, T as AnyBucket, _ as defineAnalyticsBucket, a as VectorBucketConfig, b as ImageBucketOptions, c as VectorIndexClient, d as VectorQueryOptions, f as VectorRecord, g as AnalyticsCatalog, h as AnalyticsBucketClient, i as VectorBucketClient, j as ResolvedRef, k as Buckets, l as VectorIndexConfig, m as AnalyticsBucket, n as resumableEndpoint, o as VectorDistance, p as defineVectorBucket, r as VectorBucket, s as VectorHit, t as ResumableEndpointOptions, u as VectorMetadata, v as AvatarBucketOptions, w as organizationLogoBucket, x as ImageVariant, y as IMAGE_TYPES } from "../index-CQhPHHDF.js";
+export { type AccessBucketPolicy, type AccessPolicySql, type ActualBucket, type AnalyticsBucket, type AnalyticsBucketClient, type AnalyticsCatalog, type AnyBucket, type AppliedBucket, type AvatarBucketOptions, type Bucket, type BucketClient, type BucketConfig, type BucketConnectOptions, type BucketDrift, type BucketIdOf, type BucketLifecycle, type BucketLifecycleRule, type BucketMap, type BucketPolicy, type BucketWithId, type Buckets, type ConnectedRef, type DownloadOptions, IMAGE_TYPES, type ImageBucketOptions, type ImageTransform, type ImageVariant, type ObjectTarget, type ObjectVersion, type OrganizationLogoBucketOptions, type PathIn, type PathValues, type PurgeCacheOptions, type ReplaceOptions, type ReplaceResult, type Reservation, type ReserveResumableOptions, type ResolvedRef, type ResumableEndpointOptions, type ResumableReservation, type StorageAdminClient, type StorageApi, type StorageBucketApi, type StorageClient, type StorageDestinationOptions, type StorageDownloadOptions, type StorageFailure, type StorageFetchParameters, type StorageFileOptions, type StorageImageOptions, type StorageImageSize, type StorageListEntry, type StorageListV2Folder, type StorageListV2Object, type StorageListV2Result, type StorageObjectInfo, type StoragePath, type StorageRemoveEntry, type StorageResponse, type StorageSearchOptions, type StorageSearchV2Options, type StorageSignedUrlEntry, type StorageTransform, type StorageUrlOptions, type StoredObject, type StoredRef, type SweepOptions, type SweepResult, TTL, type TemplateParams, type TemplateValues, type TransferOptions, type TransformOptions, type TtlPreset, type UploadBody, type UploadOptions, type UrlOptions, type VectorBucket, type VectorBucketClient, type VectorBucketConfig, type VectorDistance, type VectorHit, type VectorIndexClient, type VectorIndexConfig, type VectorMetadata, type VectorQueryOptions, type VectorRecord, type VersioningStatus, avatarBucket, defineAnalyticsBucket, defineBucket, defineBuckets, defineVectorBucket, fromStorageError, organizationLogoBucket, parseSize, resumableEndpoint, storageImageSrcSet, storageImageUrl };

package/dist/storage/index.js

@@ -4,6 +4,7 @@ import { c as optionalTemporal, n as isInstant } from "../temporal-DLZlWbOi.js";
 import { n as temporalMissing } from "../temporal-required-Dy0GGD8E.js";
 import { a as ok, r as err, s as toDbError, t as AsyncResult } from "../result-ntFBW2p2.js";
 import { a as spansAllTenants } from "../plugin-AKwwe2gF.js";
+import { n as decodeJwtPayload } from "../base64-B9Wlsdj7.js";
 import { a as tenantClaimPaths, o as tenantFrom, s as tenantPathsFor } from "../claims-Bp9My7XP.js";
 import { a as sqlString, i as sqlIdent, n as parseTemplate, r as slug, t as claimSql } from "../template-Drgg3v2J.js";
 import { r as accessCheck } from "../access-sql-B-MkVARa.js";
@@ -281,6 +282,38 @@ function parseFailure(status, text) {
 	};
 }
 //#endregion
+//#region src/storage/resumable.ts
+/** Storage signs upload tokens for two hours. */
+const UPLOAD_TOKEN_SECONDS = 7200;
+const HOSTED = /^(?<ref>[a-z0-9-]+)\.supabase\.co$/i;
+const SIGNED_UPLOAD = "/object/upload/sign/";
+const STORAGE_PATH = "/storage/v1";
+/**
+* The TUS endpoint for a signed resumable upload,
+* `<storage>/upload/resumable/sign`. `url` is the project URL (`SUPABASE_URL`),
+* the Storage URL (`.../storage/v1`) or a signed upload URL from
+* `createSignedUploadUrl`.
+*/
+function resumableEndpoint(url, options = {}) {
+	const parsed = new URL(url);
+	const path = parsed.pathname;
+	const storage = path.indexOf(STORAGE_PATH);
+	const signed = path.indexOf(SIGNED_UPLOAD);
+	const base = storage === -1 ? signed === -1 ? `${path.replace(/\/+$/, "")}${STORAGE_PATH}` : path.slice(0, signed) : path.slice(0, storage + 11);
+	const hosted = HOSTED.exec(parsed.hostname);
+	if ((options.direct ?? true) && hosted?.groups?.["ref"] !== void 0) parsed.hostname = `${hosted.groups["ref"]}.storage.supabase.co`;
+	parsed.pathname = `${base}/upload/resumable/sign`;
+	parsed.search = "";
+	parsed.hash = "";
+	return parsed.toString();
+}
+/** When a signed upload token expires: its `exp`, else two hours from `now`. */
+function uploadTokenExpiry(token, now) {
+	const exp = decodeJwtPayload(token)?.["exp"];
+	const seconds = typeof exp === "number" && Number.isFinite(exp) ? exp : Math.floor(now / 1e3) + UPLOAD_TOKEN_SECONDS;
+	return (/* @__PURE__ */ new Date(seconds * 1e3)).toISOString();
+}
+//#endregion
 //#region src/storage/storage-api.ts
 /** The `StorageApi` of a client, or the client itself. */
 function storageApiOf(client) {
@@ -673,6 +706,26 @@ function connectBucket(bucket, client, resolveTarget, connectOptions, guard) {
 				signedUrl: data.signedUrl
 			}));
 		}),
+		reserveResumable: (target, options) => AsyncResult.from(async () => {
+			const path = resolve(target);
+			const upsert = options?.upsert ?? false;
+			return run(() => api().createSignedUploadUrl(path, upsert ? { upsert } : void 0)).map((data) => ({
+				path: data.path,
+				token: data.token,
+				signedUrl: data.signedUrl,
+				bucket: bucket.id,
+				tusEndpoint: resumableEndpoint(data.signedUrl, options?.direct === void 0 ? {} : { direct: options.direct }),
+				expiresAt: uploadTokenExpiry(data.token, options?.now?.() ?? Date.now()),
+				headers: {
+					"x-signature": data.token,
+					"x-upsert": upsert ? "true" : "false"
+				},
+				metadata: {
+					bucketName: bucket.id,
+					objectName: data.path
+				}
+			}));
+		}),
 		uploadReserved: (reservation, body, options) => AsyncResult.from(async () => {
 			options?.signal?.throwIfAborted();
 			const path = resolve(reservation.path);
@@ -1412,4 +1465,4 @@ function connectVectorBucket(config, client) {
 	};
 }
 //#endregion
-export { IMAGE_TYPES, TTL, avatarBucket, defineAnalyticsBucket, defineBucket, defineBuckets, defineVectorBucket, fromStorageError, organizationLogoBucket, parseSize, storageImageSrcSet, storageImageUrl };
+export { IMAGE_TYPES, TTL, avatarBucket, defineAnalyticsBucket, defineBucket, defineBuckets, defineVectorBucket, fromStorageError, organizationLogoBucket, parseSize, resumableEndpoint, storageImageSrcSet, storageImageUrl };

package/dist/{subject-readers-BNSzkqw_.d.ts → subject-readers-8GySC9Z8.d.ts}

@@ -1,5 +1,5 @@
 import { t as BlockTransport } from "./block-transport-DWZSJrwN.js";
-import { g as SubscriberPolicy } from "./authorization-hooks-Cs1vP_ej.js";
+import { g as SubscriberPolicy } from "./authorization-hooks-D_pwXlBs.js";
 //#region src/core/subject-readers.d.ts
 interface SubjectReadersOptions {
   /** The schema of the `subjects` module. Default `better_supabase`. */

package/dist/support-B4ZBVxt3.d.ts

@@ -0,0 +1,357 @@
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult } from "./result-DZeA5KS6.js";
+import { o as EventHub } from "./events-vcqenSYU.js";
+import { r as AuthState } from "./resolve-CXX6DHv3.js";
+import { a as ProblemFormat } from "./problem-DNwN8iGz.js";
+import { _ as SupportAuthorize, i as AuthorizationHooks } from "./authorization-hooks-D_pwXlBs.js";
+import { t as BetterPostgres } from "./pool-CrtT4dg-.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/auth/support.d.ts
+type SupportEndedBy = "admin" | "expired" | "revoked";
+/** A support session: a platform admin viewing the app as `targetUserId`. */
+interface SupportSession {
+  readonly id: string;
+  readonly adminId: string;
+  readonly targetUserId: string;
+  readonly reason: string;
+  /** Writes fail while it is true (`begin read only`). */
+  readonly readOnly: boolean;
+  readonly tenant?: string;
+  readonly startedAt: Temporal.Instant;
+  readonly expiresAt: Temporal.Instant;
+  readonly endedAt?: Temporal.Instant;
+  readonly endedBy?: SupportEndedBy;
+  /** App data, such as a ticket id. */
+  readonly metadata: Readonly<Record<string, unknown>>;
+}
+interface SupportStartInput {
+  readonly adminId: string;
+  /**
+   * The admin's verified claims. The SQL store runs `start_support_session`
+   * with them, so `is_platform()` checks the admin in the database too.
+   */
+  readonly adminClaims: Readonly<Record<string, unknown>>;
+  readonly targetUserId: string;
+  readonly reason: string;
+  readonly ttlSeconds: number;
+  readonly readOnly: boolean;
+  readonly tenant?: string;
+  readonly metadata: Readonly<Record<string, unknown>>;
+  /** The approved request this start uses, when the server found one. */
+  readonly requestId?: string;
+}
+/**
+ * A request for a support session that waits for a second admin. A start uses
+ * an approved request once; `approvedBy` is never `adminId`.
+ */
+interface SupportRequest {
+  readonly id: string;
+  readonly adminId: string;
+  readonly targetUserId: string;
+  readonly reason: string;
+  readonly readOnly: boolean;
+  readonly tenant?: string;
+  readonly metadata: Readonly<Record<string, unknown>>;
+  readonly requestedAt: Temporal.Instant;
+  /** An unapproved or unused request is closed after this. */
+  readonly expiresAt: Temporal.Instant;
+  readonly approvedBy?: string;
+  readonly approvedAt?: Temporal.Instant;
+  /** The session the approval started. */
+  readonly sessionId?: string;
+}
+interface SupportRequestInput {
+  readonly adminId: string;
+  /** The admin's verified claims; the SQL store asks as the admin with them. */
+  readonly adminClaims: Readonly<Record<string, unknown>>;
+  readonly targetUserId: string;
+  readonly reason: string;
+  readonly readOnly: boolean;
+  readonly tenant?: string;
+  readonly metadata: Readonly<Record<string, unknown>>;
+  /**
+   * An approver the server's authorization hook already decided, never the
+   * admin. The SQL store then records the request approved, over the admin
+   * connection.
+   */
+  readonly approvedBy?: string;
+}
+/**
+ * Who approves a request: with `claims` the store runs as them and decides
+ * eligibility itself.
+ */
+interface SupportApprover {
+  readonly id: string;
+  readonly claims?: SupportCallerClaims;
+}
+/** What `approvedRequest` looks up. */
+interface SupportApprovalQuery {
+  readonly adminId: string;
+  readonly targetUserId: string;
+  readonly tenant?: string;
+  readonly readOnly: boolean;
+}
+/** A caller's verified claims, which the store runs a call with. */
+type SupportCallerClaims = Readonly<Record<string, unknown>>;
+interface SupportListFilter {
+  readonly adminId?: string;
+  readonly targetUserId?: string;
+  /** `true`: running sessions only; `false`: ended or expired ones only. */
+  readonly active?: boolean;
+  /** Defaults to 50. */
+  readonly limit?: number;
+}
+/**
+ * Where support sessions live. `sqlSupportStore` uses the `impersonation` SQL
+ * module; implement this for another store and check it with
+ * `testSupportSessionStore` from `better-supabase/testing`.
+ */
+interface SupportSessionStore {
+  readonly apiVersion: 1;
+  readonly name: string;
+  /**
+   * Starts a session and ends the admin's previous one. Rejects when the store
+   * refuses.
+   */
+  start(input: SupportStartInput): Promise<SupportSession>;
+  /**
+   * The admin's session while it is running; `undefined` once ended or expired.
+   * With the admin's `claims`, the store also checks that the admin may still
+   * start sessions.
+   */
+  get(sessionId: string, adminId: string, claims?: SupportCallerClaims): Promise<SupportSession | undefined>;
+  /**
+   * `false` when it was not running. With `claims`, it runs as that caller: the
+   * session's admin, or staff with the revoke permission.
+   */
+  end(sessionId: string, endedBy: SupportEndedBy, claims?: SupportCallerClaims): Promise<boolean>;
+  /** With `claims`, only what that caller may view. */
+  list(filter?: SupportListFilter, claims?: SupportCallerClaims): Promise<readonly SupportSession[]>;
+  /** The claims `targetUserId` would get, when the store can build them. */
+  claims?(targetUserId: string): Promise<Readonly<Record<string, unknown>>>;
+  /**
+   * Ends every running session past its expiry with `endedBy: "expired"` and
+   * returns them. Optional; `support.expire()` fails without it.
+   */
+  expire?(): Promise<readonly SupportSession[]>;
+  /**
+   * The store with `namespace` for its time values, unless it was given one
+   * itself. Optional; `createServer` calls it with the definition's
+   * `temporal`.
+   */
+  withTemporal?(namespace: typeof Temporal): SupportSessionStore;
+  /**
+   * Records a request for a session that waits for a second admin. Optional;
+   * without it and the two methods below, starts that need an approval are
+   * refused.
+   */
+  request?(input: SupportRequestInput): Promise<SupportRequest>;
+  /** A request by id, or `undefined`. */
+  getRequest?(requestId: string): Promise<SupportRequest | undefined>;
+  /** Approves a request. Rejects when the approver is the requester. */
+  approve?(requestId: string, approver: SupportApprover): Promise<SupportRequest>;
+  /** The approved, unused, unexpired request a start would use, or `undefined`. */
+  approvedRequest?(query: SupportApprovalQuery): Promise<SupportRequest | undefined>;
+}
+interface SqlSupportStoreOptions {
+  /** `blocks.impersonation.schema`. Defaults to `better_supabase`. */
+  readonly schema?: string;
+  /**
+   * The Temporal namespace for the sessions' time values, for runtimes without
+   * a global one. Defaults to the one `createServer` passes from the
+   * definition, then the provided or global Temporal.
+   */
+  readonly temporal?: typeof Temporal;
+}
+/**
+ * Support sessions in the `impersonation` SQL module. `start` runs as the
+ * admin, so the module's `is_platform()` gate applies; the reads run on the
+ * admin connection.
+ */
+declare function sqlSupportStore(postgres: Pick<BetterPostgres, "admin" | "asUser">, options?: SqlSupportStoreOptions): SupportSessionStore;
+/**
+ * The claims a support session runs with: the target's, plus `act` naming the
+ * admin, the reason and the session (the audit module records all three),
+ * marked `kind: "support"` so `actorOf` never reads it as an OAuth client.
+ * `role` falls back to `authenticated`; the admin's claims never leak in.
+ */
+declare function supportClaims(session: Pick<SupportSession, "id" | "adminId" | "targetUserId" | "reason" | "readOnly">, target: Readonly<Record<string, unknown>>): Record<string, unknown>;
+//#endregion
+//#region src/auth/support-cookie.d.ts
+/** The cookie that carries the support session id. */
+declare const SUPPORT_COOKIE = "bsb-support";
+interface SupportCookieOptions {
+  /** Defaults to `bsb-support`. */
+  readonly name?: string;
+  /** Defaults to `/`. */
+  readonly path?: string;
+  /** Defaults to true; set false for plain-HTTP local development. */
+  readonly secure?: boolean;
+}
+/**
+ * `Set-Cookie` for a session: HttpOnly, SameSite=Lax, gone when the session
+ * expires.
+ */
+declare function supportCookie(session: Pick<SupportSession, "id" | "expiresAt">, options?: SupportCookieOptions, now?: number): string;
+/** `Set-Cookie` that removes the support cookie. */
+declare function clearSupportCookie(options?: SupportCookieOptions): string;
+/** The support session id in a `Cookie` header, or `undefined`. */
+declare function supportCookieValue(cookieHeader: string | null, name?: string): string | undefined;
+//#endregion
+//#region src/server/support.d.ts
+interface SupportPolicy {
+  /** Seconds a session lasts. Defaults to 1800 (30 minutes). */
+  readonly ttl?: number;
+  /** The longest `ttl` a start may ask for. Defaults to 14400 (4 hours). */
+  readonly maxTtl?: number;
+  /** Defaults to true. */
+  readonly requireReason?: boolean;
+  /**
+   * `always` (the default): every session is read-only. `default`: read-only
+   * unless the start passes `readOnly: false`.
+   */
+  readonly readOnly?: "always" | "default";
+  /**
+   * `distinct` (the default): a start needs a request that another admin
+   * approved (`support.request`, then `support.approve`), or an `authorize`
+   * decision of `{ approvedBy }` naming someone else. `none`: no second admin.
+   * Set `blocks.impersonation.options.approval` to the same value, because the
+   * SQL store checks it again.
+   */
+  readonly approval?: "distinct" | "none";
+}
+interface SupportOptions {
+  readonly store: SupportSessionStore;
+  /**
+   * Whether `admin` may view the app as the target. Without it, the
+   * authorization hooks' `support.authorize` decides, and without those every
+   * start is refused (`SUPPORT_FORBIDDEN`). A throw or rejection counts as a
+   * deny. `true` still needs a second admin under `policy.approval:
+   * 'distinct'`; `{ approvedBy }` names that admin.
+   *
+   * `'store'` hands the decision to the store alone: the SQL store checks
+   * `is_platform(blocks['impersonation'].permissions.start)` and nothing else,
+   * so use it only when that permission is the whole rule.
+   */
+  readonly authorize?: SupportAuthorize | "store";
+  /**
+   * The claims the target gets. Defaults to `store.claims` (the SQL store runs
+   * your custom access token hook), then `{ role: 'authenticated' }`.
+   */
+  readonly claims?: (targetUserId: string) => Readonly<Record<string, unknown>> | Promise<Readonly<Record<string, unknown>>>;
+  readonly policy?: SupportPolicy;
+  readonly cookie?: SupportCookieOptions;
+  /**
+   * Where a request names its support session, for apps that keep it in a
+   * header or their own request store instead of the `bsb-support` cookie.
+   * Defaults to reading the cookie.
+   */
+  readonly sessionId?: (request: Request) => string | undefined;
+}
+interface SupportStartRequest {
+  readonly targetUserId: string;
+  readonly reason?: string;
+  /** Seconds; defaults to `policy.ttl`. */
+  readonly ttl?: number;
+  /** Honoured only with `policy.readOnly: 'default'`. */
+  readonly readOnly?: boolean;
+  readonly tenant?: string;
+  readonly metadata?: Readonly<Record<string, unknown>>;
+}
+/** Options for `support.expireRoute`. */
+interface SupportExpireRouteOptions {
+  /** The bearer token the cron caller sends, such as `process.env.CRON_SECRET`. */
+  readonly secret: string | undefined;
+  /** Rewrites the Problem Details bodies of the route's errors. */
+  readonly problem?: ProblemFormat;
+}
+/** A running support session, as the request that carries its cookie sees it. */
+interface ActiveSupport {
+  readonly session: SupportSession;
+  /** The admin behind the session, from their own verified token. */
+  readonly admin: {
+    readonly id: string;
+    readonly email?: string;
+  };
+  /** The target's claims plus `act`, which repositories run with. */
+  readonly claims: Readonly<Record<string, unknown>>;
+}
+/** `bsb.support`: start, stop and inspect support sessions. */
+interface SupportApi {
+  /**
+   * Starts a session for a signed-in admin and returns it with the `Set-Cookie`
+   * value that switches the admin's next requests to the target.
+   */
+  start(admin: AuthState, request: SupportStartRequest): AsyncResult<{
+    readonly session: SupportSession;
+    readonly cookie: string;
+  }>;
+  /**
+   * Asks for a session that a second admin approves with `approve`; the policy
+   * checks of `start` apply. `ttl` is not stored: `start` passes it.
+   */
+  request(admin: AuthState, request: SupportStartRequest): AsyncResult<SupportRequest>;
+  /**
+   * Approves a request as `approver`, who is never the admin who asked. With
+   * the hooks' `approverOf`, it decides who may approve; otherwise the store
+   * does (the SQL store: the provider's `isApprover`, else the start
+   * permission).
+   */
+  approve(approver: AuthState, requestId: string): AsyncResult<SupportRequest>;
+  /**
+   * Ends the admin's own session and returns the `Set-Cookie` that clears the
+   * cookie.
+   */
+  stop(admin: AuthState, sessionId: string): AsyncResult<{
+    readonly ended: boolean;
+    readonly cookie: string;
+  }>;
+  /**
+   * Ends a session as `caller`: the SQL store allows the session's admin and
+   * staff with the revoke permission.
+   */
+  revoke(caller: AuthState, sessionId: string): AsyncResult<boolean>;
+  /** The running session the request names (`sessionIdOf`) for `auth`, if any. */
+  current(request: Request, auth: AuthState): Promise<ActiveSupport | undefined>;
+  /**
+   * The running session `sessionId` for the admin in `auth`, if any. Use it
+   * when the app keeps the session id in its own request context; pass the
+   * result to `contextFor(auth, { support })` or `dbFor(auth, context, {
+   * support })`.
+   */
+  resolve(sessionId: string, auth: AuthState): Promise<ActiveSupport | undefined>;
+  /** The sessions `caller` may view (the SQL store checks the view permission). */
+  list(caller: AuthState, filter?: SupportListFilter): AsyncResult<readonly SupportSession[]>;
+  /**
+   * Ends every session past its expiry through the store and emits
+   * `support.ended` with `endedBy: "expired"` for each; the SQL store runs over
+   * `postgres.admin`. Returns the sessions it ended.
+   */
+  expire(): AsyncResult<readonly SupportSession[]>;
+  /**
+   * A `GET` or `POST` handler for a cron caller that runs `expire()` and
+   * answers `{ expired }`, the number of sessions it ended.
+   */
+  expireRoute(options: SupportExpireRouteOptions): (request: Request) => Promise<Response>;
+  /** The support session id a request names: `options.sessionId`, or the cookie. */
+  sessionIdOf(request: Request): string | undefined;
+  /** `Set-Cookie` that clears the support cookie. */
+  clearCookie(): string;
+}
+/** `ServerOptions.support`, from `supportSessions(options)`. */
+interface SupportSessions {
+  readonly options: SupportOptions;
+  /**
+   * Builds `bsb.support`; `createServer` calls it once, with the definition's
+   * `temporal`, which goes on to the store's `withTemporal`, and the server's
+   * authorization hooks.
+   */
+  readonly create: (events: EventHub, claimsSchema: StandardSchemaV1 | undefined, temporal?: typeof Temporal, authorization?: AuthorizationHooks) => SupportApi;
+}
+/**
+ * Support sessions for `createServer(betterSupabase, { support })`. Apps that
+ * never import it don't bundle the support code.
+ */
+declare function supportSessions(options: SupportOptions): SupportSessions;
+//#endregion
+export { SupportSessionStore as C, supportClaims as E, SupportSession as S, sqlSupportStore as T, SupportCallerClaims as _, SupportPolicy as a, SupportRequest as b, supportSessions as c, clearSupportCookie as d, supportCookie as f, SupportApprover as g, SupportApprovalQuery as h, SupportOptions as i, SUPPORT_COOKIE as l, SqlSupportStoreOptions as m, SupportApi as n, SupportSessions as o, supportCookieValue as p, SupportExpireRouteOptions as r, SupportStartRequest as s, ActiveSupport as t, SupportCookieOptions as u, SupportEndedBy as v, SupportStartInput as w, SupportRequestInput as x, SupportListFilter as y };

package/dist/svelte/index.d.ts

@@ -1,13 +1,13 @@
 import { b as DbError } from "../result-DZeA5KS6.js";
 import { Ct as Events, D as BlockEventPattern, T as BlockEvent, bt as EventMap, k as BlockEventsMatching } from "../events-vcqenSYU.js";
-import { pt as QuerySpec } from "../define-DFBnQyYg.js";
-import { $ as TemplateValues } from "../bucket-CiNi8sIw.js";
-import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-CJrQZQaa.js";
-import { t as AuthSnapshot } from "../bind-CrMBwrPN.js";
+import { pt as QuerySpec } from "../define-C5AcEkEJ.js";
+import { tt as TemplateValues } from "../bucket-vc-QRrva.js";
+import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-CZXHhZye.js";
+import { t as AuthSnapshot } from "../bind-JGCPGUJh.js";
 import { t as AuthSession } from "../view-DyFdMCqg.js";
-import { n as Controller } from "../controller-BrP0gn47.js";
-import { C as LiveCountSource, D as ProfileOf, E as PresenceTopic, O as UseActionOptions, S as LiveCountHookOptions, T as PresenceHookOptions, _ as ActionResultOf, a as DataRows, b as ClaimsOf, c as DataWrites, d as BlockMutationState, f as BlockQueryActions, g as ActionInputOf, h as BlockRefetchOn, i as DataRow, l as BlockEventSource, m as BlockQueryState, n as DataId, o as DataSource, p as BlockQueryOptions, r as DataListArgs, s as DataState, t as fieldErrorsOf, u as BlockMutationActions, v as ActionState, w as LiveQueryHookOptions, x as ClientLike, y as BroadcastOptions } from "../field-errors-fsbFktYF.js";
-import { n as BlockOptions } from "../block-env-B_uEM2xz.js";
+import { n as Controller } from "../controller-BW-5Opig.js";
+import { C as LiveCountSource, D as ProfileOf, E as PresenceTopic, O as UseActionOptions, S as LiveCountHookOptions, T as PresenceHookOptions, _ as ActionResultOf, a as DataRows, b as ClaimsOf, c as DataWrites, d as BlockMutationState, f as BlockQueryActions, g as ActionInputOf, h as BlockRefetchOn, i as DataRow, l as BlockEventSource, m as BlockQueryState, n as DataId, o as DataSource, p as BlockQueryOptions, r as DataListArgs, s as DataState, t as fieldErrorsOf, u as BlockMutationActions, v as ActionState, w as LiveQueryHookOptions, x as ClientLike, y as BroadcastOptions } from "../field-errors-Dt86dCKk.js";
+import { n as BlockOptions } from "../block-env-y65GF_px.js";
 import { n as BlockDataOf, r as BlockMethodName, t as BlockArgsOf } from "../block-method-CiVa2G-J.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { QueryClient } from "@tanstack/query-core";

package/dist/svelte/index.js

@@ -1,5 +1,5 @@
 import { t as clearOnUserChange } from "../user-change-DgWC6RRC.js";
-import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-BAEbEA7t.js";
+import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-C_mlji5R.js";
 import { c as listenToBlockEvents, d as fieldErrorsOf, i as dataTarget, l as blockEnv, n as createDataOne, o as createBlockMutation, s as createBlockQuery, t as createDataList, u as withEnv } from "../data-hooks-tgF1Ct0F.js";
 import { getContext, onDestroy, onMount, setContext } from "svelte";
 import { createSubscriber } from "svelte/reactivity";

package/dist/sveltekit/index.d.ts

@@ -1,12 +1,12 @@
 import { O as AnyFunctions, k as AnyModels } from "../types-DFdg_4yN.js";
 import { l as PermissionRef, t as AnyAuthorizer } from "../authorizer-B6X09otb.js";
-import { t as BetterSupabase } from "../define-DFBnQyYg.js";
-import { n as BetterServer } from "../server-types-CFtehAsr.js";
+import { t as BetterSupabase } from "../define-C5AcEkEJ.js";
+import { n as BetterServer } from "../server-types-CK8mUIUT.js";
 import { a as AuthorizedContext, c as ResourceLoaderContext, i as AuthorizeOptions, l as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-DOwKpSkA.js";
 import { t as RefusalRedirects } from "../refusal-CSntB_x8.js";
-import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-BKyTeS-j.js";
+import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-BGdZVyPL.js";
 import { t as Validated } from "../shared-CRRfQAKG.js";
-import { i as tagFor } from "../tags-BjHflcHF.js";
+import { i as tagFor } from "../tags-qvVk79pp.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/bridges/sveltekit.d.ts

package/dist/sveltekit/index.js

@@ -1,12 +1,12 @@
 import { t as DbException } from "../db-exception-Lngc1W49.js";
 import { r as dbErrorOf } from "../errors-BVFgt8BZ.js";
 import { c as toProblem } from "../problem-Bf0cJ7tk.js";
-import { c as extendServer, o as withFlush, s as createServer } from "../adapter-B0b6MXYS.js";
+import { c as extendServer, o as withFlush, s as createServer } from "../adapter-Dyks1lX1.js";
 import { t as defaultExpose } from "../respond-C3CcOZlA.js";
 import { r as tagFor } from "../tags-CIZTqtlY.js";
 import { i as requireCaller, o as runAction } from "../kit-5l-o8RxL.js";
 import { n as bufferInPlace, t as around } from "../shared-Bf-I13Ht.js";
-import { a as platformWaitUntil, i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-DDdkR7FX.js";
+import { a as platformWaitUntil, i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-BozTXRzt.js";
 import { i as refusalTarget } from "../refusal-ByBZcm0V.js";
 //#region src/bridges/sveltekit.ts
 /**

package/dist/{tags-BjHflcHF.d.ts → tags-qvVk79pp.d.ts}

@@ -1,4 +1,4 @@
-import { Qt as CacheTarget, Zt as CacheAdapter } from "./define-DFBnQyYg.js";
+import { Qt as CacheTarget, Zt as CacheAdapter } from "./define-C5AcEkEJ.js";
 //#region src/core/tags.d.ts
 interface TagOptions {
   /** The tenant the read is scoped to; `"*"` is every tenant's reads. */

package/dist/tanstack-db/index.d.ts

@@ -1,5 +1,5 @@
 import { O as AnyFunctions, k as AnyModels, ut as TableKey } from "../types-DFdg_4yN.js";
-import { t as BetterSupabase, v as Db } from "../define-DFBnQyYg.js";
+import { t as BetterSupabase, v as Db } from "../define-C5AcEkEJ.js";
 import { n as DataEngine } from "../data-engine-BWoz9lED.js";
 import { t as BetterQueryMeta } from "../invalidate-DMp4eqfF.js";
 import { QueryClient, SkipToken } from "@tanstack/query-core";

package/dist/tanstack-start/index.d.ts

@@ -1,10 +1,10 @@
 import { O as AnyFunctions, k as AnyModels } from "../types-DFdg_4yN.js";
 import { l as PermissionRef, t as AnyAuthorizer } from "../authorizer-B6X09otb.js";
-import { t as BetterSupabase } from "../define-DFBnQyYg.js";
-import { n as BetterServer } from "../server-types-CFtehAsr.js";
+import { t as BetterSupabase } from "../define-C5AcEkEJ.js";
+import { n as BetterServer } from "../server-types-CK8mUIUT.js";
 import { a as AuthorizedContext, c as ResourceLoaderContext, i as AuthorizeOptions, l as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-DOwKpSkA.js";
 import { t as RefusalRedirects } from "../refusal-CSntB_x8.js";
-import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-BKyTeS-j.js";
+import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-BGdZVyPL.js";
 import { t as Validated } from "../shared-CRRfQAKG.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/tanstack-start/index.js

@@ -1,8 +1,8 @@
-import { c as extendServer, o as withFlush, s as createServer } from "../adapter-B0b6MXYS.js";
+import { c as extendServer, o as withFlush, s as createServer } from "../adapter-Dyks1lX1.js";
 import { t as defaultExpose } from "../respond-C3CcOZlA.js";
 import { i as requireCaller, o as runAction } from "../kit-5l-o8RxL.js";
 import { n as bufferInPlace, t as around } from "../shared-Bf-I13Ht.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-DDdkR7FX.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-BozTXRzt.js";
 import { r as refusalResponse } from "../refusal-ByBZcm0V.js";
 //#region src/bridges/tanstack-start.ts
 /**

package/dist/{tenant-yYg0E2-n.d.ts → tenant-DOKIJI62.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSnapshot } from "./bind-CrMBwrPN.js";
+import { t as AuthSnapshot } from "./bind-JGCPGUJh.js";
 import { t as AuthSession } from "./view-DyFdMCqg.js";
 //#region src/auth/tenant.d.ts
 /**

package/dist/testing/index.d.ts

@@ -7,35 +7,36 @@ import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } f
 import { n as SqlClient } from "../executor-hGjrop3A.js";
 import { a as BlockTransportMiddleware } from "../block-hooks-DZN2w69m.js";
 import { a as SessionActor, o as SessionDelegation } from "../actor-CoveJgya.js";
-import { P as QueueProvider } from "../types-SFRomQF7.js";
-import { n as Embedder } from "../knowledge-CtL-Vfgy.js";
+import { P as QueueProvider } from "../types-Czq9Xtpa.js";
+import { n as Embedder } from "../knowledge-F1IhRI4Q.js";
 import { a as AuthorizationProvider } from "../authorization-HZdJCaVm.js";
 import { o as StreamStore } from "../store-CpheI-lN.js";
 import { o as Authorizer } from "../authorizer-B6X09otb.js";
-import { J as DbStats, Zt as CacheAdapter, t as BetterSupabase, v as Db } from "../define-DFBnQyYg.js";
-import { X as StoragePath } from "../bucket-CiNi8sIw.js";
-import { B as SupportSessionStore, a as ServerContext, c as ServerOptions } from "../server-types-CFtehAsr.js";
+import { J as DbStats, Zt as CacheAdapter, t as BetterSupabase, v as Db } from "../define-C5AcEkEJ.js";
+import { Q as StoragePath } from "../bucket-vc-QRrva.js";
+import { a as ServerContext, c as ServerOptions } from "../server-types-CK8mUIUT.js";
 import { n as Impersonator } from "../impersonation-YTa9dZUv.js";
-import { tn as AnyRecordBinding } from "../define-block-BVcLQ3DF.js";
+import { tn as AnyRecordBinding } from "../define-block-C1RHXz7L.js";
 import { n as Money } from "../money-BNRdJQzA.js";
 import { i as EventSink, t as CloudEvent } from "../cloud-event-CzZTJkXv.js";
-import { i as AuthorizationHooks } from "../authorization-hooks-Cs1vP_ej.js";
+import { i as AuthorizationHooks } from "../authorization-hooks-D_pwXlBs.js";
 import { s as SqlClaims, t as BetterPostgres } from "../pool-CrtT4dg-.js";
+import { C as SupportSessionStore } from "../support-B4ZBVxt3.js";
 import { r as GuardOptions } from "../respond-Dn1_YhC1.js";
 import { l as Transcriber, s as NoteTaker, u as TranscriberInput } from "../recordings-BBSJt_YV.js";
-import { n as Controller } from "../controller-BrP0gn47.js";
-import { c as AiTaskRunner, o as AiTaskRun, r as AiTask } from "../ai-schedules-CAquecT_.js";
-import { At as Generator, Rt as GeneratorInput, Vt as GeneratorModel, Zt as ResolvedConfig } from "../context-CEuTKrkz.js";
+import { n as Controller } from "../controller-BW-5Opig.js";
+import { c as AiTaskRunner, o as AiTaskRun, r as AiTask } from "../ai-schedules-BmkARmQ9.js";
+import { Ht as GeneratorModel, Qt as ResolvedConfig, jt as Generator, zt as GeneratorInput } from "../context-8kb8m5uO.js";
 import { r as WebhookInput } from "../signatures-Dkx9OE8j.js";
 import { n as Payment, o as PaymentProvider } from "../payments-BYcN34Fp.js";
 import { t as NotificationChannel } from "../channel-BjvGO39m.js";
 import { a as DeliveryTransport } from "../delivery-n6lZGuGx.js";
 import { l as TaxProvider, r as TaxAddress } from "../tax-DPShHual.js";
 import { p as ShippingProvider, s as ShipmentAddress } from "../carrier-KzeYXVrW.js";
-import { L as WorkflowGraph, c as GraphCompiler, i as BuilderStarter, r as BuilderStartCall } from "../types-BBQLbui9.js";
+import { L as WorkflowGraph, c as GraphCompiler, i as BuilderStarter, r as BuilderStartCall } from "../types-DsRfiQ0v.js";
 import { O as IncomingDestination, f as WebhookSecretStore, o as WebhookSigner, v as WebhookTransport } from "../signers-BAEzvTJ0.js";
 import { t as ApiModel } from "../model-hwpvole9.js";
-import { t as EveDocumentBackend } from "../eve-BFSwTu1z.js";
+import { t as EveDocumentBackend } from "../eve-B7jxYPCw.js";
 import { l as VersionOf, t as AnyDocumentFormat } from "../format-u-65igKI.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Message, StateAdapter } from "chat";