better-supabase 0.15.1 → 0.16.0

package/dist/{server-types-7QPzW2bF.d.ts → server-types-CK8mUIUT.d.ts}

@@ -6,16 +6,15 @@ import { o as EnvSource, t as BetterSupabaseEnv } from "./index-NRMMhhEi.js";
 import { a as ResolveAuthOptions, m as CookieWrite, o as ResolvePhase, r as AuthState, t as AuthResolution } from "./resolve-CXX6DHv3.js";
 import { r as CredentialProvider } from "./provider-CqwEOLCA.js";
 import { n as SqlClient } from "./executor-hGjrop3A.js";
-import { a as ProblemFormat } from "./problem-DNwN8iGz.js";
 import { c as AuthzVersionCache, t as AnyAuthorizer, u as RequestMemo } from "./authorizer-B6X09otb.js";
-import { J as DbStats, X as StatsRecorder, t as BetterSupabase, v as Db } from "./define-DFBnQyYg.js";
-import { k as StorageApi, n as Bucket } from "./bucket-CiNi8sIw.js";
+import { J as DbStats, X as StatsRecorder, t as BetterSupabase, v as Db } from "./define-C5AcEkEJ.js";
+import { j as StorageApi, n as Bucket } from "./bucket-vc-QRrva.js";
 import { t as ImpersonationOptions } from "./impersonation-YTa9dZUv.js";
 import { i as EventSink } from "./cloud-event-CzZTJkXv.js";
-import { _ as SupportAuthorize, b as TicketSubject, i as AuthorizationHooks } from "./authorization-hooks-D_pwXlBs.js";
+import { b as TicketSubject, i as AuthorizationHooks } from "./authorization-hooks-D_pwXlBs.js";
 import { s as SqlClaims, t as BetterPostgres } from "./pool-CrtT4dg-.js";
+import { n as SupportApi, o as SupportSessions, t as ActiveSupport } from "./support-B4ZBVxt3.js";
 import { SupabaseClient } from "@supabase/supabase-js";
-import { StandardSchemaV1 } from "@standard-schema/spec";
 import { JWTClaims } from "@supabase/server";
 //#region src/auth/snapshot.d.ts
 /**
@@ -169,354 +168,6 @@ interface RequestIdOptions {
   readonly generate?: boolean;
 }
 //#endregion
-//#region src/auth/support.d.ts
-type SupportEndedBy = "admin" | "expired" | "revoked";
-/** A support session: a platform admin viewing the app as `targetUserId`. */
-interface SupportSession {
-  readonly id: string;
-  readonly adminId: string;
-  readonly targetUserId: string;
-  readonly reason: string;
-  /** Writes fail while it is true (`begin read only`). */
-  readonly readOnly: boolean;
-  readonly tenant?: string;
-  readonly startedAt: Temporal.Instant;
-  readonly expiresAt: Temporal.Instant;
-  readonly endedAt?: Temporal.Instant;
-  readonly endedBy?: SupportEndedBy;
-  /** App data, such as a ticket id. */
-  readonly metadata: Readonly<Record<string, unknown>>;
-}
-interface SupportStartInput {
-  readonly adminId: string;
-  /**
-   * The admin's verified claims. The SQL store runs `start_support_session`
-   * with them, so `is_platform()` checks the admin in the database too.
-   */
-  readonly adminClaims: Readonly<Record<string, unknown>>;
-  readonly targetUserId: string;
-  readonly reason: string;
-  readonly ttlSeconds: number;
-  readonly readOnly: boolean;
-  readonly tenant?: string;
-  readonly metadata: Readonly<Record<string, unknown>>;
-  /** The approved request this start uses, when the server found one. */
-  readonly requestId?: string;
-}
-/**
- * A request for a support session that waits for a second admin. A start uses
- * an approved request once; `approvedBy` is never `adminId`.
- */
-interface SupportRequest {
-  readonly id: string;
-  readonly adminId: string;
-  readonly targetUserId: string;
-  readonly reason: string;
-  readonly readOnly: boolean;
-  readonly tenant?: string;
-  readonly metadata: Readonly<Record<string, unknown>>;
-  readonly requestedAt: Temporal.Instant;
-  /** An unapproved or unused request is closed after this. */
-  readonly expiresAt: Temporal.Instant;
-  readonly approvedBy?: string;
-  readonly approvedAt?: Temporal.Instant;
-  /** The session the approval started. */
-  readonly sessionId?: string;
-}
-interface SupportRequestInput {
-  readonly adminId: string;
-  /** The admin's verified claims; the SQL store asks as the admin with them. */
-  readonly adminClaims: Readonly<Record<string, unknown>>;
-  readonly targetUserId: string;
-  readonly reason: string;
-  readonly readOnly: boolean;
-  readonly tenant?: string;
-  readonly metadata: Readonly<Record<string, unknown>>;
-  /**
-   * An approver the server's authorization hook already decided, never the
-   * admin. The SQL store then records the request approved, over the admin
-   * connection.
-   */
-  readonly approvedBy?: string;
-}
-/**
- * Who approves a request: with `claims` the store runs as them and decides
- * eligibility itself.
- */
-interface SupportApprover {
-  readonly id: string;
-  readonly claims?: SupportCallerClaims;
-}
-/** What `approvedRequest` looks up. */
-interface SupportApprovalQuery {
-  readonly adminId: string;
-  readonly targetUserId: string;
-  readonly tenant?: string;
-  readonly readOnly: boolean;
-}
-/** A caller's verified claims, which the store runs a call with. */
-type SupportCallerClaims = Readonly<Record<string, unknown>>;
-interface SupportListFilter {
-  readonly adminId?: string;
-  readonly targetUserId?: string;
-  /** `true`: running sessions only; `false`: ended or expired ones only. */
-  readonly active?: boolean;
-  /** Defaults to 50. */
-  readonly limit?: number;
-}
-/**
- * Where support sessions live. `sqlSupportStore` uses the `impersonation` SQL
- * module; implement this for another store and check it with
- * `testSupportSessionStore` from `better-supabase/testing`.
- */
-interface SupportSessionStore {
-  readonly apiVersion: 1;
-  readonly name: string;
-  /**
-   * Starts a session and ends the admin's previous one. Rejects when the store
-   * refuses.
-   */
-  start(input: SupportStartInput): Promise<SupportSession>;
-  /**
-   * The admin's session while it is running; `undefined` once ended or expired.
-   * With the admin's `claims`, the store also checks that the admin may still
-   * start sessions.
-   */
-  get(sessionId: string, adminId: string, claims?: SupportCallerClaims): Promise<SupportSession | undefined>;
-  /**
-   * `false` when it was not running. With `claims`, it runs as that caller: the
-   * session's admin, or staff with the revoke permission.
-   */
-  end(sessionId: string, endedBy: SupportEndedBy, claims?: SupportCallerClaims): Promise<boolean>;
-  /** With `claims`, only what that caller may view. */
-  list(filter?: SupportListFilter, claims?: SupportCallerClaims): Promise<readonly SupportSession[]>;
-  /** The claims `targetUserId` would get, when the store can build them. */
-  claims?(targetUserId: string): Promise<Readonly<Record<string, unknown>>>;
-  /**
-   * Ends every running session past its expiry with `endedBy: "expired"` and
-   * returns them. Optional; `support.expire()` fails without it.
-   */
-  expire?(): Promise<readonly SupportSession[]>;
-  /**
-   * The store with `namespace` for its time values, unless it was given one
-   * itself. Optional; `createServer` calls it with the definition's
-   * `temporal`.
-   */
-  withTemporal?(namespace: typeof Temporal): SupportSessionStore;
-  /**
-   * Records a request for a session that waits for a second admin. Optional;
-   * without it and the two methods below, starts that need an approval are
-   * refused.
-   */
-  request?(input: SupportRequestInput): Promise<SupportRequest>;
-  /** A request by id, or `undefined`. */
-  getRequest?(requestId: string): Promise<SupportRequest | undefined>;
-  /** Approves a request. Rejects when the approver is the requester. */
-  approve?(requestId: string, approver: SupportApprover): Promise<SupportRequest>;
-  /** The approved, unused, unexpired request a start would use, or `undefined`. */
-  approvedRequest?(query: SupportApprovalQuery): Promise<SupportRequest | undefined>;
-}
-interface SqlSupportStoreOptions {
-  /** `blocks.impersonation.schema`. Defaults to `better_supabase`. */
-  readonly schema?: string;
-  /**
-   * The Temporal namespace for the sessions' time values, for runtimes without
-   * a global one. Defaults to the one `createServer` passes from the
-   * definition, then the provided or global Temporal.
-   */
-  readonly temporal?: typeof Temporal;
-}
-/**
- * Support sessions in the `impersonation` SQL module. `start` runs as the
- * admin, so the module's `is_platform()` gate applies; the reads run on the
- * admin connection.
- */
-declare function sqlSupportStore(postgres: Pick<BetterPostgres, "admin" | "asUser">, options?: SqlSupportStoreOptions): SupportSessionStore;
-/**
- * The claims a support session runs with: the target's, plus `act` naming the
- * admin, the reason and the session (the audit module records all three),
- * marked `kind: "support"` so `actorOf` never reads it as an OAuth client.
- * `role` falls back to `authenticated`; the admin's claims never leak in.
- */
-declare function supportClaims(session: Pick<SupportSession, "id" | "adminId" | "targetUserId" | "reason" | "readOnly">, target: Readonly<Record<string, unknown>>): Record<string, unknown>;
-//#endregion
-//#region src/auth/support-cookie.d.ts
-/** The cookie that carries the support session id. */
-declare const SUPPORT_COOKIE = "bsb-support";
-interface SupportCookieOptions {
-  /** Defaults to `bsb-support`. */
-  readonly name?: string;
-  /** Defaults to `/`. */
-  readonly path?: string;
-  /** Defaults to true; set false for plain-HTTP local development. */
-  readonly secure?: boolean;
-}
-/**
- * `Set-Cookie` for a session: HttpOnly, SameSite=Lax, gone when the session
- * expires.
- */
-declare function supportCookie(session: Pick<SupportSession, "id" | "expiresAt">, options?: SupportCookieOptions, now?: number): string;
-/** `Set-Cookie` that removes the support cookie. */
-declare function clearSupportCookie(options?: SupportCookieOptions): string;
-/** The support session id in a `Cookie` header, or `undefined`. */
-declare function supportCookieValue(cookieHeader: string | null, name?: string): string | undefined;
-//#endregion
-//#region src/server/support.d.ts
-interface SupportPolicy {
-  /** Seconds a session lasts. Defaults to 1800 (30 minutes). */
-  readonly ttl?: number;
-  /** The longest `ttl` a start may ask for. Defaults to 14400 (4 hours). */
-  readonly maxTtl?: number;
-  /** Defaults to true. */
-  readonly requireReason?: boolean;
-  /**
-   * `always` (the default): every session is read-only. `default`: read-only
-   * unless the start passes `readOnly: false`.
-   */
-  readonly readOnly?: "always" | "default";
-  /**
-   * `distinct` (the default): a start needs a request that another admin
-   * approved (`support.request`, then `support.approve`), or an `authorize`
-   * decision of `{ approvedBy }` naming someone else. `none`: no second admin.
-   * Set `blocks.impersonation.options.approval` to the same value, because the
-   * SQL store checks it again.
-   */
-  readonly approval?: "distinct" | "none";
-}
-interface SupportOptions {
-  readonly store: SupportSessionStore;
-  /**
-   * Whether `admin` may view the app as the target. Without it, the
-   * authorization hooks' `support.authorize` decides, and without those every
-   * start is refused (`SUPPORT_FORBIDDEN`). A throw or rejection counts as a
-   * deny. `true` still needs a second admin under `policy.approval:
-   * 'distinct'`; `{ approvedBy }` names that admin.
-   *
-   * `'store'` hands the decision to the store alone: the SQL store checks
-   * `is_platform(blocks['impersonation'].permissions.start)` and nothing else,
-   * so use it only when that permission is the whole rule.
-   */
-  readonly authorize?: SupportAuthorize | "store";
-  /**
-   * The claims the target gets. Defaults to `store.claims` (the SQL store runs
-   * your custom access token hook), then `{ role: 'authenticated' }`.
-   */
-  readonly claims?: (targetUserId: string) => Readonly<Record<string, unknown>> | Promise<Readonly<Record<string, unknown>>>;
-  readonly policy?: SupportPolicy;
-  readonly cookie?: SupportCookieOptions;
-  /**
-   * Where a request names its support session, for apps that keep it in a
-   * header or their own request store instead of the `bsb-support` cookie.
-   * Defaults to reading the cookie.
-   */
-  readonly sessionId?: (request: Request) => string | undefined;
-}
-interface SupportStartRequest {
-  readonly targetUserId: string;
-  readonly reason?: string;
-  /** Seconds; defaults to `policy.ttl`. */
-  readonly ttl?: number;
-  /** Honoured only with `policy.readOnly: 'default'`. */
-  readonly readOnly?: boolean;
-  readonly tenant?: string;
-  readonly metadata?: Readonly<Record<string, unknown>>;
-}
-/** Options for `support.expireRoute`. */
-interface SupportExpireRouteOptions {
-  /** The bearer token the cron caller sends, such as `process.env.CRON_SECRET`. */
-  readonly secret: string | undefined;
-  /** Rewrites the Problem Details bodies of the route's errors. */
-  readonly problem?: ProblemFormat;
-}
-/** A running support session, as the request that carries its cookie sees it. */
-interface ActiveSupport {
-  readonly session: SupportSession;
-  /** The admin behind the session, from their own verified token. */
-  readonly admin: {
-    readonly id: string;
-    readonly email?: string;
-  };
-  /** The target's claims plus `act`, which repositories run with. */
-  readonly claims: Readonly<Record<string, unknown>>;
-}
-/** `bsb.support`: start, stop and inspect support sessions. */
-interface SupportApi {
-  /**
-   * Starts a session for a signed-in admin and returns it with the `Set-Cookie`
-   * value that switches the admin's next requests to the target.
-   */
-  start(admin: AuthState, request: SupportStartRequest): AsyncResult<{
-    readonly session: SupportSession;
-    readonly cookie: string;
-  }>;
-  /**
-   * Asks for a session that a second admin approves with `approve`; the policy
-   * checks of `start` apply. `ttl` is not stored: `start` passes it.
-   */
-  request(admin: AuthState, request: SupportStartRequest): AsyncResult<SupportRequest>;
-  /**
-   * Approves a request as `approver`, who is never the admin who asked. With
-   * the hooks' `approverOf`, it decides who may approve; otherwise the store
-   * does (the SQL store: the provider's `isApprover`, else the start
-   * permission).
-   */
-  approve(approver: AuthState, requestId: string): AsyncResult<SupportRequest>;
-  /**
-   * Ends the admin's own session and returns the `Set-Cookie` that clears the
-   * cookie.
-   */
-  stop(admin: AuthState, sessionId: string): AsyncResult<{
-    readonly ended: boolean;
-    readonly cookie: string;
-  }>;
-  /**
-   * Ends a session as `caller`: the SQL store allows the session's admin and
-   * staff with the revoke permission.
-   */
-  revoke(caller: AuthState, sessionId: string): AsyncResult<boolean>;
-  /** The running session the request names (`sessionIdOf`) for `auth`, if any. */
-  current(request: Request, auth: AuthState): Promise<ActiveSupport | undefined>;
-  /**
-   * The running session `sessionId` for the admin in `auth`, if any. Use it
-   * when the app keeps the session id in its own request context; pass the
-   * result to `contextFor(auth, { support })` or `dbFor(auth, context, {
-   * support })`.
-   */
-  resolve(sessionId: string, auth: AuthState): Promise<ActiveSupport | undefined>;
-  /** The sessions `caller` may view (the SQL store checks the view permission). */
-  list(caller: AuthState, filter?: SupportListFilter): AsyncResult<readonly SupportSession[]>;
-  /**
-   * Ends every session past its expiry through the store and emits
-   * `support.ended` with `endedBy: "expired"` for each; the SQL store runs over
-   * `postgres.admin`. Returns the sessions it ended.
-   */
-  expire(): AsyncResult<readonly SupportSession[]>;
-  /**
-   * A `GET` or `POST` handler for a cron caller that runs `expire()` and
-   * answers `{ expired }`, the number of sessions it ended.
-   */
-  expireRoute(options: SupportExpireRouteOptions): (request: Request) => Promise<Response>;
-  /** The support session id a request names: `options.sessionId`, or the cookie. */
-  sessionIdOf(request: Request): string | undefined;
-  /** `Set-Cookie` that clears the support cookie. */
-  clearCookie(): string;
-}
-/** `ServerOptions.support`, from `supportSessions(options)`. */
-interface SupportSessions {
-  readonly options: SupportOptions;
-  /**
-   * Builds `bsb.support`; `createServer` calls it once, with the definition's
-   * `temporal`, which goes on to the store's `withTemporal`, and the server's
-   * authorization hooks.
-   */
-  readonly create: (events: EventHub, claimsSchema: StandardSchemaV1 | undefined, temporal?: typeof Temporal, authorization?: AuthorizationHooks) => SupportApi;
-}
-/**
- * Support sessions for `createServer(betterSupabase, { support })`. Apps that
- * never import it don't bundle the support code.
- */
-declare function supportSessions(options: SupportOptions): SupportSessions;
-//#endregion
 //#region src/server/suspend-account.d.ts
 interface EndSessionsResult {
   readonly userId: string;
@@ -943,4 +594,4 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
 }
 type ServerKeys = keyof BetterServer<AnyModels, AnyFunctions, unknown>;
 //#endregion
-export { SessionMemoStats as $, supportCookieValue as A, SupportSessionStore as B, SupportSessions as C, SupportCookieOptions as D, SUPPORT_COOKIE as E, SupportEndedBy as F, PRIMARY_COOKIE as G, sqlSupportStore as H, SupportListFilter as I, DeleteAccountOptions as J, ReplicaState as K, SupportRequest as L, SupportApprovalQuery as M, SupportApprover as N, clearSupportCookie as O, SupportCallerClaims as P, SessionMemoOptions as Q, SupportRequestInput as R, SupportPolicy as S, supportSessions as T, supportClaims as U, SupportStartInput as V, RequestIdOptions as W, deleteAccount as X, DeleteAccountResult as Y, SessionMemo as Z, suspendAccount as _, ServerContext as a, sessionMemo as at, SupportExpireRouteOptions as b, ServerOptions as c, EndSessionsResult as d, SessionSnapshot as et, LastSignIn as f, lastSignIns as g, endSessions as h, ForContextOptions as i, sessionCacheKey as it, SqlSupportStoreOptions as j, supportCookie as k, SharedServer as l, SuspendAccountResult as m, BetterServer as n, isSessionSnapshot as nt, ServerDbOptions as o, snapshotOf as ot, SuspendAccountOptions as p, LiteDriver as q, ContextOptions as r, issuedAtOf as rt, ServerKeys as s, AdminDb as t, authzVersionOf as tt, TENANT_HEADER as u, ActiveSupport as v, SupportStartRequest as w, SupportOptions as x, SupportApi as y, SupportSession as z };
+export { isSessionSnapshot as A, DeleteAccountResult as C, SessionMemoStats as D, SessionMemoOptions as E, sessionCacheKey as M, sessionMemo as N, SessionSnapshot as O, snapshotOf as P, DeleteAccountOptions as S, SessionMemo as T, suspendAccount as _, ServerContext as a, ReplicaState as b, ServerOptions as c, EndSessionsResult as d, LastSignIn as f, lastSignIns as g, endSessions as h, ForContextOptions as i, issuedAtOf as j, authzVersionOf as k, SharedServer as l, SuspendAccountResult as m, BetterServer as n, ServerDbOptions as o, SuspendAccountOptions as p, ContextOptions as r, ServerKeys as s, AdminDb as t, TENANT_HEADER as u, RequestIdOptions as v, deleteAccount as w, LiteDriver as x, PRIMARY_COOKIE as y };

package/dist/{session-CfBCJGgc.d.ts → session-DWmFv3vB.d.ts}

@@ -1,7 +1,8 @@
 import { O as AnyFunctions, k as AnyModels } from "./types-DFdg_4yN.js";
 import { n as AuthOutageEvent, o as EventHub } from "./events-vcqenSYU.js";
 import { g as SessionEncoding, o as ResolvePhase, p as CookieScope, r as AuthState, t as AuthResolution } from "./resolve-CXX6DHv3.js";
-import { a as ServerContext, r as ContextOptions, v as ActiveSupport } from "./server-types-7QPzW2bF.js";
+import { a as ServerContext, r as ContextOptions } from "./server-types-CK8mUIUT.js";
+import { t as ActiveSupport } from "./support-B4ZBVxt3.js";
 import { d as RefreshPolicy } from "./respond-Dn1_YhC1.js";
 import { SingleKeyEntry } from "@supabase/middleware";
 //#region src/server/entries/core.d.ts

package/dist/session-status-qQLm7jzh.d.ts

@@ -0,0 +1,82 @@
+import { r as AuthState, t as AuthResolution } from "./resolve-CXX6DHv3.js";
+import { t as ActiveSupport } from "./support-B4ZBVxt3.js";
+//#region src/server/session-status.d.ts
+/**
+ * `active`: the session is valid. `expired`: the cookie's token expired and the
+ * route may not refresh it; the next navigation through the proxy does. `ended`
+ * and `banned`: Auth ended the session or banned the user, and the cookies are
+ * cleared. `signed_out`: no user session.
+ */
+type SessionWatchStatus = "active" | "expired" | "ended" | "banned" | "signed_out";
+/** The JSON `sessionStatusRoute` answers with. */
+interface SessionStatusBody {
+  readonly status: SessionWatchStatus;
+  /** The signed-in user (the admin in a support session). */
+  readonly userId: string | null;
+  /**
+   * SHA-256 (hex) of the claims that decide access and of the support session,
+   * so a role, tenant or support target change gives a new value. `null` when
+   * there is no active session.
+   */
+  readonly fingerprint: string | null;
+  /** Seconds since epoch, from the token's `exp`. */
+  readonly expiresAt: number | null;
+  /** The running support session, when the admin views the app as a user. */
+  readonly support: {
+    readonly sessionId: string;
+    readonly targetUserId: string;
+    readonly readOnly: boolean;
+  } | null;
+}
+/**
+ * The part of a server `sessionStatusRoute` uses: `createServer`, `createNext`
+ * and the other adapters fit.
+ */
+interface SessionStatusServer {
+  resolve(request: Request, options?: {
+    readonly refresh?: boolean;
+    readonly checkSession?: boolean;
+  }): Promise<AuthResolution>;
+  readonly support: {
+    current(request: Request, auth: AuthState): Promise<ActiveSupport | undefined>;
+  };
+}
+interface SessionStatusRouteOptions {
+  /**
+   * Ask Auth whether the session still exists, one network call per check, so a
+   * revoked session or a ban shows up before the token expires. Defaults to
+   * true.
+   */
+  readonly checkSession?: boolean;
+  /**
+   * Refresh an expiring session cookie and send the new cookies. Defaults to
+   * false: the proxy refreshes, and an expired token answers `expired`.
+   */
+  readonly refresh?: boolean;
+  /**
+   * Claims left out of the fingerprint besides the ones that change on every
+   * refresh (`exp`, `iat`, `nbf`, `jti`).
+   */
+  readonly ignoreClaims?: readonly string[];
+}
+/**
+ * The fingerprint `sessionStatusRoute` reports for a user's claims and support
+ * session: a SHA-256 hex digest that changes when a claim that decides access
+ * changes (role, tenant, memberships, `aal`) or the support target does.
+ */
+declare function claimsFingerprint(claims: Readonly<Record<string, unknown>>, support?: ActiveSupport, ignore?: readonly string[]): Promise<string>;
+/**
+ * A `GET` handler that tells a browser whether its session still holds, for
+ * apps that keep the session in httpOnly cookies and have no browser Supabase
+ * client: `useSessionWatch()` from `better-supabase/next/client` polls it. It
+ * answers `{ status, userId, fingerprint, expiresAt, support }` with
+ * `Cache-Control: no-store`.
+ *
+ * ```ts
+ * // app/api/session-status/route.ts
+ * export const GET = sessionStatusRoute(bsb);
+ * ```
+ */
+declare function sessionStatusRoute(server: SessionStatusServer, options?: SessionStatusRouteOptions): (request: Request) => Promise<Response>;
+//#endregion
+export { claimsFingerprint as a, SessionWatchStatus as i, SessionStatusRouteOptions as n, sessionStatusRoute as o, SessionStatusServer as r, SessionStatusBody as t };

package/dist/{sign-in-BsIaNx2C.js → sign-in-CmPK1AgM.js}

@@ -1,6 +1,6 @@
-import { i as specKey, r as sessionUserId, t as hasAuthModule } from "./auth-module-BEFESDC4.js";
+import { a as specKey, i as sessionUserId, n as hasAuthModule, t as authModuleOf } from "./auth-module-BbmX-N4L.js";
 import { t as clearOnUserChange } from "./user-change-DgWC6RRC.js";
-import { c as liveKey, d as shownCount, f as startBroadcast, i as countSource, m as startLiveQuery, p as startLiveCount, t as NO_COUNT } from "./client-BAEbEA7t.js";
+import { c as liveKey, d as shownCount, f as startBroadcast, i as countSource, m as startLiveQuery, p as startLiveCount, t as NO_COUNT } from "./client-C_mlji5R.js";
 import { useSession } from "./react/session.js";
 import { createContext, createElement, useContext, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
 //#region src/react/context.ts
@@ -18,12 +18,17 @@ const LOADING = {
 };
 /** Provides the better-supabase client to the hooks. */
 function BetterSupabaseProvider(props) {
-	const { client, queryClient } = props;
+	const { client, queryClient, realtime } = props;
 	useEffect(() => queryClient ? clearOnUserChange(queryClient, client.auth) : void 0, [client, queryClient]);
 	const value = useMemo(() => ({
 		client,
-		queryClient
-	}), [client, queryClient]);
+		queryClient,
+		realtime
+	}), [
+		client,
+		queryClient,
+		realtime
+	]);
 	return createElement(ClientContext.Provider, { value }, props.children);
 }
 function useClientContext() {
@@ -84,7 +89,7 @@ function createHooks() {
 */
 function useBroadcast(topic, values, handlers, options) {
 	const context = useContext(ClientContext);
-	const supabase = options?.client ?? context?.client.supabase;
+	const supabase = options?.client ?? context?.realtime ?? context?.client.supabase;
 	if (!supabase) throw new Error("better-supabase: useBroadcast needs <BetterSupabaseProvider client={bsb}> or { client: supabase }");
 	const queryClient = options?.queryClient ?? context?.queryClient;
 	const auth = useBroadcastAuth(options?.client === void 0 ? context?.client : void 0, supabase);
@@ -139,8 +144,9 @@ function useBroadcastAuth(client, supabase) {
 	});
 	useEffect(() => {
 		if (client) return;
-		if (!hasAuthModule(supabase)) return;
-		const { data } = supabase.auth.onAuthStateChange((_event, session) => {
+		const authModule = authModuleOf(supabase);
+		if (!authModule) return;
+		const { data } = authModule.onAuthStateChange((_event, session) => {
 			setPlain({
 				status: session ? "signed-in" : "signed-out",
 				userId: session ? sessionUserId(session) : null
@@ -188,7 +194,7 @@ function useHeldSpec(spec) {
 * ```
 */
 function useLiveQuery(spec, options = {}) {
-	const { client, queryClient } = useClientContext();
+	const { client, queryClient, realtime } = useClientContext();
 	const auth = useAuth();
 	const [status, setStatus] = useState("closed");
 	if (spec && !queryClient) throw new Error("better-supabase: useLiveQuery needs <BetterSupabaseProvider queryClient={...}>");
@@ -209,6 +215,7 @@ function useLiveQuery(spec, options = {}) {
 		joined.current = held.key;
 		return startLiveQuery({
 			client,
+			...realtime ? { realtime } : {},
 			queryClient,
 			spec: held.spec,
 			auth: latest.current.auth,
@@ -218,6 +225,7 @@ function useLiveQuery(spec, options = {}) {
 		});
 	}, [
 		client,
+		realtime,
 		queryClient,
 		held,
 		key
@@ -235,7 +243,7 @@ function useLiveQuery(spec, options = {}) {
 * ```
 */
 function useLiveCount(source, options = {}) {
-	const { client } = useClientContext();
+	const { client, realtime } = useClientContext();
 	const auth = useAuth();
 	const parsed = countSource(source, options);
 	const [state, setState] = useState(NO_COUNT);
@@ -264,6 +272,7 @@ function useLiveCount(source, options = {}) {
 		};
 		return startLiveCount({
 			client,
+			...realtime ? { realtime } : {},
 			spec: held.spec,
 			key: specKey,
 			auth: latest.current.auth,
@@ -283,6 +292,7 @@ function useLiveCount(source, options = {}) {
 		});
 	}, [
 		client,
+		realtime,
 		held.spec,
 		held.key,
 		key,

package/dist/solid/index.d.ts

@@ -1,13 +1,13 @@
 import { b as DbError } from "../result-DZeA5KS6.js";
 import { Ct as Events, D as BlockEventPattern, T as BlockEvent, bt as EventMap, k as BlockEventsMatching } from "../events-vcqenSYU.js";
-import { pt as QuerySpec } from "../define-DFBnQyYg.js";
-import { $ as TemplateValues } from "../bucket-CiNi8sIw.js";
-import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-DNFEFGKI.js";
-import { t as AuthSnapshot } from "../bind-h5jre2K0.js";
+import { pt as QuerySpec } from "../define-C5AcEkEJ.js";
+import { tt as TemplateValues } from "../bucket-vc-QRrva.js";
+import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-CZXHhZye.js";
+import { t as AuthSnapshot } from "../bind-JGCPGUJh.js";
 import { t as AuthSession } from "../view-DyFdMCqg.js";
-import { n as Controller } from "../controller-DyPPMFSw.js";
-import { C as LiveCountSource, D as ProfileOf, E as PresenceTopic, O as UseActionOptions, S as LiveCountHookOptions, T as PresenceHookOptions, _ as ActionResultOf, a as DataRows, b as ClaimsOf, c as DataWrites, d as BlockMutationState, f as BlockQueryActions, g as ActionInputOf, h as BlockRefetchOn, i as DataRow, l as BlockEventSource, m as BlockQueryState, n as DataId, o as DataSource, p as BlockQueryOptions, r as DataListArgs, s as DataState, t as fieldErrorsOf, u as BlockMutationActions, v as ActionState, w as LiveQueryHookOptions, x as ClientLike, y as BroadcastOptions } from "../field-errors-DYtg1mwv.js";
-import { n as BlockOptions } from "../block-env-BrfRvPrj.js";
+import { n as Controller } from "../controller-BW-5Opig.js";
+import { C as LiveCountSource, D as ProfileOf, E as PresenceTopic, O as UseActionOptions, S as LiveCountHookOptions, T as PresenceHookOptions, _ as ActionResultOf, a as DataRows, b as ClaimsOf, c as DataWrites, d as BlockMutationState, f as BlockQueryActions, g as ActionInputOf, h as BlockRefetchOn, i as DataRow, l as BlockEventSource, m as BlockQueryState, n as DataId, o as DataSource, p as BlockQueryOptions, r as DataListArgs, s as DataState, t as fieldErrorsOf, u as BlockMutationActions, v as ActionState, w as LiveQueryHookOptions, x as ClientLike, y as BroadcastOptions } from "../field-errors-Dt86dCKk.js";
+import { n as BlockOptions } from "../block-env-y65GF_px.js";
 import { n as BlockDataOf, r as BlockMethodName, t as BlockArgsOf } from "../block-method-CiVa2G-J.js";
 import { t as SupportView } from "../support-view-BYOgwXsJ.js";
 import { SupabaseClient } from "@supabase/supabase-js";

package/dist/solid/index.js

@@ -1,5 +1,5 @@
 import { t as clearOnUserChange } from "../user-change-DgWC6RRC.js";
-import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-BAEbEA7t.js";
+import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-C_mlji5R.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
 import { c as listenToBlockEvents, d as fieldErrorsOf, i as dataTarget, l as blockEnv, n as createDataOne, o as createBlockMutation, s as createBlockQuery, t as createDataList, u as withEnv } from "../data-hooks-tgF1Ct0F.js";
 import { createComponent, createContext, createEffect, createMemo, createSignal, from, onCleanup, onMount, untrack, useContext } from "solid-js";

package/dist/solid-start/index.d.ts

@@ -1,10 +1,10 @@
 import { O as AnyFunctions, k as AnyModels } from "../types-DFdg_4yN.js";
 import { l as PermissionRef, t as AnyAuthorizer } from "../authorizer-B6X09otb.js";
-import { t as BetterSupabase } from "../define-DFBnQyYg.js";
-import { n as BetterServer } from "../server-types-7QPzW2bF.js";
+import { t as BetterSupabase } from "../define-C5AcEkEJ.js";
+import { n as BetterServer } from "../server-types-CK8mUIUT.js";
 import { a as AuthorizedContext, l as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-DOwKpSkA.js";
 import { t as RefusalRedirects } from "../refusal-CSntB_x8.js";
-import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-h5lP_5yj.js";
+import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-BGdZVyPL.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/solid-start/index.d.ts
 /** The part of a SolidStart `FetchEvent` the integration reads and writes. */

package/dist/spec/index.d.ts

@@ -2,7 +2,7 @@ import { t as DescribedFunction } from "../function-contract-DxFNOmsm.js";
 import { C as ModelWebhook, D as ResourceOperation, E as OperationSource, O as SecurityRequirement, S as ModelTag, T as OAuthFlow, _ as ModelResponseOrRef, a as JsonSchema, b as ModelServer, c as ModelChannelOperation, d as ModelInfo, f as ModelMessage, g as ModelResponse, h as ModelParameter, i as JsonObject, k as TableVerb, l as ModelContent, m as ModelOperation, n as DataApiOperation, o as ModelBody, p as ModelMessageTrait, r as HttpMethod, s as ModelChannel, t as ApiModel, u as ModelExample, v as ModelSecurityProfileRequirement, w as ModelWorkflow, x as ModelStep, y as ModelSecurityScheme } from "../model-hwpvole9.js";
 import { a as ResourcePlan, o as StandardLike, r as ResourceDescription } from "../resource-D8pzB5Qf.js";
 import { t as SPEC_PINS } from "../spec-pins-DIx95afw.js";
-import { A as AnyOpenApiDocument, B as OpenApiSecurityRequirement, C as TopicInput, D as DEFAULT_ERRORS, E as CustomSecurity, F as OpenApi33PreviewDocument, H as RenderedOpenApi, I as OpenApiComponents, L as OpenApiDocument, M as OpenApi30Document, N as OpenApi31Document, O as PROBLEM_SCHEMA, P as OpenApi32Document, R as OpenApiDocuments, S as EventsOptions, T as DataApiOptions, V as OpenApiVersion, _ as WorkflowSource, a as OverlayEngine, b as CLOUD_EVENT_TRAIT, c as defineApi, d as BuiltModel, f as ComponentNameContext, g as RouteSpec, h as ResourceInput, i as OpenApiRenderResult, j as OPENAPI_33_PREVIEW_VERSION, k as SecurityPreset, l as ApiOptions, m as OperationIdContext, n as DefineApiOptions, o as RenderOptions, p as EnrichHooks, r as OpenApiRenderOptions, s as RenderResult, t as Api, u as ApiSource, v as BlockEventSchema, w as topicsFrom, x as CloudEventsInput, y as BlockEventSchemas, z as OpenApiInfo } from "../api-DxAPqMrE.js";
+import { A as AnyOpenApiDocument, B as OpenApiSecurityRequirement, C as TopicInput, D as DEFAULT_ERRORS, E as CustomSecurity, F as OpenApi33PreviewDocument, H as RenderedOpenApi, I as OpenApiComponents, L as OpenApiDocument, M as OpenApi30Document, N as OpenApi31Document, O as PROBLEM_SCHEMA, P as OpenApi32Document, R as OpenApiDocuments, S as EventsOptions, T as DataApiOptions, V as OpenApiVersion, _ as WorkflowSource, a as OverlayEngine, b as CLOUD_EVENT_TRAIT, c as defineApi, d as BuiltModel, f as ComponentNameContext, g as RouteSpec, h as ResourceInput, i as OpenApiRenderResult, j as OPENAPI_33_PREVIEW_VERSION, k as SecurityPreset, l as ApiOptions, m as OperationIdContext, n as DefineApiOptions, o as RenderOptions, p as EnrichHooks, r as OpenApiRenderOptions, s as RenderResult, t as Api, u as ApiSource, v as BlockEventSchema, w as topicsFrom, x as CloudEventsInput, y as BlockEventSchemas, z as OpenApiInfo } from "../api-hHwieEfz.js";
 import { a as FormatVersion, c as SpecDiagnostic, d as defineDocumentFormat, i as DocumentOf, l as VersionOf, n as DiagnosticSeverity, o as LowerContext, r as DocumentFormat, s as RenderedOf, t as AnyDocumentFormat, u as VersionStatus } from "../format-u-65igKI.js";
 //#region src/spec/build.d.ts
 /**