better-supabase 0.2.0 → 0.4.0

package/dist/{resource-BHEWmQJK.js → resource-My_y-Syh.js}

@@ -1,7 +1,7 @@
-import { n as dbError } from "./errors-Bl3rkOzo.js";
-import { i as ok, n as err } from "./result-DWXatkd6.js";
-import { t as validate } from "./standard-FUi3Z3-7.js";
-import { i as respond } from "./respond-DMcbQwfN.js";
+import { n as dbError } from "./errors-L0xK41y_.js";
+import { i as ok, n as err } from "./result-Bj6yt33D.js";
+import { t as validate } from "./standard-BRyBGTtp.js";
+import { s as respond } from "./server-BA75B0mT.js";
 //#region src/server/resource.ts
 const INTEGER = /* @__PURE__ */ new Set([
 	"int2",
@@ -24,24 +24,44 @@ async function readBody(request) {
 	} catch {}
 	return err(dbError("invalid_request", "The request body must be a JSON object"));
 }
-function pageArgs(query, max) {
+function pageArgs(query, max, pagination) {
+	const raw = (name) => {
+		const value = query instanceof URLSearchParams ? query.get(name) : query?.[name];
+		return value === null || value === "" ? void 0 : value;
+	};
 	const read = (name, fallback) => {
-		const raw = query instanceof URLSearchParams ? query.get(name) : query?.[name];
-		if (raw === null || raw === void 0 || raw === "") return fallback;
-		const value = Number(raw);
-		return Number.isSafeInteger(value) && value >= 1 ? value : void 0;
+		const value = raw(name);
+		if (value === void 0) return fallback;
+		const number = Number(value);
+		return Number.isSafeInteger(number) && number >= 1 ? number : void 0;
 	};
-	const page = read("page", 1);
+	const issues = [];
 	const size = read("size", 50);
-	if (page === void 0 || size === void 0 || size > max) return err(dbError("validation", "Invalid page parameters", { issues: [...page === void 0 ? [{
-		message: "Must be a positive integer",
-		path: ["page"]
-	}] : [], ...size === void 0 || size > max ? [{
+	if (size === void 0 || size > max) issues.push({
 		message: `Must be between 1 and ${max}`,
 		path: ["size"]
-	}] : []] }));
-	return ok({
-		page,
+	});
+	const [used, unused] = pagination === "cursor" ? ["after", "page"] : ["page", "after"];
+	if (raw(unused) !== void 0) issues.push({
+		message: `This list pages with \`${used}\``,
+		path: [unused]
+	});
+	const page = read("page", 1);
+	if (pagination === "offset" && page === void 0) issues.push({
+		message: "Must be a positive integer",
+		path: ["page"]
+	});
+	const after = raw("after");
+	if (pagination === "cursor" && after !== void 0 && typeof after !== "string") issues.push({
+		message: "Must be text",
+		path: ["after"]
+	});
+	if (issues.length > 0 || size === void 0) return err(dbError("validation", "Invalid page parameters", { issues }));
+	return pagination === "cursor" ? ok({
+		after: typeof after === "string" ? after : null,
+		size
+	}) : ok({
+		page: page ?? 1,
 		size
 	});
 }
@@ -62,8 +82,8 @@ function notAllowed(allowed) {
 * `createOpenApi`: `GET/POST /<table>` and `GET/PATCH/DELETE /<table>/{id}`.
 * Shared by the HTTP adapters and the MCP table tools.
 */
-function defineResource(sb, table, options = {}) {
-	const meta = sb.meta.tables[table];
+function defineResource(betterSupabase, table, options = {}) {
+	const meta = betterSupabase.meta.tables[table];
 	if (!meta) throw new TypeError(`Unknown table "${table}"`);
 	if (options.list && options.list.table !== table) throw new TypeError(`The list query is for "${options.list.table}", not "${table}"`);
 	const operations = options.operations ?? (meta.kind === "view" ? ["list", "get"] : [
@@ -78,6 +98,7 @@ function defineResource(sb, table, options = {}) {
 	const extra = options.select === void 0 ? {} : { select: options.select };
 	const maxPageSize = options.maxPageSize ?? 200;
 	const list = options.list;
+	const pagination = list ? list.pagination ?? "offset" : options.pagination ?? "offset";
 	const execute = async (db, operation, input = {}) => {
 		const repository = db[table];
 		if (!repository) throw new TypeError(`The db has no "${table}" repository`);
@@ -90,12 +111,12 @@ function defineResource(sb, table, options = {}) {
 					if (!query.ok) return err(dbError("validation", "Invalid list query", { issues: query.issues }));
 					return settled(list.run(db, query.value, extra));
 				}
-				const page = pageArgs(input.query, maxPageSize);
+				const page = pageArgs(input.query, maxPageSize, pagination);
 				if (!page.ok) return page;
 				return settled(repository.paginate({
 					...extra,
 					...page.data,
-					count: "exact"
+					..."page" in page.data ? { count: "exact" } : {}
 				}));
 			}
 			case "get": {
@@ -160,6 +181,7 @@ function defineResource(sb, table, options = {}) {
 		operations,
 		keyParam,
 		list,
+		pagination,
 		maxPageSize,
 		execute,
 		handle(request, db, id, respondOptions = {}) {

package/dist/{respond-Dne1ARSa.d.ts → respond-DgIbdrt8.d.ts}

@@ -1,12 +1,12 @@
-import { n as AnyModels, t as AnyFunctions } from "./types-C83v5SQz.js";
-import { p as DbError, t as AsyncResult } from "./result-CTkCZ6JA.js";
-import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "./define-e3zI4_4g.js";
-import { h as RequestContext } from "./plugin-C4TR9J0Z.js";
+import { n as AnyModels, t as AnyFunctions } from "./types-DONv9SHN.js";
+import { p as DbError, t as AsyncResult } from "./result-CqEsbgYs.js";
+import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "./define-CRS2MRV3.js";
+import { h as RequestContext } from "./plugin-bNhvJwRh.js";
 import { t as BetterSupabaseEnv } from "./index-Dy6kuF0P.js";
-import { r as SqlClaims, t as Postgres } from "./pool-R2m_DkXi.js";
-import { o as ImpersonationOptions, t as Aal } from "./mfa-TVia554c.js";
-import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-CjHILk2w.js";
-import { n as Bucket } from "./index-DuP14VHo.js";
+import { o as SqlClaims, t as BetterPostgres } from "./pool-DFwEQwmN.js";
+import { o as ImpersonationOptions, t as Aal } from "./mfa-C7MNQ1Ob.js";
+import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-BAqQcwMW.js";
+import { n as Bucket } from "./index-528Ugmyp.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 //#region src/server/delete-account.d.ts
 interface DeleteAccountOptions {
@@ -40,7 +40,7 @@ interface ReplicaState {
   readonly pinned: boolean;
   /** This context wrote through its repositories (or called `pin()`). */
   readonly wrote: boolean;
-  /** Sends later reads to the primary, e.g. after a write through `$client` or `$sql`. */
+  /** Sends later reads to the primary, e.g. after a write through `$client` or `ctx.sql`. */
   pin(): void;
 }
 //#endregion
@@ -49,8 +49,14 @@ interface ServerOptions {
   /** Defaults to `loadEnv()`. */
   readonly env?: BetterSupabaseEnv;
   /** Enables `ctx.sql` and `actingAs()`. */
-  readonly postgres?: Postgres;
+  readonly postgres?: BetterPostgres;
   readonly auth?: Omit<ResolveAuthOptions, "env">;
+  /**
+   * Fetch the JWKS when the server is created, so the first request verifies
+   * its token without waiting for it. Applies when `env.jwksUrl` is set and
+   * `auth.jwks` is not. Defaults to true, except under `NODE_ENV=test`.
+   */
+  readonly prefetchJwks?: boolean;
   /**
    * Extra headers on the caller's PostgREST requests, readable in Postgres as
    * `current_setting('request.headers')` (channel, request id, client IP for audit).
@@ -98,6 +104,11 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
    * cookie session only with `refresh: true`; send `ctx.resolution.apply(response)`.
    */
   context(request: Request, options?: ContextOptions): Promise<ServerContext<M, F, E, C, P>>;
+  /**
+   * The context for a resolution from `resolve(request)`, so one resolution
+   * can back several contexts without verifying the token again.
+   */
+  contextFromResolution(resolution: AuthResolution<C, P>, request: Request, options?: Omit<ContextOptions, "refresh">): ServerContext<M, F, E, C, P>;
   /** The context for an auth state resolved elsewhere (the proxy, a queue message). */
   contextFor(auth: AuthState<C, P>, options?: ContextOptions): ServerContext<M, F, E, C, P>;
   /** A stateless supabase-js client for an auth state, optionally with extra request headers. */
@@ -121,9 +132,9 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
 }
 /**
  * Server-side entry point for APIs, jobs, MCP servers and framework
- * adapters. Holds the secrets; `sb` stays isomorphic.
+ * adapters. Holds the secrets; `betterSupabase` stays isomorphic.
  */
-declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(sb: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
+declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
 //#endregion
 //#region src/server/respond.d.ts
 type AuthKind = AuthState["kind"];
@@ -135,9 +146,23 @@ interface GuardOptions {
    * `required: 'aal2'` until the user verifies a second factor.
    */
   readonly aal?: Aal;
+  /**
+   * OAuth scopes a delegated token (an OAuth client or an `act` chain) needs.
+   * A missing one answers 403 with `error="insufficient_scope"`. The user's
+   * own session is not limited by scopes.
+   */
+  readonly scopes?: readonly string[];
+}
+/** Guard options for middleware and fetch handlers that resolve the caller themselves. */
+interface MiddlewareOptions extends GuardOptions {
+  /**
+   * Refresh an expired cookie session and send the new cookies. Only for
+   * routes browsers call with cookies; bearer tokens never refresh.
+   */
+  readonly refresh?: boolean;
 }
 /** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
-declare function guard(auth: AuthState, allow?: GuardOptions["allow"], aal?: Aal): DbError | undefined;
+declare function guard(auth: AuthState, allow?: GuardOptions["allow"], aal?: Aal, scopes?: readonly string[]): DbError | undefined;
 declare function isResult(value: unknown): value is {
   ok: boolean;
   data: unknown;
@@ -166,4 +191,4 @@ interface RespondOptions {
 /** A handler's value as a response: `Response` as is, data as JSON, errors as Problem Details. */
 declare function respond(run: () => unknown, options?: RespondOptions): Promise<Response>;
 //#endregion
-export { DeleteAccountResult as _, guard as a, settle as c, ServerContext as d, ServerOptions as f, DeleteAccountOptions as g, ReplicaState as h, Settled as i, BetterServer as l, PRIMARY_COOKIE as m, GuardOptions as n, isResult as o, createServer as p, RespondOptions as r, respond as s, AuthKind as t, ContextOptions as u };
+export { DeleteAccountOptions as _, Settled as a, respond as c, ContextOptions as d, ServerContext as f, ReplicaState as g, PRIMARY_COOKIE as h, RespondOptions as i, settle as l, createServer as m, GuardOptions as n, guard as o, ServerOptions as p, MiddlewareOptions as r, isResult as s, AuthKind as t, BetterServer as u, DeleteAccountResult as v };

package/dist/{result-DWXatkd6.js → result-Bj6yt33D.js}

@@ -1,4 +1,4 @@
-import { n as dbError, r as dbErrorOf, t as DbException } from "./errors-Bl3rkOzo.js";
+import { n as dbError, r as dbErrorOf, t as DbException } from "./errors-L0xK41y_.js";
 //#region src/core/result.ts
 const throwMappers = /* @__PURE__ */ new WeakMap();
 function inherit(from, next) {
@@ -49,7 +49,7 @@ var AsyncResult = class AsyncResult {
 	/**
 	* Resolves with the data, or rejects with a `DbException`. Pass `factory`
 	* to throw your own error instead, e.g. an HTTP error for your framework;
-	* without it, the mapper from `sb.mapError()` applies when one is set.
+	* without it, the mapper from `betterSupabase.mapError()` applies when one is set.
 	*/
 	async orThrow(factory) {
 		const result = await this.#promise;

package/dist/{result-CTkCZ6JA.d.ts → result-CqEsbgYs.d.ts}

@@ -7,9 +7,14 @@
 interface DbErrorKinds {
   not_found: Record<never, never>;
   unauthorized: Record<never, never>;
-  /** `required`: the assurance level the route needs, when a second factor is missing. */
+  /**
+   * `required`: the assurance level the route needs, when a second factor is
+   * missing. `scopes`: the OAuth scopes the route needs, when a delegated
+   * token lacks one (`INSUFFICIENT_SCOPE`).
+   */
   forbidden: {
     required?: "aal1" | "aal2";
+    scopes?: readonly string[];
   };
   conflict: {
     constraint?: string;
@@ -119,7 +124,7 @@ type ErrorMapper = (raw: RawDbError, fallback: DbError) => DbError | undefined;
 declare function mapDbError(raw: RawDbError, mappers?: readonly ErrorMapper[]): DbError;
 //#endregion
 //#region src/core/result.d.ts
-/** Turns a `DbError` into the error `.orThrow()` throws; set with `sb.mapError()`. */
+/** Turns a `DbError` into the error `.orThrow()` throws; set with `betterSupabase.mapError()`. */
 type ThrowMapper = (error: DbError) => unknown;
 type Ok<T> = {
   readonly ok: true;
@@ -148,7 +153,7 @@ declare class AsyncResult<T> implements PromiseLike<Result<T>> {
   /**
    * Resolves with the data, or rejects with a `DbException`. Pass `factory`
    * to throw your own error instead, e.g. an HTTP error for your framework;
-   * without it, the mapper from `sb.mapError()` applies when one is set.
+   * without it, the mapper from `betterSupabase.mapError()` applies when one is set.
    */
   orThrow(factory?: (error: DbError) => unknown): Promise<T>;
   /** Resolves with the data, or `fallback` when the result is an error. */
@@ -158,7 +163,7 @@ declare class AsyncResult<T> implements PromiseLike<Result<T>> {
   andThen<U>(fn: (data: T) => PromiseLike<Result<U>>): AsyncResult<U>;
 }
 /** What `toBetterResult` returns: the `status`/`value`/`error` fields every better-result value has. */
-type BetterResultShape<T, E> = {
+type BetterResultValue<T, E> = {
   readonly status: "ok";
   readonly value: T;
 } | {
@@ -173,7 +178,7 @@ interface BetterResultApi<T, E> {
 /**
  * Builds a better-result value with the `Result` namespace you pass, so
  * better-result stays your dependency. Errors go through `mapError`, or, for a
- * result from a `db` of `sb.mapError(fn)`, through `fn` (typed `unknown`).
+ * result from a `db` of `betterSupabase.mapError(fn)`, through `fn` (typed `unknown`).
  * The value is a real `Ok`/`Err`: cast it (`as Result<T, E>`) for its
  * methods in types; the cast itself is not checked against `T`.
  *
@@ -182,17 +187,17 @@ interface BetterResultApi<T, E> {
  * const customer = toBetterResult(await db.customers.findById(id), Result, toAppError);
  * ```
  */
-declare function toBetterResult<T, E>(result: Result<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): BetterResultShape<T, E>;
-declare function toBetterResult<T>(result: Result<T>, api: BetterResultApi<T, DbError>): BetterResultShape<T, DbError>;
-declare function toBetterResult<T, E>(result: AsyncResult<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): Promise<BetterResultShape<T, E>>;
-declare function toBetterResult<T>(result: AsyncResult<T>, api: BetterResultApi<T, unknown>): Promise<BetterResultShape<T, unknown>>;
+declare function toBetterResult<T, E>(result: Result<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): BetterResultValue<T, E>;
+declare function toBetterResult<T>(result: Result<T>, api: BetterResultApi<T, DbError>): BetterResultValue<T, DbError>;
+declare function toBetterResult<T, E>(result: AsyncResult<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): Promise<BetterResultValue<T, E>>;
+declare function toBetterResult<T>(result: AsyncResult<T>, api: BetterResultApi<T, unknown>): Promise<BetterResultValue<T, unknown>>;
 /**
  * Converts a better-result value back into a `Result`, by its `status`
  * field, so it works across better-result versions. A `DbError`, or an
  * error whose `cause` is one, is kept; others go through `mapError`
  * (default `toDbError`).
  */
-declare function fromBetterResult<T>(result: BetterResultShape<T, unknown>, mapError?: (error: unknown) => DbError): Result<T>;
+declare function fromBetterResult<T>(result: BetterResultValue<T, unknown>, mapError?: (error: unknown) => DbError): Result<T>;
 declare function toDbError(cause: unknown): DbError;
 //#endregion
-export { isConflict as C, statusOf as D, mapDbError as E, isCheck as S, isForeignKey as T, DbException as _, Ok as a, ValidationIssue as b, err as c, toBetterResult as d, toDbError as f, DbErrorOf as g, DbErrorKinds as h, Err as i, fromBetterResult as l, DbErrorKind as m, BetterResultApi as n, Result as o, DbError as p, BetterResultShape as r, ThrowMapper as s, AsyncResult as t, ok as u, ErrorMapper as v, isDbError as w, dbError as x, RawDbError as y };
+export { isConflict as C, statusOf as D, mapDbError as E, isCheck as S, isForeignKey as T, DbException as _, Ok as a, ValidationIssue as b, err as c, toBetterResult as d, toDbError as f, DbErrorOf as g, DbErrorKinds as h, Err as i, fromBetterResult as l, DbErrorKind as m, BetterResultApi as n, Result as o, DbError as p, BetterResultValue as r, ThrowMapper as s, AsyncResult as t, ok as u, ErrorMapper as v, isDbError as w, dbError as x, RawDbError as y };

package/dist/server/index.d.ts

@@ -1,12 +1,14 @@
-import { n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
-import { t as BetterSupabase, y as Db } from "../define-e3zI4_4g.js";
-import { h as RequestContext } from "../plugin-C4TR9J0Z.js";
-import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-TVia554c.js";
-import { _ as readSession, a as ResolveAuthOptions, b as writeSession, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as StoredSession, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, y as sessionCookieName } from "../resolve-CjHILk2w.js";
-import { _ as DeleteAccountResult, a as guard, c as settle, d as ServerContext, f as ServerOptions, g as DeleteAccountOptions, h as ReplicaState, i as Settled, l as BetterServer, m as PRIMARY_COOKIE, n as GuardOptions, o as isResult, p as createServer, r as RespondOptions, s as respond, t as AuthKind, u as ContextOptions } from "../respond-Dne1ARSa.js";
-import { a as defineResource, i as ResourceRouteOptions, n as ResourceInput, r as ResourceList, t as ResourceHandler } from "../resource-CgZa3YG_.js";
-import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-DlgB0lYl.js";
-import { n as RefreshOutcome, r as refreshSession } from "../index-CG69s15v.js";
+import { n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { p as DbError } from "../result-CqEsbgYs.js";
+import { t as BetterSupabase, y as Db } from "../define-CRS2MRV3.js";
+import { h as RequestContext } from "../plugin-bNhvJwRh.js";
+import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-C7MNQ1Ob.js";
+import { _ as readSession, a as ResolveAuthOptions, b as writeSession, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as StoredSession, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, y as sessionCookieName } from "../resolve-BAqQcwMW.js";
+import { _ as DeleteAccountOptions, a as Settled, c as respond, d as ContextOptions, f as ServerContext, g as ReplicaState, h as PRIMARY_COOKIE, i as RespondOptions, l as settle, m as createServer, n as GuardOptions, o as guard, p as ServerOptions, r as MiddlewareOptions, s as isResult, t as AuthKind, u as BetterServer, v as DeleteAccountResult } from "../respond-DgIbdrt8.js";
+import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-BJcaIfxi.js";
+import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-U8UEKccv.js";
+import { a as SessionDelegation, i as SessionActor, n as toSession, r as ActClaim, t as AuthSession } from "../view-B64o81wp.js";
+import { n as RefreshOutcome, r as refreshSession } from "../refresh-BwYkyNOQ.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
@@ -25,18 +27,41 @@ export declare function contextFromSupabase(ctx: SupabaseAuthContext): RequestCo
  * `ctx.supabase` (the caller-scoped client from `withSupabase`).
  *
  * ```ts
- * pipeline([withSupabase({ auth: 'user' }), withBetterSupabase(sb)()], (req, ctx) => ...)
+ * pipeline([withSupabase({ auth: 'user' }), withBetterSupabase(betterSupabase)()], (req, ctx) => ...)
  * ```
  */
-export declare function withBetterSupabase<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>): Middleware<"db", void, SupabaseAuthContext & {
+export declare function withBetterSupabase<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>): Middleware<"db", void, SupabaseAuthContext & {
   readonly supabase: SupabaseClient;
 }, Db<M, F, E, SupabaseClient>>;
 /**
  * Entry contributing `ctx.sql`: repositories over `ctx.postgres` from
  * `withPostgresClient`, which runs each query as the caller with RLS.
  */
-export declare function withBetterPostgres<M extends AnyModels, D, F extends AnyFunctions, E>(sb: BetterSupabase<M, D, F, E>): Middleware<"sql", void, SupabaseAuthContext & {
+export declare function withBetterPostgres<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>): Middleware<"sql", void, SupabaseAuthContext & {
   readonly postgres: PostgresApi;
 }, Db<M, F, E, undefined>>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthState, type BetterServer, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type GuardOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourceRouteOptions, type RespondOptions, type ServerContext, type ServerOptions, type Settled, type StoredSession, type SupabaseAuthContext, aalOf, amrOf, authContext, checkAal, clientIp, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, writeSession };
+//#region src/auth/revocation.d.ts
+/** A client that can read `auth.sessions`, such as `createPostgres().admin`. */
+interface SessionLookup {
+  queryRaw<T = Record<string, unknown>>(text: string, params?: unknown[]): Promise<T[]>;
+}
+/**
+ * `undefined` when the user token's session still exists in `auth.sessions`;
+ * otherwise an `unauthorized` error with code `SESSION_REVOKED`. A verified
+ * access token stays valid until it expires, even after sign-out; call this
+ * before sensitive actions (deleting the account, changing the email) to
+ * reject tokens of ended sessions. It costs one query, so nothing calls it
+ * by default. Non-user callers pass: `guard` decides about them.
+ */
+export declare function checkSession(sql: SessionLookup, auth: {
+  readonly kind: "user";
+  readonly claims: {
+    readonly sub?: unknown;
+    readonly session_id?: unknown;
+  };
+} | {
+  readonly kind: string;
+}): Promise<DbError | undefined>;
+//#endregion
+export { AUTH_CACHE_HEADERS, type Aal, type ActClaim, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type BetterServer, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type GuardOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, type ServerContext, type ServerOptions, type SessionActor, type SessionDelegation, type SessionLookup, type Settled, type StoredSession, type SupabaseAuthContext, aalOf, amrOf, authContext, checkAal, clientIp, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, toSession, writeSession };

package/dist/server/index.js

@@ -1,8 +1,10 @@
-import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-BTkTtRV9.js";
-import { a as settle, i as respond, n as guard, o as createServer, r as isResult, u as PRIMARY_COOKIE } from "../respond-DMcbQwfN.js";
-import { a as clientIp, f as sessionCookieName, g as impersonatorOf, i as authContext, m as refreshSession, n as amrOf, o as resolveAuth, p as writeSession, r as checkAal, s as AUTH_CACHE_HEADERS, t as aalOf, u as readSession } from "../mfa-CpLfJSde.js";
-import { n as postgresExecutor } from "../executor-DeppvirK.js";
-import { t as defineResource } from "../resource-BHEWmQJK.js";
+import { n as dbError } from "../errors-L0xK41y_.js";
+import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-BihjPR0t.js";
+import { a as guard, c as settle, o as isResult, s as respond, t as createServer, u as PRIMARY_COOKIE } from "../server-BA75B0mT.js";
+import { a as clientIp, c as AUTH_CACHE_HEADERS, d as readSession, h as refreshSession, i as authContext, m as writeSession, n as amrOf, p as sessionCookieName, r as checkAal, s as resolveAuth, t as aalOf, y as impersonatorOf } from "../mfa-byfjruR9.js";
+import { n as postgresExecutor } from "../executor-CVt6dD0B.js";
+import { t as toSession } from "../view-BrJI2LKp.js";
+import { t as defineResource } from "../resource-My_y-Syh.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/server/middleware.ts
 /** Repository context from a `@supabase/server` context. */
@@ -14,8 +16,8 @@ function contextFromSupabase(ctx) {
 				actor: {
 					id: ctx.userClaims.id,
 					kind: "user",
-					...ctx.userClaims.role !== void 0 ? { role: ctx.userClaims.role } : {},
-					...ctx.userClaims.email !== void 0 ? { email: ctx.userClaims.email } : {}
+					...ctx.userClaims.role === void 0 ? {} : { role: ctx.userClaims.role },
+					...ctx.userClaims.email === void 0 ? {} : { email: ctx.userClaims.email }
 				},
 				claims: ctx.jwtClaims ?? {}
 			};
@@ -29,7 +31,10 @@ function contextFromSupabase(ctx) {
 		};
 		case "publishable":
 		case "none": break;
-		default: return ctx.authMode;
+		default: {
+			const unknown = ctx.authMode;
+			throw new TypeError(`contextFromSupabase: unknown auth mode "${String(unknown)}"`);
+		}
 	}
 	return {
 		actor: {
@@ -45,24 +50,48 @@ function contextFromSupabase(ctx) {
 * `ctx.supabase` (the caller-scoped client from `withSupabase`).
 *
 * ```ts
-* pipeline([withSupabase({ auth: 'user' }), withBetterSupabase(sb)()], (req, ctx) => ...)
+* pipeline([withSupabase({ auth: 'user' }), withBetterSupabase(betterSupabase)()], (req, ctx) => ...)
 * ```
 */
-function withBetterSupabase(sb) {
+function withBetterSupabase(betterSupabase) {
 	return defineMiddleware({
 		key: "db",
-		run: (_config) => (_req, ctx) => Promise.resolve({ db: sb.connect(ctx.supabase, contextFromSupabase(ctx)) })
+		run: (_config) => (_req, ctx) => Promise.resolve({ db: betterSupabase.connect(ctx.supabase, contextFromSupabase(ctx)) })
 	});
 }
 /**
 * Entry contributing `ctx.sql`: repositories over `ctx.postgres` from
 * `withPostgresClient`, which runs each query as the caller with RLS.
 */
-function withBetterPostgres(sb) {
+function withBetterPostgres(betterSupabase) {
 	return defineMiddleware({
 		key: "sql",
-		run: (_config) => (_req, ctx) => Promise.resolve({ sql: sb.connect(postgresExecutor(ctx.postgres), contextFromSupabase(ctx)) })
+		run: (_config) => (_req, ctx) => Promise.resolve({ sql: betterSupabase.connect(postgresExecutor(ctx.postgres), contextFromSupabase(ctx)) })
 	});
 }
 //#endregion
-export { AUTH_CACHE_HEADERS, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, aalOf, amrOf, authContext, checkAal, clientIp, contextFromSupabase, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, withBetterPostgres, withBetterSupabase, writeSession };
+//#region src/auth/revocation.ts
+const UUID = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
+const ACTIVE = `select exists (
+  select 1 from auth.sessions s
+  where s.id = $1::uuid and s.user_id = $2::uuid
+    and (s.not_after is null or s.not_after > now())
+) as active`;
+/**
+* `undefined` when the user token's session still exists in `auth.sessions`;
+* otherwise an `unauthorized` error with code `SESSION_REVOKED`. A verified
+* access token stays valid until it expires, even after sign-out; call this
+* before sensitive actions (deleting the account, changing the email) to
+* reject tokens of ended sessions. It costs one query, so nothing calls it
+* by default. Non-user callers pass: `guard` decides about them.
+*/
+async function checkSession(sql, auth) {
+	if (auth.kind !== "user" || !("claims" in auth)) return void 0;
+	const { sub, session_id: sessionId } = auth.claims;
+	const revoked = dbError("unauthorized", "This session has ended", { code: "SESSION_REVOKED" });
+	if (typeof sessionId !== "string" || typeof sub !== "string" || !UUID.test(sessionId) || !UUID.test(sub)) return revoked;
+	const [row] = await sql.queryRaw(ACTIVE, [sessionId, sub]);
+	return row?.active === true ? void 0 : revoked;
+}
+//#endregion
+export { AUTH_CACHE_HEADERS, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, aalOf, amrOf, authContext, checkAal, checkSession, clientIp, contextFromSupabase, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, toSession, withBetterPostgres, withBetterSupabase, writeSession };