better-supabase 0.3.0 → 0.5.0

package/dist/server-Csx2sRjg.js

@@ -0,0 +1,655 @@
+import { n as dbError, o as isDbError, r as dbErrorOf } from "./errors-DtwXa6b8.js";
+import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-BKiliPY7.js";
+import { a as postgrestExecutor, n as StatsRecorder } from "./stats-Bqob3WqT.js";
+import { a as problemResponse } from "./problem-BW1KhzSG.js";
+import { r as userContext, t as actClaim } from "./impersonation-VfaGc4Q_.js";
+import { loadEnv } from "./env/index.js";
+import { a as checkAal, b as delegationOf, c as prefetchJwks, l as rememberVerified, o as authContext, t as isAnonymousUser, u as resolveAuth, y as actorOf } from "./view-Bq64ki8-.js";
+import { parseCookieHeader, serializeCookieHeader } from "@supabase/ssr";
+import { createClient } from "@supabase/supabase-js";
+import { PostgrestClient } from "@supabase/postgrest-js";
+//#region src/server/replicas.ts
+/** Cookie holding the epoch ms until which reads stay on the primary. */
+const PRIMARY_COOKIE = "bs-primary-until";
+/** Default time reads stay on the primary after a write. */
+const DEFAULT_PIN_MS = 5e3;
+function replicaState(pinnedUntil = 0, now = Date.now()) {
+	let wrote = false;
+	const inherited = pinnedUntil > now;
+	return {
+		get pinned() {
+			return wrote || inherited;
+		},
+		get wrote() {
+			return wrote;
+		},
+		pin() {
+			wrote = true;
+		}
+	};
+}
+/** `bs-primary-until` from a `cookie` header or parsed cookies, or 0. */
+function pinnedUntil(cookies) {
+	if (!cookies) return 0;
+	const value = (typeof cookies === "string" ? parseCookieHeader(cookies) : cookies).find((cookie) => cookie.name === PRIMARY_COOKIE)?.value;
+	const until = Number(value);
+	return value !== void 0 && Number.isFinite(until) ? until : 0;
+}
+/** Options of the `bs-primary-until` cookie, for frameworks that set cookies themselves. */
+function primaryCookieOptions(pinMs) {
+	return {
+		path: "/",
+		maxAge: Math.max(1, Math.ceil(pinMs / 1e3)),
+		httpOnly: true,
+		sameSite: "lax"
+	};
+}
+/** A `Set-Cookie` value keeping the next requests on the primary for `pinMs`. */
+function primaryCookie(pinMs, now = Date.now()) {
+	return serializeCookieHeader(PRIMARY_COOKIE, String(now + pinMs), primaryCookieOptions(pinMs));
+}
+/**
+* `response` with the `bs-primary-until` cookie when the request wrote, so the
+* caller's next requests read their own writes. A response with immutable
+* headers is copied.
+*/
+function withPrimaryPin(response, replica, pinMs) {
+	if (!replica?.wrote) return response;
+	const cookie = primaryCookie(pinMs);
+	try {
+		response.headers.append("set-cookie", cookie);
+		return response;
+	} catch {
+		const copy = new Response(response.body, response);
+		copy.headers.append("set-cookie", cookie);
+		return copy;
+	}
+}
+/**
+* Reads go to `replica` until the context is pinned; writes, and every read
+* after a successful write, go to `primary`.
+*/
+function routedExecutor(primary, replica, state) {
+	const batch = primary.batch?.bind(primary);
+	const replicaBatch = replica.batch?.bind(replica);
+	return {
+		name: primary.name,
+		...primary.functionSources && replica.functionSources ? { functionSources: true } : {},
+		async execute(op, context) {
+			if (op.kind === "select" && !state.pinned) return replica.execute(op, context);
+			const result = await primary.execute(op, context);
+			if (op.kind !== "select" && result.ok) state.pin();
+			return result;
+		},
+		...primary.rpc ? { async rpc(name, args, context) {
+			if (context.get && !state.pinned && replica.rpc) return replica.rpc(name, args, context);
+			const result = await primary.rpc(name, args, context);
+			if (!context.get && result.ok) state.pin();
+			return result;
+		} } : {},
+		...batch ? { batch: (ops, context) => !state.pinned && replicaBatch ? replicaBatch(ops, context) : batch(ops, context) } : {}
+	};
+}
+//#endregion
+//#region src/server/delete-account.ts
+const REMOVE_BATCH = 1e3;
+/** Maps an `AuthApiError` from `auth.admin.deleteUser` to a `DbError`. */
+function fromAuthError(raw) {
+	if (isDbError(raw)) return raw;
+	const failure = typeof raw === "object" && raw !== null ? raw : {};
+	const message = failure.message ?? "Auth request failed";
+	const base = {
+		table: "auth.users",
+		...failure.code ? { code: failure.code } : {}
+	};
+	if (failure.code === "user_not_found" || failure.status === 404) return dbError("not_found", message, base);
+	if (/database error deleting user/i.test(message)) return dbError("conflict", message, {
+		...base,
+		hint: "A foreign key to auth.users without on delete cascade or set null blocks the delete (doctor BS406)"
+	});
+	if (failure.status === 401) return dbError("unauthorized", message, base);
+	if (failure.status === 403) return dbError("forbidden", message, base);
+	return failure.name === "AuthRetryableFetchError" || (failure.status ?? 0) >= 500 ? dbError("network", message, base) : dbError("unexpected", message, base);
+}
+/**
+* Removes a user's Storage objects, then the Auth user, then announces the
+* delete. Rows referencing `auth.users` follow their foreign keys.
+*/
+function deleteAccount(betterSupabase, service, userId, options = {}) {
+	return AsyncResult.from(async () => {
+		const client = service();
+		const removed = {};
+		for (const bucket of options.buckets ?? []) {
+			const param = bucket.owner;
+			if (!param) continue;
+			options.signal?.throwIfAborted();
+			const storage = bucket.connect(client, { allTenants: true });
+			const listed = await storage.list({ [param]: userId }, options.signal ? { signal: options.signal } : {});
+			if (!listed.ok) return listed;
+			const paths = listed.data.map((object) => object.path).filter((path) => {
+				return bucket.match(path)?.[param] === userId;
+			});
+			for (let start = 0; start < paths.length; start += REMOVE_BATCH) {
+				const batch = await storage.remove(paths.slice(start, start + REMOVE_BATCH));
+				if (!batch.ok) return batch;
+			}
+			removed[bucket.id] = paths.length;
+		}
+		options.signal?.throwIfAborted();
+		try {
+			const { error } = await client.auth.admin.deleteUser(userId);
+			if (error) return err(fromAuthError(error));
+		} catch (cause) {
+			return err(fromAuthError(cause));
+		}
+		const context = options.context ?? {};
+		betterSupabase.events.emit("mutation", {
+			table: "auth.users",
+			kind: "delete",
+			rows: [{ id: userId }],
+			context
+		});
+		for (const table of options.cascades ?? []) betterSupabase.events.emit("mutation", {
+			table,
+			kind: "delete",
+			rows: [],
+			context
+		});
+		return ok({
+			userId,
+			removed
+		});
+	});
+}
+//#endregion
+//#region src/core/json.ts
+/** A `JSON.stringify` replacer: `bigint` values become decimal strings, as the wire codec writes them. */
+function jsonReplacer(_key, value) {
+	return typeof value === "bigint" ? value.toString() : value;
+}
+/** `Response.json` that writes `bigint` values as decimal strings instead of throwing. */
+function jsonResponse(data, init = {}) {
+	const headers = new Headers(init.headers);
+	if (!headers.has("content-type")) headers.set("content-type", "application/json");
+	return new Response(JSON.stringify(data, jsonReplacer), {
+		...init,
+		headers
+	});
+}
+//#endregion
+//#region src/server/respond.ts
+/** The scopes a delegated user token lacks; empty for the user's own session. */
+function missingScopes(auth, required) {
+	if (required.length === 0) return [];
+	const outcome = actorOf(auth.claims);
+	if (!outcome.ok || !outcome.actor) return [];
+	const granted = new Set(delegationOf(auth.claims)?.scopes);
+	return required.filter((scope) => !granted.has(scope));
+}
+/** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
+function guard(auth, allow = ["user"], aal = "aal1", scopes = []) {
+	if (auth.kind === "invalid") return auth.error;
+	if (allow.includes(auth.kind)) {
+		const denied = checkAal(auth, aal);
+		if (denied || auth.kind !== "user") return denied;
+		if (isAnonymousUser(auth.claims) && !allow.includes("anonymous") && !allow.includes("anon")) return dbError("forbidden", "Sign up to continue", { code: "ANONYMOUS_USER" });
+		const missing = missingScopes(auth, scopes);
+		return missing.length > 0 ? dbError("forbidden", `The token lacks the scope ${missing.join(" ")}`, {
+			code: "INSUFFICIENT_SCOPE",
+			scopes
+		}) : void 0;
+	}
+	return auth.kind === "anon" ? dbError("unauthorized", "Sign in to continue", { code: "MISSING_CREDENTIALS" }) : dbError("forbidden", `A ${auth.kind} caller is not allowed here`);
+}
+function isResult(value) {
+	return typeof value === "object" && value !== null && "ok" in value && "data" in value && "error" in value;
+}
+/**
+* Settles a handler's return value: `Result`s and `AsyncResult`s unwrap,
+* thrown `DbException`s (or errors whose `cause` is a `DbError`) become
+* errors, anything else is data. Other thrown
+* errors propagate.
+*/
+async function settle(run) {
+	try {
+		const value = await run();
+		if (!isResult(value)) return {
+			ok: true,
+			data: value
+		};
+		if (value.ok) return {
+			ok: true,
+			data: value.data
+		};
+		return {
+			ok: false,
+			error: isDbError(value.error) ? value.error : toDbError(value.error)
+		};
+	} catch (cause) {
+		const thrown = dbErrorOf(cause);
+		if (thrown) return {
+			ok: false,
+			error: thrown
+		};
+		throw cause;
+	}
+}
+/** A handler's value as a response: `Response` as is, data as JSON, errors as Problem Details. */
+async function respond(run, options = {}) {
+	const settled = await settle(run);
+	if (!settled.ok) return problemResponse(settled.error, options);
+	if (settled.data instanceof Response) return settled.data;
+	if (settled.data === void 0) return new Response(null, { status: 204 });
+	return jsonResponse(settled.data, { status: options.status ?? 200 });
+}
+/** Prefetching the JWKS would add a network call to every test that builds a server. */
+function defaultPrefetchJwks() {
+	return typeof process === "undefined" || process.env["NODE_ENV"] !== "test";
+}
+function defaultExpose() {
+	return typeof process !== "undefined" && process.env["NODE_ENV"] === "development";
+}
+//#endregion
+//#region src/auth/support-cookie.ts
+/** The cookie that carries the support session id. */
+const SUPPORT_COOKIE = "bs-support";
+/** `Set-Cookie` for a session: HttpOnly, SameSite=Lax, gone when the session expires. */
+function supportCookie(session, options = {}, now = Date.now()) {
+	const maxAge = Math.max(0, Math.ceil((session.expiresAt.epochMilliseconds - now) / 1e3));
+	return cookieLine(options, encodeURIComponent(session.id), maxAge);
+}
+/** `Set-Cookie` that removes the support cookie. */
+function clearSupportCookie(options = {}) {
+	return cookieLine(options, "", 0);
+}
+function cookieLine(options, value, maxAge) {
+	return [
+		`${options.name ?? "bs-support"}=${value}`,
+		`Path=${options.path ?? "/"}`,
+		`Max-Age=${String(maxAge)}`,
+		"HttpOnly",
+		"SameSite=Lax",
+		...options.secure === false ? [] : ["Secure"]
+	].join("; ");
+}
+/** The support session id in a `Cookie` header, or `undefined`. */
+function supportCookieValue(cookieHeader, name = SUPPORT_COOKIE) {
+	if (!cookieHeader) return void 0;
+	for (const part of cookieHeader.split(";")) {
+		const index = part.indexOf("=");
+		if (index === -1 || part.slice(0, index).trim() !== name) continue;
+		const value = decodeURIComponent(part.slice(index + 1).trim());
+		return value === "" ? void 0 : value;
+	}
+}
+//#endregion
+//#region src/server/support-off.ts
+const NOT_CONFIGURED = "Support sessions need createServer(betterSupabase, { support: supportSessions({ store }) })";
+const notConfigured = () => AsyncResult.err(dbError("unexpected", NOT_CONFIGURED));
+/** `bs.support` without `ServerOptions.support`: every call fails. */
+const supportOff = {
+	start: notConfigured,
+	stop: notConfigured,
+	revoke: notConfigured,
+	current: () => Promise.resolve(void 0),
+	list: notConfigured,
+	sessionIdOf: () => void 0,
+	clearCookie: () => clearSupportCookie()
+};
+//#endregion
+//#region src/server/server.ts
+/** The header `current_tenant_id()` reads over the Data API. */
+const TENANT_HEADER = "x-bs-tenant";
+const STATELESS = {
+	persistSession: false,
+	autoRefreshToken: false,
+	detectSessionInUrl: false
+};
+/** `{ ...server, ...extra }` without reading the lazy `env` getter. */
+function extendServer(server, extra) {
+	return Object.defineProperties({}, {
+		...Object.getOwnPropertyDescriptors(server),
+		...Object.getOwnPropertyDescriptors(extra)
+	});
+}
+/** `{ ...base, ...extra }` that keeps lazy getters lazy. */
+function withExtra(base, extra) {
+	return Object.defineProperties({}, {
+		...Object.getOwnPropertyDescriptors(base),
+		...Object.getOwnPropertyDescriptors(extra)
+	});
+}
+/**
+* Server-side entry point for APIs, jobs, MCP servers and framework
+* adapters. Holds the secrets; `betterSupabase` stays isomorphic.
+*/
+function createServer(betterSupabase, options = {}) {
+	let loaded;
+	const env = () => loaded ??= options.env ?? loadEnv();
+	let adminClient;
+	let anonClient;
+	if ((options.prefetchJwks ?? defaultPrefetchJwks()) && options.auth?.jwks === void 0) try {
+		prefetchJwks({
+			...options.auth,
+			env: env()
+		});
+	} catch {}
+	const secretKey = () => {
+		const key = env().secretKey;
+		if (!key) throw new TypeError("admin() needs SUPABASE_SECRET_KEY; it is not set");
+		return key;
+	};
+	const customFetch = options.fetch ? { fetch: options.fetch } : void 0;
+	const sharedGlobal = customFetch ? { global: customFetch } : {};
+	const serviceClient = () => {
+		adminClient ??= createClient(env().url, secretKey(), {
+			auth: STATELESS,
+			...sharedGlobal
+		});
+		return adminClient;
+	};
+	const readUrl = () => options.readUrl === false ? void 0 : options.readUrl?.replace(/\/+$/, "") ?? env().readUrl;
+	/** Clients for the primary share the service and anon clients; others don't. */
+	const supabaseAt = (url, auth, headers = {}) => {
+		const custom = Object.keys(headers).length > 0;
+		const global = custom ? { global: {
+			headers,
+			...customFetch
+		} } : sharedGlobal;
+		const shared = !custom && url === env().url;
+		switch (auth.kind) {
+			case "user": return createClient(url, env().publishableKey, {
+				accessToken: () => Promise.resolve(auth.token),
+				...global
+			});
+			case "service": return shared ? serviceClient() : createClient(url, secretKey(), {
+				auth: STATELESS,
+				...global
+			});
+			case "anon":
+			case "invalid":
+				if (!shared) return createClient(url, env().publishableKey, {
+					auth: STATELESS,
+					...global
+				});
+				anonClient ??= createClient(url, env().publishableKey, {
+					auth: STATELESS,
+					...sharedGlobal
+				});
+				return anonClient;
+			default: return auth;
+		}
+	};
+	const supabaseFor = (auth, headers = {}) => supabaseAt(env().url, auth, headers);
+	/**
+	* The client queries run on. A user's requests need only PostgREST, so they
+	* skip building Realtime, Storage and Auth clients per request; the shared
+	* service and anon clients are built once anyway.
+	*/
+	const restAt = (url, auth, headers = {}) => {
+		if (auth.kind !== "user") return supabaseAt(url, auth, headers);
+		const key = env().publishableKey;
+		return new PostgrestClient(new URL("rest/v1", url.endsWith("/") ? url : `${url}/`).href, {
+			headers: {
+				...headers,
+				apikey: key,
+				Authorization: `Bearer ${auth.token}`
+			},
+			...customFetch
+		});
+	};
+	/** `$client` stays the full Supabase client, built when first read. */
+	const withLazyClient = (db, client) => Object.defineProperty(db, "$client", {
+		get: client,
+		enumerable: true,
+		configurable: true
+	});
+	const dbFor = (auth, context = {}) => {
+		let supabase;
+		const rest = restAt(env().url, auth);
+		const db = betterSupabase.connect(rest, {
+			...authContext(auth),
+			...context
+		});
+		return withLazyClient(db, () => supabase ??= supabaseFor(auth));
+	};
+	const sqlFor = (claims, context, stats, session) => {
+		if (!options.postgres) throw new TypeError("Direct Postgres access needs createServer(betterSupabase, { postgres: createPostgres() })");
+		return betterSupabase.connect(session ? options.postgres.executorFor(claims, session) : options.postgres.executorFor(claims), context, stats ? { stats } : {});
+	};
+	/** `ServerOptions.tenant` outside `context()`, where it can't be awaited. */
+	const syncTenant = (request, auth) => {
+		const tenant = options.tenant?.(request, auth);
+		if (tenant !== void 0 && typeof tenant !== "string") throw new TypeError("ServerOptions.tenant returned a promise: use context(request), or pass { tenant } to contextFromResolution");
+		return tenant;
+	};
+	const pinMs = options.replicas?.pinMs ?? 5e3;
+	if (options.support && !options.postgres) throw new TypeError("Support sessions need createServer(betterSupabase, { postgres: createPostgres(), support })");
+	const support = options.support ? options.support.create(betterSupabase.events, options.auth?.claims ?? betterSupabase.claimsSchema) : supportOff;
+	/**
+	* The target's context in a support session. Queries run over direct
+	* Postgres with the target's claims plus `act`, read-only unless the
+	* session allows writes; nothing reaches Supabase with the admin's token.
+	*/
+	const supportContextFor = (resolution, active, parent, tenant) => {
+		const { session, claims } = active;
+		const record = (key) => {
+			const value = claims[key];
+			return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : void 0;
+		};
+		const appMetadata = record("app_metadata");
+		const userMetadata = record("user_metadata");
+		const user = {
+			id: session.targetUserId,
+			role: typeof claims["role"] === "string" ? claims["role"] : "authenticated",
+			...typeof claims["email"] === "string" ? { email: claims["email"] } : {},
+			...appMetadata ? { appMetadata } : {},
+			...userMetadata ? { userMetadata } : {}
+		};
+		const auth = {
+			kind: "user",
+			token: "",
+			claims,
+			user,
+			source: "support",
+			expiresAt: Math.floor(session.expiresAt.epochMilliseconds / 1e3)
+		};
+		const scope = tenant ?? session.tenant;
+		const base = userContext(user, claims);
+		const context = scope === void 0 ? base : {
+			...base,
+			tenant: scope
+		};
+		const sessionOptions = {
+			...session.readOnly ? { readOnly: true } : {},
+			...scope === void 0 ? {} : { settings: { "better_supabase.tenant": scope } }
+		};
+		const recorder = new StatsRecorder(parent);
+		const sqlClaims = claims;
+		const unavailable = () => {
+			throw new TypeError("ctx.supabase and ctx.db.$client are not available in a support session; ctx.db and ctx.sql run as the target");
+		};
+		let db;
+		let sql;
+		return {
+			auth,
+			resolution,
+			support: active,
+			get supabase() {
+				return unavailable();
+			},
+			get db() {
+				db ??= Object.defineProperty(sqlFor(sqlClaims, context, recorder, sessionOptions), "$client", {
+					get: unavailable,
+					enumerable: true,
+					configurable: true
+				});
+				return db;
+			},
+			get sql() {
+				sql ??= sqlFor(sqlClaims, context, recorder, sessionOptions);
+				return sql;
+			},
+			replica: void 0,
+			stats: () => recorder.snapshot(),
+			apply: (response) => resolution.apply(response)
+		};
+	};
+	/** Clients and repositories are built on first access: most scopes use one of them. */
+	const contextFor = (resolution, requestHeaders, parent, until = 0, tenant, active) => {
+		if (active) return supportContextFor(resolution, active, parent, tenant);
+		const { auth } = resolution;
+		const context = tenant === void 0 ? authContext(auth) : {
+			...authContext(auth),
+			tenant
+		};
+		const headers = tenant === void 0 ? requestHeaders : {
+			...requestHeaders,
+			[TENANT_HEADER]: tenant
+		};
+		const session = tenant === void 0 ? void 0 : { settings: { "better_supabase.tenant": tenant } };
+		const recorder = new StatsRecorder(parent);
+		let supabase;
+		let db;
+		let sql;
+		const sqlClaims = auth.kind === "user" ? auth.claims : auth.kind === "anon" ? { role: "anon" } : void 0;
+		const client = () => supabase ??= supabaseFor(auth, headers);
+		let replica;
+		const replicaUrl = () => {
+			const url = readUrl();
+			if (url) replica ??= replicaState(until);
+			return url;
+		};
+		return {
+			auth,
+			resolution,
+			get supabase() {
+				return client();
+			},
+			get db() {
+				if (db) return db;
+				const url = replicaUrl();
+				const rest = supabase ?? restAt(env().url, auth, headers);
+				const connected = betterSupabase.connect(rest, context, {
+					stats: recorder,
+					...url && replica ? { executor: routedExecutor(postgrestExecutor(rest), postgrestExecutor(restAt(url, auth, headers)), replica) } : {}
+				});
+				db = withLazyClient(connected, client);
+				return db;
+			},
+			get replica() {
+				replicaUrl();
+				return replica;
+			},
+			get sql() {
+				if (!options.postgres || !sqlClaims) return;
+				sql ??= sqlFor(sqlClaims, context, recorder, session);
+				return sql;
+			},
+			stats: () => recorder.snapshot(),
+			apply: (response) => withPrimaryPin(resolution.apply(response), replica, pinMs)
+		};
+	};
+	const fromResolution = (resolution, request, contextOptions, tenant) => contextFor(resolution, options.headers?.(request) ?? {}, contextOptions.stats, contextOptions.pinnedUntil ?? (readUrl() ? pinnedUntil(resolution.requestCookies) : 0), tenant, contextOptions.support);
+	const resolve = async (request, resolveOptions = {}) => {
+		const claims = options.auth?.claims ?? betterSupabase.claimsSchema;
+		const userMetadata = betterSupabase.userMetadataSchema;
+		const resolution = await resolveAuth(request, {
+			logger: betterSupabase.events.logger,
+			...options.auth,
+			...claims ? { claims } : {},
+			...userMetadata ? { userMetadata } : {},
+			env: env(),
+			...resolveOptions.refresh === void 0 ? {} : { refresh: resolveOptions.refresh },
+			...resolveOptions.cookies === void 0 ? {} : { cookies: resolveOptions.cookies },
+			onRefresh: (event) => {
+				options.auth?.onRefresh?.(event);
+				betterSupabase.events.emit("refresh", event);
+			}
+		});
+		if (betterSupabase.events.has("auth")) {
+			const { auth } = resolution;
+			betterSupabase.events.emit("auth", {
+				source: auth.kind === "user" ? auth.source === "cookie" ? "cookie" : "bearer" : auth.kind === "service" ? "bearer" : "none",
+				ok: auth.kind !== "invalid",
+				...auth.kind === "user" ? {
+					userId: auth.user.id,
+					rawSource: auth.source
+				} : {},
+				...auth.kind === "anon" || auth.kind === "invalid" ? { reason: auth.reason } : {}
+			});
+		}
+		return resolution;
+	};
+	const server = {
+		get env() {
+			return env();
+		},
+		resolve,
+		supabaseFor,
+		dbFor,
+		contextFor: (auth, contextOptions = {}) => contextFor({
+			auth,
+			cookies: [],
+			headers: {},
+			requestCookies: [],
+			apply: (response) => response
+		}, {}, contextOptions.stats, contextOptions.pinnedUntil, contextOptions.tenant, contextOptions.support),
+		async context(request, contextOptions = {}) {
+			const resolution = await resolve(request, {
+				refresh: contextOptions.refresh ?? false,
+				...contextOptions.cookies === void 0 ? {} : { cookies: contextOptions.cookies }
+			});
+			const [tenant, active] = await Promise.all([contextOptions.tenant ?? options.tenant?.(request, resolution.auth), contextOptions.support ?? support.current(request, resolution.auth)]);
+			return fromResolution(resolution, request, active ? {
+				...contextOptions,
+				support: active
+			} : contextOptions, tenant);
+		},
+		contextFromResolution: (resolution, request, contextOptions = {}) => fromResolution(resolution, request, contextOptions, contextOptions.tenant ?? syncTenant(request, resolution.auth)),
+		admin: (context = {}) => betterSupabase.connect(serviceClient(), {
+			actor: {
+				id: "service",
+				kind: "service",
+				role: "service_role"
+			},
+			claims: { role: "service_role" },
+			...context
+		}),
+		support,
+		deleteAccount: (userId, deleteOptions) => deleteAccount(betterSupabase, serviceClient, userId, deleteOptions),
+		actingAs: (userId, claims = {}, impersonation) => {
+			const full = {
+				role: "authenticated",
+				...claims,
+				sub: userId,
+				...impersonation ? { act: actClaim(impersonation) } : {}
+			};
+			return sqlFor(full, {
+				actor: {
+					id: userId,
+					kind: "user",
+					role: full.role ?? "authenticated",
+					...impersonation ? { impersonator: impersonation.actor } : {}
+				},
+				claims: full
+			});
+		}
+	};
+	verifiedSeeders.set(server, (verified) => rememberVerified({
+		...options.auth,
+		env: env()
+	}, verified));
+	return server;
+}
+const verifiedSeeders = /* @__PURE__ */ new WeakMap();
+/**
+* Hands `server` a bearer token another layer verified for this request
+* (`@supabase/server`'s `withSupabase`), so `context()` doesn't verify it
+* again. See `rememberVerified` for when it is accepted.
+*/
+function rememberVerifiedFor(server, verified) {
+	return verifiedSeeders.get(server)?.(verified) ?? false;
+}
+//#endregion
+export { DEFAULT_PIN_MS as _, withExtra as a, withPrimaryPin as b, supportCookie as c, guard as d, isResult as f, jsonResponse as g, jsonReplacer as h, rememberVerifiedFor as i, supportCookieValue as l, settle as m, createServer as n, SUPPORT_COOKIE as o, respond as p, extendServer as r, clearSupportCookie as s, TENANT_HEADER as t, defaultExpose as u, PRIMARY_COOKIE as v, primaryCookieOptions as y };

package/dist/{shared-_6-uPL7E.js → shared-D1dRUrAg.js}

@@ -1,4 +1,5 @@
-import { n as dbError, t as DbException } from "./errors-Bl3rkOzo.js";
+import { n as dbError, t as DbException } from "./errors-DtwXa6b8.js";
+import { t as lookupOf } from "./lookup-BaP5bI27.js";
 //#region src/plugins/shared.ts
 /** Database column name for an app column, or `undefined` if it is unknown. */
 function dbName(table, app) {
@@ -34,6 +35,20 @@ function withDefault(row, column, value) {
 		[column]: value
 	};
 }
+/**
+* Refuses caller-supplied values for columns a plugin fills (timestamps,
+* actor, soft delete) unless the call passes `{ override: true }`. Returns
+* whether the caller may keep its own values.
+*/
+function guardManaged(op, columns, plugin, options) {
+	if (options["override"] === true) return true;
+	const rows = op.kind === "insert" ? op.rows : op.kind === "update" ? [op.set] : [];
+	for (const column of columns) {
+		if (column === void 0) continue;
+		if (rows.some((row) => column in row)) throw new DbException(dbError("invalid_request", `"${column}" on ${op.table.key} is filled by ${plugin}(); pass { override: true } to set it yourself`, { table: op.table.key }));
+	}
+	return false;
+}
 /** Upserts that may update existing rows must not overwrite "created" columns. */
 function insertsOnly(op) {
 	return !op.onConflict || op.onConflict.action === "ignore";
@@ -44,14 +59,14 @@ function forbidden(message) {
 /** Database-keyed row to app-keyed row. */
 function toApp(table, row) {
 	const out = {};
-	for (const [app, meta] of Object.entries(table.columns)) if (meta.db in row) out[app] = row[meta.db];
+	for (const [app, meta] of lookupOf(table).entries) if (meta.db in row) out[app] = row[meta.db];
 	return out;
 }
 /** App-keyed row to database-keyed row. Unknown keys are dropped. */
 function toDb(table, row) {
 	const out = {};
-	for (const [app, meta] of Object.entries(table.columns)) if (app in row) out[meta.db] = row[app];
+	for (const [app, meta] of lookupOf(table).entries) if (app in row) out[meta.db] = row[app];
 	return out;
 }
 //#endregion
-export { isNotNull as a, toDb as c, insertsOnly as i, withDefault as l, equals as n, isNull as o, forbidden as r, toApp as s, dbName as t };
+export { insertsOnly as a, toApp as c, guardManaged as i, toDb as l, equals as n, isNotNull as o, forbidden as r, isNull as s, dbName as t, withDefault as u };