better-supabase 0.3.0 → 0.5.0

package/dist/user-change-CHFEUro1.js

@@ -0,0 +1,49 @@
+//#region src/query/invalidate.ts
+function isString(value) {
+	return typeof value === "string";
+}
+function queryTables(query) {
+	const tables = query.meta?.["bsTables"];
+	if (Array.isArray(tables)) {
+		const list = tables;
+		return list.every(isString) ? list : list.filter(isString);
+	}
+	const [prefix, table] = query.queryKey;
+	return prefix === "bs" && typeof table === "string" ? [table] : void 0;
+}
+/**
+* Invalidates every query that read one of `tables`: better-supabase queries
+* by their `meta.bsTables`, and other `['bs', table, ...]` keys by prefix.
+*/
+function invalidateTables(client, tables) {
+	if (tables.length === 0) return Promise.resolve();
+	const changed = new Set(tables);
+	return client.invalidateQueries({ predicate: (query) => queryTables(query)?.some((table) => changed.has(table)) ?? false });
+}
+//#endregion
+//#region src/query/user-change.ts
+/**
+* Removes every `['bs', ...]` query when the signed-in user changes or signs
+* out, so the next user never sees the previous user's rows. Returns the
+* function that stops listening. `BetterSupabaseProvider` calls it for React;
+* call it yourself with Vue, Solid, Svelte or Angular Query.
+*
+* ```ts
+* const stop = clearOnUserChange(queryClient, bs.auth);
+* ```
+*/
+function clearOnUserChange(queryClient, auth) {
+	let user;
+	const check = () => {
+		const snapshot = auth.current();
+		if (snapshot.status === "loading") return;
+		const id = snapshot.user?.id ?? null;
+		if (user !== void 0 && user !== id) queryClient.removeQueries({ queryKey: ["bs"] });
+		user = id;
+	};
+	const stop = auth.subscribe(check);
+	check();
+	return stop;
+}
+//#endregion
+export { invalidateTables as n, clearOnUserChange as t };

package/dist/{webhooks-CAIFQSTM.js → verify-Ce49ETPz.js}

@@ -1,11 +1,11 @@
-import { n as dbError } from "./errors-Bl3rkOzo.js";
-import { n as nowInstant, r as optionalTemporal } from "./temporal-BwshQk0W.js";
-import { n as temporalMissing } from "./temporal-required-CMxeSVPo.js";
-import { i as ok, n as err } from "./result-DWXatkd6.js";
-import { i as toBase64, r as fromBase64 } from "./base64-CQeB1eSf.js";
-import { s as toApp } from "./shared-_6-uPL7E.js";
+import { n as dbError } from "./errors-DtwXa6b8.js";
+import { n as nowInstant, r as optionalTemporal } from "./temporal-CVlIV2DZ.js";
+import { n as temporalMissing } from "./temporal-required-CAt4Dc9Z.js";
+import { i as ok, n as err } from "./result-BKiliPY7.js";
+import { i as toBase64, r as fromBase64 } from "./base64-D2gsioCY.js";
+import { c as toApp } from "./shared-D1dRUrAg.js";
 //#region src/webhooks/verify.ts
-const encoder = new TextEncoder();
+const encoder = /* @__PURE__ */ new TextEncoder();
 /** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
 function secretBytes(secret) {
 	const raw = secret.replace(/^v1,/, "").replace(/^whsec_/, "");
@@ -15,12 +15,31 @@ function secretBytes(secret) {
 		throw new TypeError("Webhook secret is not valid base64");
 	}
 }
+/** Secrets come from configuration, so a handful of keys suffice. */
+const keys = /* @__PURE__ */ new Map();
+function keyFor(secret) {
+	let key = keys.get(secret);
+	if (!key) {
+		key = crypto.subtle.importKey("raw", secretBytes(secret), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["sign", "verify"]);
+		if (keys.size < 16) {
+			keys.set(secret, key);
+			key.catch(() => keys.delete(secret));
+		}
+	}
+	return key;
+}
 async function signature(secret, content) {
-	const key = await crypto.subtle.importKey("raw", secretBytes(secret), {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	return toBase64(new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(content))));
+	return toBase64(new Uint8Array(await crypto.subtle.sign("HMAC", await keyFor(secret), encoder.encode(content))));
+}
+function decodeSignature(value) {
+	try {
+		return fromBase64(value);
+	} catch {
+		return;
+	}
 }
 /** Constant-time string comparison. */
 function timingSafeEqual(a, b) {
@@ -51,7 +70,6 @@ async function signWebhook(secret, message) {
 */
 async function verifyWebhook(input, secrets, options = {}) {
 	const headers = input.headers;
-	const body = input instanceof Request ? await input.text() : input.body;
 	const id = header(headers, "webhook-id");
 	const timestamp = header(headers, "webhook-timestamp");
 	const signatures = header(headers, "webhook-signature");
@@ -64,12 +82,13 @@ async function verifyWebhook(input, secrets, options = {}) {
 	const tolerance = options.tolerance ?? 300;
 	if (seconds < now - tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_OLD", "Webhook timestamp is too old"));
 	if (seconds > now + tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_NEW", "Webhook timestamp is in the future"));
-	const content = `${id}.${timestamp}.${body}`;
-	const offered = signatures.split(" ").map((entry) => entry.split(",")).filter(([version, value]) => version === "v1" && value).map(([, value]) => value);
+	const body = input instanceof Request ? await input.text() : input.body;
+	const content = encoder.encode(`${id}.${timestamp}.${body}`);
+	const offered = signatures.split(" ").map((entry) => entry.split(",")).filter(([version, value]) => version === "v1" && value).flatMap(([, value]) => decodeSignature(value) ?? []);
 	let valid = false;
 	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
-		const expected = await signature(secret, content);
-		for (const candidate of offered) if (timingSafeEqual(candidate, expected)) valid = true;
+		const key = await keyFor(secret);
+		for (const candidate of offered) if (await crypto.subtle.verify("HMAC", key, candidate, content)) valid = true;
 	}
 	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
 	try {
@@ -127,8 +146,8 @@ function isDatabaseWebhook(value) {
 * Reads a database webhook payload for `table` as an app-cased change.
 * Returns `null` for other tables or payloads that aren't database webhooks.
 */
-function databaseChange(sb, table, payload) {
-	const meta = sb.meta.tables[table];
+function databaseChange(betterSupabase, table, payload) {
+	const meta = betterSupabase.meta.tables[table];
 	if (!meta || !isDatabaseWebhook(payload) || payload.table !== meta.name || payload.schema !== meta.schema) return null;
 	return {
 		type: payload.type,

package/dist/{version-BfpG2gks.js → version-DM_Roffb.js}

@@ -1,4 +1,4 @@
 //#region src/core/version.ts
-const VERSION = "0.0.0";
+const VERSION = "0.5.0";
 //#endregion
 export { VERSION as t };

package/dist/{view-3Po_PVlr.d.ts → view-BEf0diC5.d.ts}

@@ -1,6 +1,6 @@
-import { p as DbError } from "./result-c2OYgCV2.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-x3V3vGh-.js";
-import { i as InvalidReason, r as AuthState } from "./resolve-BRciX2jK.js";
+import { _ as DbError } from "./executor-BunPOO-k.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-C15TJq77.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-CusDgPaD.js";
 import { JWTClaims, UserClaims } from "@supabase/server";
 //#region src/auth/actor.d.ts
 /** One level of an RFC 8693 `act` chain: who acts, and who acted before it. */
@@ -35,19 +35,24 @@ type AuthSession<C = unknown, P = unknown> = {
   readonly user: UserClaims;
   /**
    * The verified JWT payload, including custom access token hook claims,
-   * typed and validated by `sb.claims(schema)`.
+   * typed and validated by `betterSupabase.claims(schema)`.
    */
   readonly claims: JWTClaims & C;
   /** Seconds since epoch, from the token's `exp`. */
   readonly expiresAt: number | null;
   /**
-   * `user_metadata` parsed by `sb.userMetadata(schema)`, for display.
+   * `user_metadata` parsed by `betterSupabase.userMetadata(schema)`, for display.
    * Absent without a schema or when the metadata fails it. Users
    * write this data with `auth.updateUser()`: never base access on it.
    */
   readonly profile?: P;
   /** `aal2` once the user verified a second factor in this session. */
   readonly aal: Aal;
+  /**
+   * Signed in with `signInAnonymously()` (the `is_anonymous` claim). Guards
+   * refuse these users unless `allow` lists `'anonymous'`.
+   */
+  readonly anonymous: boolean;
   /** How the user signed in (`password`, `totp`, `sso/saml`, ...). */
   readonly amr: readonly AmrEntry[];
   /** Set when an admin acts as this user (the `act` claim), for a banner. */

package/dist/{mfa-BxoR1RkN.js → view-Bq64ki8-.js}

@@ -1,28 +1,9 @@
-import { n as dbError } from "./errors-Bl3rkOzo.js";
+import { n as dbError } from "./errors-DtwXa6b8.js";
 import { t as consoleLogger } from "./logger-glM28NVN.js";
-import { n as decodeJwtPayload } from "./base64-CQeB1eSf.js";
+import { n as decodeJwtPayload } from "./base64-D2gsioCY.js";
+import { n as impersonatorOf, r as userContext } from "./impersonation-VfaGc4Q_.js";
 import { DEFAULT_COOKIE_OPTIONS, createChunks, isChunkLike, parseCookieHeader, serializeCookieHeader, stringFromBase64URL, stringToBase64URL } from "@supabase/ssr";
 import { extractCredentials, verifyCredentials } from "@supabase/server/core";
-//#region src/auth/impersonation.ts
-/** The `act` claim for an impersonated session. */
-function actClaim(options) {
-	return {
-		sub: options.actor,
-		reason: options.reason
-	};
-}
-/** The impersonator in `claims.act`, or `undefined` for a normal session. */
-function impersonatorOf(claims) {
-	const act = claims["act"];
-	if (typeof act !== "object" || act === null) return void 0;
-	const { sub, reason } = act;
-	if (typeof sub !== "string" || sub === "") return void 0;
-	return typeof reason === "string" ? {
-		id: sub,
-		reason
-	} : { id: sub };
-}
-//#endregion
 //#region src/auth/actor.ts
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -89,6 +70,7 @@ function delegationOf(claims) {
 * refresh-token reuse interval of Supabase Auth.
 */
 const REUSE_MS = 1e4;
+const DEFAULT_TIMEOUT_MS = 5e3;
 const inflight = /* @__PURE__ */ new Map();
 const recent = /* @__PURE__ */ new Map();
 function shared(outcome) {
@@ -98,10 +80,14 @@ function shared(outcome) {
 	} : outcome;
 }
 function prune(now) {
-	for (const [token, entry] of recent) if (entry.until <= now) recent.delete(token);
+	for (const [token, entry] of recent) {
+		if (entry.until > now) return;
+		recent.delete(token);
+	}
 }
 async function request(refreshToken, options, now) {
 	const doFetch = options.fetch ?? fetch;
+	const signal = AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
 	let response;
 	try {
 		response = await doFetch(`${options.url}/auth/v1/token?grant_type=refresh_token`, {
@@ -111,7 +97,8 @@ async function request(refreshToken, options, now) {
 				"content-type": "application/json",
 				...options.forwardedFor ? { "sb-forwarded-for": options.forwardedFor.ip } : {}
 			},
-			body: JSON.stringify({ refresh_token: refreshToken })
+			body: JSON.stringify({ refresh_token: refreshToken }),
+			signal
 		});
 	} catch (cause) {
 		return {
@@ -121,6 +108,11 @@ async function request(refreshToken, options, now) {
 		};
 	}
 	const body = await response.json().catch(() => null);
+	if (signal.aborted) return {
+		ok: false,
+		reason: "network",
+		message: "refresh timed out"
+	};
 	if (!response.ok || !body || typeof body["access_token"] !== "string" || typeof body["refresh_token"] !== "string") {
 		const message = typeof body?.["msg"] === "string" ? body["msg"] : typeof body?.["error_description"] === "string" ? body["error_description"] : `Refresh failed with ${String(response.status)}`;
 		return {
@@ -154,12 +146,16 @@ function refreshSession(refreshToken, options) {
 	const pending = inflight.get(refreshToken);
 	if (pending) return pending.then(shared);
 	const promise = request(refreshToken, options, now).then((outcome) => {
-		inflight.delete(refreshToken);
-		if (outcome.ok) recent.set(refreshToken, {
-			outcome,
-			until: now + REUSE_MS
-		});
+		if (outcome.ok || outcome.reason === "rejected") {
+			recent.delete(refreshToken);
+			recent.set(refreshToken, {
+				outcome,
+				until: now + REUSE_MS
+			});
+		}
 		return outcome;
+	}).finally(() => {
+		inflight.delete(refreshToken);
 	});
 	inflight.set(refreshToken, promise);
 	return promise;
@@ -175,8 +171,15 @@ const AUTH_CACHE_HEADERS = {
 };
 /** `sb-<first label of the hostname>-auth-token`, the supabase-js default. */
 function sessionCookieName(url) {
-	return `sb-${new URL(url).hostname.split(".")[0] ?? ""}-auth-token`;
+	let name = cookieNames.get(url);
+	if (name === void 0) {
+		name = `sb-${new URL(url).hostname.split(".")[0] ?? ""}-auth-token`;
+		if (cookieNames.size < 16) cookieNames.set(url, name);
+	}
+	return name;
 }
+/** Project URLs come from configuration, so a handful of entries suffice. */
+const cookieNames = /* @__PURE__ */ new Map();
 function parseCookies(header) {
 	return header ? parseCookieHeader(header) : [];
 }
@@ -262,7 +265,7 @@ function serverEnv(options) {
 		url: env.url,
 		publishableKeys: { default: env.publishableKey },
 		secretKeys: env.secretKeys ?? (env.secretKey ? { default: env.secretKey } : {}),
-		jwks: options.jwks ?? env.jwksUrl
+		jwks: options.jwks ?? env.jwks ?? env.jwksUrl
 	};
 }
 const MEMO_SIZE = 256;
@@ -273,7 +276,7 @@ let memoByJwks = /* @__PURE__ */ new WeakMap();
 * and island resolves the same token again; this skips the signature check.
 */
 function memoFor(options) {
-	const jwks = options.jwks;
+	const jwks = options.jwks ?? options.env.jwks;
 	if (jwks && typeof jwks === "object" && !(jwks instanceof URL)) {
 		let memo = memoByJwks.get(jwks);
 		if (!memo) memoByJwks.set(jwks, memo = /* @__PURE__ */ new Map());
@@ -289,6 +292,42 @@ function memoFor(options) {
 	if (!memo) memoByUrl.set(key, memo = /* @__PURE__ */ new Map());
 	return memo;
 }
+function sameJson(a, b) {
+	if (a === b) return true;
+	if (typeof a !== "object" || typeof b !== "object" || !a || !b) return false;
+	if (Array.isArray(a) !== Array.isArray(b)) return false;
+	const left = Object.entries(a);
+	const right = new Map(Object.entries(b));
+	return left.length === right.size && left.every(([key, value]) => right.has(key) && sameJson(value, right.get(key)));
+}
+/**
+* Records a token that `@supabase/server` verified for this request, so the
+* next `resolveAuth` with these options doesn't verify it again. Only when
+* `claims` is the token's own payload, it hasn't expired, and its `iss` and
+* `aud` pass the checks these options would apply; otherwise returns false
+* and the token is verified as usual.
+*/
+function rememberVerified(options, verified) {
+	const { token, claims, user } = verified;
+	const now = Math.floor((options.now ?? Date.now)() / 1e3);
+	const expiresAt = typeof claims.exp === "number" ? claims.exp : null;
+	if (expiresAt === null || expiresAt <= now) return false;
+	if (!sameJson(decodeJwtPayload(token), claims)) return false;
+	const issuers = [options.issuer ?? `${options.env.url}/auth/v1`].flat();
+	if (typeof claims.iss !== "string" || !issuers.includes(claims.iss)) return false;
+	const audiences = [options.audience ?? "authenticated"].flat();
+	const aud = claims.aud;
+	const given = Array.isArray(aud) ? aud : [aud];
+	if (!audiences.some((audience) => given.includes(audience))) return false;
+	remember(memoFor(options), token, {
+		kind: "user",
+		token,
+		claims,
+		user,
+		expiresAt
+	}, expiresAt);
+	return true;
+}
 function remembered(memo, token, now) {
 	const hit = memo.get(token);
 	if (!hit) return void 0;
@@ -297,8 +336,31 @@ function remembered(memo, token, now) {
 	memo.set(token, hit);
 	return hit;
 }
-function remember(memo, token, user) {
-	if (user.expiresAt === null) return;
+const NO_SCHEMA = {};
+const checkedByMemo = /* @__PURE__ */ new WeakMap();
+/**
+* Tokens that already passed (or failed) the claims and `userMetadata`
+* schemas, per verification memo and schema pair, so a memo hit skips
+* validation too.
+*/
+function checkedFor(memo, options) {
+	const claims = options.claims ?? NO_SCHEMA;
+	const metadata = options.userMetadata ?? NO_SCHEMA;
+	let byClaims = checkedByMemo.get(memo);
+	if (!byClaims) checkedByMemo.set(memo, byClaims = /* @__PURE__ */ new WeakMap());
+	let byMetadata = byClaims.get(claims);
+	if (!byMetadata) byClaims.set(claims, byMetadata = /* @__PURE__ */ new WeakMap());
+	let checked = byMetadata.get(metadata);
+	if (!checked) byMetadata.set(metadata, checked = /* @__PURE__ */ new Map());
+	return checked;
+}
+function withoutSource(state) {
+	if (state.kind !== "user") return state;
+	const { source: _source, ...rest } = state;
+	return rest;
+}
+function remember(memo, token, user, expiresAt) {
+	if (expiresAt === null) return;
 	memo.set(token, user);
 	if (memo.size > MEMO_SIZE) memo.delete(memo.keys().next().value);
 }
@@ -307,10 +369,20 @@ async function verify(credentials, modes, options, source) {
 	const memo = token ? memoFor(options) : void 0;
 	if (token && memo) {
 		const hit = remembered(memo, token, Math.floor((options.now ?? Date.now)() / 1e3));
-		if (hit) return checkUser({
-			...hit,
-			source
-		}, options);
+		if (hit) {
+			const checked = checkedFor(memo, options);
+			const known = checked.get(token);
+			if (known) return known.kind === "user" ? {
+				...known,
+				source
+			} : known;
+			const state = await checkUser({
+				...hit,
+				source
+			}, options);
+			remember(checked, token, withoutSource(state), hit.expiresAt);
+			return state;
+		}
 	}
 	const state = await verifyOnce(credentials, modes, options, source);
 	if (token && memo && state.kind === "user") remember(memo, token, {
@@ -319,8 +391,10 @@ async function verify(credentials, modes, options, source) {
 		claims: state.claims,
 		user: state.user,
 		expiresAt: state.expiresAt
-	});
-	return checkUser(state, options);
+	}, state.expiresAt);
+	const checked = await checkUser(state, options);
+	if (token && memo && state.kind === "user") remember(checkedFor(memo, options), token, withoutSource(checked), state.expiresAt);
+	return checked;
 }
 /** Validates a user's claims against `options.claims`, keeping every JWT claim. */
 async function checkClaims(state, options) {
@@ -368,10 +442,34 @@ async function checkUser(state, options) {
 	};
 	if (!warnedMetadata.has(schema)) {
 		warnedMetadata.add(schema);
-		(options.logger ?? consoleLogger).warn("user_metadata does not match sb.userMetadata(schema); session.profile is undefined", { paths: outcome.issues.map((issue) => issue.path?.map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join(".") ?? "") });
+		(options.logger ?? consoleLogger).warn("user_metadata does not match betterSupabase.userMetadata(schema); session.profile is undefined", { paths: outcome.issues.map((issue) => issue.path?.map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join(".") ?? "") });
 	}
 	return user;
 }
+/** A token whose `kid` matches no key: verifying it loads the JWKS and fails. */
+const PREFETCH_TOKEN = `${base64url(JSON.stringify({
+	alg: "ES256",
+	kid: "better-supabase-prefetch",
+	typ: "JWT"
+}))}.e30.AA`;
+function base64url(text) {
+	return btoa(text).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+/**
+* Loads the remote JWKS into the verifier's cache so the first request
+* doesn't wait for it. Never throws; a failure leaves the first request to
+* fetch it as before.
+*/
+function prefetchJwks(options) {
+	if (options.jwks !== void 0 || options.env.jwks !== void 0) return Promise.resolve();
+	return verifyCredentials({
+		token: PREFETCH_TOKEN,
+		apikey: null
+	}, {
+		auth: ["user"],
+		env: serverEnv(options)
+	}).then(() => {}, () => {});
+}
 async function verifyOnce(credentials, modes, options, source) {
 	const { data, error } = await verifyCredentials(credentials, {
 		auth: modes,
@@ -406,11 +504,16 @@ async function verifyOnce(credentials, modes, options, source) {
 }
 function resolution(auth, cookies, writes = []) {
 	const headers = writes.length > 0 ? AUTH_CACHE_HEADERS : {};
+	let requestCookies;
 	return {
 		auth,
 		cookies: writes,
 		headers,
-		requestCookies: writes.length > 0 ? applyCookieWrites(cookies, writes) : cookies,
+		/** Parsed on first read: bearer requests rarely need their cookies. */
+		get requestCookies() {
+			requestCookies ??= writes.length > 0 ? applyCookieWrites(cookies(), writes) : cookies();
+			return requestCookies;
+		},
 		apply(response) {
 			if (writes.length === 0) return response;
 			let target = response;
@@ -440,7 +543,8 @@ function clientIp(request) {
 * set, through a single-flight request, and only then are cookies written.
 */
 async function resolveAuth(request, options) {
-	const cookies = parseCookies(request.headers.get("cookie"));
+	let parsed;
+	const cookies = () => parsed ??= parseCookies(request.headers.get("cookie"));
 	for (const resolver of options.resolvers ?? []) {
 		const state = await resolver.resolve(request);
 		if (!state) continue;
@@ -459,11 +563,15 @@ async function resolveAuth(request, options) {
 		token: null,
 		apikey: credentials.apikey
 	}, options.secret === true ? ["secret"] : options.secret.map((name) => `secret:${name}`), options, "bearer"), cookies);
+	if (options.cookies === false) return resolution({
+		kind: "anon",
+		reason: "none"
+	}, cookies);
 	const name = options.cookie?.name ?? sessionCookieName(options.env.url);
-	const session = readSession(cookies, name);
+	const session = readSession(cookies(), name);
 	if (!session) {
-		const stale = cookies.some((cookie) => cookie.name === name || cookie.name.startsWith(`${name}.`));
-		const writes = stale && options.refresh ? writeSession(cookies, name, null, options.cookie?.options) : [];
+		const stale = cookies().some((cookie) => cookie.name === name || cookie.name.startsWith(`${name}.`));
+		const writes = stale && options.refresh ? writeSession(cookies(), name, null, options.cookie?.options) : [];
 		return resolution({
 			kind: "anon",
 			reason: stale ? "signed_out" : "none"
@@ -471,7 +579,8 @@ async function resolveAuth(request, options) {
 	}
 	const now = Math.floor((options.now ?? Date.now)() / 1e3);
 	const expiry = expiryOf(session);
-	if (expiry !== void 0 && expiry - (options.leeway ?? 60) > now) {
+	const leeway = options.refresh ? options.leeway ?? 60 : 0;
+	if (expiry !== void 0 && expiry - leeway > now) {
 		const state = await verify({
 			token: session.access_token,
 			apikey: null
@@ -496,7 +605,8 @@ async function resolveAuth(request, options) {
 			secretKey
 		} } : {},
 		...options.fetch ? { fetch: options.fetch } : {},
-		...options.now ? { now: options.now } : {}
+		...options.now ? { now: options.now } : {},
+		...options.refreshTimeoutMs === void 0 ? {} : { timeoutMs: options.refreshTimeoutMs }
 	});
 	options.onRefresh?.({
 		ok: outcome.ok,
@@ -511,9 +621,9 @@ async function resolveAuth(request, options) {
 		return resolution({
 			kind: "anon",
 			reason: "signed_out"
-		}, cookies, writeSession(cookies, name, null, options.cookie?.options));
+		}, cookies, writeSession(cookies(), name, null, options.cookie?.options));
 	}
-	const writes = writeSession(cookies, name, outcome.session, options.cookie?.options);
+	const writes = writeSession(cookies(), name, outcome.session, options.cookie?.options);
 	return resolution(await verify({
 		token: outcome.session.access_token,
 		apikey: null
@@ -522,19 +632,7 @@ async function resolveAuth(request, options) {
 /** The repository context (`actor`, `claims`) for an auth state. */
 function authContext(auth) {
 	switch (auth.kind) {
-		case "user": {
-			const impersonator = impersonatorOf(auth.claims);
-			return {
-				actor: {
-					id: auth.user.id,
-					kind: "user",
-					...auth.user.role === void 0 ? {} : { role: auth.user.role },
-					...auth.user.email === void 0 ? {} : { email: auth.user.email },
-					...impersonator ? { impersonator: impersonator.id } : {}
-				},
-				claims: auth.claims
-			};
-		}
+		case "user": return userContext(auth.user, auth.claims);
 		case "service": return {
 			actor: {
 				id: `service:${auth.keyName}`,
@@ -593,4 +691,52 @@ function checkAal(auth, required) {
 	});
 }
 //#endregion
-export { actClaim as _, clientIp as a, applyCookieWrites as c, serializeCookie as d, sessionCookieName as f, delegationOf as g, actorOf as h, authContext as i, parseCookies as l, refreshSession as m, amrOf as n, resolveAuth as o, writeSession as p, checkAal as r, AUTH_CACHE_HEADERS as s, aalOf as t, readSession as u, impersonatorOf as v };
+//#region src/auth/view.ts
+/** Whether the token belongs to an anonymous user (`signInAnonymously()`). */
+function isAnonymousUser(claims) {
+	return "is_anonymous" in claims && claims.is_anonymous === true;
+}
+/** Drops the token from an `AuthState`, leaving only serializable fields. */
+function toSession(auth) {
+	switch (auth.kind) {
+		case "user": {
+			const impersonator = impersonatorOf(auth.claims);
+			const outcome = actorOf(auth.claims);
+			const actor = outcome.ok ? outcome.actor : void 0;
+			const scopes = actor ? delegationOf(auth.claims)?.scopes : void 0;
+			const delegation = actor && (scopes || actor.chain) ? {
+				scopes: scopes ?? [],
+				...actor.chain ? { chain: actor.chain } : {}
+			} : void 0;
+			return {
+				kind: "user",
+				user: auth.user,
+				claims: auth.claims,
+				expiresAt: auth.expiresAt,
+				...auth.profile === void 0 ? {} : { profile: auth.profile },
+				aal: aalOf(auth.claims),
+				anonymous: isAnonymousUser(auth.claims),
+				amr: amrOf(auth.claims),
+				...impersonator ? { impersonator } : {},
+				...actor ? { actor } : {},
+				...delegation ? { delegation } : {}
+			};
+		}
+		case "service": return {
+			kind: "service",
+			keyName: auth.keyName
+		};
+		case "anon": return {
+			kind: "anon",
+			reason: auth.reason
+		};
+		case "invalid": return {
+			kind: "invalid",
+			reason: auth.reason,
+			error: auth.error
+		};
+		default: return auth;
+	}
+}
+//#endregion
+export { writeSession as _, checkAal as a, delegationOf as b, prefetchJwks as c, AUTH_CACHE_HEADERS as d, applyCookieWrites as f, sessionCookieName as g, serializeCookie as h, amrOf as i, rememberVerified as l, readSession as m, toSession as n, authContext as o, parseCookies as p, aalOf as r, clientIp as s, isAnonymousUser as t, resolveAuth as u, refreshSession as v, actorOf as y };