better-supabase 0.4.0 → 0.5.0

package/dist/testing/index.js

@@ -1,13 +1,13 @@
-import { n as dbError } from "../errors-L0xK41y_.js";
-import { i as temporalText } from "../temporal-BwshQk0W.js";
-import { t as temporal } from "../temporal-required-CBNHT6ni.js";
-import { i as ok } from "../result-Bj6yt33D.js";
-import { t as BetterSupabase } from "../define-Bh0AqTik.js";
+import { n as dbError } from "../errors-DtwXa6b8.js";
+import { i as temporalText } from "../temporal-CVlIV2DZ.js";
+import { t as temporal } from "../temporal-required-CAt4Dc9Z.js";
+import { i as ok } from "../result-BKiliPY7.js";
+import { t as BetterSupabase } from "../define-cNKzqwL_.js";
 import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-D2gsioCY.js";
-import { r as resolveConfig } from "../config-BpxDfnbg.js";
+import { a as resolveConfig } from "../kits-CGLLrNPd.js";
 import { t as isList } from "../guards-BnzDvFrz.js";
 import { ENV_VARIABLES } from "../env/index.js";
-import { n as postgresExecutor } from "../executor-CVt6dD0B.js";
+import { n as postgresExecutor } from "../executor-XycESQPH.js";
 import { toCloudEvents } from "../events/index.js";
 import { createClient } from "@supabase/supabase-js";
 import { existsSync } from "node:fs";
@@ -546,6 +546,147 @@ function testEventSink(sink, options = {}) {
 		}]
 	]);
 }
+function claimedJob(queue, row) {
+	const instant = temporal().Instant.fromEpochMilliseconds(0);
+	return {
+		id: Number(row.id),
+		queue,
+		payload: row.message?.payload,
+		attempts: row.attempts,
+		maxAttempts: row.message?.max_attempts ?? 5,
+		enqueuedAt: instant,
+		visibleUntil: instant,
+		lastError: row.message?.last_error ?? null,
+		context: {}
+	};
+}
+/**
+* Proves a `QueueBackend` round-trips payloads, hides claimed messages for
+* their lease, counts attempts, retries and dead-letters on `fail`, and
+* (when it has `leases`) rejects a stale attempt and extends a lease. It
+* writes to `options.queue` on the backend's real store.
+*/
+function testQueueBackend(backend, options) {
+	const { queue } = options;
+	const claimOne = async () => {
+		const [row] = await backend.read(queue, 30, 1);
+		return row && claimedJob(queue, row);
+	};
+	return conform(`QueueBackend "${backend.name}"`, [
+		hasName(backend),
+		["has apiVersion 1", () => {
+			const version = backend.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["round-trips a payload and leases it", async () => {
+			const id = await backend.send(queue, { n: 1 }, 0, 3, void 0);
+			expect(Number.isFinite(id), "send must return a numeric id");
+			const job = await claimOne();
+			expect(job?.id === id, "read must return the sent message");
+			expect(same(job.payload, { n: 1 }), "the payload must round-trip");
+			expect(job.attempts === 1, "the first claim must be attempt 1");
+			expect(job.maxAttempts === 3, "max_attempts must round-trip");
+			expect(await claimOne() === void 0, "a leased message must stay hidden from other reads");
+			expect(await backend.complete(job), "complete must return true");
+		}],
+		backend.leases && ["rejects a stale attempt and extends a lease", async () => {
+			await backend.send(queue, { n: 2 }, 0, 3, void 0);
+			const job = await claimOne();
+			expect(job, "read must return the sent message");
+			expect(!await backend.complete({
+				...job,
+				attempts: job.attempts + 1
+			}), "complete with another attempt must return false");
+			expect(await backend.extend(job, 60), "extend must return true");
+			expect(await backend.complete(job), "complete must return true");
+		}],
+		["retries, then dead-letters at max attempts", async () => {
+			await backend.send(queue, { n: 3 }, 0, 2, void 0);
+			const first = await claimOne();
+			expect(first, "read must return the sent message");
+			expect(await backend.fail(first, "boom", 0) === "queued", "fail before max_attempts must return queued");
+			const second = await claimOne();
+			expect(second?.attempts === 2, "a retried message must be attempt 2");
+			expect(await backend.fail(second, "boom", 0) === "dead", "fail at max_attempts must return dead");
+			expect(await claimOne() === void 0, "a dead message must not be claimed again");
+		}],
+		(options.dedupe ?? backend.leases) && ["returns the first id for a repeated dedupe key", async () => {
+			expect(await backend.send(queue, { n: 4 }, 0, 3, "same") === await backend.send(queue, { n: 4 }, 0, 3, "same"), "a waiting dedupe key must return its id");
+			const job = await claimOne();
+			expect(job, "read must return the sent message");
+			await backend.complete(job);
+		}]
+	]);
+}
+/**
+* Proves a `SupportSessionStore` starts sessions with the input it was
+* given, shows a running session only to its admin, ends the admin's
+* previous session on start, ends a session once, and lists sessions.
+* It writes sessions to the store; they are all ended when it returns.
+*/
+function testSupportSessionStore(store, options) {
+	const { admin } = options;
+	const [first, second] = options.targets;
+	const start = (targetUserId) => store.start({
+		adminId: admin.id,
+		adminClaims: admin.claims,
+		targetUserId,
+		reason: "conformance",
+		ttlSeconds: 600,
+		readOnly: true,
+		metadata: { ticket: "T-1" }
+	});
+	return conform(`SupportSessionStore "${store.name}"`, [
+		hasName(store),
+		["has apiVersion 1", () => {
+			const version = store.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["starts a session with its input and shows it to its admin only", async () => {
+			const session = await start(first);
+			try {
+				expect(session.id.length > 0, "start must return an id");
+				expect(session.adminId === admin.id, "adminId must round-trip");
+				expect(session.targetUserId === first, "targetUserId must round-trip");
+				expect(session.reason === "conformance", "reason must round-trip");
+				expect(session.readOnly, "readOnly must round-trip");
+				expect(same(session.metadata, { ticket: "T-1" }), "metadata must round-trip");
+				const seconds = (session.expiresAt.epochMilliseconds - session.startedAt.epochMilliseconds) / 1e3;
+				expect(Math.abs(seconds - 600) < 5, "expiresAt must be ttlSeconds after startedAt");
+				expect((await store.get(session.id, admin.id))?.id === session.id, "get must return the running session");
+				expect(await store.get(session.id, first) === void 0, "get must hide a session from anyone but its admin");
+			} finally {
+				await store.end(session.id, "admin");
+			}
+		}],
+		["ends the admin's previous session on start", async () => {
+			const older = await start(first);
+			const newer = await start(second);
+			try {
+				expect(await store.get(older.id, admin.id) === void 0, "starting a session must end the admin's previous one");
+				expect((await store.get(newer.id, admin.id))?.id === newer.id, "the new session must be running");
+			} finally {
+				await store.end(newer.id, "admin");
+			}
+		}],
+		["ends a session once and lists it", async () => {
+			const session = await start(first);
+			expect(await store.end(session.id, "admin"), "end must return true");
+			expect(!await store.end(session.id, "admin"), "ending an ended session must return false");
+			expect(await store.get(session.id, admin.id) === void 0, "get must not return an ended session");
+			const entry = (await store.list({
+				adminId: admin.id,
+				active: false
+			})).find((item) => item.id === session.id);
+			expect(entry, "list must include the ended session");
+			expect(entry.endedAt !== void 0, "an ended session has endedAt");
+			expect((await store.list({
+				adminId: admin.id,
+				active: true
+			})).every((item) => item.id !== session.id), "list({ active: true }) must leave out ended sessions");
+		}]
+	]);
+}
 async function resolveSafely(resolver, request) {
 	try {
 		return await resolver.resolve(request);
@@ -678,6 +819,21 @@ function testPlugin(plugin, options) {
 			expect(first.kind === op.kind, "must return a mutation of the same kind");
 			expect(same(first, second), "two calls with the same input differ");
 		}],
+		plugin.afterMutation && create && ["afterMutation cannot change the result", async () => {
+			const row = {
+				marker: "conformance",
+				nested: { kept: true }
+			};
+			const result = await betterSupabase.use(plugin).connect({
+				name: "rows",
+				execute: () => Promise.resolve(ok({
+					rows: [structuredClone(row)],
+					count: 1
+				}))
+			}, context)[table]["create"](create);
+			expect(result.ok, "create failed");
+			expect(same(result.data, row), "afterMutation changed the returned row");
+		}],
 		plugin.wrapExecutor && ["wrapExecutor keeps results intact", async () => {
 			const op = await captureOp(betterSupabase, (db) => db[table]["findMany"]({ limit: 1 }));
 			const data = {
@@ -915,4 +1071,176 @@ function defineSeed(betterSupabase, fixtures) {
 	};
 }
 //#endregion
-export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectTenantIsolation, isSeed, localAuth, localSigningKey, signLocalJwt, signTestJwt, signTestJwtWithKey, testAuthResolver, testCacheAdapter, testEventSink, testExecutor, testGenerator, testPlugin };
+//#region src/testing/notification-channel.ts
+const STATUSES = /* @__PURE__ */ new Set(["sent", "skipped"]);
+function sample(channel, email) {
+	const createdAt = temporal().Instant.fromEpochMilliseconds(0);
+	return Object.freeze({
+		deliveryId: "00000000-0000-4000-8000-00000000c0f0",
+		channel,
+		attempts: 1,
+		userId: "00000000-0000-4000-8000-0000000000aa",
+		email,
+		notification: Object.freeze({
+			id: "00000000-0000-4000-8000-00000000c0f1",
+			eventId: "00000000-0000-4000-8000-00000000c0f2",
+			type: "conformance.check",
+			data: Object.freeze({ title: "Conformance" }),
+			tenant: null,
+			actorId: null,
+			subject: Object.freeze({
+				type: "task",
+				id: "42",
+				label: "Conformance"
+			}),
+			summary: "Conformance check",
+			actionPath: "/",
+			priority: null,
+			createdAt,
+			readAt: null,
+			resolvedAt: null
+		}),
+		text: Object.freeze({ title: "Conformance check" })
+	});
+}
+/**
+* Runs the `NotificationChannel` contract against `channel`: the API version,
+* a name, and one frozen sample message it must send without mutating.
+* Throws a `ConformanceError` listing every failed check.
+*/
+function testNotificationChannel(channel, options = {}) {
+	const message = sample(channel.name, options.email ?? null);
+	return conform(`NotificationChannel "${channel.name}"`, [
+		["has apiVersion 1", () => {
+			const version = channel.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["has a name", () => {
+			expect(typeof channel.name === "string" && channel.name.length > 0, "name must be a non-empty string");
+		}],
+		["sends a message without mutating it and returns a valid result", async () => {
+			const result = await channel.send(message);
+			if (result === void 0) return;
+			expect(result.status === void 0 || STATUSES.has(result.status), `status must be "sent" or "skipped", got ${String(result.status)}`);
+			for (const key of ["provider", "providerMessageId"]) expect(result[key] === void 0 || typeof result[key] === "string", `${key} must be a string`);
+		}],
+		options.received && ["delivers the message", async () => {
+			expect((await options.received()).includes(message.deliveryId), `delivery ${message.deliveryId} was not received`);
+		}]
+	]);
+}
+//#endregion
+//#region src/testing/webhooks.ts
+const SECRET = "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw";
+function signInput(body, timestamp) {
+	return Object.freeze({
+		id: "msg_conformance",
+		body,
+		timestamp,
+		secrets: Object.freeze([SECRET])
+	});
+}
+function isHeaders(value) {
+	return typeof value === "object" && value !== null && Object.values(value).every((entry) => typeof entry === "string");
+}
+/**
+* Runs the `WebhookSigner` contract against `signer`: the API version, a
+* name, string headers that depend on the body and are stable for the same
+* input, and, with `verify`, a signature the receiver accepts.
+*/
+function testWebhookSigner(signer, options = {}) {
+	const body = JSON.stringify({
+		type: "conformance.check",
+		data: { n: 1 }
+	});
+	const now = temporal().Now.instant();
+	return conform(`WebhookSigner "${signer.name}"`, [
+		["has apiVersion 1", () => {
+			const version = signer.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["has a name", () => {
+			expect(typeof signer.name === "string" && signer.name.length > 0, "name must be a non-empty string");
+		}],
+		["returns string headers, stable for the same input", async () => {
+			const first = await signer.sign(signInput(body, now));
+			const second = await signer.sign(signInput(body, now));
+			expect(isHeaders(first), "sign must return a record of string headers");
+			expect(isHeaders(first) && Object.keys(first).length > 0, "sign must return at least one header");
+			expect(JSON.stringify(first) === JSON.stringify(second), "the same input must produce the same headers");
+		}],
+		["changes the headers when the body changes", async () => {
+			const original = await signer.sign(signInput(body, now));
+			const tampered = await signer.sign(signInput(`${body} `, now));
+			expect(JSON.stringify(original) !== JSON.stringify(tampered), "the signature must cover the body");
+		}],
+		options.verify && ["produces a signature the receiver verifies", async () => {
+			const headers = await signer.sign(signInput(body, now));
+			expect(await options.verify({
+				headers,
+				body
+			}, SECRET), "the receiver rejected the signature");
+		}]
+	]);
+}
+/**
+* Runs the `WebhookTransport` contract against `transport`: the API version,
+* a name, and one POST to `options.url` that returns an HTTP status and a
+* string body.
+*/
+function testWebhookTransport(transport, options) {
+	const body = JSON.stringify({
+		type: "conformance.check",
+		id: crypto.randomUUID()
+	});
+	return conform(`WebhookTransport "${transport.name}"`, [
+		["has apiVersion 1", () => {
+			const version = transport.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["has a name", () => {
+			expect(typeof transport.name === "string" && transport.name.length > 0, "name must be a non-empty string");
+		}],
+		["sends the request and returns a status and a body", async () => {
+			const response = await transport.send(Object.freeze({
+				url: options.url,
+				headers: Object.freeze({ "content-type": "application/json" }),
+				body
+			}));
+			expect(Number.isInteger(response.status) && response.status >= 100 && response.status <= 599, `status must be an HTTP status, got ${String(response.status)}`);
+			const responseBody = response.body;
+			expect(typeof responseBody === "string", "body must be a string");
+		}],
+		options.received && ["delivers the body", async () => {
+			expect((await options.received()).includes(body), "the receiver did not get the body");
+		}]
+	]);
+}
+/**
+* Runs the `WebhookSecretStore` contract against `store`: the API version, a
+* list of strings, and, when it can rotate, a new secret listed first while
+* the previous one keeps signing.
+*/
+function testWebhookSecretStore(store, options) {
+	return conform("WebhookSecretStore", [
+		["has apiVersion 1", () => {
+			const version = store.apiVersion;
+			expect(version === 1, "apiVersion must be 1");
+		}],
+		["lists the secrets as strings", async () => {
+			const secrets = await store.secrets(options.endpointId);
+			expect(Array.isArray(secrets) && secrets.every((secret) => typeof secret === "string"), "secrets must return an array of strings");
+		}],
+		store.rotate && ["rotates to a new secret and keeps the previous one during the overlap", async () => {
+			const first = await store.rotate(options.endpointId, { overlap: "1 hour" });
+			const second = await store.rotate(options.endpointId, { overlap: "1 hour" });
+			expect(typeof first === "string" && first.length > 0, "rotate must return the new secret");
+			expect(first !== second, "each rotation must create a new secret");
+			const secrets = await store.secrets(options.endpointId);
+			expect(secrets[0] === second, "the newest secret must be listed first");
+			expect(secrets.includes(first), "the previous secret must keep signing during the overlap");
+		}]
+	]);
+}
+//#endregion
+export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectTenantIsolation, isSeed, localAuth, localSigningKey, signLocalJwt, signTestJwt, signTestJwtWithKey, testAuthResolver, testCacheAdapter, testEventSink, testExecutor, testGenerator, testNotificationChannel, testPlugin, testQueueBackend, testSupportSessionStore, testWebhookSecretStore, testWebhookSigner, testWebhookTransport };

package/dist/{types-DONv9SHN.d.ts → types-Dnf_wRDz.d.ts}

@@ -62,6 +62,8 @@ interface TableFlags {
   readonly actor?: {
     readonly createdBy?: string;
     readonly updatedBy?: string;
+    /** The admin behind an impersonated write; `null` otherwise. */
+    readonly impersonatedBy?: string;
   };
   /** App column used for optimistic concurrency, usually `updatedAt`. */
   readonly version?: string;
@@ -140,7 +142,7 @@ interface PermdockBucketPolicy {
   readonly segment?: number;
   /**
    * Schema of the helpers `permdock rls generate` writes: PermDock's
-   * `rls.schema`. Defaults to `public`.
+   * `rls.schema`. Defaults to `permdock`, PermDock's default.
    */
   readonly schema?: string;
 }
@@ -153,14 +155,35 @@ interface PermdockTopicPolicy {
   readonly scope: string;
   /** 1-based `:`-separated topic segment holding the scope id. Defaults to the `{orgId}` segment. */
   readonly segment?: number;
+  /** Schema of PermDock's helpers (`rls.schema`). Defaults to `permdock`. */
   readonly schema?: string;
 }
 type BucketPolicyName = "tenant" | "owner" | "public" | "none";
+/**
+ * A policy through the SQL kit's [access contract](/docs/kits/access):
+ * `tenant_ids_with(permission)` for the tenant id in the path, or
+ * `is_platform(permission)`. Works with every access model.
+ */
+interface AccessBucketPolicy {
+  readonly access: {
+    /** Downloads, signed URLs, renders and metadata reads. */
+    readonly read: string;
+    /** Listing; without it `read` covers listing too. */
+    readonly list?: string;
+    /** Uploads, updates and moves; also deletes unless `delete` is set. */
+    readonly write: string;
+    readonly delete?: string;
+  };
+  /** `tenant` (default) checks the path's tenant segment; `platform` checks platform permissions. */
+  readonly scope?: "tenant" | "platform";
+  /** 1-based path segment holding the tenant id. Defaults to the `{orgId}` segment. */
+  readonly segment?: number;
+}
 interface BucketMeta {
   readonly id: string;
   readonly public: boolean;
   readonly path: string;
-  readonly policy?: BucketPolicyName | PermdockBucketPolicy;
+  readonly policy?: BucketPolicyName | PermdockBucketPolicy | AccessBucketPolicy;
   /** Claim paths for the tenant policy, when `config.claims.tenant` is not the default. */
   readonly tenant?: {
     readonly claim: readonly string[];
@@ -248,4 +271,4 @@ type IsUnion<T, U = T> = T extends unknown ? [U] extends [T] ? false : true : ne
 type PrimaryKeyValue<M extends AnyModels, T extends keyof M> = true extends IsUnion<PrimaryKeyColumn<M, T>> ? { readonly [K in PrimaryKeyColumn<M, T>]: Row<M, T>[K]; } : Row<M, T>[PrimaryKeyColumn<M, T>];
 type Simplify<T> = { [K in keyof T]: T[K]; } & {};
 //#endregion
-export { SchemaMeta as A, PrimaryKeyValue as C, Relations as D, RelationTypes as E, UniqueConstraint as F, UniqueKeyName as I, UniqueWhere as L, TableFlags as M, TableKey as N, Row as O, TableMeta as P, Update as R, PrimaryKeyColumn as S, RelationMeta as T, ModelFlags as _, Casing as a, PermdockBucketPolicy as b, Codec as c, Flags as d, ForeignKeyConstraint as f, Insert as g, FunctionsOf as h, BucketPolicyName as i, Simplify as j, Schema as k, ColumnMeta as l, FunctionTypes as m, AnyModels as n, CheckConstraint as o, FunctionMeta as p, BucketMeta as r, ClaimsMeta as s, AnyFunctions as t, DatabaseOf as u, ModelTypes as v, RealtimeTableMeta as w, PermdockTopicPolicy as x, ModelsOf as y };
+export { Schema as A, PrimaryKeyColumn as C, RelationTypes as D, RelationMeta as E, TableMeta as F, UniqueConstraint as I, UniqueKeyName as L, Simplify as M, TableFlags as N, Relations as O, TableKey as P, UniqueWhere as R, PermdockTopicPolicy as S, RealtimeTableMeta as T, Insert as _, BucketPolicyName as a, ModelsOf as b, ClaimsMeta as c, DatabaseOf as d, Flags as f, FunctionsOf as g, FunctionTypes as h, BucketMeta as i, SchemaMeta as j, Row as k, Codec as l, FunctionMeta as m, AnyFunctions as n, Casing as o, ForeignKeyConstraint as p, AnyModels as r, CheckConstraint as s, AccessBucketPolicy as t, ColumnMeta as u, ModelFlags as v, PrimaryKeyValue as w, PermdockBucketPolicy as x, ModelTypes as y, Update as z };

package/dist/user-change-CHFEUro1.js

@@ -0,0 +1,49 @@
+//#region src/query/invalidate.ts
+function isString(value) {
+	return typeof value === "string";
+}
+function queryTables(query) {
+	const tables = query.meta?.["bsTables"];
+	if (Array.isArray(tables)) {
+		const list = tables;
+		return list.every(isString) ? list : list.filter(isString);
+	}
+	const [prefix, table] = query.queryKey;
+	return prefix === "bs" && typeof table === "string" ? [table] : void 0;
+}
+/**
+* Invalidates every query that read one of `tables`: better-supabase queries
+* by their `meta.bsTables`, and other `['bs', table, ...]` keys by prefix.
+*/
+function invalidateTables(client, tables) {
+	if (tables.length === 0) return Promise.resolve();
+	const changed = new Set(tables);
+	return client.invalidateQueries({ predicate: (query) => queryTables(query)?.some((table) => changed.has(table)) ?? false });
+}
+//#endregion
+//#region src/query/user-change.ts
+/**
+* Removes every `['bs', ...]` query when the signed-in user changes or signs
+* out, so the next user never sees the previous user's rows. Returns the
+* function that stops listening. `BetterSupabaseProvider` calls it for React;
+* call it yourself with Vue, Solid, Svelte or Angular Query.
+*
+* ```ts
+* const stop = clearOnUserChange(queryClient, bs.auth);
+* ```
+*/
+function clearOnUserChange(queryClient, auth) {
+	let user;
+	const check = () => {
+		const snapshot = auth.current();
+		if (snapshot.status === "loading") return;
+		const id = snapshot.user?.id ?? null;
+		if (user !== void 0 && user !== id) queryClient.removeQueries({ queryKey: ["bs"] });
+		user = id;
+	};
+	const stop = auth.subscribe(check);
+	check();
+	return stop;
+}
+//#endregion
+export { invalidateTables as n, clearOnUserChange as t };

package/dist/{webhooks-Bh_Jf_-l.js → verify-Ce49ETPz.js}

@@ -1,9 +1,9 @@
-import { n as dbError } from "./errors-L0xK41y_.js";
-import { n as nowInstant, r as optionalTemporal } from "./temporal-BwshQk0W.js";
-import { n as temporalMissing } from "./temporal-required-CBNHT6ni.js";
-import { i as ok, n as err } from "./result-Bj6yt33D.js";
+import { n as dbError } from "./errors-DtwXa6b8.js";
+import { n as nowInstant, r as optionalTemporal } from "./temporal-CVlIV2DZ.js";
+import { n as temporalMissing } from "./temporal-required-CAt4Dc9Z.js";
+import { i as ok, n as err } from "./result-BKiliPY7.js";
 import { i as toBase64, r as fromBase64 } from "./base64-D2gsioCY.js";
-import { s as toApp } from "./shared-DnoCdMDr.js";
+import { c as toApp } from "./shared-D1dRUrAg.js";
 //#region src/webhooks/verify.ts
 const encoder = /* @__PURE__ */ new TextEncoder();
 /** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */

package/dist/{version-Bmf7_FzM.js → version-DM_Roffb.js}

@@ -1,4 +1,4 @@
 //#region src/core/version.ts
-const VERSION = "0.4.0";
+const VERSION = "0.5.0";
 //#endregion
 export { VERSION as t };

package/dist/{view-B64o81wp.d.ts → view-BEf0diC5.d.ts}

@@ -1,6 +1,6 @@
-import { p as DbError } from "./result-CqEsbgYs.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-C7MNQ1Ob.js";
-import { i as InvalidReason, r as AuthState } from "./resolve-BAqQcwMW.js";
+import { _ as DbError } from "./executor-BunPOO-k.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-C15TJq77.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-CusDgPaD.js";
 import { JWTClaims, UserClaims } from "@supabase/server";
 //#region src/auth/actor.d.ts
 /** One level of an RFC 8693 `act` chain: who acts, and who acted before it. */
@@ -48,6 +48,11 @@ type AuthSession<C = unknown, P = unknown> = {
   readonly profile?: P;
   /** `aal2` once the user verified a second factor in this session. */
   readonly aal: Aal;
+  /**
+   * Signed in with `signInAnonymously()` (the `is_anonymous` claim). Guards
+   * refuse these users unless `allow` lists `'anonymous'`.
+   */
+  readonly anonymous: boolean;
   /** How the user signed in (`password`, `totp`, `sso/saml`, ...). */
   readonly amr: readonly AmrEntry[];
   /** Set when an admin acts as this user (the `act` claim), for a banner. */