better-supabase 0.4.0 → 0.5.0

package/dist/events-B21UOhvP.d.ts

@@ -1,84 +0,0 @@
-import { g as Operation } from "./executor-B5IoUxLE.js";
-import { p as DbError } from "./result-CqEsbgYs.js";
-import { h as RequestContext, l as MutationKind } from "./plugin-bNhvJwRh.js";
-//#region src/core/logger.d.ts
-type LogFields = Readonly<Record<string, unknown>>;
-/**
- * Where better-supabase reports problems it swallows on purpose: event
- * handlers, `afterMutation` hooks, sinks and cache adapters that throw.
- * Structured loggers (pino, consola, OpenTelemetry logs) fit directly.
- */
-interface Logger {
-  debug(message: string, fields?: LogFields): void;
-  info(message: string, fields?: LogFields): void;
-  warn(message: string, fields?: LogFields): void;
-  error(message: string, fields?: LogFields): void;
-}
-/** The default: `console`, with a `better-supabase:` prefix. */
-declare const consoleLogger: Logger;
-declare const silentLogger: Logger;
-//#endregion
-//#region src/core/events.d.ts
-interface QueryEvent {
-  readonly table: string;
-  readonly operation: Operation["kind"];
-  readonly ok: boolean;
-  readonly durationMs: number;
-  readonly rows: number;
-  /**
-   * An unbounded read returned `maxRows` rows: PostgREST's `db-max-rows`
-   * probably cut it short. Add `limit` or use `paginate`.
-   */
-  readonly truncated: boolean;
-}
-interface MutationNotice {
-  readonly table: string;
-  readonly kind: MutationKind;
-  readonly rows: readonly Readonly<Record<string, unknown>>[];
-  readonly context: RequestContext;
-}
-/** A successful RPC registered with `betterSupabase.defineRpc(name, { invalidates })`. */
-interface RpcNotice {
-  readonly name: string;
-  /** App keys of the tables the function changes. */
-  readonly invalidates: readonly string[];
-  readonly context: RequestContext;
-}
-interface ErrorEvent {
-  readonly table?: string;
-  readonly error: DbError;
-}
-interface AuthEvent {
-  readonly source: "bearer" | "cookie" | "none";
-  readonly ok: boolean;
-  readonly userId?: string;
-}
-interface RefreshEvent {
-  readonly ok: boolean;
-  readonly shared: boolean;
-  readonly durationMs: number;
-}
-interface BetterSupabaseEvents {
-  query: QueryEvent;
-  mutation: MutationNotice;
-  rpc: RpcNotice;
-  error: ErrorEvent;
-  auth: AuthEvent;
-  refresh: RefreshEvent;
-}
-type EventName = keyof BetterSupabaseEvents;
-type EventHandler<K extends EventName> = (event: BetterSupabaseEvents[K]) => void;
-/**
- * Observers only: a handler that throws is reported to the logger and never
- * changes a result.
- */
-declare class EventHub {
-  #private;
-  readonly logger: Logger;
-  constructor(logger?: Logger);
-  on<K extends EventName>(name: K, handler: EventHandler<K>): () => void;
-  has(name: EventName): boolean;
-  emit<K extends EventName>(name: K, event: BetterSupabaseEvents[K]): void;
-}
-//#endregion
-export { EventHub as a, QueryEvent as c, LogFields as d, Logger as f, EventHandler as i, RefreshEvent as l, silentLogger as m, BetterSupabaseEvents as n, EventName as o, consoleLogger as p, ErrorEvent as r, MutationNotice as s, AuthEvent as t, RpcNotice as u };

package/dist/executor-B5IoUxLE.d.ts

@@ -1,195 +0,0 @@
-import { P as TableMeta, T as RelationMeta, c as Codec } from "./types-DONv9SHN.js";
-import { o as Result, v as ErrorMapper } from "./result-CqEsbgYs.js";
-//#region src/ir/types.d.ts
-/**
- * The query IR. Every repository call becomes one of these operations; the
- * executor compiles it to PostgREST or SQL. Column names in the IR are
- * database names; `Selection` carries the app aliases.
- */
-type ColumnOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "is" | "like" | "ilike" | "contains" | "containedBy" | "overlaps" | "fts";
-type Quantifier = "some" | "none" | "every";
-type Condition = {
-  readonly kind: "and";
-  readonly items: readonly Condition[];
-} | {
-  readonly kind: "or";
-  readonly items: readonly Condition[];
-} | {
-  readonly kind: "not";
-  readonly item: Condition;
-} | {
-  readonly kind: "column";
-  readonly column: string;
-  readonly op: ColumnOp;
-  readonly value: unknown;
-  /** Full-text search configuration for `fts`. */
-  readonly config?: string;
-} | {
-  readonly kind: "relation";
-  readonly name: string;
-  readonly relation: RelationMeta;
-  readonly target: TableMeta;
-  readonly quantifier: Quantifier;
-  readonly where: Condition | undefined;
-};
-interface SelectColumn {
-  /** Key in the returned row. */
-  readonly alias: string;
-  /** Database column name. */
-  readonly column: string;
-  /** Read the column as text, so exact `int8`/`numeric` values survive JSON. */
-  readonly cast?: "text";
-  /** Decodes the returned value (see `ColumnMeta.codec`). */
-  readonly codec?: Codec;
-}
-interface OrderTerm {
-  readonly column: string;
-  readonly direction: "asc" | "desc";
-  readonly nulls?: "first" | "last";
-}
-interface Include {
-  readonly alias: string;
-  readonly relation: RelationMeta;
-  readonly target: TableMeta;
-  readonly selection: Selection;
-  readonly where: Condition | undefined;
-  readonly orderBy: readonly OrderTerm[];
-  readonly limit: number | undefined;
-  /** Drop parent rows without a match (`!inner`). */
-  readonly required: boolean;
-  /**
-   * `_count` include: returns the number of matching related rows instead of
-   * rows, folded into `row._count[count]` when decoded.
-   */
-  readonly count?: string;
-  /**
-   * `_sum`/`_avg`/`_min`/`_max` include: `selection.aggregate` holds the
-   * measures, folded into `row[`_${fn}`][name]` when decoded.
-   */
-  readonly aggregate?: {
-    readonly fn: AggregateFn;
-    readonly name: string;
-  };
-}
-type AggregateFn = "sum" | "avg" | "min" | "max";
-interface Measure {
-  readonly fn: AggregateFn;
-  /** Key in the returned row (`_sum_amount`, or the column alias in an include). */
-  readonly key: string;
-  /** App column name, the key under `_sum` in the decoded row. */
-  readonly alias: string;
-  /** Database column name. */
-  readonly column: string;
-  /** Read the result as text, so exact `int8`/`numeric` values survive JSON. */
-  readonly cast?: "text";
-  readonly codec?: Codec;
-}
-/**
- * Aggregates instead of rows. `Selection.columns` become the grouping
- * columns; without any, the result is exactly one row.
- */
-interface Aggregation {
-  /** Also return `_count`, the number of rows in each group. */
-  readonly count: boolean;
-  readonly measures: readonly Measure[];
-}
-interface Selection {
-  readonly columns: readonly SelectColumn[];
-  readonly includes: readonly Include[];
-  readonly aggregate?: Aggregation;
-}
-type CountMode = "exact" | "planned" | "estimated";
-interface SelectOp {
-  readonly kind: "select";
-  readonly table: TableMeta;
-  readonly selection: Selection;
-  readonly where: Condition | undefined;
-  readonly orderBy: readonly OrderTerm[];
-  readonly limit: number | undefined;
-  readonly offset: number | undefined;
-  readonly count: CountMode | undefined;
-  /** Only count, return no rows. */
-  readonly head: boolean;
-  readonly single: "one" | "maybe" | undefined;
-  /**
-   * Read from this set-returning function instead of the table (`db.$search`).
-   * Only executors with `functionSources` honor it.
-   */
-  readonly source?: FunctionSource;
-}
-/** A function returning `setof <table>`, called with named arguments. */
-interface FunctionSource {
-  readonly schema: string;
-  readonly name: string;
-  readonly args: Readonly<Record<string, unknown>>;
-}
-interface InsertOp {
-  readonly kind: "insert";
-  readonly table: TableMeta;
-  /** Rows keyed by database column names. */
-  readonly rows: readonly Readonly<Record<string, unknown>>[];
-  readonly returning: Selection | undefined;
-  readonly onConflict: {
-    readonly columns: readonly string[];
-    readonly action: "update" | "ignore";
-  } | undefined;
-  /** Missing columns become `null` instead of their default in bulk inserts. */
-  readonly defaultToNull: boolean;
-}
-interface UpdateOp {
-  readonly kind: "update";
-  readonly table: TableMeta;
-  /** Keyed by database column names. */
-  readonly set: Readonly<Record<string, unknown>>;
-  readonly where: Condition | undefined;
-  readonly returning: Selection | undefined;
-}
-interface DeleteOp {
-  readonly kind: "delete";
-  readonly table: TableMeta;
-  readonly where: Condition | undefined;
-  readonly returning: Selection | undefined;
-}
-type Operation = SelectOp | InsertOp | UpdateOp | DeleteOp;
-type MutationOp = InsertOp | UpdateOp | DeleteOp;
-declare const and: (...items: (Condition | undefined)[]) => Condition | undefined;
-declare const or: (...items: Condition[]) => Condition;
-declare const not: (item: Condition) => Condition;
-declare const column: (name: string, op: ColumnOp, value: unknown) => Condition;
-//#endregion
-//#region src/core/executor.d.ts
-interface ExecuteContext {
-  readonly signal?: AbortSignal;
-  readonly errorMappers: readonly ErrorMapper[];
-}
-interface ExecuteResult {
-  /** Rows keyed by the aliases in the operation's selection. */
-  readonly rows: readonly Record<string, unknown>[];
-  readonly count: number | null;
-}
-/**
- * Runs IR operations. PostgREST (`postgrestExecutor`) and SQL
- * (`better-supabase/postgres`) are built in; any other backend can implement
- * this interface and prove it with `testExecutor` from `better-supabase/testing`.
- */
-interface Executor {
-  readonly name: string;
-  /** Honors `SelectOp.source`. `db.$search` fails on executors without it. */
-  readonly functionSources?: boolean;
-  execute(op: Operation, context: ExecuteContext): Promise<Result<ExecuteResult>>;
-  /** Calls a database function. Optional; `db.$rpc` fails without it. */
-  rpc?(name: string, args: Readonly<Record<string, unknown>>, context: RpcContext): Promise<Result<unknown>>;
-  /**
-   * Runs several reads together, for `db.$many`: one transaction on a SQL
-   * connection. Returns one result per operation, in order. Optional;
-   * without it `db.$many` runs the operations in parallel.
-   */
-  batch?(ops: readonly Operation[], context: ExecuteContext): Promise<readonly Result<ExecuteResult>[]>;
-}
-interface RpcContext extends ExecuteContext {
-  readonly schema: string;
-  /** The function is `stable`: send it as a GET, so read replicas can serve it. */
-  readonly get?: boolean;
-}
-//#endregion
-export { and as C, or as E, UpdateOp as S, not as T, OrderTerm as _, AggregateFn as a, SelectOp as b, Condition as c, FunctionSource as d, Include as f, Operation as g, MutationOp as h, RpcContext as i, CountMode as l, Measure as m, ExecuteResult as n, Aggregation as o, InsertOp as p, Executor as r, ColumnOp as s, ExecuteContext as t, DeleteOp as u, Quantifier as v, column as w, Selection as x, SelectColumn as y };

package/dist/invalidate-CgxmRamI.js

@@ -1,24 +0,0 @@
-//#region src/query/invalidate.ts
-function isString(value) {
-	return typeof value === "string";
-}
-function queryTables(query) {
-	const tables = query.meta?.["bsTables"];
-	if (Array.isArray(tables)) {
-		const list = tables;
-		return list.every(isString) ? list : list.filter(isString);
-	}
-	const [prefix, table] = query.queryKey;
-	return prefix === "bs" && typeof table === "string" ? [table] : void 0;
-}
-/**
-* Invalidates every query that read one of `tables`: better-supabase queries
-* by their `meta.bsTables`, and other `['bs', table, ...]` keys by prefix.
-*/
-function invalidateTables(client, tables) {
-	if (tables.length === 0) return Promise.resolve();
-	const changed = new Set(tables);
-	return client.invalidateQueries({ predicate: (query) => queryTables(query)?.some((table) => changed.has(table)) ?? false });
-}
-//#endregion
-export { invalidateTables as t };

package/dist/permdock-sql-DImJULY-.d.ts

@@ -1,17 +0,0 @@
-//#region src/core/permdock-sql.d.ts
-/**
- * The part of PermDock's `permissions.catalog.json` the Storage and Realtime
- * builders read: `import catalog from './permissions.catalog.json'`.
- */
-interface PermdockCatalog {
-  readonly permissions: readonly {
-    readonly key: string;
-    readonly rowConditions?: boolean;
-  }[];
-}
-/** The keys a bucket or topic PermDock policy names. */
-declare function permdockKeys(policy: {
-  readonly permdock: object;
-}): string[];
-//#endregion
-export { permdockKeys as n, PermdockCatalog as t };

package/dist/plugin-BqR6wKMB.js

@@ -1,23 +0,0 @@
-//#region src/core/plugin.ts
-const PLUGIN_API_VERSION = 1;
-const RANK = {
-	pre: 0,
-	normal: 1,
-	post: 2
-};
-/** Plugins in hook order: `pre`, then unmarked in `use()` order, then `post`. */
-function orderPlugins(plugins) {
-	return plugins.map((plugin, index) => ({
-		plugin,
-		index
-	})).sort((a, b) => RANK[a.plugin.enforce ?? "normal"] - RANK[b.plugin.enforce ?? "normal"] || a.index - b.index).map(({ plugin }) => plugin);
-}
-/** Identity helper that fixes `apiVersion` and infers the plugin types. */
-function definePlugin(plugin) {
-	return {
-		...plugin,
-		apiVersion: 1
-	};
-}
-//#endregion
-export { definePlugin as n, orderPlugins as r, PLUGIN_API_VERSION as t };

package/dist/respond-DgIbdrt8.d.ts

@@ -1,194 +0,0 @@
-import { n as AnyModels, t as AnyFunctions } from "./types-DONv9SHN.js";
-import { p as DbError, t as AsyncResult } from "./result-CqEsbgYs.js";
-import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "./define-CRS2MRV3.js";
-import { h as RequestContext } from "./plugin-bNhvJwRh.js";
-import { t as BetterSupabaseEnv } from "./index-Dy6kuF0P.js";
-import { o as SqlClaims, t as BetterPostgres } from "./pool-DFwEQwmN.js";
-import { o as ImpersonationOptions, t as Aal } from "./mfa-C7MNQ1Ob.js";
-import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-BAqQcwMW.js";
-import { n as Bucket } from "./index-528Ugmyp.js";
-import { SupabaseClient } from "@supabase/supabase-js";
-//#region src/server/delete-account.d.ts
-interface DeleteAccountOptions {
-  /**
-   * Buckets to clear first. Objects whose `owner` placeholder (`{userId}`,
-   * or `owner.param` for `owner` buckets) is the user are removed; buckets
-   * without one are skipped.
-   */
-  readonly buckets?: readonly Bucket<string>[];
-  /**
-   * App keys of tables whose rows the database deletes or updates with the
-   * user (`on delete cascade` or `set null` to `auth.users`). They get a
-   * table-wide `mutation` notice, so caches drop their reads.
-   */
-  readonly cascades?: readonly string[];
-  readonly context?: RequestContext;
-  readonly signal?: AbortSignal;
-}
-interface DeleteAccountResult {
-  readonly userId: string;
-  /** Removed objects per bucket id. */
-  readonly removed: Readonly<Record<string, number>>;
-}
-//#endregion
-//#region src/server/replicas.d.ts
-/** Cookie holding the epoch ms until which reads stay on the primary. */
-declare const PRIMARY_COOKIE = "bs-primary-until";
-/** Where a request context sends its reads. */
-interface ReplicaState {
-  /** Reads go to the primary: this context wrote, or a recent request did. */
-  readonly pinned: boolean;
-  /** This context wrote through its repositories (or called `pin()`). */
-  readonly wrote: boolean;
-  /** Sends later reads to the primary, e.g. after a write through `$client` or `ctx.sql`. */
-  pin(): void;
-}
-//#endregion
-//#region src/server/server.d.ts
-interface ServerOptions {
-  /** Defaults to `loadEnv()`. */
-  readonly env?: BetterSupabaseEnv;
-  /** Enables `ctx.sql` and `actingAs()`. */
-  readonly postgres?: BetterPostgres;
-  readonly auth?: Omit<ResolveAuthOptions, "env">;
-  /**
-   * Fetch the JWKS when the server is created, so the first request verifies
-   * its token without waiting for it. Applies when `env.jwksUrl` is set and
-   * `auth.jwks` is not. Defaults to true, except under `NODE_ENV=test`.
-   */
-  readonly prefetchJwks?: boolean;
-  /**
-   * Extra headers on the caller's PostgREST requests, readable in Postgres as
-   * `current_setting('request.headers')` (channel, request id, client IP for audit).
-   */
-  readonly headers?: (request: Request) => Readonly<Record<string, string>>;
-  /**
-   * PostgREST URL for the caller's reads: a read replica or the `<ref>-all`
-   * load balancer. Defaults to `SUPABASE_READ_URL`; `false` reads from the
-   * primary.
-   */
-  readonly readUrl?: string | false;
-  readonly replicas?: {
-    /** How long the next requests read from the primary after a write. Defaults to 5 s. */
-    readonly pinMs?: number;
-  };
-}
-interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
-  readonly auth: AuthState<C, P>;
-  readonly resolution: AuthResolution<C, P>;
-  /** supabase-js client scoped to the caller (RLS applies). */
-  readonly supabase: SupabaseClient;
-  /** Repositories over PostgREST as the caller. */
-  readonly db: Db<M, F, E, SupabaseClient>;
-  /** Repositories over direct Postgres as the caller, when `postgres` is configured. */
-  readonly sql: Db<M, F, E, undefined> | undefined;
-  /** Calls, waves, tables and time for `db` and `sql` together. */
-  stats(): DbStats;
-  /** Where `db` reads go, when a read URL is configured. */
-  readonly replica: ReplicaState | undefined;
-}
-interface ContextOptions {
-  readonly refresh?: boolean;
-  /** Epoch ms until which `db` reads from the primary (the `bs-primary-until` cookie). */
-  readonly pinnedUntil?: number;
-  /** Also records this context's calls into a request-wide recorder. */
-  readonly stats?: StatsRecorder;
-}
-interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
-  readonly env: BetterSupabaseEnv;
-  resolve(request: Request, options?: {
-    readonly refresh?: boolean;
-  }): Promise<AuthResolution<C, P>>;
-  /**
-   * Resolves auth and binds repositories to the caller. Refreshes an expired
-   * cookie session only with `refresh: true`; send `ctx.resolution.apply(response)`.
-   */
-  context(request: Request, options?: ContextOptions): Promise<ServerContext<M, F, E, C, P>>;
-  /**
-   * The context for a resolution from `resolve(request)`, so one resolution
-   * can back several contexts without verifying the token again.
-   */
-  contextFromResolution(resolution: AuthResolution<C, P>, request: Request, options?: Omit<ContextOptions, "refresh">): ServerContext<M, F, E, C, P>;
-  /** The context for an auth state resolved elsewhere (the proxy, a queue message). */
-  contextFor(auth: AuthState<C, P>, options?: ContextOptions): ServerContext<M, F, E, C, P>;
-  /** A stateless supabase-js client for an auth state, optionally with extra request headers. */
-  supabaseFor(auth: AuthState, headers?: Readonly<Record<string, string>>): SupabaseClient;
-  /** Repositories for an auth state (e.g. one resolved by the proxy). */
-  dbFor(auth: AuthState, context?: RequestContext): Db<M, F, E, SupabaseClient>;
-  /** Service-role repositories. Bypasses RLS; the actor is `service`. */
-  admin(context?: RequestContext): Db<M, F, E, SupabaseClient>;
-  /**
-   * Deletes a user: their objects in `buckets`, then the Auth user, then a
-   * `mutation` notice for `auth.users`. Needs the secret key. Access tokens
-   * already issued stay valid until they expire.
-   */
-  deleteAccount(userId: string, options?: DeleteAccountOptions): AsyncResult<DeleteAccountResult>;
-  /**
-   * Repositories running as a user, with RLS, over direct Postgres. With
-   * `impersonation`, the claims carry `act: { sub: actor, reason }`, which
-   * the `audit` and `actor` SQL kit modules record.
-   */
-  actingAs(userId: string, claims?: Omit<SqlClaims, "sub" | "act">, impersonation?: ImpersonationOptions): Db<M, F, E, undefined>;
-}
-/**
- * Server-side entry point for APIs, jobs, MCP servers and framework
- * adapters. Holds the secrets; `betterSupabase` stays isomorphic.
- */
-declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
-//#endregion
-//#region src/server/respond.d.ts
-type AuthKind = AuthState["kind"];
-interface GuardOptions {
-  /** Auth kinds allowed through. Defaults to `['user']`. */
-  readonly allow?: readonly Exclude<AuthKind, "invalid">[];
-  /**
-   * Assurance level user sessions need. `aal2` answers 403 with
-   * `required: 'aal2'` until the user verifies a second factor.
-   */
-  readonly aal?: Aal;
-  /**
-   * OAuth scopes a delegated token (an OAuth client or an `act` chain) needs.
-   * A missing one answers 403 with `error="insufficient_scope"`. The user's
-   * own session is not limited by scopes.
-   */
-  readonly scopes?: readonly string[];
-}
-/** Guard options for middleware and fetch handlers that resolve the caller themselves. */
-interface MiddlewareOptions extends GuardOptions {
-  /**
-   * Refresh an expired cookie session and send the new cookies. Only for
-   * routes browsers call with cookies; bearer tokens never refresh.
-   */
-  readonly refresh?: boolean;
-}
-/** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
-declare function guard(auth: AuthState, allow?: GuardOptions["allow"], aal?: Aal, scopes?: readonly string[]): DbError | undefined;
-declare function isResult(value: unknown): value is {
-  ok: boolean;
-  data: unknown;
-  error: unknown;
-};
-type Settled = {
-  readonly ok: true;
-  readonly data: unknown;
-} | {
-  readonly ok: false;
-  readonly error: DbError;
-};
-/**
- * Settles a handler's return value: `Result`s and `AsyncResult`s unwrap,
- * thrown `DbException`s (or errors whose `cause` is a `DbError`) become
- * errors, anything else is data. Other thrown
- * errors propagate.
- */
-declare function settle(run: () => unknown): Promise<Settled>;
-interface RespondOptions {
-  readonly instance?: string;
-  readonly expose?: boolean;
-  /** Status for data responses. Defaults to 200 (204 without data). */
-  readonly status?: number;
-}
-/** A handler's value as a response: `Response` as is, data as JSON, errors as Problem Details. */
-declare function respond(run: () => unknown, options?: RespondOptions): Promise<Response>;
-//#endregion
-export { DeleteAccountOptions as _, Settled as a, respond as c, ContextOptions as d, ServerContext as f, ReplicaState as g, PRIMARY_COOKIE as h, RespondOptions as i, settle as l, createServer as m, GuardOptions as n, guard as o, ServerOptions as p, MiddlewareOptions as r, isResult as s, AuthKind as t, BetterServer as u, DeleteAccountResult as v };

package/dist/view-BrJI2LKp.js

@@ -1,45 +0,0 @@
-import { _ as delegationOf, g as actorOf, n as amrOf, t as aalOf, y as impersonatorOf } from "./mfa-byfjruR9.js";
-//#region src/auth/view.ts
-/** Drops the token from an `AuthState`, leaving only serializable fields. */
-function toSession(auth) {
-	switch (auth.kind) {
-		case "user": {
-			const impersonator = impersonatorOf(auth.claims);
-			const outcome = actorOf(auth.claims);
-			const actor = outcome.ok ? outcome.actor : void 0;
-			const scopes = actor ? delegationOf(auth.claims)?.scopes : void 0;
-			const delegation = actor && (scopes || actor.chain) ? {
-				scopes: scopes ?? [],
-				...actor.chain ? { chain: actor.chain } : {}
-			} : void 0;
-			return {
-				kind: "user",
-				user: auth.user,
-				claims: auth.claims,
-				expiresAt: auth.expiresAt,
-				...auth.profile === void 0 ? {} : { profile: auth.profile },
-				aal: aalOf(auth.claims),
-				amr: amrOf(auth.claims),
-				...impersonator ? { impersonator } : {},
-				...actor ? { actor } : {},
-				...delegation ? { delegation } : {}
-			};
-		}
-		case "service": return {
-			kind: "service",
-			keyName: auth.keyName
-		};
-		case "anon": return {
-			kind: "anon",
-			reason: auth.reason
-		};
-		case "invalid": return {
-			kind: "invalid",
-			reason: auth.reason,
-			error: auth.error
-		};
-		default: return auth;
-	}
-}
-//#endregion
-export { toSession as t };