better-supabase 0.4.0 → 0.5.1

package/dist/{result-CqEsbgYs.d.ts → executor-BunPOO-k.d.ts}

@@ -1,3 +1,163 @@
+import { E as RelationMeta, F as TableMeta, l as Codec } from "./types-Dnf_wRDz.js";
+//#region src/ir/types.d.ts
+/**
+ * The query IR. Every repository call becomes one of these operations; the
+ * executor compiles it to PostgREST or SQL. Column names in the IR are
+ * database names; `Selection` carries the app aliases.
+ */
+type ColumnOp = "eq" | "neq" | "gt" | "gte" | "lt" | "lte" | "in" | "is" | "like" | "ilike" | "contains" | "containedBy" | "overlaps" | "fts";
+type Quantifier = "some" | "none" | "every";
+type Condition = {
+  readonly kind: "and";
+  readonly items: readonly Condition[];
+} | {
+  readonly kind: "or";
+  readonly items: readonly Condition[];
+} | {
+  readonly kind: "not";
+  readonly item: Condition;
+} | {
+  readonly kind: "column";
+  readonly column: string;
+  readonly op: ColumnOp;
+  readonly value: unknown;
+  /** Full-text search configuration for `fts`. */
+  readonly config?: string;
+} | {
+  readonly kind: "relation";
+  readonly name: string;
+  readonly relation: RelationMeta;
+  readonly target: TableMeta;
+  readonly quantifier: Quantifier;
+  readonly where: Condition | undefined;
+};
+interface SelectColumn {
+  /** Key in the returned row. */
+  readonly alias: string;
+  /** Database column name. */
+  readonly column: string;
+  /** Read the column as text, so exact `int8`/`numeric` values survive JSON. */
+  readonly cast?: "text";
+  /** Decodes the returned value (see `ColumnMeta.codec`). */
+  readonly codec?: Codec;
+}
+interface OrderTerm {
+  readonly column: string;
+  readonly direction: "asc" | "desc";
+  readonly nulls?: "first" | "last";
+}
+interface Include {
+  readonly alias: string;
+  readonly relation: RelationMeta;
+  readonly target: TableMeta;
+  readonly selection: Selection;
+  readonly where: Condition | undefined;
+  readonly orderBy: readonly OrderTerm[];
+  readonly limit: number | undefined;
+  /** Drop parent rows without a match (`!inner`). */
+  readonly required: boolean;
+  /**
+   * `_count` include: returns the number of matching related rows instead of
+   * rows, folded into `row._count[count]` when decoded.
+   */
+  readonly count?: string;
+  /**
+   * `_sum`/`_avg`/`_min`/`_max` include: `selection.aggregate` holds the
+   * measures, folded into `row[`_${fn}`][name]` when decoded.
+   */
+  readonly aggregate?: {
+    readonly fn: AggregateFn;
+    readonly name: string;
+  };
+}
+type AggregateFn = "sum" | "avg" | "min" | "max";
+interface Measure {
+  readonly fn: AggregateFn;
+  /** Key in the returned row (`_sum_amount`, or the column alias in an include). */
+  readonly key: string;
+  /** App column name, the key under `_sum` in the decoded row. */
+  readonly alias: string;
+  /** Database column name. */
+  readonly column: string;
+  /** Read the result as text, so exact `int8`/`numeric` values survive JSON. */
+  readonly cast?: "text";
+  readonly codec?: Codec;
+}
+/**
+ * Aggregates instead of rows. `Selection.columns` become the grouping
+ * columns; without any, the result is exactly one row.
+ */
+interface Aggregation {
+  /** Also return `_count`, the number of rows in each group. */
+  readonly count: boolean;
+  readonly measures: readonly Measure[];
+}
+interface Selection {
+  readonly columns: readonly SelectColumn[];
+  readonly includes: readonly Include[];
+  readonly aggregate?: Aggregation;
+}
+type CountMode = "exact" | "planned" | "estimated";
+interface SelectOp {
+  readonly kind: "select";
+  readonly table: TableMeta;
+  readonly selection: Selection;
+  readonly where: Condition | undefined;
+  readonly orderBy: readonly OrderTerm[];
+  readonly limit: number | undefined;
+  readonly offset: number | undefined;
+  readonly count: CountMode | undefined;
+  /** Only count, return no rows. */
+  readonly head: boolean;
+  readonly single: "one" | "maybe" | undefined;
+  /** `limit` includes one row past the page, which `paginate()` reads to set `hasMore`. */
+  readonly lookAhead?: boolean;
+  /**
+   * Read from this set-returning function instead of the table (`db.$search`).
+   * Only executors with `functionSources` honor it.
+   */
+  readonly source?: FunctionSource;
+}
+/** A function returning `setof <table>`, called with named arguments. */
+interface FunctionSource {
+  readonly schema: string;
+  readonly name: string;
+  readonly args: Readonly<Record<string, unknown>>;
+}
+interface InsertOp {
+  readonly kind: "insert";
+  readonly table: TableMeta;
+  /** Rows keyed by database column names. */
+  readonly rows: readonly Readonly<Record<string, unknown>>[];
+  readonly returning: Selection | undefined;
+  readonly onConflict: {
+    readonly columns: readonly string[];
+    readonly action: "update" | "ignore";
+  } | undefined;
+  /** Missing columns become `null` instead of their default in bulk inserts. */
+  readonly defaultToNull: boolean;
+}
+interface UpdateOp {
+  readonly kind: "update";
+  readonly table: TableMeta;
+  /** Keyed by database column names. */
+  readonly set: Readonly<Record<string, unknown>>;
+  readonly where: Condition | undefined;
+  readonly returning: Selection | undefined;
+}
+interface DeleteOp {
+  readonly kind: "delete";
+  readonly table: TableMeta;
+  readonly where: Condition | undefined;
+  readonly returning: Selection | undefined;
+}
+type Operation = SelectOp | InsertOp | UpdateOp | DeleteOp;
+type MutationOp = InsertOp | UpdateOp | DeleteOp;
+declare const and: (...items: (Condition | undefined)[]) => Condition | undefined;
+declare const or: (...items: Condition[]) => Condition;
+declare const not: (item: Condition) => Condition;
+declare const column: (name: string, op: ColumnOp, value: unknown) => Condition;
+//#endregion
 //#region src/core/errors.d.ts
 /**
  * Extra fields carried by each error kind. Plugins can add kinds through the
@@ -34,6 +194,10 @@ interface DbErrorKinds {
     constraint?: string;
   };
   invalid_input: Record<never, never>;
+  /** A stored value the app type can't hold, e.g. `infinity` for a Temporal timestamp. */
+  invalid_value: {
+    column?: string;
+  };
   raised: Record<never, never>;
   timeout: Record<never, never>;
   serialization: Record<never, never>;
@@ -200,4 +364,39 @@ declare function toBetterResult<T>(result: AsyncResult<T>, api: BetterResultApi<
 declare function fromBetterResult<T>(result: BetterResultValue<T, unknown>, mapError?: (error: unknown) => DbError): Result<T>;
 declare function toDbError(cause: unknown): DbError;
 //#endregion
-export { isConflict as C, statusOf as D, mapDbError as E, isCheck as S, isForeignKey as T, DbException as _, Ok as a, ValidationIssue as b, err as c, toBetterResult as d, toDbError as f, DbErrorOf as g, DbErrorKinds as h, Err as i, fromBetterResult as l, DbErrorKind as m, BetterResultApi as n, Result as o, DbError as p, BetterResultValue as r, ThrowMapper as s, AsyncResult as t, ok as u, ErrorMapper as v, isDbError as w, dbError as x, RawDbError as y };
+//#region src/core/executor.d.ts
+interface ExecuteContext {
+  readonly signal?: AbortSignal;
+  readonly errorMappers: readonly ErrorMapper[];
+}
+interface ExecuteResult {
+  /** Rows keyed by the aliases in the operation's selection. */
+  readonly rows: readonly Record<string, unknown>[];
+  readonly count: number | null;
+}
+/**
+ * Runs IR operations. PostgREST (`postgrestExecutor`) and SQL
+ * (`better-supabase/postgres`) are built in; any other backend can implement
+ * this interface and prove it with `testExecutor` from `better-supabase/testing`.
+ */
+interface Executor {
+  readonly name: string;
+  /** Honors `SelectOp.source`. `db.$search` fails on executors without it. */
+  readonly functionSources?: boolean;
+  execute(op: Operation, context: ExecuteContext): Promise<Result<ExecuteResult>>;
+  /** Calls a database function. Optional; `db.$rpc` fails without it. */
+  rpc?(name: string, args: Readonly<Record<string, unknown>>, context: RpcContext): Promise<Result<unknown>>;
+  /**
+   * Runs several reads together, for `db.$many`: one transaction on a SQL
+   * connection. Returns one result per operation, in order. Optional;
+   * without it `db.$many` runs the operations in parallel.
+   */
+  batch?(ops: readonly Operation[], context: ExecuteContext): Promise<readonly Result<ExecuteResult>[]>;
+}
+interface RpcContext extends ExecuteContext {
+  readonly schema: string;
+  /** The function is `stable`: send it as a GET, so read replicas can serve it. */
+  readonly get?: boolean;
+}
+//#endregion
+export { or as $, mapDbError as A, InsertOp as B, RawDbError as C, isConflict as D, isCheck as E, Condition as F, Quantifier as G, MutationOp as H, CountMode as I, Selection as J, SelectColumn as K, DeleteOp as L, AggregateFn as M, Aggregation as N, isDbError as O, ColumnOp as P, not as Q, FunctionSource as R, ErrorMapper as S, dbError as T, Operation as U, Measure as V, OrderTerm as W, and as X, UpdateOp as Y, column as Z, DbError as _, AsyncResult as a, DbErrorOf as b, Err as c, ThrowMapper as d, err as f, toDbError as g, toBetterResult as h, RpcContext as i, statusOf as j, isForeignKey as k, Ok as l, ok as m, ExecuteResult as n, BetterResultApi as o, fromBetterResult as p, SelectOp as q, Executor as r, BetterResultValue as s, ExecuteContext as t, Result as u, DbErrorKind as v, ValidationIssue as w, DbException as x, DbErrorKinds as y, Include as z };

package/dist/{executor-CZ7ImRiD.d.ts → executor-Cghdstwu.d.ts}

@@ -1,5 +1,4 @@
-import { r as Executor } from "./executor-B5IoUxLE.js";
-import { y as RawDbError } from "./result-CqEsbgYs.js";
+import { C as RawDbError, r as Executor } from "./executor-BunPOO-k.js";
 //#region src/postgres/executor.d.ts
 /**
  * Anything that runs parameterized SQL: `ctx.postgres` from

package/dist/{executor-CVt6dD0B.js → executor-XycESQPH.js}

@@ -1,6 +1,6 @@
-import { c as mapDbError, n as dbError } from "./errors-L0xK41y_.js";
-import { i as ok, n as err, o as toDbError } from "./result-Bj6yt33D.js";
-import { t as compileSql } from "./sql-B34HU2DI.js";
+import { c as mapDbError, n as dbError } from "./errors-DtwXa6b8.js";
+import { i as ok, n as err, o as toDbError } from "./result-BKiliPY7.js";
+import { t as compileSql } from "./sql-Coh6n4cC.js";
 //#region src/postgres/executor.ts
 function isPgError(value) {
 	return typeof value === "object" && value !== null && typeof value.code === "string";

package/dist/hono/index.d.ts

@@ -1,8 +1,8 @@
-import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
-import { t as BetterSupabase } from "../define-CRS2MRV3.js";
-import { r as AuthState } from "../resolve-BAqQcwMW.js";
-import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-DgIbdrt8.js";
-import { a as ResourceRouteOptions } from "../resource-BJcaIfxi.js";
+import { P as TableKey, n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
+import { t as BetterSupabase } from "../define-Bp_BZa5h.js";
+import { o as AuthState } from "../impersonation-BmePsuxz.js";
+import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-BR1fJWOB.js";
+import { a as ResourceRouteOptions } from "../resource-DNRFP7KR.js";
 import { Context, ErrorHandler, Hono, MiddlewareHandler } from "hono";
 //#region src/hono/index.d.ts
 /** Hono `Env` with the request's better-supabase context in `c.var`. */
@@ -18,13 +18,24 @@ export interface HonoOptions extends ServerOptions {
   readonly exposeErrors?: boolean;
 }
 export interface BetterHono<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
+  /**
+   * The app's Hono `Env`, for `new Hono<typeof bs.Env>()` and
+   * `Context<typeof bs.Env>`. Type only: `undefined` at runtime.
+   */
+  readonly Env: HonoEnv<M, F, E, C, P>;
+  /** `new Hono<typeof bs.Env>()` with `onError(bs.onError)` installed. */
+  app(): Hono<HonoEnv<M, F, E, C, P>>;
   /** Resolves the caller, enforces `allow` and sets `c.var.bs`, `c.var.db`, `c.var.auth`. */
   middleware(options?: MiddlewareOptions): MiddlewareHandler<HonoEnv<M, F, E, C, P>>;
   /** Wraps a handler: `Result`s become JSON or Problem Details, `undefined` becomes 204. */
   handler(fn: (c: Context<HonoEnv<M, F, E, C, P>>, ctx: ServerContext<M, F, E, C, P>) => unknown, options?: {
     readonly status?: number;
   }): (c: Context<HonoEnv<M, F, E, C, P>>) => Promise<Response>;
-  /** `app.onError(bs.onError)`: `DbException`s (and errors caused by a `DbError`) become Problem Details, others a 500. */
+  /**
+   * `app.onError(bs.onError)`: `DbException`s (and errors caused by a `DbError`)
+   * become Problem Details, Hono's `HTTPException`s keep their own response,
+   * and anything else is a 500.
+   */
   readonly onError: ErrorHandler<HonoEnv<M, F, E, C, P>>;
   /**
    * REST routes for a table matching `createOpenApi`. Mount with

package/dist/hono/index.js

@@ -1,19 +1,48 @@
-import { n as dbError, r as dbErrorOf } from "../errors-L0xK41y_.js";
-import { a as problemResponse } from "../problem-BihjPR0t.js";
-import { a as guard, i as defaultExpose, n as extendServer, s as respond, t as createServer } from "../server-BA75B0mT.js";
-import { t as defineResource } from "../resource-My_y-Syh.js";
+import { n as dbError, r as dbErrorOf } from "../errors-DtwXa6b8.js";
+import { a as problemResponse } from "../problem-BW1KhzSG.js";
+import { d as guard, i as rememberVerifiedFor, n as createServer, p as respond, r as extendServer, u as defaultExpose } from "../server-B1mZ7CgQ.js";
+import { t as defineResource } from "../resource-mqfJW4YF.js";
 import { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
 //#region src/hono/index.ts
 function contextOf(c) {
 	const ctx = c.get("bs");
 	if (!ctx) throw new TypeError("better-supabase: no context on this request; add app.use(bs.middleware()) first");
 	return ctx;
 }
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function isJwtClaims(value) {
+	return isRecord(value) && typeof value["sub"] === "string";
+}
+function isUserClaims(value) {
+	return isRecord(value) && typeof value["id"] === "string";
+}
+/**
+* The bearer token `withSupabase` from `@supabase/server/adapters/hono`
+* verified for this request, with the claims it stored in
+* `c.var.supabaseContext`.
+*/
+function verifiedBySupabase(c) {
+	const supabase = c.var["supabaseContext"];
+	if (!isRecord(supabase) || supabase["authMode"] !== "user") return void 0;
+	const { jwtClaims, userClaims } = supabase;
+	const header = c.req.header("authorization");
+	const token = header?.startsWith("Bearer ") ? header.slice(7) : "";
+	if (!token || !isJwtClaims(jwtClaims) || !isUserClaims(userClaims)) return void 0;
+	return {
+		token,
+		claims: jwtClaims,
+		user: userClaims
+	};
+}
 /** Hono integration: a server plus middleware, handlers and REST resources. */
 function createHono(betterSupabase, options = {}) {
 	const server = createServer(betterSupabase, options);
 	const expose = options.exposeErrors ?? defaultExpose();
 	const onError = (cause, c) => {
+		if (cause instanceof HTTPException) return cause.getResponse();
 		const instance = new URL(c.req.url).pathname;
 		const thrown = dbErrorOf(cause);
 		if (thrown) return problemResponse(thrown, {
@@ -27,9 +56,15 @@ function createHono(betterSupabase, options = {}) {
 		});
 	};
 	return extendServer(server, {
+		Env: void 0,
 		onError,
+		app() {
+			return new Hono().onError(onError);
+		},
 		middleware(middlewareOptions = {}) {
 			return async (c, next) => {
+				const verified = verifiedBySupabase(c);
+				if (verified) rememberVerifiedFor(server, verified);
 				const ctx = await server.context(c.req.raw, { refresh: middlewareOptions.refresh ?? false });
 				const denied = guard(ctx.auth, middlewareOptions.allow, middlewareOptions.aal, middlewareOptions.scopes);
 				if (denied) return ctx.resolution.apply(problemResponse(denied, {
@@ -40,7 +75,7 @@ function createHono(betterSupabase, options = {}) {
 				c.set("db", ctx.db);
 				c.set("auth", ctx.auth);
 				await next();
-				c.res = ctx.resolution.apply(c.res);
+				c.res = ctx.apply(c.res);
 			};
 		},
 		handler(fn, handlerOptions = {}) {

package/dist/impersonation-BgSHAYLf.js

@@ -0,0 +1,133 @@
+//#region src/auth/actor.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function copyAct(level) {
+	const entries = Object.entries(level).map(([key, value]) => [key, key === "act" && isRecord(value) ? copyAct(value) : value]);
+	return Object.fromEntries(entries);
+}
+const INVALID = {
+	ok: false,
+	reason: "invalid-chain"
+};
+function actorAt(outer, id) {
+	const kind = outer["kind"];
+	const sessionId = outer["session_id"];
+	const readOnly = outer["read_only"];
+	const reason = outer["reason"];
+	if (kind === "support" || kind === void 0 && sessionId !== void 0) {
+		if (typeof sessionId !== "string" || sessionId === "") return INVALID;
+		if (readOnly !== void 0 && typeof readOnly !== "boolean") return INVALID;
+		return {
+			ok: true,
+			actor: {
+				kind: "support",
+				id,
+				sessionId,
+				readOnly: readOnly ?? true,
+				...typeof reason === "string" ? { reason } : {}
+			}
+		};
+	}
+	if (kind === "impersonation") return {
+		ok: true,
+		actor: {
+			kind: "impersonation",
+			id,
+			...typeof reason === "string" ? { reason } : {}
+		}
+	};
+	if (kind !== void 0) return INVALID;
+	return {
+		ok: true,
+		actor: {
+			kind: "oauth-client",
+			id,
+			chain: copyAct(outer)
+		}
+	};
+}
+/**
+* Reads only `act` and `client_id`, the way PermDock's `actorOf` does. An
+* `act` that is not a chain of objects each with a non-empty `sub`, a
+* `kind` other than `support` or `impersonation`, or a support level without
+* a `session_id` is `{ ok: false }`: the session must not pass as the user
+* alone.
+*/
+function actorOf(claims) {
+	const outer = claims["act"];
+	if (outer !== void 0) {
+		if (!isRecord(outer)) return INVALID;
+		const id = outer["sub"];
+		if (typeof id !== "string" || id === "") return INVALID;
+		let level = outer["act"];
+		while (level !== void 0) {
+			if (!isRecord(level)) return INVALID;
+			const sub = level["sub"];
+			if (typeof sub !== "string" || sub === "") return INVALID;
+			level = level["act"];
+		}
+		return actorAt(outer, id);
+	}
+	const client = claims["client_id"];
+	if (typeof client === "string" && client !== "") return {
+		ok: true,
+		actor: {
+			id: client,
+			kind: "oauth-client"
+		}
+	};
+	return { ok: true };
+}
+/** The OAuth `scope` claim (a space-separated string or a list); `undefined` when empty. */
+function delegationOf(claims) {
+	const scope = claims["scope"];
+	const scopes = typeof scope === "string" ? scope.split(/\s+/u).filter(Boolean) : Array.isArray(scope) ? scope.filter((item) => typeof item === "string") : [];
+	return scopes.length > 0 ? { scopes } : void 0;
+}
+//#endregion
+//#region src/auth/impersonation.ts
+/** The `act` claim for an impersonated session. */
+function actClaim(options) {
+	return {
+		kind: "impersonation",
+		sub: options.actor,
+		reason: options.reason
+	};
+}
+/**
+* The admin in `claims.act`: a support session or an impersonated session
+* (`actorOf` reads the same level, so the two always agree). `undefined`
+* for a normal session, an OAuth client or agent chain, and an invalid `act`.
+*/
+function impersonatorOf(claims) {
+	const outcome = actorOf(claims);
+	const actor = outcome.ok ? outcome.actor : void 0;
+	if (actor === void 0) return void 0;
+	switch (actor.kind) {
+		case "oauth-client": return;
+		case "support":
+		case "impersonation": return { ...actor };
+		default: return actor;
+	}
+}
+/**
+* The repository context of a signed-in user: the actor, with the
+* impersonator from `act`, and the claims. Every adapter builds it here, so
+* plugins see the same actor on the server, in middleware and in the browser.
+*/
+function userContext(user, claims) {
+	const impersonator = impersonatorOf(claims);
+	return {
+		actor: {
+			id: user.id,
+			kind: "user",
+			...user.role ? { role: user.role } : {},
+			...user.email ? { email: user.email } : {},
+			...impersonator ? { impersonator: impersonator.id } : {}
+		},
+		claims
+	};
+}
+//#endregion
+export { delegationOf as a, actorOf as i, impersonatorOf as n, userContext as r, actClaim as t };

package/dist/{resolve-BAqQcwMW.d.ts → impersonation-BmePsuxz.d.ts}

@@ -1,8 +1,8 @@
-import { p as DbError } from "./result-CqEsbgYs.js";
-import { f as Logger, l as RefreshEvent } from "./events-B21UOhvP.js";
-import { h as RequestContext } from "./plugin-bNhvJwRh.js";
-import { t as StandardSchemaV1 } from "./standard-BsaCYQJc.js";
-import { t as BetterSupabaseEnv } from "./index-Dy6kuF0P.js";
+import { _ as DbError } from "./executor-BunPOO-k.js";
+import { E as Logger, l as RefreshEvent } from "./events-aIO7vsIk.js";
+import { g as RequestContext } from "./plugin-o144f322.js";
+import { t as StandardSchemaV1 } from "./standard-J4YgMOLm.js";
+import { t as BetterSupabaseEnv } from "./index-CLg87OBW.js";
 import { CookieOptions } from "@supabase/ssr";
 import { JWTClaims, SupabaseEnv, UserClaims } from "@supabase/server";
 //#region src/auth/session.d.ts
@@ -119,6 +119,12 @@ interface ResolveAuthOptions {
     readonly name?: string;
     readonly options?: CookieOptions;
   };
+  /**
+   * Read the session cookie. Defaults to true. `false` suits endpoints only
+   * bearer clients call (MCP): a browser's cookie then can't authorize a
+   * request another site makes it send.
+   */
+  readonly cookies?: boolean;
   /** Inline JWKS instead of fetching `env.jwksUrl` (tests, air-gapped). */
   readonly jwks?: SupabaseEnv["jwks"];
   /**
@@ -173,4 +179,28 @@ declare function resolveAuth(request: Request, options: ResolveAuthOptions): Pro
 /** The repository context (`actor`, `claims`) for an auth state. */
 declare function authContext(auth: AuthState): RequestContext;
 //#endregion
-export { readSession as _, ResolveAuthOptions as a, writeSession as b, clientIp as c, CookieOptions as d, CookieRecord as f, parseCookies as g, applyCookieWrites as h, InvalidReason as i, resolveAuth as l, StoredSession as m, AuthResolver as n, ResolvedState as o, CookieWrite as p, AuthState as r, authContext as s, AuthResolution as t, AUTH_CACHE_HEADERS as u, serializeCookie as v, sessionCookieName as y };
+//#region src/auth/impersonation.d.ts
+/** The admin acting as the user, from the RFC 8693 `act` claim. */
+interface Impersonator {
+  /** `act.kind`: a support session or an impersonated session. */
+  readonly kind: "support" | "impersonation";
+  readonly id: string;
+  readonly reason?: string;
+  /** The support session, when the admin started one (`act.session_id`). */
+  readonly sessionId?: string;
+  /** Whether the support session blocks writes (`act.read_only`). */
+  readonly readOnly?: boolean;
+}
+/** `actingAs(userId, claims, { actor, reason })`: who acts, and why (recorded by the audit module). */
+interface ImpersonationOptions {
+  readonly actor: string;
+  readonly reason: string;
+}
+/**
+ * The admin in `claims.act`: a support session or an impersonated session
+ * (`actorOf` reads the same level, so the two always agree). `undefined`
+ * for a normal session, an OAuth client or agent chain, and an invalid `act`.
+ */
+declare function impersonatorOf(claims: Readonly<Record<string, unknown>>): Impersonator | undefined;
+//#endregion
+export { writeSession as C, sessionCookieName as S, StoredSession as _, AuthResolver as a, readSession as b, ResolveAuthOptions as c, clientIp as d, resolveAuth as f, CookieWrite as g, CookieRecord as h, AuthResolution as i, ResolvedState as l, CookieOptions as m, Impersonator as n, AuthState as o, AUTH_CACHE_HEADERS as p, impersonatorOf as r, InvalidReason as s, ImpersonationOptions as t, authContext as u, applyCookieWrites as v, serializeCookie as x, parseCookies as y };

package/dist/{index-BhHEC04r.d.ts → index-C7f8cOBM.d.ts}

@@ -1,5 +1,5 @@
-import { A as SchemaMeta } from "./types-DONv9SHN.js";
-import { p as OpenApiParameter } from "./index-BAy4tsAP.js";
+import { j as SchemaMeta } from "./types-Dnf_wRDz.js";
+import { p as OpenApiParameter } from "./index-fag8VJZ2.js";
 //#region src/openapi/index.d.ts
 type Json = Record<string, unknown>;
 type ResourceOperation = "list" | "get" | "create" | "update" | "delete";

package/dist/{index-Dy6kuF0P.d.ts → index-CLg87OBW.d.ts}

@@ -10,6 +10,8 @@ interface BetterSupabaseEnv {
   readonly secretKeys?: Readonly<Record<string, string>>;
   /** `SUPABASE_JWKS_URL`, or `<url>/auth/v1/.well-known/jwks.json`. */
   readonly jwksUrl: URL;
+  /** `SUPABASE_JWKS`: inline keys, used instead of fetching `jwksUrl`. */
+  readonly jwks?: InlineJwks;
   /** Direct Postgres connection string (`SUPABASE_DB_URL` / `DATABASE_URL`). */
   readonly dbUrl?: string;
   /** Project ref for hosted projects (`<ref>.supabase.co`). */
@@ -17,6 +19,8 @@ interface BetterSupabaseEnv {
   /** `SUPABASE_READ_URL`: a read replica or the `<ref>-all` load balancer, for reads. */
   readonly readUrl?: string;
 }
+/** A JSON Web Key Set, as `@supabase/server` verifies with it. */
+type InlineJwks = Exclude<SupabaseEnv["jwks"], URL | null>;
 interface PublicEnv {
   readonly url: string;
   readonly publishableKey: string;
@@ -46,6 +50,7 @@ declare const ENV_VARIABLES: {
   readonly secretKey: readonly string[];
   readonly dbUrl: readonly string[];
   readonly jwksUrl: readonly string[];
+  readonly jwks: readonly string[];
   readonly readUrl: readonly string[];
 };
 declare class EnvValidationError extends Error {
@@ -68,4 +73,4 @@ declare function publicEnv(env: BetterSupabaseEnv): PublicEnv;
 /** Converts to `@supabase/server`'s `SupabaseEnv` (the `env` option of `withSupabase`). */
 declare function toServerEnv(env: BetterSupabaseEnv): SupabaseEnv;
 //#endregion
-export { EnvResult as a, PublicEnv as c, parseEnv as d, publicEnv as f, EnvOptions as i, envSchema as l, ENV_VARIABLES as n, EnvSource as o, toServerEnv as p, EnvIssue as r, EnvValidationError as s, BetterSupabaseEnv as t, loadEnv as u };
+export { EnvResult as a, InlineJwks as c, loadEnv as d, parseEnv as f, EnvOptions as i, PublicEnv as l, toServerEnv as m, ENV_VARIABLES as n, EnvSource as o, publicEnv as p, EnvIssue as r, EnvValidationError as s, BetterSupabaseEnv as t, envSchema as u };

package/dist/{index-Cf-D2jk1.d.ts → index-CWMDdEr4.d.ts}

@@ -1,5 +1,5 @@
-import { A as SchemaMeta, s as ClaimsMeta } from "./types-DONv9SHN.js";
-import { d as Generator } from "./config-C1CYcm6o.js";
+import { c as ClaimsMeta, j as SchemaMeta } from "./types-Dnf_wRDz.js";
+import { d as Generator } from "./config-Bv7gvfzC.js";
 //#region src/core/claims.d.ts
 declare const DEFAULT_CLAIMS: ClaimsMeta;
 /** Where the active tenant is read from: the top-level claim, then `app_metadata`. */