better-supabase 0.4.0 → 0.5.1

package/dist/{json-schema-DP6V7cbr.js → json-schema-m1fiwKgN.js}

@@ -32,6 +32,18 @@ function scalarKind(column) {
 	if (column.type === "record" || column.type === "void") return { kind: "unknown" };
 	return { kind: "string" };
 }
+/** App names of the columns that plugins fill from the table's flags. */
+function managedColumns(table) {
+	const { timestamps, actor, softDelete } = table.flags;
+	return new Set([
+		timestamps?.createdAt,
+		timestamps?.updatedAt,
+		actor?.createdBy,
+		actor?.updatedBy,
+		actor?.impersonatedBy,
+		softDelete
+	].filter((name) => name !== void 0));
+}
 /**
 * The generated row type of a field (its element type for arrays). Storage
 * path columns validate as strings and are cast to their `StoragePath` brand.
@@ -43,6 +55,7 @@ function rowType(table, plan) {
 /** The fields a variant accepts; read-only columns are left out of writes. */
 function fieldsFor(table, variant, input) {
 	const fields = [];
+	const managed = managedColumns(table);
 	for (const [name, column] of Object.entries(table.columns)) {
 		if (variant === "Insert" && (column.generated || column.insertable === false)) continue;
 		if (variant === "Update" && (column.generated || column.updatable === false)) continue;
@@ -52,7 +65,8 @@ function fieldsFor(table, variant, input) {
 			scalar: scalarKind(column),
 			nullable: column.nullable,
 			optional: variant === "Update" || variant === "Insert" && (column.nullable || column.hasDefault),
-			customJson: Boolean(column.json && input.config.json[`${table.name}.${column.db}`])
+			customJson: Boolean(column.json && input.config.json[`${table.name}.${column.db}`]),
+			managed: managed.has(name)
 		});
 	}
 	return fields;
@@ -130,6 +144,13 @@ function scalar(kind) {
 	}
 }
 function property(plan) {
+	const schema = nullable(plan);
+	return plan.managed ? {
+		...schema,
+		readOnly: true
+	} : schema;
+}
+function nullable(plan) {
 	let schema = scalar(plan.scalar);
 	if (plan.column.array) schema = {
 		type: "array",

package/dist/kit-events-CTFDfSwb.js

@@ -0,0 +1,60 @@
+import { t as cloneValue } from "./clone-BfgmLU90.js";
+import { n as nowInstant } from "./temporal-CVlIV2DZ.js";
+//#region src/core/kit-events.ts
+/**
+* Fixed OpenTelemetry attribute names for kit work, so dashboards and
+* queries can rely on them.
+*/
+const KIT_ATTRIBUTES = {
+	event: "better_supabase.kit.event",
+	tenant: "better_supabase.tenant",
+	actor: "better_supabase.actor.id",
+	supportSessionId: "better_supabase.support.session_id",
+	orgId: "better_supabase.org.id",
+	invitationId: "better_supabase.invitation.id",
+	notificationType: "better_supabase.notification.type",
+	webhookEndpointId: "better_supabase.webhook.endpoint_id"
+};
+/** The `KIT_ATTRIBUTES` an event carries. */
+function kitEventAttributes(event) {
+	const attributes = { [KIT_ATTRIBUTES.event]: event.type };
+	if (event.tenant) attributes[KIT_ATTRIBUTES.tenant] = event.tenant;
+	if (event.actorId) attributes[KIT_ATTRIBUTES.actor] = event.actorId;
+	const data = Object.fromEntries(Object.entries(event.data));
+	const add = (key, value) => {
+		if (typeof value === "string" && value.length > 0) attributes[key] = value;
+	};
+	add(KIT_ATTRIBUTES.supportSessionId, data["sessionId"]);
+	add(KIT_ATTRIBUTES.orgId, data["organizationId"]);
+	add(KIT_ATTRIBUTES.invitationId, data["invitationId"]);
+	add(KIT_ATTRIBUTES.notificationType, data["type"]);
+	add(KIT_ATTRIBUTES.webhookEndpointId, data["endpointId"]);
+	return attributes;
+}
+/**
+* Emits a kit event on `events` with a copy of `data`. Does nothing without
+* a `kit` handler, so kits call it unconditionally.
+*/
+function emitKitEvent(events, type, data, meta = {}) {
+	if (!events.has("kit")) return;
+	const event = {
+		...meta,
+		type,
+		data: cloneValue(data),
+		time: nowInstant()
+	};
+	events.emit("kit", event);
+}
+const matches = (pattern, type) => pattern.endsWith(".*") ? type.startsWith(pattern.slice(0, -1)) : pattern === type;
+/**
+* Listens to the kit events that match `pattern` (`'support.started'` or
+* `'support.*'`). Returns a function that stops listening.
+*/
+function onKitEvent(betterSupabase, pattern, handler) {
+	return betterSupabase.events.on("kit", (event) => {
+		if (!matches(pattern, event.type)) return;
+		handler(event);
+	});
+}
+//#endregion
+export { onKitEvent as i, emitKitEvent as n, kitEventAttributes as r, KIT_ATTRIBUTES as t };

package/dist/kit-transport-B82k1djG.d.ts

@@ -0,0 +1,33 @@
+import { t as SqlClient } from "./executor-Cghdstwu.js";
+//#region src/core/kit-transport.d.ts
+/**
+ * Calls a kit function as the current user and resolves with its result.
+ * Rejects with the raw database error (a `pg` error or a PostgREST error
+ * object), which the kit maps to a `DbError`.
+ */
+interface KitTransport {
+  call(schema: string, fn: string, args: Readonly<Record<string, unknown>>): Promise<unknown>;
+}
+/**
+ * Calls the functions over Postgres, as the user `client` runs as:
+ * `sqlTransport(postgres.asUser(ctx.auth.claims))`. Works for any schema.
+ */
+declare function sqlTransport(client: SqlClient): KitTransport;
+interface RpcResponse {
+  readonly data: unknown;
+  readonly error: unknown;
+}
+/** The part of a supabase-js client `rpcTransport` uses. */
+interface RpcClient {
+  schema(name: string): {
+    rpc(fn: string, args: Record<string, unknown>): PromiseLike<RpcResponse>;
+  };
+}
+/**
+ * Calls the functions over the Data API with the user's session. The kit
+ * schema must be exposed (`[api] schemas` in `config.toml`), or the modules
+ * installed in `public` (`kits.<module>.schema`).
+ */
+declare function rpcTransport(client: RpcClient): KitTransport;
+//#endregion
+export { sqlTransport as i, RpcClient as n, rpcTransport as r, KitTransport as t };

package/dist/kit-transport-DJlHQUBU.js

@@ -0,0 +1,55 @@
+import { r as sqlIdent } from "./template-TxrGI5jR.js";
+//#region src/core/kit-transport.ts
+/**
+* Calls the functions over Postgres, as the user `client` runs as:
+* `sqlTransport(postgres.asUser(ctx.auth.claims))`. Works for any schema.
+*/
+function sqlTransport(client) {
+	return { async call(schema, fn, args) {
+		const entries = Object.entries(args).filter(([, value]) => value !== void 0);
+		const params = entries.map(([, value]) => value !== null && typeof value === "object" && !Array.isArray(value) ? JSON.stringify(value) : value);
+		const list = entries.map(([name], index) => `${sqlIdent(name)} => $${String(index + 1)}`).join(", ");
+		const [row] = await client.queryRaw(`select ${sqlIdent(schema)}.${sqlIdent(fn)}(${list}) as value`, params);
+		return row?.value ?? null;
+	} };
+}
+/**
+* Calls the functions over the Data API with the user's session. The kit
+* schema must be exposed (`[api] schemas` in `config.toml`), or the modules
+* installed in `public` (`kits.<module>.schema`).
+*/
+function rpcTransport(client) {
+	return { async call(schema, fn, args) {
+		const defined = Object.fromEntries(Object.entries(args).filter(([, value]) => value !== void 0));
+		const { data, error } = await client.schema(schema).rpc(fn, defined);
+		if (error) {
+			const message = typeof error === "object" && "message" in error ? String(error.message) : String(error);
+			throw Object.assign(new Error(message), error);
+		}
+		return data;
+	} };
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** The Postgres or PostgREST error a transport rejected with, if it is one. */
+function rawError(cause) {
+	if (!isRecord(cause)) return void 0;
+	const field = (key) => {
+		const value = cause[key];
+		return typeof value === "string" ? value : void 0;
+	};
+	if (field("code") === void 0) return void 0;
+	const raw = {};
+	for (const key of [
+		"message",
+		"code",
+		"details",
+		"hint",
+		"constraint"
+	]) {
+		const value = field(key);
+		if (value !== void 0) raw[key] = value;
+	}
+	return raw;
+}
+//#endregion
+export { rpcTransport as n, sqlTransport as r, rawError as t };

package/dist/{config-BpxDfnbg.js → kits-CGLLrNPd.js}

@@ -9,14 +9,16 @@ function resolveJsonSchema(source) {
 	return jsonSchema.input({ target: "draft-2020-12" });
 }
 function entitlementsOf(config = {}) {
-	const customer = config.customer ?? "organizations.stripe_customer_id";
-	const dot = customer.lastIndexOf(".");
-	if (dot <= 0) throw new TypeError(`entitlements.customer must be "table.column", got "${customer}"`);
+	const customer = config.customer;
+	const dot = customer?.lastIndexOf(".") ?? -1;
+	if (customer !== void 0 && dot <= 0) throw new TypeError(`entitlements.customer must be "table.column", got "${customer}"`);
 	return {
-		table: customer.slice(0, dot),
-		column: customer.slice(dot + 1),
+		...customer === void 0 ? {} : {
+			table: customer.slice(0, dot),
+			column: customer.slice(dot + 1)
+		},
 		key: config.key ?? "id",
-		permdock: config.permdock === false ? false : { scope: config.permdock?.scope ?? "organization" }
+		permdock: config.permdock === false ? false : config.permdock?.scope === void 0 ? {} : { scope: config.permdock.scope }
 	};
 }
 function vectorSearchOf(config = {}) {
@@ -86,7 +88,8 @@ function resolveConfig(config, root) {
 			tenant: pick(config.plugins?.tenant, { column: "organization_id" }),
 			actor: pick(config.plugins?.actor, {
 				createdBy: "created_by",
-				updatedBy: "updated_by"
+				updatedBy: "updated_by",
+				impersonatedBy: "impersonated_by"
 			})
 		},
 		claims: {
@@ -95,7 +98,10 @@ function resolveConfig(config, root) {
 		},
 		buckets: config.buckets ?? {},
 		topics: config.topics ?? {},
-		realtime: { tables: config.realtime?.tables ?? [] },
+		realtime: {
+			tables: config.realtime?.tables ?? [],
+			global: config.realtime?.global ?? []
+		},
 		entitlements: entitlementsOf(config.entitlements),
 		permdock: {
 			manifest: config.permdock?.manifest ?? "permdock.manifest.json",
@@ -108,6 +114,7 @@ function resolveConfig(config, root) {
 			testsDir: config.sql?.testsDir ?? "supabase/tests",
 			kit: config.sql?.kit ?? []
 		},
+		kits: config.kits ?? {},
 		seed: {
 			entry: config.seed?.entry ?? "supabase/seed.ts",
 			output: config.seed?.output ?? "supabase/seeds/000_better_supabase.sql"
@@ -126,4 +133,25 @@ function resolveConfig(config, root) {
 	};
 }
 //#endregion
-export { resolveJsonSchema as i, defineConfig as n, resolveConfig as r, CONFIG_SCHEMA_URL as t };
+//#region src/config/kits.ts
+/** URL tenancy: the tenant comes from the request (a slug), not a stored setting. */
+const DEFAULT_ACTIVE_TENANT = "resolver";
+const KIT_SCHEMA = "better_supabase";
+function resolveKitModule(config = {}) {
+	return {
+		mode: config.mode ?? "managed",
+		schema: config.schema ?? KIT_SCHEMA,
+		tables: config.tables ?? {},
+		columns: config.columns ?? {},
+		...config.idType === void 0 ? {} : { idType: config.idType },
+		permissions: config.permissions ?? {},
+		options: config.options ?? {},
+		hooks: {
+			schema: config.hooks?.schema ?? "public",
+			functions: config.hooks?.functions ?? {}
+		},
+		events: config.events ?? true
+	};
+}
+//#endregion
+export { resolveConfig as a, defineConfig as i, resolveKitModule as n, resolveJsonSchema as o, CONFIG_SCHEMA_URL as r, DEFAULT_ACTIVE_TENANT as t };

package/dist/list/index.d.ts

@@ -1,2 +1,2 @@
-import { a as ListPage, c as ListParsers, d as ListQueryInput, f as ListSearchParams, g as defineListQuery, h as UNSET, i as ListExtra, l as ListQuery, m as ParserSpec, n as FacetInfo, o as ListPagination, p as OpenApiParameter, r as ListDefinition, s as ListParseResult, t as FacetCounts, u as ListQueryConfig } from "../index-BAy4tsAP.js";
+import { a as ListPage, c as ListParsers, d as ListQueryInput, f as ListSearchParams, g as defineListQuery, h as UNSET, i as ListExtra, l as ListQuery, m as ParserSpec, n as FacetInfo, o as ListPagination, p as OpenApiParameter, r as ListDefinition, s as ListParseResult, t as FacetCounts, u as ListQueryConfig } from "../index-fag8VJZ2.js";
 export { type FacetCounts, type FacetInfo, type ListDefinition, type ListExtra, type ListPage, type ListPagination, type ListParseResult, type ListParsers, type ListQuery, type ListQueryConfig, type ListQueryInput, type ListSearchParams, type OpenApiParameter, type ParserSpec, UNSET, defineListQuery };

package/dist/{live-BHakSWWo.d.ts → live-D9W2M5aO.d.ts}

@@ -1,7 +1,7 @@
-import { A as SchemaMeta, N as TableKey, O as Row, n as AnyModels, t as AnyFunctions, x as PermdockTopicPolicy } from "./types-DONv9SHN.js";
-import { b as ValidationIssue, o as Result, p as DbError, t as AsyncResult } from "./result-CqEsbgYs.js";
-import { Z as QuerySpec, t as BetterSupabase } from "./define-CRS2MRV3.js";
-import { t as PermdockCatalog } from "./permdock-sql-DImJULY-.js";
+import { P as TableKey, S as PermdockTopicPolicy, j as SchemaMeta, k as Row, n as AnyFunctions, r as AnyModels } from "./types-Dnf_wRDz.js";
+import { _ as DbError, a as AsyncResult, u as Result, w as ValidationIssue } from "./executor-BunPOO-k.js";
+import { Z as QuerySpec, t as BetterSupabase } from "./define-Bp_BZa5h.js";
+import { n as PermdockCatalog } from "./permdock-sql-C2Inc6Xc.js";
 import { n as TemplateValues, t as TemplateParams } from "./template-mbvlysOo.js";
 import { RealtimeChannel, SupabaseClient } from "@supabase/supabase-js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
@@ -41,7 +41,8 @@ interface TopicOptions<E extends EventSchemas> {
   readonly permdock?: PermdockTopicPolicy;
   /**
    * PermDock's `permissions.catalog.json`. With it, a `permdock` policy
-   * naming a permission with `rowConditions: true` throws.
+   * naming a permission without `rowConditions: false` (including one the
+   * catalog doesn't list) throws.
    */
   readonly catalog?: PermdockCatalog;
   /** Let clients broadcast on the topic, not only receive. Defaults to `false`. */

package/dist/mcp/index.d.ts

@@ -1,7 +1,8 @@
-import { N as TableKey, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
-import { t as BetterSupabase } from "../define-CRS2MRV3.js";
-import { f as ServerContext, n as GuardOptions, p as ServerOptions, u as BetterServer } from "../respond-DgIbdrt8.js";
-import { a as ResourceRouteOptions } from "../resource-BJcaIfxi.js";
+import { P as TableKey, n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
+import { t as BetterSupabase } from "../define-Bp_BZa5h.js";
+import { f as ServerContext, n as GuardOptions, p as ServerOptions, u as BetterServer } from "../respond-BR1fJWOB.js";
+import { i as ResourceOperation } from "../index-C7f8cOBM.js";
+import { a as ResourceRouteOptions } from "../resource-DNRFP7KR.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/mcp/mcp.d.ts
 export declare const MCP_PROTOCOL_VERSION: string;
@@ -38,7 +39,7 @@ interface McpTool<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P
 /** What the `authorize` and `visible` hooks see of a tool. */
 interface ToolRef {
   readonly info: ToolInfo;
-  /** The tool's `meta`, e.g. a PermDock permission. `undefined` for table tools. */
+  /** The tool's `meta`, e.g. a PermDock permission. For table tools, the resource's `meta` for that operation. */
   readonly meta: unknown;
 }
 /** The outcome of `authorize`. `scopes` turns a refusal into an OAuth challenge. */
@@ -66,8 +67,17 @@ interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E, I, C =
   readonly meta?: unknown;
   run(args: I, ctx: ToolContext<M, F, E, C, P>): unknown;
 }
-type ToolResources<M extends AnyModels> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T> | true; };
-interface McpOptions<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends ServerOptions, GuardOptions {
+/** A table's tools: the REST resource options, plus `meta` per operation for `authorize` and `visible`. */
+type ToolResourceOptions<M extends AnyModels, T extends TableKey<M>> = ResourceRouteOptions<M, T> & {
+  /**
+   * Opaque data per operation, e.g. a PermDock permission, passed to
+   * `authorize` and `visible` as the table tool's `meta`. Never sent to
+   * clients. An operation without an entry gets `undefined`.
+   */
+  readonly meta?: { readonly [K in ResourceOperation]?: unknown; };
+};
+type ToolResources<M extends AnyModels> = { readonly [T in TableKey<M>]?: ToolResourceOptions<M, T> | true; };
+interface McpOptions<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends ServerOptions, Omit<GuardOptions, "scopes"> {
   readonly name: string;
   readonly version: string;
   readonly title?: string;
@@ -88,7 +98,14 @@ interface McpOptions<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * `insufficient_scope` challenges. `offline_access` is left out: refresh
    * tokens are between the client and the authorization server.
    */
+  readonly advertisedScopes?: readonly string[];
+  /** @deprecated Use `advertisedScopes`; `requiredScopes` is what `guard` enforces. */
   readonly scopes?: readonly string[];
+  /**
+   * Scopes a delegated token (an OAuth client or an `act` chain) needs to call
+   * the server at all. A missing one answers 403 `insufficient_scope`.
+   */
+  readonly requiredScopes?: readonly string[];
   /** Origins allowed to call the server (DNS rebinding protection). Defaults to any. */
   readonly allowedOrigins?: readonly string[];
   /**
@@ -146,4 +163,4 @@ export declare function defineTool<M extends AnyModels, F extends AnyFunctions,
  */
 export declare function createMcp<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options: McpOptions<M, F, E, C, P>): BetterMcp<M, F, E, C, P>;
 //#endregion
-export type { BetterMcp, GuardOptions, McpOptions, McpTool, ResourceRouteOptions, ToolAnnotations, ToolContext, ToolDecision, ToolDefinition, ToolInfo, ToolRef, ToolResources, ToolResult };
+export type { BetterMcp, GuardOptions, McpOptions, McpTool, ResourceRouteOptions, ToolAnnotations, ToolContext, ToolDecision, ToolDefinition, ToolInfo, ToolRef, ToolResourceOptions, ToolResources, ToolResult };

package/dist/mcp/index.js

@@ -1,11 +1,11 @@
-import { n as dbError } from "../errors-L0xK41y_.js";
+import { n as dbError } from "../errors-DtwXa6b8.js";
 import { t as base64ToText } from "../base64-D2gsioCY.js";
-import { t as validate } from "../standard-BRyBGTtp.js";
-import { o as toProblem } from "../problem-BihjPR0t.js";
+import { t as validate } from "../standard-D7r6dMUu.js";
+import { a as problemResponse, o as toProblem } from "../problem-BW1KhzSG.js";
 import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
-import { t as buildJsonSchema } from "../json-schema-DP6V7cbr.js";
-import { a as guard, c as settle, i as defaultExpose, n as extendServer, r as withExtra, t as createServer } from "../server-BA75B0mT.js";
-import { t as defineResource } from "../resource-My_y-Syh.js";
+import { t as buildJsonSchema } from "../json-schema-m1fiwKgN.js";
+import { a as withExtra, d as guard, g as jsonResponse, h as jsonReplacer, m as settle, n as createServer, r as extendServer, u as defaultExpose } from "../server-B1mZ7CgQ.js";
+import { t as defineResource } from "../resource-mqfJW4YF.js";
 import { fromSupabaseUrl, unauthorizedResponse } from "@supabase/server/oauth-protected-resource";
 //#region src/mcp/mcp.ts
 const MCP_PROTOCOL_VERSION = SPEC_PINS.mcp;
@@ -215,7 +215,7 @@ function textResult(value, isError = false) {
 	return {
 		content: [{
 			type: "text",
-			text: typeof value === "string" ? value : JSON.stringify(value ?? null)
+			text: typeof value === "string" ? value : JSON.stringify(value ?? null, jsonReplacer)
 		}],
 		...structured ? { structuredContent: structured } : {},
 		...isError ? { isError: true } : {}
@@ -258,11 +258,14 @@ function createMcp(betterSupabase, options) {
 	const isVisible = async (tool, ctx) => !options.visible || options.visible(ctx, tool);
 	for (const [table, raw] of Object.entries(options.resources ?? {})) {
 		if (!raw) continue;
-		const resource = defineResource(betterSupabase, table, raw === true ? {} : raw);
+		const key = table;
+		const entry = raw;
+		const { meta, ...route } = entry === true ? {} : entry;
+		const resource = defineResource(betterSupabase, key, route);
 		for (const { info, operation } of tableTools(resource, defs)) {
 			const ref = {
 				info,
-				meta: void 0
+				meta: meta?.[operation]
 			};
 			register({
 				...ref,
@@ -338,7 +341,7 @@ function createMcp(betterSupabase, options) {
 		const outcome = await invoke(name, args, ctx);
 		return isRefusal(outcome) ? failure(dbError("forbidden", outcome.refusal)) : outcome;
 	};
-	const scopes = (options.scopes ?? []).filter((scope) => scope !== "offline_access");
+	const scopes = (options.advertisedScopes ?? options.scopes ?? []).filter((scope) => scope !== "offline_access");
 	const serverInfo = {
 		name: options.name,
 		version: options.version,
@@ -362,6 +365,12 @@ function createMcp(betterSupabase, options) {
 		response.headers.set("www-authenticate", challenge);
 		return response;
 	};
+	/** A missing second factor is no scope problem, and an outage is not the caller's fault. */
+	const refuse = (request, denied) => {
+		if (denied.kind === "unauthorized") return unauthorized(request);
+		if (denied.kind !== "forbidden") return problemResponse(denied, { expose });
+		return denied.code === "INSUFFICIENT_AAL" ? rpcError(null, INVALID_REQUEST, denied.message, 403) : forbidden(request, denied.message, denied.scopes);
+	};
 	const unsupportedVersion = (id, requested) => rpcError(id, UNSUPPORTED_PROTOCOL_VERSION, "Unsupported protocol version", 400, {
 		supported: [...SUPPORTED_VERSIONS],
 		requested
@@ -391,9 +400,9 @@ function createMcp(betterSupabase, options) {
 		});
 		const header = request.headers.get("mcp-protocol-version");
 		if (header && !SUPPORTED_VERSIONS.includes(header)) return unsupportedVersion(null, header);
-		const ctx = await server.context(request);
-		const denied = guard(ctx.auth, options.allow, options.aal);
-		if (denied) return denied.kind === "unauthorized" ? unauthorized(request) : forbidden(request, denied.message);
+		const ctx = await server.context(request, { cookies: false });
+		const denied = guard(ctx.auth, options.allow, options.aal, options.requiredScopes);
+		if (denied) return refuse(request, denied);
 		let message;
 		try {
 			message = await request.json();
@@ -412,7 +421,7 @@ function createMcp(betterSupabase, options) {
 			request,
 			signal: request.signal
 		});
-		const reply = (result) => Response.json({
+		const reply = (result) => jsonResponse({
 			jsonrpc: "2.0",
 			id: message.id,
 			result: modern ? {

package/dist/{mfa-C7MNQ1Ob.d.ts → mfa-Cu96oJdw.d.ts}

@@ -1,18 +1,4 @@
-import { p as DbError } from "./result-CqEsbgYs.js";
-//#region src/auth/impersonation.d.ts
-/** The admin acting as the user, from the RFC 8693 `act` claim. */
-interface Impersonator {
-  readonly id: string;
-  readonly reason?: string;
-}
-/** `actingAs(userId, claims, { actor, reason })`: who acts, and why (recorded by the audit module). */
-interface ImpersonationOptions {
-  readonly actor: string;
-  readonly reason: string;
-}
-/** The impersonator in `claims.act`, or `undefined` for a normal session. */
-declare function impersonatorOf(claims: Readonly<Record<string, unknown>>): Impersonator | undefined;
-//#endregion
+import { _ as DbError } from "./executor-BunPOO-k.js";
 //#region src/auth/mfa.d.ts
 /** Authenticator assurance level: `aal2` once a second factor is verified in this session. */
 type Aal = "aal1" | "aal2";
@@ -41,4 +27,4 @@ declare function checkAal(auth: {
   readonly kind: string;
 }, required: Aal): DbError | undefined;
 //#endregion
-export { checkAal as a, impersonatorOf as c, amrOf as i, AmrEntry as n, ImpersonationOptions as o, aalOf as r, Impersonator as s, Aal as t };
+export { checkAal as a, amrOf as i, AmrEntry as n, aalOf as r, Aal as t };

package/dist/next/index.d.ts

@@ -1,12 +1,13 @@
-import { n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
-import { p as DbError } from "../result-CqEsbgYs.js";
-import { B as ReadSet, P as DbStats, Z as QuerySpec, l as CacheAdapter, t as BetterSupabase } from "../define-CRS2MRV3.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-C7MNQ1Ob.js";
-import { r as AuthState } from "../resolve-BAqQcwMW.js";
-import { d as ContextOptions, f as ServerContext, n as GuardOptions, p as ServerOptions, t as AuthKind, u as BetterServer } from "../respond-DgIbdrt8.js";
-import { n as toSession, t as AuthSession } from "../view-B64o81wp.js";
-import { r as LiveCountSeed, t as CountRunner } from "../live-BHakSWWo.js";
-import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-Dm-FHpNH.js";
+import { n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
+import { _ as DbError } from "../executor-BunPOO-k.js";
+import { B as ReadSet, P as DbStats, Z as QuerySpec, l as CacheAdapter, t as BetterSupabase } from "../define-Bp_BZa5h.js";
+import { n as Impersonator, o as AuthState } from "../impersonation-BmePsuxz.js";
+import { C as SupportOptions, D as supportSessions, E as SupportStartRequest, T as SupportSessions, b as ActiveSupport, d as ContextOptions, f as ServerContext, n as GuardOptions, p as ServerOptions, t as AuthKind, u as BetterServer, w as SupportPolicy } from "../respond-BR1fJWOB.js";
+import { n as AmrEntry, t as Aal } from "../mfa-Cu96oJdw.js";
+import { n as toSession, t as AuthSession } from "../view-CbgObAeb.js";
+import { r as LiveCountSeed, t as CountRunner } from "../live-D9W2M5aO.js";
+import { n as supportOf, t as SupportView } from "../support-view-B8SlToQX.js";
+import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-BiJZ4t49.js";
 import { NextRequest } from "next/server.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/collector.d.ts
@@ -149,7 +150,27 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * `expectDbBudget`. Answers 404 unless `debug` is on.
    */
   debugRoute(): (request: Request) => Promise<Response>;
+  /**
+   * Starts a support session for the signed-in admin and sets its cookie,
+   * so the admin's next requests render as the target. Call it from a
+   * server action.
+   */
+  startSupport(request: SupportStartRequest): Promise<ActionResult<SupportStarted>>;
+  /** Ends the admin's support session and clears its cookie. Call it from a server action. */
+  stopSupport(): Promise<ActionResult<{
+    readonly ended: boolean;
+  }>>;
+}
+/** What `startSupport` returns: plain data, safe across the action boundary. */
+interface SupportStarted {
+  readonly sessionId: string;
+  readonly targetUserId: string;
+  readonly readOnly: boolean;
+  /** ISO 8601. */
+  readonly expiresAt: string;
 }
+/** The tag `bs.cached()` adds to entries rendered in a support session. */
+export declare function supportTag(sessionId: string): string;
 interface SessionStaleOptions {
   /** Below this, the result would not be prefetched anyway. Defaults to 30. */
   readonly min?: number;
@@ -223,4 +244,4 @@ export declare function shouldRefresh(request: Request): boolean;
  */
 export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: NextOptions): BetterNext<M, F, E, C, P>;
 //#endregion
-export { type Aal, type ActionOptions, type ActionResult, type AmrEntry, type AuthKind, type AuthSession, type BetterNext, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EntitlementKey, type GuardOptions, type Impersonator, type LiveCountSeed, type MembershipClaim, type NextDebugOptions, type NextOptions, type ProxyOptions, type RequireAalOptions, type SessionStaleOptions, hasEntitlement, toSession };
+export { type Aal, type ActionOptions, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthSession, type BetterNext, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EntitlementKey, type GuardOptions, type Impersonator, type LiveCountSeed, type MembershipClaim, type NextDebugOptions, type NextOptions, type ProxyOptions, type RequireAalOptions, type SessionStaleOptions, type SupportOptions, type SupportPolicy, type SupportSessions, type SupportStartRequest, type SupportStarted, type SupportView, hasEntitlement, supportOf, supportSessions, toSession };