better-supabase 0.4.0 → 0.5.1

package/dist/{read-set-FWK8qQ58.js → read-set-DQFt1N_Y.js}

@@ -1,4 +1,4 @@
-import { r as builderFor, u as tableMeta } from "./simplify-Cqvfr9dj.js";
+import { r as builderFor, s as tableMeta } from "./simplify-_0oUKqCd.js";
 import { n as touchedTables } from "./tables-Cb-3_VWc.js";
 //#region src/core/spec.ts
 const READ_METHODS = [
@@ -159,6 +159,7 @@ function defineReadSet(betterSupabase, name, options, build) {
 	const entries = Object.entries(specs);
 	if (entries.length === 0 || entries.length > MAX_ENTRIES) throw new TypeError(`better-supabase: read set "${name}" needs between 1 and ${MAX_ENTRIES} reads`);
 	for (const [key, spec] of entries) if (!isQuerySpec(spec)) throw new TypeError(`better-supabase: read set "${name}" entry "${key}" is not a spec from betterSupabase.spec`);
+	warnUnscopedReads(betterSupabase, name, specs);
 	return {
 		kind: "read-set",
 		name,
@@ -169,6 +170,26 @@ function defineReadSet(betterSupabase, name, options, build) {
 		definition: betterSupabase
 	};
 }
+/**
+* The generated function runs the reads as compiled at `gen` time, without
+* the runtime's `transformQuery` plugins, so tenant and soft-delete filters
+* that only those plugins add never reach it.
+*/
+function warnUnscopedReads(betterSupabase, name, specs) {
+	const scoping = betterSupabase.plugins.filter((plugin) => plugin.transformQuery !== void 0 && plugin.name !== "rules").map((plugin) => plugin.name);
+	if (scoping.length === 0) return;
+	const { meta } = betterSupabase;
+	const tables = [...new Set(Object.values(specs).flatMap((spec) => specTables(meta, spec)))].filter((key) => {
+		const flags = meta.tables[key]?.flags;
+		return flags?.tenant !== void 0 || flags?.softDelete !== void 0;
+	});
+	if (tables.length === 0) return;
+	betterSupabase.events.logger.warn(`read set "${name}" reads ${tables.join(", ")}, which ${scoping.join(", ")} scope at runtime; its generated function only sees those filters when the specs spell them out (or RLS enforces them)`, {
+		readSet: name,
+		tables,
+		plugins: scoping
+	});
+}
 function isReadSet(value) {
 	return typeof value === "object" && value !== null && value.kind === "read-set" && typeof value.name === "string";
 }

package/dist/realtime/index.d.ts

@@ -1,5 +1,5 @@
-import { x as PermdockTopicPolicy } from "../types-DONv9SHN.js";
-import { t as PermdockCatalog } from "../permdock-sql-DImJULY-.js";
+import { S as PermdockTopicPolicy } from "../types-Dnf_wRDz.js";
+import { n as PermdockCatalog } from "../permdock-sql-C2Inc6Xc.js";
 import { n as TemplateValues, t as TemplateParams } from "../template-mbvlysOo.js";
-import { C as defineTopic, S as TriggerOptions, _ as TopicEvent, a as LiveSource, b as TopicOptions, c as liveQuery, d as RealtimeClient, f as RowChange, g as Topic, h as SubscriptionStatus, i as LiveQueryOptions, l as liveTopic, m as Subscription, n as LiveCountOptions, o as LiveSubscription, p as SubscribeOptions, r as LiveCountSeed, s as liveCount, t as CountRunner, u as EventSchemas, v as TopicHandlers, w as rowChange, x as TopicPayload, y as TopicMessage } from "../live-BHakSWWo.js";
+import { C as defineTopic, S as TriggerOptions, _ as TopicEvent, a as LiveSource, b as TopicOptions, c as liveQuery, d as RealtimeClient, f as RowChange, g as Topic, h as SubscriptionStatus, i as LiveQueryOptions, l as liveTopic, m as Subscription, n as LiveCountOptions, o as LiveSubscription, p as SubscribeOptions, r as LiveCountSeed, s as liveCount, t as CountRunner, u as EventSchemas, v as TopicHandlers, w as rowChange, x as TopicPayload, y as TopicMessage } from "../live-D9W2M5aO.js";
 export { type CountRunner, type EventSchemas, type LiveCountOptions, type LiveCountSeed, type LiveQueryOptions, type LiveSource, type LiveSubscription, type PermdockCatalog, type PermdockTopicPolicy, type RealtimeClient, type RowChange, type SubscribeOptions, type Subscription, type SubscriptionStatus, type TemplateParams, type TemplateValues, type Topic, type TopicEvent, type TopicHandlers, type TopicMessage, type TopicOptions, type TopicPayload, type TriggerOptions, defineTopic, liveCount, liveQuery, liveTopic, rowChange };

package/dist/realtime/index.js

@@ -1,9 +1,10 @@
-import { n as dbError } from "../errors-L0xK41y_.js";
-import { i as ok, n as err, t as AsyncResult } from "../result-Bj6yt33D.js";
+import { n as dbError } from "../errors-DtwXa6b8.js";
+import { i as ok, n as err, t as AsyncResult } from "../result-BKiliPY7.js";
 import { i as tenantClaimPaths } from "../claims-BAf6c7is.js";
 import { n as liveQuery, r as liveTopic, t as liveCount } from "../live-CdJBOc4f.js";
-import { s as toApp } from "../shared-DnoCdMDr.js";
-import { a as sqlIdent, i as slug, o as sqlString, r as parseTemplate, t as permdockCheck } from "../permdock-sql-C4KFzLc9.js";
+import { i as sqlString, n as slug, r as sqlIdent, t as parseTemplate } from "../template-TxrGI5jR.js";
+import { c as toApp } from "../shared-D1dRUrAg.js";
+import { n as permdockCheck } from "../permdock-sql-DgOfeixi.js";
 import { REALTIME_SUBSCRIBE_STATES } from "@supabase/supabase-js";
 //#region src/realtime/topic.ts
 const VALUE = /^[\w.@+=-]+$/;

package/dist/{refresh-BwYkyNOQ.d.ts → refresh-CFPX0Qft.d.ts}

@@ -1,4 +1,4 @@
-import { m as StoredSession } from "./resolve-BAqQcwMW.js";
+import { _ as StoredSession } from "./impersonation-BmePsuxz.js";
 //#region src/auth/refresh.d.ts
 interface RefreshOptions {
   readonly url: string;

package/dist/{resource-BJcaIfxi.d.ts → resource-DNRFP7KR.d.ts}

@@ -1,8 +1,8 @@
-import { N as TableKey, P as TableMeta, R as Update, g as Insert, n as AnyModels, t as AnyFunctions } from "./types-DONv9SHN.js";
-import { b as ValidationIssue, o as Result } from "./result-CqEsbgYs.js";
-import { t as BetterSupabase, xt as SelectArg } from "./define-CRS2MRV3.js";
-import { i as RespondOptions } from "./respond-DgIbdrt8.js";
-import { i as ResourceOperation } from "./index-BhHEC04r.js";
+import { F as TableMeta, P as TableKey, _ as Insert, n as AnyFunctions, r as AnyModels, z as Update } from "./types-Dnf_wRDz.js";
+import { u as Result, w as ValidationIssue } from "./executor-BunPOO-k.js";
+import { t as BetterSupabase, xt as SelectArg } from "./define-Bp_BZa5h.js";
+import { i as RespondOptions } from "./respond-BR1fJWOB.js";
+import { i as ResourceOperation } from "./index-C7f8cOBM.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/server/resource.d.ts
 /** What a resource needs from `defineListQuery`. */

package/dist/{resource-My_y-Syh.js → resource-mqfJW4YF.js}

@@ -1,7 +1,7 @@
-import { n as dbError } from "./errors-L0xK41y_.js";
-import { i as ok, n as err } from "./result-Bj6yt33D.js";
-import { t as validate } from "./standard-BRyBGTtp.js";
-import { s as respond } from "./server-BA75B0mT.js";
+import { n as dbError } from "./errors-DtwXa6b8.js";
+import { i as ok, n as err } from "./result-BKiliPY7.js";
+import { t as validate } from "./standard-D7r6dMUu.js";
+import { p as respond } from "./server-B1mZ7CgQ.js";
 //#region src/server/resource.ts
 const INTEGER = /* @__PURE__ */ new Set([
 	"int2",
@@ -9,7 +9,7 @@ const INTEGER = /* @__PURE__ */ new Set([
 	"int8"
 ]);
 function keyValue(table, raw) {
-	const invalid = err(dbError("invalid_request", `${JSON.stringify(raw)} is not a valid ${table.key} key`));
+	const invalid = err(dbError("invalid_input", `${JSON.stringify(raw)} is not a valid ${table.key} key`));
 	const column = table.columns[table.primaryKey[0]];
 	if (column && INTEGER.has(column.type)) {
 		const value = typeof raw === "string" ? Number(raw) : raw;
@@ -17,12 +17,26 @@ function keyValue(table, raw) {
 	}
 	return typeof raw === "string" && raw !== "" ? ok(raw) : invalid;
 }
+/**
+* A cross-site browser request that needed no CORS preflight: a form post
+* riding on the session cookie. Bearer requests and JSON bodies (which need a
+* preflight) pass, as do requests without an `Origin` (not a browser).
+*/
+function crossSiteSimpleRequest(request) {
+	if (request.method === "GET" || request.method === "HEAD") return false;
+	if (request.headers.has("authorization")) return false;
+	const origin = request.headers.get("origin");
+	if (!origin || origin === new URL(request.url).origin) return false;
+	if (request.headers.get("sec-fetch-site") === "same-origin") return false;
+	const type = request.headers.get("content-type") ?? "";
+	return !/^application\/(?:[\w.+-]+\+)?json\b/iu.test(type);
+}
 async function readBody(request) {
 	try {
 		const body = await request.json();
 		if (typeof body === "object" && body !== null && !Array.isArray(body)) return ok(body);
 	} catch {}
-	return err(dbError("invalid_request", "The request body must be a JSON object"));
+	return err(dbError("invalid_input", "The request body must be a JSON object"));
 }
 function pageArgs(query, max, pagination) {
 	const raw = (name) => {
@@ -66,7 +80,7 @@ function pageArgs(query, max, pagination) {
 	});
 }
 function asObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value) ? ok(value) : err(dbError("invalid_request", "Expected an object of column values"));
+	return typeof value === "object" && value !== null && !Array.isArray(value) ? ok(value) : err(dbError("invalid_input", "Expected an object of column values"));
 }
 async function settled(value) {
 	return await value;
@@ -155,6 +169,7 @@ function defineResource(betterSupabase, table, options = {}) {
 		...has("delete") ? ["DELETE"] : []
 	];
 	const route = async (request, db, id) => {
+		if (crossSiteSimpleRequest(request)) return err(dbError("forbidden", "Cross-site requests need Content-Type: application/json or a bearer token", { code: "CROSS_SITE_REQUEST" }));
 		if (id === void 0) {
 			if (request.method === "GET" && has("list")) return execute(db, "list", { query: new URL(request.url).searchParams });
 			if (request.method === "POST" && has("create")) {

package/dist/respond-BR1fJWOB.d.ts

@@ -0,0 +1,377 @@
+import { n as AnyFunctions, r as AnyModels } from "./types-Dnf_wRDz.js";
+import { _ as DbError, a as AsyncResult } from "./executor-BunPOO-k.js";
+import { a as EventHub } from "./events-aIO7vsIk.js";
+import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "./define-Bp_BZa5h.js";
+import { g as RequestContext } from "./plugin-o144f322.js";
+import { t as BetterSupabaseEnv } from "./index-CLg87OBW.js";
+import { s as SqlClaims, t as BetterPostgres } from "./pool-C9voM4Kw.js";
+import { c as ResolveAuthOptions, i as AuthResolution, o as AuthState, t as ImpersonationOptions } from "./impersonation-BmePsuxz.js";
+import { a as SupportSession, i as SupportListFilter, o as SupportSessionStore } from "./support-CEPwlw2G.js";
+import { c as Bucket } from "./index-SaTsEfGP.js";
+import { t as Aal } from "./mfa-Cu96oJdw.js";
+import { SupabaseClient } from "@supabase/supabase-js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/auth/support-cookie.d.ts
+/** The cookie that carries the support session id. */
+declare const SUPPORT_COOKIE = "bs-support";
+interface SupportCookieOptions {
+  /** Defaults to `bs-support`. */
+  readonly name?: string;
+  /** Defaults to `/`. */
+  readonly path?: string;
+  /** Defaults to true; set false for plain-HTTP local development. */
+  readonly secure?: boolean;
+}
+/** `Set-Cookie` for a session: HttpOnly, SameSite=Lax, gone when the session expires. */
+declare function supportCookie(session: Pick<SupportSession, "id" | "expiresAt">, options?: SupportCookieOptions, now?: number): string;
+/** `Set-Cookie` that removes the support cookie. */
+declare function clearSupportCookie(options?: SupportCookieOptions): string;
+/** The support session id in a `Cookie` header, or `undefined`. */
+declare function supportCookieValue(cookieHeader: string | null, name?: string): string | undefined;
+//#endregion
+//#region src/server/support.d.ts
+type UserAuth = Extract<AuthState, {
+  kind: "user";
+}>;
+interface SupportPolicy {
+  /** Seconds a session lasts. Defaults to 1800 (30 minutes). */
+  readonly ttl?: number;
+  /** The longest `ttl` a start may ask for. Defaults to 14400 (4 hours). */
+  readonly maxTtl?: number;
+  /** Defaults to true. */
+  readonly requireReason?: boolean;
+  /**
+   * `always` (the default): every session is read-only. `default`: read-only
+   * unless the start passes `readOnly: false`.
+   */
+  readonly readOnly?: "always" | "default";
+}
+interface SupportAuthorizeInput {
+  readonly admin: UserAuth;
+  readonly targetUserId: string;
+  readonly reason: string;
+  readonly readOnly: boolean;
+  readonly tenant?: string;
+  readonly metadata: Readonly<Record<string, unknown>>;
+}
+interface SupportOptions {
+  readonly store: SupportSessionStore;
+  /**
+   * Whether `admin` may view the app as the target. A throw or rejection
+   * counts as a deny. Defaults to allowing, so the store decides: the SQL
+   * store checks `is_platform(kits.support-sessions.permissions.start)`.
+   */
+  readonly authorize?: (input: SupportAuthorizeInput) => boolean | Promise<boolean>;
+  /**
+   * The claims the target gets. Defaults to `store.claims` (the SQL store
+   * runs your custom access token hook), then `{ role: 'authenticated' }`.
+   */
+  readonly claims?: (targetUserId: string) => Readonly<Record<string, unknown>> | Promise<Readonly<Record<string, unknown>>>;
+  readonly policy?: SupportPolicy;
+  readonly cookie?: SupportCookieOptions;
+}
+interface SupportStartRequest {
+  readonly targetUserId: string;
+  readonly reason?: string;
+  /** Seconds; defaults to `policy.ttl`. */
+  readonly ttl?: number;
+  /** Honoured only with `policy.readOnly: 'default'`. */
+  readonly readOnly?: boolean;
+  readonly tenant?: string;
+  readonly metadata?: Readonly<Record<string, unknown>>;
+}
+/** A running support session, as the request that carries its cookie sees it. */
+interface ActiveSupport {
+  readonly session: SupportSession;
+  /** The admin behind the session, from their own verified token. */
+  readonly admin: {
+    readonly id: string;
+    readonly email?: string;
+  };
+  /** The target's claims plus `act`, which repositories run with. */
+  readonly claims: Readonly<Record<string, unknown>>;
+}
+/** `bs.support`: start, stop and inspect support sessions. */
+interface SupportApi {
+  /**
+   * Starts a session for a signed-in admin and returns it with the
+   * `Set-Cookie` value that switches the admin's next requests to the target.
+   */
+  start(admin: AuthState, request: SupportStartRequest): AsyncResult<{
+    readonly session: SupportSession;
+    readonly cookie: string;
+  }>;
+  /** Ends the admin's own session and returns the `Set-Cookie` that clears the cookie. */
+  stop(admin: AuthState, sessionId: string): AsyncResult<{
+    readonly ended: boolean;
+    readonly cookie: string;
+  }>;
+  /**
+   * Ends a session as `caller`: the SQL store allows the session's admin and
+   * staff with the revoke permission.
+   */
+  revoke(caller: AuthState, sessionId: string): AsyncResult<boolean>;
+  /** The running session the request's cookie names for `auth`, if any. */
+  current(request: Request, auth: AuthState): Promise<ActiveSupport | undefined>;
+  /** The sessions `caller` may view (the SQL store checks the view permission). */
+  list(caller: AuthState, filter?: SupportListFilter): AsyncResult<readonly SupportSession[]>;
+  /** The support session id in a request's cookie. */
+  sessionIdOf(request: Request): string | undefined;
+  /** `Set-Cookie` that clears the support cookie. */
+  clearCookie(): string;
+}
+/** `ServerOptions.support`, from `supportSessions(options)`. */
+interface SupportSessions {
+  readonly options: SupportOptions;
+  /** Builds `bs.support`; `createServer` calls it once. */
+  readonly create: (events: EventHub, claimsSchema: StandardSchemaV1 | undefined) => SupportApi;
+}
+/**
+ * Support sessions for `createServer(betterSupabase, { support })`. Apps that
+ * never import it don't bundle the support code.
+ */
+declare function supportSessions(options: SupportOptions): SupportSessions;
+//#endregion
+//#region src/server/delete-account.d.ts
+interface DeleteAccountOptions {
+  /**
+   * Buckets to clear first. Objects whose `owner` placeholder (`{userId}`,
+   * or `owner.param` for `owner` buckets) is the user are removed; buckets
+   * without one are skipped.
+   */
+  readonly buckets?: readonly Bucket<string>[];
+  /**
+   * App keys of tables whose rows the database deletes or updates with the
+   * user (`on delete cascade` or `set null` to `auth.users`). They get a
+   * table-wide `mutation` notice, so caches drop their reads.
+   */
+  readonly cascades?: readonly string[];
+  readonly context?: RequestContext;
+  readonly signal?: AbortSignal;
+}
+interface DeleteAccountResult {
+  readonly userId: string;
+  /** Removed objects per bucket id. */
+  readonly removed: Readonly<Record<string, number>>;
+}
+//#endregion
+//#region src/server/replicas.d.ts
+/** Cookie holding the epoch ms until which reads stay on the primary. */
+declare const PRIMARY_COOKIE = "bs-primary-until";
+/** Where a request context sends its reads. */
+interface ReplicaState {
+  /** Reads go to the primary: this context wrote, or a recent request did. */
+  readonly pinned: boolean;
+  /** This context wrote through its repositories (or called `pin()`). */
+  readonly wrote: boolean;
+  /** Sends later reads to the primary, e.g. after a write through `$client` or `ctx.sql`. */
+  pin(): void;
+}
+//#endregion
+//#region src/server/server.d.ts
+interface ServerOptions {
+  /** Defaults to `loadEnv()`. */
+  readonly env?: BetterSupabaseEnv;
+  /** Enables `ctx.sql` and `actingAs()`. */
+  readonly postgres?: BetterPostgres;
+  readonly auth?: Omit<ResolveAuthOptions, "env">;
+  /**
+   * Fetch the JWKS when the server is created, so the first request verifies
+   * its token without waiting for it. Applies when neither `auth.jwks` nor
+   * `env.jwks` (`SUPABASE_JWKS`) holds the keys inline. Defaults to true, except under `NODE_ENV=test`.
+   */
+  readonly prefetchJwks?: boolean;
+  /**
+   * Extra headers on the caller's PostgREST requests, readable in Postgres as
+   * `current_setting('request.headers')` (channel, request id, client IP for audit).
+   */
+  readonly headers?: (request: Request) => Readonly<Record<string, string>>;
+  /**
+   * PostgREST URL for the caller's reads: a read replica or the `<ref>-all`
+   * load balancer. Defaults to `SUPABASE_READ_URL`; `false` reads from the
+   * primary.
+   */
+  readonly readUrl?: string | false;
+  /**
+   * `fetch` for the PostgREST and supabase-js clients, e.g. `tracedFetch()`
+   * from `better-supabase/otel`. Auth refreshes use `auth.fetch`.
+   */
+  readonly fetch?: typeof globalThis.fetch;
+  readonly replicas?: {
+    /** How long the next requests read from the primary after a write. Defaults to 5 s. */
+    readonly pinMs?: number;
+  };
+  /**
+   * The active tenant of a request when it doesn't come from a claim, e.g.
+   * from a URL slug (`kits.access.activeTenant: 'resolver'`). It becomes
+   * `context.tenant` for the `tenant()` plugin, the `better_supabase.tenant`
+   * setting over Postgres and the `x-bs-tenant` header over PostgREST, which
+   * `current_tenant_id()` reads only while the caller is a member. Async
+   * resolvers need `context(request)`; `contextFromResolution` takes
+   * `options.tenant` instead.
+   */
+  readonly tenant?: (request: Request, auth: AuthState) => string | undefined | PromiseLike<string | undefined>;
+  /**
+   * Support sessions ("view as user") from `supportSessions(options)`: a platform admin's requests that carry
+   * the support cookie run as the target user, read-only by default. Needs
+   * `postgres`, since the target's queries run over direct Postgres.
+   */
+  readonly support?: SupportSessions;
+}
+/** The header `current_tenant_id()` reads over the Data API. */
+declare const TENANT_HEADER = "x-bs-tenant";
+interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
+  readonly auth: AuthState<C, P>;
+  readonly resolution: AuthResolution<C, P>;
+  /**
+   * supabase-js client scoped to the caller (RLS applies). Throws in a
+   * support session: Realtime, Storage and Auth would act as the admin.
+   */
+  readonly supabase: SupabaseClient;
+  /** Repositories over PostgREST as the caller. */
+  readonly db: Db<M, F, E, SupabaseClient>;
+  /** Repositories over direct Postgres as the caller, when `postgres` is configured. */
+  readonly sql: Db<M, F, E, undefined> | undefined;
+  /** Calls, waves, tables and time for `db` and `sql` together. */
+  stats(): DbStats;
+  /** Where `db` reads go, when a read URL is configured. */
+  readonly replica: ReplicaState | undefined;
+  /**
+   * `response` with this request's cookies: refreshed session cookies
+   * (`resolution.apply`) and, after a write, `bs-primary-until`.
+   */
+  apply(response: Response): Response;
+  /**
+   * Set while an admin views the app as another user: `auth`, `db` and
+   * `sql` are the target's, and `resolution` stays the admin's.
+   */
+  readonly support?: ActiveSupport;
+}
+interface ContextOptions {
+  readonly refresh?: boolean;
+  /** Read the session cookie. Defaults to true; `false` resolves bearer tokens only. */
+  readonly cookies?: boolean;
+  /** Epoch ms until which `db` reads from the primary (the `bs-primary-until` cookie). */
+  readonly pinnedUntil?: number;
+  /** Also records this context's calls into a request-wide recorder. */
+  readonly stats?: StatsRecorder;
+  /** The active tenant, instead of `ServerOptions.tenant`. */
+  readonly tenant?: string;
+  /**
+   * The request's support session, from `support.current()`. `context()`
+   * looks it up itself; `contextFromResolution` only uses this.
+   */
+  readonly support?: ActiveSupport;
+}
+interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
+  readonly env: BetterSupabaseEnv;
+  resolve(request: Request, options?: {
+    readonly refresh?: boolean;
+    readonly cookies?: boolean;
+  }): Promise<AuthResolution<C, P>>;
+  /**
+   * Resolves auth and binds repositories to the caller. Refreshes an expired
+   * cookie session only with `refresh: true`; send `ctx.apply(response)`.
+   */
+  context(request: Request, options?: ContextOptions): Promise<ServerContext<M, F, E, C, P>>;
+  /**
+   * The context for a resolution from `resolve(request)`, so one resolution
+   * can back several contexts without verifying the token again.
+   */
+  contextFromResolution(resolution: AuthResolution<C, P>, request: Request, options?: Omit<ContextOptions, "refresh">): ServerContext<M, F, E, C, P>;
+  /** The context for an auth state resolved elsewhere (the proxy, a queue message). */
+  contextFor(auth: AuthState<C, P>, options?: ContextOptions): ServerContext<M, F, E, C, P>;
+  /** A stateless supabase-js client for an auth state, optionally with extra request headers. */
+  supabaseFor(auth: AuthState, headers?: Readonly<Record<string, string>>): SupabaseClient;
+  /** Repositories for an auth state (e.g. one resolved by the proxy). */
+  dbFor(auth: AuthState, context?: RequestContext): Db<M, F, E, SupabaseClient>;
+  /** Service-role repositories. Bypasses RLS; the actor is `service`. */
+  admin(context?: RequestContext): Db<M, F, E, SupabaseClient>;
+  /**
+   * Deletes a user: their objects in `buckets`, then the Auth user, then a
+   * `mutation` notice for `auth.users`. Needs the secret key. Access tokens
+   * already issued stay valid until they expire.
+   */
+  deleteAccount(userId: string, options?: DeleteAccountOptions): AsyncResult<DeleteAccountResult>;
+  /**
+   * Repositories running as a user, with RLS, over direct Postgres. With
+   * `impersonation`, the claims carry `act: { kind: "impersonation", sub, reason }`, which
+   * the `audit` and `actor` SQL kit modules record.
+   */
+  actingAs(userId: string, claims?: Omit<SqlClaims, "sub" | "act">, impersonation?: ImpersonationOptions): Db<M, F, E, undefined>;
+  /** Support sessions; every method fails without `ServerOptions.support`. */
+  readonly support: SupportApi;
+}
+/**
+ * Server-side entry point for APIs, jobs, MCP servers and framework
+ * adapters. Holds the secrets; `betterSupabase` stays isomorphic.
+ */
+declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
+//#endregion
+//#region src/server/respond.d.ts
+type AuthKind = AuthState["kind"];
+/**
+ * An auth kind a guard lets through. `anonymous` admits users signed in with
+ * `signInAnonymously()` (`is_anonymous`); `anon` admits callers without a
+ * session only.
+ */
+type AllowedCaller = Exclude<AuthKind, "invalid"> | "anonymous";
+interface GuardOptions {
+  /**
+   * Callers allowed through. Defaults to `['user']`, which refuses anonymous
+   * sign-ins. Only `'anonymous'` admits them: `['anonymous']` alone admits
+   * anonymous sign-ins and refuses other users, and `'anon'` (no session)
+   * never admits them.
+   */
+  readonly allow?: readonly AllowedCaller[];
+  /**
+   * Assurance level user sessions need. `aal2` answers 403 with
+   * `required: 'aal2'` until the user verifies a second factor.
+   */
+  readonly aal?: Aal;
+  /**
+   * OAuth scopes a delegated token (an OAuth client or an `act` chain) needs.
+   * A missing one answers 403 with `error="insufficient_scope"`. The user's
+   * own session is not limited by scopes.
+   */
+  readonly scopes?: readonly string[];
+}
+/** Guard options for middleware and fetch handlers that resolve the caller themselves. */
+interface MiddlewareOptions extends GuardOptions {
+  /**
+   * Refresh an expired cookie session and send the new cookies. Only for
+   * routes browsers call with cookies; bearer tokens never refresh.
+   */
+  readonly refresh?: boolean;
+}
+/** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
+declare function guard(auth: AuthState, allow?: GuardOptions["allow"], aal?: Aal, scopes?: readonly string[]): DbError | undefined;
+declare function isResult(value: unknown): value is {
+  ok: boolean;
+  data: unknown;
+  error: unknown;
+};
+type Settled = {
+  readonly ok: true;
+  readonly data: unknown;
+} | {
+  readonly ok: false;
+  readonly error: DbError;
+};
+/**
+ * Settles a handler's return value: `Result`s and `AsyncResult`s unwrap,
+ * thrown `DbException`s (or errors whose `cause` is a `DbError`) become
+ * errors, anything else is data. Other thrown
+ * errors propagate.
+ */
+declare function settle(run: () => unknown): Promise<Settled>;
+interface RespondOptions {
+  readonly instance?: string;
+  readonly expose?: boolean;
+  /** Status for data responses. Defaults to 200 (204 without data). */
+  readonly status?: number;
+}
+/** A handler's value as a response: `Response` as is, data as JSON, errors as Problem Details. */
+declare function respond(run: () => unknown, options?: RespondOptions): Promise<Response>;
+//#endregion
+export { clearSupportCookie as A, SupportOptions as C, supportSessions as D, SupportStartRequest as E, supportCookieValue as M, SUPPORT_COOKIE as O, SupportAuthorizeInput as S, SupportSessions as T, ReplicaState as _, Settled as a, ActiveSupport as b, respond as c, ContextOptions as d, ServerContext as f, PRIMARY_COOKIE as g, createServer as h, RespondOptions as i, supportCookie as j, SupportCookieOptions as k, settle as l, TENANT_HEADER as m, GuardOptions as n, guard as o, ServerOptions as p, MiddlewareOptions as r, isResult as s, AuthKind as t, BetterServer as u, DeleteAccountOptions as v, SupportPolicy as w, SupportApi as x, DeleteAccountResult as y };

package/dist/{result-Bj6yt33D.js → result-BKiliPY7.js}

@@ -1,4 +1,4 @@
-import { n as dbError, r as dbErrorOf, t as DbException } from "./errors-L0xK41y_.js";
+import { n as dbError, r as dbErrorOf, t as DbException } from "./errors-DtwXa6b8.js";
 //#region src/core/result.ts
 const throwMappers = /* @__PURE__ */ new WeakMap();
 function inherit(from, next) {

package/dist/server/index.d.ts

@@ -1,14 +1,17 @@
-import { n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
-import { p as DbError } from "../result-CqEsbgYs.js";
-import { t as BetterSupabase, y as Db } from "../define-CRS2MRV3.js";
-import { h as RequestContext } from "../plugin-bNhvJwRh.js";
-import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-C7MNQ1Ob.js";
-import { _ as readSession, a as ResolveAuthOptions, b as writeSession, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as StoredSession, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, y as sessionCookieName } from "../resolve-BAqQcwMW.js";
-import { _ as DeleteAccountOptions, a as Settled, c as respond, d as ContextOptions, f as ServerContext, g as ReplicaState, h as PRIMARY_COOKIE, i as RespondOptions, l as settle, m as createServer, n as GuardOptions, o as guard, p as ServerOptions, r as MiddlewareOptions, s as isResult, t as AuthKind, u as BetterServer, v as DeleteAccountResult } from "../respond-DgIbdrt8.js";
-import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-BJcaIfxi.js";
-import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-U8UEKccv.js";
-import { a as SessionDelegation, i as SessionActor, n as toSession, r as ActClaim, t as AuthSession } from "../view-B64o81wp.js";
-import { n as RefreshOutcome, r as refreshSession } from "../refresh-BwYkyNOQ.js";
+import { n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
+import { _ as DbError } from "../executor-BunPOO-k.js";
+import { t as BetterSupabase, y as Db } from "../define-Bp_BZa5h.js";
+import { g as RequestContext } from "../plugin-o144f322.js";
+import { C as writeSession, S as sessionCookieName, _ as StoredSession, a as AuthResolver, b as readSession, c as ResolveAuthOptions, d as clientIp, f as resolveAuth, g as CookieWrite, h as CookieRecord, i as AuthResolution, l as ResolvedState, m as CookieOptions, n as Impersonator, o as AuthState, p as AUTH_CACHE_HEADERS, r as impersonatorOf, s as InvalidReason, t as ImpersonationOptions, u as authContext } from "../impersonation-BmePsuxz.js";
+import { a as SupportSession, c as sqlSupportStore, i as SupportListFilter, l as supportClaims, n as SupportCallerClaims, o as SupportSessionStore, r as SupportEndedBy, s as SupportStartInput, t as SqlSupportStoreOptions } from "../support-CEPwlw2G.js";
+import { A as clearSupportCookie, C as SupportOptions, D as supportSessions, E as SupportStartRequest, M as supportCookieValue, O as SUPPORT_COOKIE, S as SupportAuthorizeInput, T as SupportSessions, _ as ReplicaState, a as Settled, b as ActiveSupport, c as respond, d as ContextOptions, f as ServerContext, g as PRIMARY_COOKIE, h as createServer, i as RespondOptions, j as supportCookie, k as SupportCookieOptions, l as settle, m as TENANT_HEADER, n as GuardOptions, o as guard, p as ServerOptions, r as MiddlewareOptions, s as isResult, t as AuthKind, u as BetterServer, v as DeleteAccountOptions, w as SupportPolicy, x as SupportApi, y as DeleteAccountResult } from "../respond-BR1fJWOB.js";
+import { a as checkAal, i as amrOf, n as AmrEntry, r as aalOf, t as Aal } from "../mfa-Cu96oJdw.js";
+import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-DNRFP7KR.js";
+import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-Blxe8S31.js";
+import { n as SessionActor, r as SessionDelegation, t as ActClaim } from "../actor-DaJjqD5R.js";
+import { n as toSession, t as AuthSession } from "../view-CbgObAeb.js";
+import { n as supportOf, t as SupportView } from "../support-view-B8SlToQX.js";
+import { n as RefreshOutcome, r as refreshSession } from "../refresh-CFPX0Qft.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
@@ -64,4 +67,4 @@ export declare function checkSession(sql: SessionLookup, auth: {
   readonly kind: string;
 }): Promise<DbError | undefined>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type ActClaim, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type BetterServer, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type GuardOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, type ServerContext, type ServerOptions, type SessionActor, type SessionDelegation, type SessionLookup, type Settled, type StoredSession, type SupabaseAuthContext, aalOf, amrOf, authContext, checkAal, clientIp, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, toSession, writeSession };
+export { AUTH_CACHE_HEADERS, type Aal, type ActClaim, type ActiveSupport, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type BetterServer, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type GuardOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerOptions, type SessionActor, type SessionDelegation, type SessionLookup, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportView, TENANT_HEADER, aalOf, amrOf, authContext, checkAal, clearSupportCookie, clientIp, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, toProblem, toSession, writeSession };

package/dist/server/index.js

@@ -1,10 +1,12 @@
-import { n as dbError } from "../errors-L0xK41y_.js";
-import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-BihjPR0t.js";
-import { a as guard, c as settle, o as isResult, s as respond, t as createServer, u as PRIMARY_COOKIE } from "../server-BA75B0mT.js";
-import { a as clientIp, c as AUTH_CACHE_HEADERS, d as readSession, h as refreshSession, i as authContext, m as writeSession, n as amrOf, p as sessionCookieName, r as checkAal, s as resolveAuth, t as aalOf, y as impersonatorOf } from "../mfa-byfjruR9.js";
-import { n as postgresExecutor } from "../executor-CVt6dD0B.js";
-import { t as toSession } from "../view-BrJI2LKp.js";
-import { t as defineResource } from "../resource-My_y-Syh.js";
+import { n as dbError } from "../errors-DtwXa6b8.js";
+import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-BW1KhzSG.js";
+import { n as impersonatorOf, r as userContext } from "../impersonation-BgSHAYLf.js";
+import { t as supportOf } from "../support-view-g4YLBeqX.js";
+import { c as supportCookie, d as guard, f as isResult, l as supportCookieValue, m as settle, n as createServer, o as SUPPORT_COOKIE, p as respond, s as clearSupportCookie, t as TENANT_HEADER, v as PRIMARY_COOKIE } from "../server-B1mZ7CgQ.js";
+import { _ as writeSession, a as checkAal, d as AUTH_CACHE_HEADERS, g as sessionCookieName, i as amrOf, m as readSession, n as toSession, o as authContext, r as aalOf, s as clientIp, u as resolveAuth, v as refreshSession } from "../view-Bn6HNKUe.js";
+import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-wHnK6zp-.js";
+import { n as postgresExecutor } from "../executor-XycESQPH.js";
+import { t as defineResource } from "../resource-mqfJW4YF.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/server/middleware.ts
 /** Repository context from a `@supabase/server` context. */
@@ -12,15 +14,7 @@ function contextFromSupabase(ctx) {
 	switch (ctx.authMode) {
 		case "user":
 			if (!ctx.userClaims) break;
-			return {
-				actor: {
-					id: ctx.userClaims.id,
-					kind: "user",
-					...ctx.userClaims.role === void 0 ? {} : { role: ctx.userClaims.role },
-					...ctx.userClaims.email === void 0 ? {} : { email: ctx.userClaims.email }
-				},
-				claims: ctx.jwtClaims ?? {}
-			};
+			return userContext(ctx.userClaims, ctx.jwtClaims ?? {});
 		case "secret": return {
 			actor: {
 				id: "service",
@@ -94,4 +88,4 @@ async function checkSession(sql, auth) {
 	return row?.active === true ? void 0 : revoked;
 }
 //#endregion
-export { AUTH_CACHE_HEADERS, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, aalOf, amrOf, authContext, checkAal, checkSession, clientIp, contextFromSupabase, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, toSession, withBetterPostgres, withBetterSupabase, writeSession };
+export { AUTH_CACHE_HEADERS, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, amrOf, authContext, checkAal, checkSession, clearSupportCookie, clientIp, contextFromSupabase, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, toProblem, toSession, withBetterPostgres, withBetterSupabase, writeSession };