better-supabase 0.4.0 → 0.5.1

package/dist/{sql-B34HU2DI.js → sql-Coh6n4cC.js}

@@ -1,4 +1,4 @@
-import { a as invalidRequest, n as simplifyOrFalse } from "./simplify-Cqvfr9dj.js";
+import { a as invalidRequest, n as simplifyOrFalse } from "./simplify-_0oUKqCd.js";
 import { t as lookupOf } from "./lookup-BaP5bI27.js";
 //#region src/compile/sql.ts
 const MAX_PARAMS = 65535;
@@ -291,10 +291,17 @@ function insertPlan(compiler, from, alias, op, columns) {
 	if (op.onConflict) {
 		const target = `(${op.onConflict.columns.map(quoteIdent).join(", ")})`;
 		const updates = columns.map((column) => `${quoteIdent(column)} = excluded.${quoteIdent(column)}`);
-		conflict = op.onConflict.action === "ignore" || updates.length === 0 ? ` on conflict ${target} do nothing` : ` on conflict ${target} do update set ${updates.join(", ")}`;
+		conflict = op.onConflict.action === "ignore" || updates.length === 0 ? ` on conflict ${target} do nothing` : ` on conflict ${target} do update set ${updates.join(", ")}${tenantGuard(op, alias)}`;
 	}
 	return mutation(`insert into ${from} ${body}${conflict}${returningRows(compiler, op, alias)}`, op.returning !== void 0, compiler.params);
 }
+/** An upsert never updates a row that belongs to another tenant. */
+function tenantGuard(op, alias) {
+	const app = op.table.flags.tenant;
+	const column = app === void 0 ? void 0 : op.table.columns[app]?.db;
+	if (column === void 0) return "";
+	return ` where ${alias}.${quoteIdent(column)} = excluded.${quoteIdent(column)}`;
+}
 function mutation(statement, returning, params) {
 	if (returning) return {
 		rows: {

package/dist/ssr/index.d.ts

@@ -1,5 +1,5 @@
-import { _ as readSession, a as ResolveAuthOptions, b as writeSession, d as CookieOptions, f as CookieRecord, g as parseCookies, h as applyCookieWrites, l as resolveAuth, m as StoredSession, n as AuthResolver, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, v as serializeCookie, y as sessionCookieName } from "../resolve-BAqQcwMW.js";
-import { n as toSession, t as AuthSession } from "../view-B64o81wp.js";
-import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-Dm-FHpNH.js";
-import { n as RefreshOutcome, r as refreshSession, t as RefreshOptions } from "../refresh-BwYkyNOQ.js";
+import { C as writeSession, S as sessionCookieName, _ as StoredSession, a as AuthResolver, b as readSession, c as ResolveAuthOptions, f as resolveAuth, g as CookieWrite, h as CookieRecord, i as AuthResolution, m as CookieOptions, o as AuthState, p as AUTH_CACHE_HEADERS, u as authContext, v as applyCookieWrites, x as serializeCookie, y as parseCookies } from "../impersonation-BmePsuxz.js";
+import { n as toSession, t as AuthSession } from "../view-CbgObAeb.js";
+import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-BiJZ4t49.js";
+import { n as RefreshOutcome, r as refreshSession, t as RefreshOptions } from "../refresh-CFPX0Qft.js";
 export { AUTH_CACHE_HEADERS, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type CookieOptions, type CookieRecord, type CookieWrite, type EntitlementKey, type MembershipClaim, type RefreshOptions, type RefreshOutcome, type ResolveAuthOptions, type StoredSession, applyCookieWrites, authContext, hasEntitlement, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, toSession, writeSession };

package/dist/ssr/index.js

@@ -1,4 +1,3 @@
 import { t as hasEntitlement } from "../entitlements-CTEBm7IB.js";
-import { c as AUTH_CACHE_HEADERS, d as readSession, f as serializeCookie, h as refreshSession, i as authContext, l as applyCookieWrites, m as writeSession, p as sessionCookieName, s as resolveAuth, u as parseCookies } from "../mfa-byfjruR9.js";
-import { t as toSession } from "../view-BrJI2LKp.js";
+import { _ as writeSession, d as AUTH_CACHE_HEADERS, f as applyCookieWrites, g as sessionCookieName, h as serializeCookie, m as readSession, n as toSession, o as authContext, p as parseCookies, u as resolveAuth, v as refreshSession } from "../view-Bn6HNKUe.js";
 export { AUTH_CACHE_HEADERS, applyCookieWrites, authContext, hasEntitlement, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, toSession, writeSession };

package/dist/{standard-BRyBGTtp.js → standard-D7r6dMUu.js}

@@ -1,5 +1,5 @@
-import { n as dbError } from "./errors-L0xK41y_.js";
-import { i as ok, n as err } from "./result-Bj6yt33D.js";
+import { n as dbError } from "./errors-DtwXa6b8.js";
+import { i as ok, n as err } from "./result-BKiliPY7.js";
 //#region src/core/standard.ts
 /** Validates with any Standard Schema (zod, valibot, arktype, ...). */
 async function validate(schema, value, label = "value") {
@@ -10,7 +10,10 @@ async function validate(schema, value, label = "value") {
 }
 function toIssues(issues) {
 	return issues.map((issue) => {
-		const path = issue.path?.map((segment) => typeof segment === "object" ? segment.key : segment);
+		const path = issue.path?.map((segment) => {
+			const key = typeof segment === "object" ? segment.key : segment;
+			return typeof key === "symbol" ? String(key) : key;
+		});
 		return path && path.length > 0 ? {
 			message: issue.message,
 			path

package/dist/{standard-BsaCYQJc.d.ts → standard-J4YgMOLm.d.ts}

@@ -1,4 +1,4 @@
-import { o as Result } from "./result-CqEsbgYs.js";
+import { u as Result } from "./executor-BunPOO-k.js";
 import { StandardSchemaV1 as StandardSchemaV1$1 } from "@standard-schema/spec";
 //#region src/core/standard.d.ts
 /** Validates with any Standard Schema (zod, valibot, arktype, ...). */

package/dist/{stats-C_YxA2r1.js → stats-Bqob3WqT.js}

@@ -1,7 +1,7 @@
-import { c as mapDbError, n as dbError } from "./errors-L0xK41y_.js";
-import { a as invalidRequest, n as simplifyOrFalse } from "./simplify-Cqvfr9dj.js";
-import { i as temporalText } from "./temporal-BwshQk0W.js";
-import { i as ok, n as err, o as toDbError } from "./result-Bj6yt33D.js";
+import { c as mapDbError, n as dbError } from "./errors-DtwXa6b8.js";
+import { a as invalidRequest, n as simplifyOrFalse } from "./simplify-_0oUKqCd.js";
+import { i as temporalText } from "./temporal-CVlIV2DZ.js";
+import { i as ok, n as err, o as toDbError } from "./result-BKiliPY7.js";
 //#region src/compile/postgrest.ts
 function scalar(value) {
 	if (typeof value === "string") return value;

package/dist/storage/index.d.ts

@@ -1,6 +1,6 @@
-import { b as PermdockBucketPolicy } from "../types-DONv9SHN.js";
+import { t as AccessBucketPolicy, x as PermdockBucketPolicy } from "../types-Dnf_wRDz.js";
+import { n as PermdockCatalog } from "../permdock-sql-C2Inc6Xc.js";
 import { n as StoragePath, t as PathIn } from "../path-Cv__-OTj.js";
-import { t as PermdockCatalog } from "../permdock-sql-DImJULY-.js";
 import { n as TemplateValues, t as TemplateParams } from "../template-mbvlysOo.js";
-import { C as fromStorageError, S as defineBucket, _ as TransformOptions, a as BucketConnectOptions, b as UploadOptions, c as ObjectTarget, d as Reservation, f as StorageClient, g as TTL, h as SweepResult, i as BucketConfig, l as ReplaceOptions, m as SweepOptions, n as Bucket, o as BucketDrift, p as StoredObject, r as BucketClient, s as BucketPolicy, t as ActualBucket, u as ReplaceResult, v as TtlPreset, w as parseSize, x as UrlOptions, y as UploadBody } from "../index-528Ugmyp.js";
-export { type ActualBucket, type Bucket, type BucketClient, type BucketConfig, type BucketConnectOptions, type BucketDrift, type BucketPolicy, type ObjectTarget, type PathIn, type PermdockBucketPolicy, type PermdockCatalog, type ReplaceOptions, type ReplaceResult, type Reservation, type StorageClient, type StoragePath, type StoredObject, type SweepOptions, type SweepResult, TTL, type TemplateParams, type TemplateValues, type TransformOptions, type TtlPreset, type UploadBody, type UploadOptions, type UrlOptions, defineBucket, fromStorageError, parseSize };
+import { A as parseSize, C as TransformOptions, D as UrlOptions, E as UploadOptions, O as defineBucket, S as TTL, T as UploadBody, _ as Reservation, a as avatarBucket, b as SweepOptions, c as Bucket, d as BucketConnectOptions, f as BucketDrift, g as ReplaceResult, h as ReplaceOptions, i as OrgLogoBucketOptions, k as fromStorageError, l as BucketClient, m as ObjectTarget, n as IMAGE_TYPES, o as orgLogoBucket, p as BucketPolicy, r as ImageBucketOptions, s as ActualBucket, t as AvatarBucketOptions, u as BucketConfig, v as StorageClient, w as TtlPreset, x as SweepResult, y as StoredObject } from "../index-SaTsEfGP.js";
+export { type AccessBucketPolicy, type ActualBucket, type AvatarBucketOptions, type Bucket, type BucketClient, type BucketConfig, type BucketConnectOptions, type BucketDrift, type BucketPolicy, IMAGE_TYPES, type ImageBucketOptions, type ObjectTarget, type OrgLogoBucketOptions, type PathIn, type PermdockBucketPolicy, type PermdockCatalog, type ReplaceOptions, type ReplaceResult, type Reservation, type StorageClient, type StoragePath, type StoredObject, type SweepOptions, type SweepResult, TTL, type TemplateParams, type TemplateValues, type TransformOptions, type TtlPreset, type UploadBody, type UploadOptions, type UrlOptions, avatarBucket, defineBucket, fromStorageError, orgLogoBucket, parseSize };

package/dist/storage/index.js

@@ -1,9 +1,82 @@
-import { n as dbError, o as isDbError, t as DbException } from "../errors-L0xK41y_.js";
-import { r as optionalTemporal } from "../temporal-BwshQk0W.js";
-import { n as temporalMissing } from "../temporal-required-CBNHT6ni.js";
-import { i as ok, n as err, o as toDbError, t as AsyncResult } from "../result-Bj6yt33D.js";
-import { i as tenantClaimPaths } from "../claims-BAf6c7is.js";
-import { a as sqlIdent, i as slug, o as sqlString, r as parseTemplate, t as permdockCheck } from "../permdock-sql-C4KFzLc9.js";
+import { n as dbError, o as isDbError, t as DbException } from "../errors-DtwXa6b8.js";
+import { r as optionalTemporal } from "../temporal-CVlIV2DZ.js";
+import { n as temporalMissing } from "../temporal-required-CAt4Dc9Z.js";
+import { i as ok, n as err, o as toDbError, t as AsyncResult } from "../result-BKiliPY7.js";
+import { o as spansAllTenants, s as tenantOf } from "../plugin-DwARMuQp.js";
+import { i as tenantClaimPaths, n as claimAt } from "../claims-BAf6c7is.js";
+import { i as sqlString, n as slug, r as sqlIdent, t as parseTemplate } from "../template-TxrGI5jR.js";
+import { n as permdockCheck } from "../permdock-sql-DgOfeixi.js";
+//#region src/storage/policy.ts
+/**
+* The checks of a PermDock or access contract policy, or `undefined` for a
+* named policy. `segmentOf` returns the tenant segment, or throws when the
+* path has none.
+*/
+function policyChecks(config, policy, segmentOf) {
+	if (typeof policy === "string") return void 0;
+	let check;
+	let keys;
+	if ("permdock" in policy) {
+		const where = `defineBucket(${config.id})`;
+		const id = policy.scope === "global" ? void 0 : `split_part(name, '/', ${String(policy.segment ?? segmentOf("PermDock"))})`;
+		check = (key) => permdockCheck(where, policy, key, id, config.catalog);
+		keys = policy.permdock;
+	} else {
+		const segment = policy.segment ?? (policy.scope === "platform" ? void 0 : segmentOf("permission"));
+		check = (key) => segment === void 0 ? `(select better_supabase.is_platform(${sqlString(key)}))` : `split_part(name, '/', ${String(segment)}) in (select t::text from better_supabase.tenant_ids_with(${sqlString(key)}) t)`;
+		keys = policy.access;
+	}
+	return {
+		read: check(keys.read),
+		...keys.list === void 0 ? {} : { list: check(keys.list) },
+		write: check(keys.write),
+		delete: check(keys.delete ?? keys.write)
+	};
+}
+//#endregion
+//#region src/storage/tenant-scope.ts
+const forbidden = (bucket, message) => new DbException(dbError("forbidden", message, { table: bucket }));
+function resolveTenant(options, claim) {
+	const { context } = options;
+	if (options.tenant !== void 0) return options.tenant;
+	if (!context) return void 0;
+	const tenant = tenantOf(context);
+	if (tenant !== void 0) return tenant;
+	const paths = typeof claim === "string" ? [claim] : claim ?? tenantClaimPaths();
+	for (const path of paths) {
+		const value = claimAt(context.claims, path);
+		if (value !== void 0) return value;
+	}
+}
+/**
+* The guard for a client of bucket `bucket` whose template holds the tenant
+* in `param`, or `undefined` when nothing is checked (no tenant config,
+* `allTenants`, or an all-tenants context).
+*/
+function tenantGuard(bucket, param, claim, match, options) {
+	const { context } = options;
+	if (param === void 0 || options.allTenants === true || context && spansAllTenants(context)) return;
+	const tenant = resolveTenant(options, claim);
+	const tenantOrThrow = () => {
+		if (tenant !== void 0) return tenant;
+		throw forbidden(bucket, `No tenant for bucket "${bucket}": pass { context } or { tenant } to connect(), or { allTenants: true }`);
+	};
+	return {
+		param,
+		path(path) {
+			const owner = tenantOrThrow();
+			if (String(match(path)?.[param]) !== owner) throw forbidden(bucket, `Path "${path}" belongs to another tenant`);
+			return path;
+		},
+		within(within) {
+			const owner = tenantOrThrow();
+			const given = within?.[param];
+			if (given !== void 0 && String(given) !== owner) throw forbidden(bucket, "Listing belongs to another tenant");
+			return owner;
+		}
+	};
+}
+//#endregion
 //#region src/storage/bucket.ts
 /** Storage operations that list objects; every other `select` is a read. */
 const LIST_OPERATIONS = [
@@ -123,7 +196,10 @@ function defineBucket(config) {
 		if (index === void 0) throw new TypeError(`defineBucket: a ${kind} policy needs {${param}} as a whole path segment in "${config.path}"`);
 		return index;
 	}
-	const mode = typeof policy === "string" ? policy : "permdock";
+	const tenantParam = config.tenant ? config.tenant.param ?? "orgId" : void 0;
+	if (tenantParam !== void 0 && !template.params.includes(tenantParam)) throw new TypeError(`defineBucket: tenant.param {${tenantParam}} is not in "${config.path}"`);
+	const tenantClaim = config.tenant?.claim;
+	const mode = typeof policy === "string" ? policy : "permdock" in policy ? "permdock" : "access";
 	const accessCheck = (() => {
 		switch (mode) {
 			case "tenant": {
@@ -137,23 +213,12 @@ function defineBucket(config) {
 			}
 			case "public":
 			case "none":
-			case "permdock": return;
+			case "permdock":
+			case "access": return;
 			default: throw new TypeError(`defineBucket: unknown policy "${String(mode)}"`);
 		}
 	})();
-	const permdock = (() => {
-		if (typeof policy === "string") return void 0;
-		const where = `defineBucket(${config.id})`;
-		const id = policy.scope === "global" ? void 0 : `split_part(name, '/', ${String(policy.segment ?? segmentFor(config.tenant?.param ?? "orgId", "PermDock"))})`;
-		const check = (key) => permdockCheck(where, policy, key, id, config.catalog);
-		const keys = policy.permdock;
-		return {
-			read: check(keys.read),
-			...keys.list === void 0 ? {} : { list: check(keys.list) },
-			write: check(keys.write),
-			delete: check(keys.delete ?? keys.write)
-		};
-	})();
+	const permdock = policyChecks(config, policy, (kind) => segmentFor(config.tenant?.param ?? "orgId", kind));
 	const resolve = (target) => {
 		if (typeof target !== "string") return template.build(target);
 		if (!template.match(target)) throw new DbException(dbError("invalid_input", `Path "${target}" does not match "${config.path}"`));
@@ -168,6 +233,7 @@ function defineBucket(config) {
 		template: config.path,
 		params: template.params,
 		owner: policy === "owner" ? config.owner?.param ?? "userId" : template.params.includes("userId") ? "userId" : void 0,
+		tenant: tenantParam,
 		public: config.public ?? false,
 		policy,
 		fileSizeLimit,
@@ -217,7 +283,8 @@ function defineBucket(config) {
 					using,
 					void 0
 				]);
-			} else if (policy === "public") policies.push([
+			} else if (policy === "public" && bucket.public) lines.push("-- Public URLs serve objects without a policy; a select policy would also let anyone list them.");
+			else if (policy === "public") policies.push([
 				"select",
 				"select",
 				"anon, authenticated",
@@ -309,7 +376,7 @@ function defineBucket(config) {
 			});
 			return issues;
 		},
-		connect: (client, options) => connectBucket(bucket, client, resolve, options)
+		connect: (client, options = {}) => connectBucket(bucket, client, resolve, options, tenantGuard(bucket.id, tenantParam, tenantClaim, (path) => bucket.match(path), options))
 	};
 	return bucket;
 }
@@ -328,7 +395,15 @@ function ttlSeconds(ttl) {
 function isErrorResult(value) {
 	return typeof value === "object" && value !== null && value.ok === false && "error" in value;
 }
-function connectBucket(bucket, client, resolve, connectOptions = {}) {
+function connectBucket(bucket, client, resolveTarget, connectOptions, guard) {
+	const resolve = (target) => {
+		const path = resolveTarget(target);
+		return guard ? guard.path(path) : path;
+	};
+	const scopedWithin = (within) => guard ? {
+		...within,
+		[guard.param]: guard.within(within)
+	} : within ?? {};
 	const api = () => client.storage.from(bucket.id);
 	const signed = connectOptions.cacheSignedUrls ? /* @__PURE__ */ new Map() : void 0;
 	const run = (fn) => AsyncResult.from(async () => {
@@ -391,7 +466,7 @@ function connectBucket(bucket, client, resolve, connectOptions = {}) {
 	};
 	const list = (within, options) => AsyncResult.from(async () => {
 		const out = [];
-		await walk(bucket.prefix(within ?? {}), options?.signal, out);
+		await walk(bucket.prefix(scopedWithin(within)), options?.signal, out);
 		return ok(out);
 	}).mapError((error) => ({
 		...error,
@@ -423,6 +498,13 @@ function connectBucket(bucket, client, resolve, connectOptions = {}) {
 	});
 	return {
 		bucket,
+		path: (target) => {
+			try {
+				return ok(resolve(target));
+			} catch (cause) {
+				return err(toDbError(cause));
+			}
+		},
 		upload,
 		download: (target, options) => AsyncResult.from(async () => {
 			const path = resolve(target);
@@ -546,4 +628,51 @@ function connectBucket(bucket, client, resolve, connectOptions = {}) {
 	};
 }
 //#endregion
-export { TTL, defineBucket, fromStorageError, parseSize };
+//#region src/storage/presets.ts
+/** The image types browsers display everywhere. */
+const IMAGE_TYPES = [
+	"image/png",
+	"image/jpeg",
+	"image/webp",
+	"image/gif",
+	"image/avif"
+];
+const AVATAR_PATH = "{userId}/avatar-{version}.{ext}";
+const LOGO_PATH = "{orgId}/logo-{version}.{ext}";
+/**
+* A bucket for profile pictures: `{userId}/avatar-{version}.{ext}`, public,
+* 2 MiB of images, written only by their owner (the `owner` policy).
+*/
+function avatarBucket(options = {}) {
+	return defineBucket({
+		id: options.id ?? "avatars",
+		path: options.path ?? AVATAR_PATH,
+		public: options.public ?? true,
+		fileSizeLimit: options.fileSizeLimit ?? "2MiB",
+		allowedMimeTypes: options.allowedMimeTypes ?? IMAGE_TYPES,
+		policy: options.policy ?? "owner"
+	});
+}
+/**
+* A bucket for organization logos: `{orgId}/logo-{version}.{ext}`, public,
+* 2 MiB of images, written by members with the update permission through
+* the access contract (`tenant_ids_with`), so it follows the app's roles.
+*/
+function orgLogoBucket(options = {}) {
+	const permission = options.permission ?? "organization.update";
+	const tenant = options.tenant === false ? void 0 : options.tenant ?? { param: "orgId" };
+	return defineBucket({
+		id: options.id ?? "organization-logos",
+		path: options.path ?? LOGO_PATH,
+		public: options.public ?? true,
+		fileSizeLimit: options.fileSizeLimit ?? "2MiB",
+		allowedMimeTypes: options.allowedMimeTypes ?? IMAGE_TYPES,
+		policy: options.policy ?? { access: {
+			read: permission,
+			write: permission
+		} },
+		...tenant ? { tenant } : {}
+	});
+}
+//#endregion
+export { IMAGE_TYPES, TTL, avatarBucket, defineBucket, fromStorageError, orgLogoBucket, parseSize };

package/dist/support-CEPwlw2G.d.ts

@@ -0,0 +1,89 @@
+/// <reference lib="esnext.temporal" />
+import { t as BetterPostgres } from "./pool-C9voM4Kw.js";
+//#region src/auth/support.d.ts
+type SupportEndedBy = "admin" | "expired" | "revoked";
+/** A support session: a platform admin viewing the app as `targetUserId`. */
+interface SupportSession {
+  readonly id: string;
+  readonly adminId: string;
+  readonly targetUserId: string;
+  readonly reason: string;
+  /** Writes fail while it is true (`begin read only`). */
+  readonly readOnly: boolean;
+  readonly tenant?: string;
+  readonly startedAt: Temporal.Instant;
+  readonly expiresAt: Temporal.Instant;
+  readonly endedAt?: Temporal.Instant;
+  readonly endedBy?: SupportEndedBy;
+  /** App data, such as a ticket id. */
+  readonly metadata: Readonly<Record<string, unknown>>;
+}
+interface SupportStartInput {
+  readonly adminId: string;
+  /**
+   * The admin's verified claims. The SQL store runs `start_support_session`
+   * with them, so `is_platform()` checks the admin in the database too.
+   */
+  readonly adminClaims: Readonly<Record<string, unknown>>;
+  readonly targetUserId: string;
+  readonly reason: string;
+  readonly ttlSeconds: number;
+  readonly readOnly: boolean;
+  readonly tenant?: string;
+  readonly metadata: Readonly<Record<string, unknown>>;
+}
+/** A caller's verified claims, which the store runs a call with. */
+type SupportCallerClaims = Readonly<Record<string, unknown>>;
+interface SupportListFilter {
+  readonly adminId?: string;
+  readonly targetUserId?: string;
+  /** `true`: running sessions only; `false`: ended or expired ones only. */
+  readonly active?: boolean;
+  /** Defaults to 50. */
+  readonly limit?: number;
+}
+/**
+ * Where support sessions live. `sqlSupportStore` uses the `support-sessions`
+ * SQL kit module; implement this for another store and check it with
+ * `testSupportSessionStore` from `better-supabase/testing`.
+ */
+interface SupportSessionStore {
+  readonly apiVersion: 1;
+  readonly name: string;
+  /** Starts a session and ends the admin's previous one. Rejects when the store refuses. */
+  start(input: SupportStartInput): Promise<SupportSession>;
+  /**
+   * The admin's session while it is running; `undefined` once ended or
+   * expired. With the admin's `claims`, the store also checks that the admin
+   * may still start sessions.
+   */
+  get(sessionId: string, adminId: string, claims?: SupportCallerClaims): Promise<SupportSession | undefined>;
+  /**
+   * `false` when it was not running. With `claims`, it runs as that caller:
+   * the session's admin, or staff with the revoke permission.
+   */
+  end(sessionId: string, endedBy: SupportEndedBy, claims?: SupportCallerClaims): Promise<boolean>;
+  /** With `claims`, only what that caller may view. */
+  list(filter?: SupportListFilter, claims?: SupportCallerClaims): Promise<readonly SupportSession[]>;
+  /** The claims `targetUserId` would get, when the store can build them. */
+  claims?(targetUserId: string): Promise<Readonly<Record<string, unknown>>>;
+}
+interface SqlSupportStoreOptions {
+  /** `kits.support-sessions.schema`. Defaults to `better_supabase`. */
+  readonly schema?: string;
+}
+/**
+ * Support sessions in the `support-sessions` SQL kit module. `start` runs
+ * as the admin, so the module's `is_platform()` gate applies; the reads run
+ * on the admin connection.
+ */
+declare function sqlSupportStore(postgres: Pick<BetterPostgres, "admin" | "asUser">, options?: SqlSupportStoreOptions): SupportSessionStore;
+/**
+ * The claims a support session runs with: the target's, plus `act` naming
+ * the admin, the reason and the session (the audit module records all three),
+ * marked `kind: "support"` so `actorOf` never reads it as an OAuth client.
+ * `role` falls back to `authenticated`; the admin's claims never leak in.
+ */
+declare function supportClaims(session: Pick<SupportSession, "id" | "adminId" | "targetUserId" | "reason" | "readOnly">, target: Readonly<Record<string, unknown>>): Record<string, unknown>;
+//#endregion
+export { SupportSession as a, sqlSupportStore as c, SupportListFilter as i, supportClaims as l, SupportCallerClaims as n, SupportSessionStore as o, SupportEndedBy as r, SupportStartInput as s, SqlSupportStoreOptions as t };

package/dist/support-view-B8SlToQX.d.ts

@@ -0,0 +1,17 @@
+import { t as AuthSession } from "./view-CbgObAeb.js";
+//#region src/auth/support-view.d.ts
+/** A running support session as the target's view shows it, for a banner. */
+interface SupportView {
+  readonly sessionId: string;
+  /** The admin viewing the app. */
+  readonly adminId: string;
+  readonly targetUserId: string;
+  readonly reason?: string;
+  readonly readOnly: boolean;
+  /** Seconds since epoch. */
+  readonly expiresAt: number | null;
+}
+/** The support session behind `session`, or `undefined` outside one. */
+declare function supportOf(session: AuthSession): SupportView | undefined;
+//#endregion
+export { supportOf as n, SupportView as t };

package/dist/support-view-g4YLBeqX.js

@@ -0,0 +1,18 @@
+//#region src/auth/support-view.ts
+/** The support session behind `session`, or `undefined` outside one. */
+function supportOf(session) {
+	if (session.kind !== "user") return;
+	const { impersonator } = session;
+	const sessionId = impersonator?.sessionId;
+	if (!impersonator || !sessionId) return;
+	return {
+		sessionId,
+		adminId: impersonator.id,
+		targetUserId: session.user.id,
+		...impersonator.reason ? { reason: impersonator.reason } : {},
+		readOnly: impersonator.readOnly ?? true,
+		expiresAt: session.expiresAt
+	};
+}
+//#endregion
+export { supportOf as t };