better-supabase 0.4.0 → 0.5.1

package/dist/respond-DgIbdrt8.d.ts

@@ -1,194 +0,0 @@
-import { n as AnyModels, t as AnyFunctions } from "./types-DONv9SHN.js";
-import { p as DbError, t as AsyncResult } from "./result-CqEsbgYs.js";
-import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "./define-CRS2MRV3.js";
-import { h as RequestContext } from "./plugin-bNhvJwRh.js";
-import { t as BetterSupabaseEnv } from "./index-Dy6kuF0P.js";
-import { o as SqlClaims, t as BetterPostgres } from "./pool-DFwEQwmN.js";
-import { o as ImpersonationOptions, t as Aal } from "./mfa-C7MNQ1Ob.js";
-import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-BAqQcwMW.js";
-import { n as Bucket } from "./index-528Ugmyp.js";
-import { SupabaseClient } from "@supabase/supabase-js";
-//#region src/server/delete-account.d.ts
-interface DeleteAccountOptions {
-  /**
-   * Buckets to clear first. Objects whose `owner` placeholder (`{userId}`,
-   * or `owner.param` for `owner` buckets) is the user are removed; buckets
-   * without one are skipped.
-   */
-  readonly buckets?: readonly Bucket<string>[];
-  /**
-   * App keys of tables whose rows the database deletes or updates with the
-   * user (`on delete cascade` or `set null` to `auth.users`). They get a
-   * table-wide `mutation` notice, so caches drop their reads.
-   */
-  readonly cascades?: readonly string[];
-  readonly context?: RequestContext;
-  readonly signal?: AbortSignal;
-}
-interface DeleteAccountResult {
-  readonly userId: string;
-  /** Removed objects per bucket id. */
-  readonly removed: Readonly<Record<string, number>>;
-}
-//#endregion
-//#region src/server/replicas.d.ts
-/** Cookie holding the epoch ms until which reads stay on the primary. */
-declare const PRIMARY_COOKIE = "bs-primary-until";
-/** Where a request context sends its reads. */
-interface ReplicaState {
-  /** Reads go to the primary: this context wrote, or a recent request did. */
-  readonly pinned: boolean;
-  /** This context wrote through its repositories (or called `pin()`). */
-  readonly wrote: boolean;
-  /** Sends later reads to the primary, e.g. after a write through `$client` or `ctx.sql`. */
-  pin(): void;
-}
-//#endregion
-//#region src/server/server.d.ts
-interface ServerOptions {
-  /** Defaults to `loadEnv()`. */
-  readonly env?: BetterSupabaseEnv;
-  /** Enables `ctx.sql` and `actingAs()`. */
-  readonly postgres?: BetterPostgres;
-  readonly auth?: Omit<ResolveAuthOptions, "env">;
-  /**
-   * Fetch the JWKS when the server is created, so the first request verifies
-   * its token without waiting for it. Applies when `env.jwksUrl` is set and
-   * `auth.jwks` is not. Defaults to true, except under `NODE_ENV=test`.
-   */
-  readonly prefetchJwks?: boolean;
-  /**
-   * Extra headers on the caller's PostgREST requests, readable in Postgres as
-   * `current_setting('request.headers')` (channel, request id, client IP for audit).
-   */
-  readonly headers?: (request: Request) => Readonly<Record<string, string>>;
-  /**
-   * PostgREST URL for the caller's reads: a read replica or the `<ref>-all`
-   * load balancer. Defaults to `SUPABASE_READ_URL`; `false` reads from the
-   * primary.
-   */
-  readonly readUrl?: string | false;
-  readonly replicas?: {
-    /** How long the next requests read from the primary after a write. Defaults to 5 s. */
-    readonly pinMs?: number;
-  };
-}
-interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
-  readonly auth: AuthState<C, P>;
-  readonly resolution: AuthResolution<C, P>;
-  /** supabase-js client scoped to the caller (RLS applies). */
-  readonly supabase: SupabaseClient;
-  /** Repositories over PostgREST as the caller. */
-  readonly db: Db<M, F, E, SupabaseClient>;
-  /** Repositories over direct Postgres as the caller, when `postgres` is configured. */
-  readonly sql: Db<M, F, E, undefined> | undefined;
-  /** Calls, waves, tables and time for `db` and `sql` together. */
-  stats(): DbStats;
-  /** Where `db` reads go, when a read URL is configured. */
-  readonly replica: ReplicaState | undefined;
-}
-interface ContextOptions {
-  readonly refresh?: boolean;
-  /** Epoch ms until which `db` reads from the primary (the `bs-primary-until` cookie). */
-  readonly pinnedUntil?: number;
-  /** Also records this context's calls into a request-wide recorder. */
-  readonly stats?: StatsRecorder;
-}
-interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
-  readonly env: BetterSupabaseEnv;
-  resolve(request: Request, options?: {
-    readonly refresh?: boolean;
-  }): Promise<AuthResolution<C, P>>;
-  /**
-   * Resolves auth and binds repositories to the caller. Refreshes an expired
-   * cookie session only with `refresh: true`; send `ctx.resolution.apply(response)`.
-   */
-  context(request: Request, options?: ContextOptions): Promise<ServerContext<M, F, E, C, P>>;
-  /**
-   * The context for a resolution from `resolve(request)`, so one resolution
-   * can back several contexts without verifying the token again.
-   */
-  contextFromResolution(resolution: AuthResolution<C, P>, request: Request, options?: Omit<ContextOptions, "refresh">): ServerContext<M, F, E, C, P>;
-  /** The context for an auth state resolved elsewhere (the proxy, a queue message). */
-  contextFor(auth: AuthState<C, P>, options?: ContextOptions): ServerContext<M, F, E, C, P>;
-  /** A stateless supabase-js client for an auth state, optionally with extra request headers. */
-  supabaseFor(auth: AuthState, headers?: Readonly<Record<string, string>>): SupabaseClient;
-  /** Repositories for an auth state (e.g. one resolved by the proxy). */
-  dbFor(auth: AuthState, context?: RequestContext): Db<M, F, E, SupabaseClient>;
-  /** Service-role repositories. Bypasses RLS; the actor is `service`. */
-  admin(context?: RequestContext): Db<M, F, E, SupabaseClient>;
-  /**
-   * Deletes a user: their objects in `buckets`, then the Auth user, then a
-   * `mutation` notice for `auth.users`. Needs the secret key. Access tokens
-   * already issued stay valid until they expire.
-   */
-  deleteAccount(userId: string, options?: DeleteAccountOptions): AsyncResult<DeleteAccountResult>;
-  /**
-   * Repositories running as a user, with RLS, over direct Postgres. With
-   * `impersonation`, the claims carry `act: { sub: actor, reason }`, which
-   * the `audit` and `actor` SQL kit modules record.
-   */
-  actingAs(userId: string, claims?: Omit<SqlClaims, "sub" | "act">, impersonation?: ImpersonationOptions): Db<M, F, E, undefined>;
-}
-/**
- * Server-side entry point for APIs, jobs, MCP servers and framework
- * adapters. Holds the secrets; `betterSupabase` stays isomorphic.
- */
-declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
-//#endregion
-//#region src/server/respond.d.ts
-type AuthKind = AuthState["kind"];
-interface GuardOptions {
-  /** Auth kinds allowed through. Defaults to `['user']`. */
-  readonly allow?: readonly Exclude<AuthKind, "invalid">[];
-  /**
-   * Assurance level user sessions need. `aal2` answers 403 with
-   * `required: 'aal2'` until the user verifies a second factor.
-   */
-  readonly aal?: Aal;
-  /**
-   * OAuth scopes a delegated token (an OAuth client or an `act` chain) needs.
-   * A missing one answers 403 with `error="insufficient_scope"`. The user's
-   * own session is not limited by scopes.
-   */
-  readonly scopes?: readonly string[];
-}
-/** Guard options for middleware and fetch handlers that resolve the caller themselves. */
-interface MiddlewareOptions extends GuardOptions {
-  /**
-   * Refresh an expired cookie session and send the new cookies. Only for
-   * routes browsers call with cookies; bearer tokens never refresh.
-   */
-  readonly refresh?: boolean;
-}
-/** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
-declare function guard(auth: AuthState, allow?: GuardOptions["allow"], aal?: Aal, scopes?: readonly string[]): DbError | undefined;
-declare function isResult(value: unknown): value is {
-  ok: boolean;
-  data: unknown;
-  error: unknown;
-};
-type Settled = {
-  readonly ok: true;
-  readonly data: unknown;
-} | {
-  readonly ok: false;
-  readonly error: DbError;
-};
-/**
- * Settles a handler's return value: `Result`s and `AsyncResult`s unwrap,
- * thrown `DbException`s (or errors whose `cause` is a `DbError`) become
- * errors, anything else is data. Other thrown
- * errors propagate.
- */
-declare function settle(run: () => unknown): Promise<Settled>;
-interface RespondOptions {
-  readonly instance?: string;
-  readonly expose?: boolean;
-  /** Status for data responses. Defaults to 200 (204 without data). */
-  readonly status?: number;
-}
-/** A handler's value as a response: `Response` as is, data as JSON, errors as Problem Details. */
-declare function respond(run: () => unknown, options?: RespondOptions): Promise<Response>;
-//#endregion
-export { DeleteAccountOptions as _, Settled as a, respond as c, ContextOptions as d, ServerContext as f, ReplicaState as g, PRIMARY_COOKIE as h, RespondOptions as i, settle as l, createServer as m, GuardOptions as n, guard as o, ServerOptions as p, MiddlewareOptions as r, isResult as s, AuthKind as t, BetterServer as u, DeleteAccountResult as v };

package/dist/view-BrJI2LKp.js

@@ -1,45 +0,0 @@
-import { _ as delegationOf, g as actorOf, n as amrOf, t as aalOf, y as impersonatorOf } from "./mfa-byfjruR9.js";
-//#region src/auth/view.ts
-/** Drops the token from an `AuthState`, leaving only serializable fields. */
-function toSession(auth) {
-	switch (auth.kind) {
-		case "user": {
-			const impersonator = impersonatorOf(auth.claims);
-			const outcome = actorOf(auth.claims);
-			const actor = outcome.ok ? outcome.actor : void 0;
-			const scopes = actor ? delegationOf(auth.claims)?.scopes : void 0;
-			const delegation = actor && (scopes || actor.chain) ? {
-				scopes: scopes ?? [],
-				...actor.chain ? { chain: actor.chain } : {}
-			} : void 0;
-			return {
-				kind: "user",
-				user: auth.user,
-				claims: auth.claims,
-				expiresAt: auth.expiresAt,
-				...auth.profile === void 0 ? {} : { profile: auth.profile },
-				aal: aalOf(auth.claims),
-				amr: amrOf(auth.claims),
-				...impersonator ? { impersonator } : {},
-				...actor ? { actor } : {},
-				...delegation ? { delegation } : {}
-			};
-		}
-		case "service": return {
-			kind: "service",
-			keyName: auth.keyName
-		};
-		case "anon": return {
-			kind: "anon",
-			reason: auth.reason
-		};
-		case "invalid": return {
-			kind: "invalid",
-			reason: auth.reason,
-			error: auth.error
-		};
-		default: return auth;
-	}
-}
-//#endregion
-export { toSession as t };