better-supabase 0.5.0 → 0.5.1

package/dist/{index-Dxn2a5cw.d.ts → index-CWMDdEr4.d.ts}

@@ -1,5 +1,5 @@
 import { c as ClaimsMeta, j as SchemaMeta } from "./types-Dnf_wRDz.js";
-import { d as Generator } from "./config-T_ejwyd3.js";
+import { d as Generator } from "./config-Bv7gvfzC.js";
 //#region src/core/claims.d.ts
 declare const DEFAULT_CLAIMS: ClaimsMeta;
 /** Where the active tenant is read from: the top-level claim, then `app_metadata`. */

package/dist/{index-BGdgBPdf.d.ts → index-Dp2VDwog.d.ts}

@@ -2,7 +2,7 @@ import { _ as DbError } from "./executor-BunPOO-k.js";
 import { Z as QuerySpec } from "./define-Bp_BZa5h.js";
 import { i as ClientAuth, t as AuthSnapshot } from "./index-DmXSxbLi.js";
 import { n as TemplateValues } from "./template-mbvlysOo.js";
-import { t as AuthSession } from "./view-BEf0diC5.js";
+import { t as AuthSession } from "./view-CbgObAeb.js";
 import { a as LiveSource, g as Topic, h as SubscriptionStatus, p as SubscribeOptions, r as LiveCountSeed, u as EventSchemas, v as TopicHandlers, y as TopicMessage } from "./live-D9W2M5aO.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { ReactNode } from "react";

package/dist/mcp/index.d.ts

@@ -1,8 +1,8 @@
 import { P as TableKey, n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
 import { t as BetterSupabase } from "../define-Bp_BZa5h.js";
-import { f as ServerContext, n as GuardOptions, p as ServerOptions, u as BetterServer } from "../respond-D2OQl62-.js";
+import { f as ServerContext, n as GuardOptions, p as ServerOptions, u as BetterServer } from "../respond-BR1fJWOB.js";
 import { i as ResourceOperation } from "../index-C7f8cOBM.js";
-import { a as ResourceRouteOptions } from "../resource-D8iqWMr-.js";
+import { a as ResourceRouteOptions } from "../resource-DNRFP7KR.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/mcp/mcp.d.ts
 export declare const MCP_PROTOCOL_VERSION: string;

package/dist/mcp/index.js

@@ -4,8 +4,8 @@ import { t as validate } from "../standard-D7r6dMUu.js";
 import { a as problemResponse, o as toProblem } from "../problem-BW1KhzSG.js";
 import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
 import { t as buildJsonSchema } from "../json-schema-m1fiwKgN.js";
-import { a as withExtra, d as guard, g as jsonResponse, h as jsonReplacer, m as settle, n as createServer, r as extendServer, u as defaultExpose } from "../server-Csx2sRjg.js";
-import { t as defineResource } from "../resource-CRxxwkQq.js";
+import { a as withExtra, d as guard, g as jsonResponse, h as jsonReplacer, m as settle, n as createServer, r as extendServer, u as defaultExpose } from "../server-B1mZ7CgQ.js";
+import { t as defineResource } from "../resource-mqfJW4YF.js";
 import { fromSupabaseUrl, unauthorizedResponse } from "@supabase/server/oauth-protected-resource";
 //#region src/mcp/mcp.ts
 const MCP_PROTOCOL_VERSION = SPEC_PINS.mcp;

package/dist/{mfa-CusDgPaD.d.ts → mfa-Cu96oJdw.d.ts}

@@ -1,22 +1,4 @@
 import { _ as DbError } from "./executor-BunPOO-k.js";
-//#region src/auth/impersonation.d.ts
-/** The admin acting as the user, from the RFC 8693 `act` claim. */
-interface Impersonator {
-  readonly id: string;
-  readonly reason?: string;
-  /** The support session, when the admin started one (`act.session_id`). */
-  readonly sessionId?: string;
-  /** Whether the support session blocks writes (`act.read_only`). */
-  readonly readOnly?: boolean;
-}
-/** `actingAs(userId, claims, { actor, reason })`: who acts, and why (recorded by the audit module). */
-interface ImpersonationOptions {
-  readonly actor: string;
-  readonly reason: string;
-}
-/** The impersonator in `claims.act`, or `undefined` for a normal session. */
-declare function impersonatorOf(claims: Readonly<Record<string, unknown>>): Impersonator | undefined;
-//#endregion
 //#region src/auth/mfa.d.ts
 /** Authenticator assurance level: `aal2` once a second factor is verified in this session. */
 type Aal = "aal1" | "aal2";
@@ -45,4 +27,4 @@ declare function checkAal(auth: {
   readonly kind: string;
 }, required: Aal): DbError | undefined;
 //#endregion
-export { checkAal as a, impersonatorOf as c, amrOf as i, AmrEntry as n, ImpersonationOptions as o, aalOf as r, Impersonator as s, Aal as t };
+export { checkAal as a, amrOf as i, AmrEntry as n, aalOf as r, Aal as t };

package/dist/next/index.d.ts

@@ -1,13 +1,13 @@
 import { n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
 import { _ as DbError } from "../executor-BunPOO-k.js";
 import { B as ReadSet, P as DbStats, Z as QuerySpec, l as CacheAdapter, t as BetterSupabase } from "../define-Bp_BZa5h.js";
-import { r as AuthState } from "../resolve-C15TJq77.js";
-import { C as SupportOptions, D as supportSessions, E as SupportStartRequest, T as SupportSessions, b as ActiveSupport, d as ContextOptions, f as ServerContext, n as GuardOptions, p as ServerOptions, t as AuthKind, u as BetterServer, w as SupportPolicy } from "../respond-D2OQl62-.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-CusDgPaD.js";
-import { n as toSession, t as AuthSession } from "../view-BEf0diC5.js";
+import { n as Impersonator, o as AuthState } from "../impersonation-BmePsuxz.js";
+import { C as SupportOptions, D as supportSessions, E as SupportStartRequest, T as SupportSessions, b as ActiveSupport, d as ContextOptions, f as ServerContext, n as GuardOptions, p as ServerOptions, t as AuthKind, u as BetterServer, w as SupportPolicy } from "../respond-BR1fJWOB.js";
+import { n as AmrEntry, t as Aal } from "../mfa-Cu96oJdw.js";
+import { n as toSession, t as AuthSession } from "../view-CbgObAeb.js";
 import { r as LiveCountSeed, t as CountRunner } from "../live-D9W2M5aO.js";
-import { n as supportOf, t as SupportView } from "../support-view-Da5peKFg.js";
-import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-DUxU4oHe.js";
+import { n as supportOf, t as SupportView } from "../support-view-B8SlToQX.js";
+import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-BiJZ4t49.js";
 import { NextRequest } from "next/server.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/collector.d.ts

package/dist/next/index.js

@@ -6,9 +6,9 @@ import { a as problemResponse } from "../problem-BW1KhzSG.js";
 import { t as isList } from "../guards-BnzDvFrz.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
 import { t as hasEntitlement } from "../entitlements-CTEBm7IB.js";
-import { a as withExtra, b as withPrimaryPin, d as guard, m as settle, n as createServer, p as respond, r as extendServer, u as defaultExpose, v as PRIMARY_COOKIE, y as primaryCookieOptions } from "../server-Csx2sRjg.js";
-import { a as checkAal, n as toSession } from "../view-Bq64ki8-.js";
-import { t as supportSessions } from "../support-Dk6vdmEw.js";
+import { a as withExtra, b as withPrimaryPin, d as guard, m as settle, n as createServer, p as respond, r as extendServer, u as defaultExpose, v as PRIMARY_COOKIE, y as primaryCookieOptions } from "../server-B1mZ7CgQ.js";
+import { a as checkAal, n as toSession } from "../view-Bn6HNKUe.js";
+import { t as supportSessions } from "../support-wHnK6zp-.js";
 import { cache } from "react";
 import { cacheLife, cacheTag, revalidateTag, updateTag } from "next/cache.js";
 import { cookies, headers } from "next/headers.js";

package/dist/orpc/index.d.ts

@@ -1,8 +1,8 @@
 import { n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
 import { _ as DbError, u as Result } from "../executor-BunPOO-k.js";
 import { t as BetterSupabase } from "../define-Bp_BZa5h.js";
-import { r as AuthState } from "../resolve-C15TJq77.js";
-import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-D2OQl62-.js";
+import { o as AuthState } from "../impersonation-BmePsuxz.js";
+import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-BR1fJWOB.js";
 import { r as ProblemDetails } from "../problem-Blxe8S31.js";
 import { DecoratedMiddleware, ORPCError } from "@orpc/server";
 //#region src/orpc/index.d.ts

package/dist/orpc/index.js

@@ -1,6 +1,6 @@
 import { r as dbErrorOf } from "../errors-DtwXa6b8.js";
 import { o as toProblem } from "../problem-BW1KhzSG.js";
-import { d as guard, m as settle, n as createServer, r as extendServer, u as defaultExpose } from "../server-Csx2sRjg.js";
+import { d as guard, m as settle, n as createServer, r as extendServer, u as defaultExpose } from "../server-B1mZ7CgQ.js";
 import { COMMON_ERROR_STATUS_MAP, ORPCError, os } from "@orpc/server";
 //#region src/orpc/index.ts
 const CODES = /* @__PURE__ */ new Map(Object.entries(COMMON_ERROR_STATUS_MAP).map(([code, status]) => [status, code]));

package/dist/otel/index.js

@@ -1,7 +1,7 @@
 import { r as definePlugin } from "../plugin-DwARMuQp.js";
 import { t as SPEC_PINS } from "../spec-pins-C3oc-Tdp.js";
 import { r as kitEventAttributes } from "../kit-events-CTFDfSwb.js";
-import "../version-DM_Roffb.js";
+import "../version-DOYTYwHP.js";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 //#region src/otel/index.ts
 const INSTRUMENTATION_NAME = "better-supabase";
@@ -40,9 +40,9 @@ function systemOf(executor) {
 * ```
 */
 function otel(options = {}) {
-	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.5.0");
+	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.5.1");
 	let histogram;
-	if (options.metrics !== false) histogram = (options.meter ?? metrics.getMeter("better-supabase", "0.5.0")).createHistogram("db.client.operation.duration", {
+	if (options.metrics !== false) histogram = (options.meter ?? metrics.getMeter("better-supabase", "0.5.1")).createHistogram("db.client.operation.duration", {
 		unit: "s",
 		description: "Duration of database client operations.",
 		advice: { explicitBucketBoundaries: [
@@ -151,7 +151,7 @@ function otel(options = {}) {
 * Returns a function that stops listening.
 */
 function traceAuth(betterSupabase, options = {}) {
-	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.5.0");
+	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.5.1");
 	const offAuth = betterSupabase.events.on("auth", (event) => {
 		const span = tracer.startSpan("auth.resolve", {
 			kind: SpanKind.INTERNAL,
@@ -189,7 +189,7 @@ function traceAuth(betterSupabase, options = {}) {
 * set an error status. Returns a function that stops listening.
 */
 function traceKitEvents(betterSupabase, options = {}) {
-	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.5.0");
+	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.5.1");
 	return betterSupabase.events.on("kit", (event) => {
 		const attributes = {
 			...options.attributes,

package/dist/react/index.d.ts

@@ -1,8 +1,8 @@
-import { s as Impersonator } from "../mfa-CusDgPaD.js";
-import { t as AuthSession } from "../view-BEf0diC5.js";
+import { n as Impersonator } from "../impersonation-BmePsuxz.js";
+import { t as AuthSession } from "../view-CbgObAeb.js";
 import { r as LiveCountSeed } from "../live-D9W2M5aO.js";
-import { n as supportOf, t as SupportView } from "../support-view-Da5peKFg.js";
-import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-DUxU4oHe.js";
-import { _ as useBroadcast, a as BetterHooks, b as useSupabase, c as BroadcastOptions, d as LiveCount, f as LiveCountHookOptions, g as useAuth, h as createHooks, i as useNotifications, l as ClaimsOf, m as ProfileOf, n as NotificationsState, o as BetterSupabaseProvider, p as LiveQueryHookOptions, r as UseNotificationsOptions, s as BetterSupabaseProviderProps, t as NotificationSource, u as ClientLike, v as useLiveCount, y as useLiveQuery } from "../index-BGdgBPdf.js";
+import { n as supportOf, t as SupportView } from "../support-view-B8SlToQX.js";
+import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-BiJZ4t49.js";
+import { _ as useBroadcast, a as BetterHooks, b as useSupabase, c as BroadcastOptions, d as LiveCount, f as LiveCountHookOptions, g as useAuth, h as createHooks, i as useNotifications, l as ClaimsOf, m as ProfileOf, n as NotificationsState, o as BetterSupabaseProvider, p as LiveQueryHookOptions, r as UseNotificationsOptions, s as BetterSupabaseProviderProps, t as NotificationSource, u as ClientLike, v as useLiveCount, y as useLiveQuery } from "../index-Dp2VDwog.js";
 import { SessionProvider, SessionProviderProps, useSession, useSupportSession } from "./session.js";
 export { type AuthSession, type BetterHooks, BetterSupabaseProvider, type BetterSupabaseProviderProps, type BroadcastOptions, type ClaimsOf, type ClientLike, type EntitlementKey, type Impersonator, type LiveCount, type LiveCountHookOptions, type LiveCountSeed, type LiveQueryHookOptions, type MembershipClaim, type NotificationSource, type NotificationsState, type ProfileOf, SessionProvider, type SessionProviderProps, type SupportView, type UseNotificationsOptions, createHooks, hasEntitlement, supportOf, useAuth, useBroadcast, useLiveCount, useLiveQuery, useNotifications, useSession, useSupabase, useSupportSession };

package/dist/react/server.d.ts

@@ -1,10 +1,10 @@
 import { Z as QuerySpec } from "../define-Bp_BZa5h.js";
-import { s as Impersonator } from "../mfa-CusDgPaD.js";
-import { t as AuthSession } from "../view-BEf0diC5.js";
+import { n as Impersonator } from "../impersonation-BmePsuxz.js";
+import { t as AuthSession } from "../view-CbgObAeb.js";
 import { r as LiveCountSeed } from "../live-D9W2M5aO.js";
-import { n as supportOf, t as SupportView } from "../support-view-Da5peKFg.js";
-import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-DUxU4oHe.js";
-import { _ as useBroadcast, a as BetterHooks, b as useSupabase, c as BroadcastOptions, d as LiveCount, f as LiveCountHookOptions, g as useAuth, l as ClaimsOf, m as ProfileOf, n as NotificationsState, o as BetterSupabaseProvider, p as LiveQueryHookOptions, r as UseNotificationsOptions, s as BetterSupabaseProviderProps, t as NotificationSource, u as ClientLike, y as useLiveQuery } from "../index-BGdgBPdf.js";
+import { n as supportOf, t as SupportView } from "../support-view-B8SlToQX.js";
+import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-BiJZ4t49.js";
+import { _ as useBroadcast, a as BetterHooks, b as useSupabase, c as BroadcastOptions, d as LiveCount, f as LiveCountHookOptions, g as useAuth, l as ClaimsOf, m as ProfileOf, n as NotificationsState, o as BetterSupabaseProvider, p as LiveQueryHookOptions, r as UseNotificationsOptions, s as BetterSupabaseProviderProps, t as NotificationSource, u as ClientLike, y as useLiveQuery } from "../index-Dp2VDwog.js";
 import { SessionProvider, SessionProviderProps } from "./session.js";
 //#region src/react/server.d.ts
 /** The `react-server` build of `useSession`: await `bs.session()` instead. */

package/dist/react/session.d.ts

@@ -1,5 +1,5 @@
-import { t as AuthSession } from "../view-BEf0diC5.js";
-import { t as SupportView } from "../support-view-Da5peKFg.js";
+import { t as AuthSession } from "../view-CbgObAeb.js";
+import { t as SupportView } from "../support-view-B8SlToQX.js";
 import { ReactNode } from "react";
 //#region src/react/session.d.ts
 export interface SessionProviderProps {

package/dist/{refresh-BTrQ_ZTp.d.ts → refresh-CFPX0Qft.d.ts}

@@ -1,4 +1,4 @@
-import { m as StoredSession } from "./resolve-C15TJq77.js";
+import { _ as StoredSession } from "./impersonation-BmePsuxz.js";
 //#region src/auth/refresh.d.ts
 interface RefreshOptions {
   readonly url: string;

package/dist/{resource-D8iqWMr-.d.ts → resource-DNRFP7KR.d.ts}

@@ -1,7 +1,7 @@
 import { F as TableMeta, P as TableKey, _ as Insert, n as AnyFunctions, r as AnyModels, z as Update } from "./types-Dnf_wRDz.js";
 import { u as Result, w as ValidationIssue } from "./executor-BunPOO-k.js";
 import { t as BetterSupabase, xt as SelectArg } from "./define-Bp_BZa5h.js";
-import { i as RespondOptions } from "./respond-D2OQl62-.js";
+import { i as RespondOptions } from "./respond-BR1fJWOB.js";
 import { i as ResourceOperation } from "./index-C7f8cOBM.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/server/resource.d.ts

package/dist/{resource-CRxxwkQq.js → resource-mqfJW4YF.js}

@@ -1,7 +1,7 @@
 import { n as dbError } from "./errors-DtwXa6b8.js";
 import { i as ok, n as err } from "./result-BKiliPY7.js";
 import { t as validate } from "./standard-D7r6dMUu.js";
-import { p as respond } from "./server-Csx2sRjg.js";
+import { p as respond } from "./server-B1mZ7CgQ.js";
 //#region src/server/resource.ts
 const INTEGER = /* @__PURE__ */ new Set([
 	"int2",

package/dist/{respond-D2OQl62-.d.ts → respond-BR1fJWOB.d.ts}

@@ -5,10 +5,10 @@ import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "
 import { g as RequestContext } from "./plugin-o144f322.js";
 import { t as BetterSupabaseEnv } from "./index-CLg87OBW.js";
 import { s as SqlClaims, t as BetterPostgres } from "./pool-C9voM4Kw.js";
-import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-C15TJq77.js";
-import { a as SupportSession, i as SupportListFilter, o as SupportSessionStore } from "./support-DT-OhSxD.js";
-import { o as ImpersonationOptions, t as Aal } from "./mfa-CusDgPaD.js";
+import { c as ResolveAuthOptions, i as AuthResolution, o as AuthState, t as ImpersonationOptions } from "./impersonation-BmePsuxz.js";
+import { a as SupportSession, i as SupportListFilter, o as SupportSessionStore } from "./support-CEPwlw2G.js";
 import { c as Bucket } from "./index-SaTsEfGP.js";
+import { t as Aal } from "./mfa-Cu96oJdw.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/auth/support-cookie.d.ts
@@ -295,7 +295,7 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
   deleteAccount(userId: string, options?: DeleteAccountOptions): AsyncResult<DeleteAccountResult>;
   /**
    * Repositories running as a user, with RLS, over direct Postgres. With
-   * `impersonation`, the claims carry `act: { sub: actor, reason }`, which
+   * `impersonation`, the claims carry `act: { kind: "impersonation", sub, reason }`, which
    * the `audit` and `actor` SQL kit modules record.
    */
   actingAs(userId: string, claims?: Omit<SqlClaims, "sub" | "act">, impersonation?: ImpersonationOptions): Db<M, F, E, undefined>;
@@ -310,12 +310,18 @@ declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E,
 //#endregion
 //#region src/server/respond.d.ts
 type AuthKind = AuthState["kind"];
-/** An auth kind a guard lets through; `anonymous` admits `signInAnonymously()` users. */
+/**
+ * An auth kind a guard lets through. `anonymous` admits users signed in with
+ * `signInAnonymously()` (`is_anonymous`); `anon` admits callers without a
+ * session only.
+ */
 type AllowedCaller = Exclude<AuthKind, "invalid"> | "anonymous";
 interface GuardOptions {
   /**
    * Callers allowed through. Defaults to `['user']`, which refuses anonymous
-   * users (`is_anonymous`); add `'anonymous'` (or `'anon'`) to admit them.
+   * sign-ins. Only `'anonymous'` admits them: `['anonymous']` alone admits
+   * anonymous sign-ins and refuses other users, and `'anon'` (no session)
+   * never admits them.
    */
   readonly allow?: readonly AllowedCaller[];
   /**

package/dist/server/index.d.ts

@@ -2,15 +2,16 @@ import { n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
 import { _ as DbError } from "../executor-BunPOO-k.js";
 import { t as BetterSupabase, y as Db } from "../define-Bp_BZa5h.js";
 import { g as RequestContext } from "../plugin-o144f322.js";
-import { _ as readSession, a as ResolveAuthOptions, b as writeSession, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as StoredSession, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, y as sessionCookieName } from "../resolve-C15TJq77.js";
-import { a as SupportSession, c as sqlSupportStore, i as SupportListFilter, l as supportClaims, n as SupportCallerClaims, o as SupportSessionStore, r as SupportEndedBy, s as SupportStartInput, t as SqlSupportStoreOptions } from "../support-DT-OhSxD.js";
-import { A as clearSupportCookie, C as SupportOptions, D as supportSessions, E as SupportStartRequest, M as supportCookieValue, O as SUPPORT_COOKIE, S as SupportAuthorizeInput, T as SupportSessions, _ as ReplicaState, a as Settled, b as ActiveSupport, c as respond, d as ContextOptions, f as ServerContext, g as PRIMARY_COOKIE, h as createServer, i as RespondOptions, j as supportCookie, k as SupportCookieOptions, l as settle, m as TENANT_HEADER, n as GuardOptions, o as guard, p as ServerOptions, r as MiddlewareOptions, s as isResult, t as AuthKind, u as BetterServer, v as DeleteAccountOptions, w as SupportPolicy, x as SupportApi, y as DeleteAccountResult } from "../respond-D2OQl62-.js";
-import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-CusDgPaD.js";
-import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-D8iqWMr-.js";
+import { C as writeSession, S as sessionCookieName, _ as StoredSession, a as AuthResolver, b as readSession, c as ResolveAuthOptions, d as clientIp, f as resolveAuth, g as CookieWrite, h as CookieRecord, i as AuthResolution, l as ResolvedState, m as CookieOptions, n as Impersonator, o as AuthState, p as AUTH_CACHE_HEADERS, r as impersonatorOf, s as InvalidReason, t as ImpersonationOptions, u as authContext } from "../impersonation-BmePsuxz.js";
+import { a as SupportSession, c as sqlSupportStore, i as SupportListFilter, l as supportClaims, n as SupportCallerClaims, o as SupportSessionStore, r as SupportEndedBy, s as SupportStartInput, t as SqlSupportStoreOptions } from "../support-CEPwlw2G.js";
+import { A as clearSupportCookie, C as SupportOptions, D as supportSessions, E as SupportStartRequest, M as supportCookieValue, O as SUPPORT_COOKIE, S as SupportAuthorizeInput, T as SupportSessions, _ as ReplicaState, a as Settled, b as ActiveSupport, c as respond, d as ContextOptions, f as ServerContext, g as PRIMARY_COOKIE, h as createServer, i as RespondOptions, j as supportCookie, k as SupportCookieOptions, l as settle, m as TENANT_HEADER, n as GuardOptions, o as guard, p as ServerOptions, r as MiddlewareOptions, s as isResult, t as AuthKind, u as BetterServer, v as DeleteAccountOptions, w as SupportPolicy, x as SupportApi, y as DeleteAccountResult } from "../respond-BR1fJWOB.js";
+import { a as checkAal, i as amrOf, n as AmrEntry, r as aalOf, t as Aal } from "../mfa-Cu96oJdw.js";
+import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-DNRFP7KR.js";
 import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-Blxe8S31.js";
-import { a as SessionDelegation, i as SessionActor, n as toSession, r as ActClaim, t as AuthSession } from "../view-BEf0diC5.js";
-import { n as supportOf, t as SupportView } from "../support-view-Da5peKFg.js";
-import { n as RefreshOutcome, r as refreshSession } from "../refresh-BTrQ_ZTp.js";
+import { n as SessionActor, r as SessionDelegation, t as ActClaim } from "../actor-DaJjqD5R.js";
+import { n as toSession, t as AuthSession } from "../view-CbgObAeb.js";
+import { n as supportOf, t as SupportView } from "../support-view-B8SlToQX.js";
+import { n as RefreshOutcome, r as refreshSession } from "../refresh-CFPX0Qft.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";

package/dist/server/index.js

@@ -1,12 +1,12 @@
 import { n as dbError } from "../errors-DtwXa6b8.js";
 import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-BW1KhzSG.js";
-import { n as impersonatorOf, r as userContext } from "../impersonation-VfaGc4Q_.js";
+import { n as impersonatorOf, r as userContext } from "../impersonation-BgSHAYLf.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { c as supportCookie, d as guard, f as isResult, l as supportCookieValue, m as settle, n as createServer, o as SUPPORT_COOKIE, p as respond, s as clearSupportCookie, t as TENANT_HEADER, v as PRIMARY_COOKIE } from "../server-Csx2sRjg.js";
-import { _ as writeSession, a as checkAal, d as AUTH_CACHE_HEADERS, g as sessionCookieName, i as amrOf, m as readSession, n as toSession, o as authContext, r as aalOf, s as clientIp, u as resolveAuth, v as refreshSession } from "../view-Bq64ki8-.js";
-import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-Dk6vdmEw.js";
+import { c as supportCookie, d as guard, f as isResult, l as supportCookieValue, m as settle, n as createServer, o as SUPPORT_COOKIE, p as respond, s as clearSupportCookie, t as TENANT_HEADER, v as PRIMARY_COOKIE } from "../server-B1mZ7CgQ.js";
+import { _ as writeSession, a as checkAal, d as AUTH_CACHE_HEADERS, g as sessionCookieName, i as amrOf, m as readSession, n as toSession, o as authContext, r as aalOf, s as clientIp, u as resolveAuth, v as refreshSession } from "../view-Bn6HNKUe.js";
+import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-wHnK6zp-.js";
 import { n as postgresExecutor } from "../executor-XycESQPH.js";
-import { t as defineResource } from "../resource-CRxxwkQq.js";
+import { t as defineResource } from "../resource-mqfJW4YF.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/server/middleware.ts
 /** Repository context from a `@supabase/server` context. */

package/dist/{server-Csx2sRjg.js → server-B1mZ7CgQ.js}

@@ -2,9 +2,9 @@ import { n as dbError, o as isDbError, r as dbErrorOf } from "./errors-DtwXa6b8.
 import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-BKiliPY7.js";
 import { a as postgrestExecutor, n as StatsRecorder } from "./stats-Bqob3WqT.js";
 import { a as problemResponse } from "./problem-BW1KhzSG.js";
-import { r as userContext, t as actClaim } from "./impersonation-VfaGc4Q_.js";
+import { a as delegationOf, i as actorOf, r as userContext, t as actClaim } from "./impersonation-BgSHAYLf.js";
 import { loadEnv } from "./env/index.js";
-import { a as checkAal, b as delegationOf, c as prefetchJwks, l as rememberVerified, o as authContext, t as isAnonymousUser, u as resolveAuth, y as actorOf } from "./view-Bq64ki8-.js";
+import { a as checkAal, c as prefetchJwks, l as rememberVerified, o as authContext, t as isAnonymousUser, u as resolveAuth } from "./view-Bn6HNKUe.js";
 import { parseCookieHeader, serializeCookieHeader } from "@supabase/ssr";
 import { createClient } from "@supabase/supabase-js";
 import { PostgrestClient } from "@supabase/postgrest-js";
@@ -178,27 +178,32 @@ function jsonResponse(data, init = {}) {
 }
 //#endregion
 //#region src/server/respond.ts
-/** The scopes a delegated user token lacks; empty for the user's own session. */
+/**
+* The scopes a delegated user token lacks. Empty for the user's own session,
+* which a support or impersonated session counts as: only an `oauth-client`
+* actor is limited to what the user delegated.
+*/
 function missingScopes(auth, required) {
 	if (required.length === 0) return [];
 	const outcome = actorOf(auth.claims);
-	if (!outcome.ok || !outcome.actor) return [];
+	if (!outcome.ok || outcome.actor?.kind !== "oauth-client") return [];
 	const granted = new Set(delegationOf(auth.claims)?.scopes);
 	return required.filter((scope) => !granted.has(scope));
 }
 /** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
 function guard(auth, allow = ["user"], aal = "aal1", scopes = []) {
 	if (auth.kind === "invalid") return auth.error;
-	if (allow.includes(auth.kind)) {
+	const anonymous = auth.kind === "user" && isAnonymousUser(auth.claims);
+	if (anonymous ? allow.includes("anonymous") : allow.includes(auth.kind)) {
 		const denied = checkAal(auth, aal);
 		if (denied || auth.kind !== "user") return denied;
-		if (isAnonymousUser(auth.claims) && !allow.includes("anonymous") && !allow.includes("anon")) return dbError("forbidden", "Sign up to continue", { code: "ANONYMOUS_USER" });
 		const missing = missingScopes(auth, scopes);
 		return missing.length > 0 ? dbError("forbidden", `The token lacks the scope ${missing.join(" ")}`, {
 			code: "INSUFFICIENT_SCOPE",
 			scopes
 		}) : void 0;
 	}
+	if (anonymous) return dbError("forbidden", "Sign up to continue", { code: "ANONYMOUS_USER" });
 	return auth.kind === "anon" ? dbError("unauthorized", "Sign in to continue", { code: "MISSING_CREDENTIALS" }) : dbError("forbidden", `A ${auth.kind} caller is not allowed here`);
 }
 function isResult(value) {

package/dist/sql/index.d.ts

@@ -1,6 +1,6 @@
 import { c as ClaimsMeta } from "../types-Dnf_wRDz.js";
 import { B as ReadSet } from "../define-Bp_BZa5h.js";
-import { b as ResolvedConfig, ct as KitsConfig, lt as ResolvedKitModule, ot as KitMode } from "../config-T_ejwyd3.js";
+import { b as ResolvedConfig, ct as KitsConfig, lt as ResolvedKitModule, ot as KitMode } from "../config-Bv7gvfzC.js";
 import { a as permdockKeys, i as permdockKeyStatus, n as PermdockCatalog, r as PermdockKeyStatus, t as PERMDOCK_SCHEMA } from "../permdock-sql-C2Inc6Xc.js";
 //#region src/sql/context.d.ts
 /** The scope id types kit modules render. */
@@ -232,6 +232,8 @@ interface KitLayout {
   readonly claims?: ClaimsMeta;
   /** PermDock's helpers and membership sources, from its manifest: `entitlements` reads them instead of `tenant`. */
   readonly permdock?: KitPermdock;
+  /** PermDock's permission helpers for the `access` module's `permdock` model, from its manifest. */
+  readonly accessPermdock?: KitAccessPermdock;
   /** `config.kits`: modes, names and permission keys per module. */
   readonly kits?: KitsConfig;
 }
@@ -257,6 +259,15 @@ interface KitPermdock {
   readonly idType: KitIdType;
   readonly memberships: readonly KitMembershipSource[];
 }
+/** Where the `permdock` access model finds `permitted_<scope>_ids` and `permdock_has`. */
+interface KitAccessPermdock {
+  /** PermDock's `rls.schema`. */
+  readonly schema: string;
+  /** The PermDock scope tenants are: the manifest's root scope unless set. */
+  readonly scope: string;
+  /** The scope's id type, from the manifest's `rls.scopes[].type`. */
+  readonly idType: KitIdType;
+}
 /** An embedding column `db.$search` can query. */
 interface VectorSearchTable {
   /** `table` or `schema.table`. */
@@ -296,6 +307,30 @@ export declare function kitFileVersion(contents: string): {
 } | undefined;
 /** A module's SQL for `layout`, without header; `undefined` in custom mode. */
 export declare function moduleBody(name: string, layout?: KitLayout): string | undefined;
+/**
+ * The schema or test file `renderKit` writes for each of `names` and the
+ * modules they pull in, without rendering: modules in custom mode have none.
+ */
+export declare function kitFilePaths(names: readonly string[], layout?: KitLayout): ReadonlyMap<string, string>;
+/** A permission key a kit module checks, from `kitPermissionKeys`. */
+interface KitPermissionKey {
+  readonly module: string;
+  /** The action in `kits.<module>.permissions` that overrides the key. */
+  readonly action: string;
+  readonly key: string;
+  /**
+   * `tenant` for keys checked in a tenant (`member_can`, `can`,
+   * `tenant_ids_with`), `platform` for `is_platform` and `platform_can`.
+   */
+  readonly scope: "tenant" | "platform";
+}
+/**
+ * Every permission key the modules `names` install (with what they pull
+ * in) check, after `kits.<module>.permissions` overrides. Modules in custom
+ * mode are skipped, and so is `invitations.invitePlatform` without platform
+ * roles. PermDock's doctor runs the same catalog check from its side.
+ */
+export declare function kitPermissionKeys(kits: KitsConfig, names: readonly string[]): KitPermissionKey[];
 /**
  * The files `sql add` writes for these modules. Modules in `custom` mode
  * write nothing: the app implements their contract. A schema module's rows,
@@ -340,7 +375,7 @@ export declare function customContracts(names: readonly string[], layout?: KitLa
 //#endregion
 //#region src/sql/layout.d.ts
 /** Where and how `sql add` writes kit files for this config. */
-export declare function kitLayout(config: ResolvedConfig, testsDir?: string, readSets?: KitLayout["readSets"], permdock?: KitPermdock): KitLayout;
+export declare function kitLayout(config: ResolvedConfig, testsDir?: string, readSets?: KitLayout["readSets"], permdock?: KitPermdock, accessPermdock?: KitAccessPermdock): KitLayout;
 //#endregion
 //#region src/sql/migration-options.d.ts
 /** A migration-only option a config sets. */
@@ -373,4 +408,4 @@ export declare function compileReadSet(set: ReadSet): Promise<CompiledReadSet>;
 /** Compiles every set, sorted by name. Throws on a duplicate name. */
 export declare function compileReadSets(sets: readonly ReadSet[]): Promise<CompiledReadSet[]>;
 //#endregion
-export { type CompiledReadSet, type InstalledKitModule, type KitContext, type KitContractFunction, type KitDeprecation, type KitFile, type KitIdType, type KitLayout, type KitNames, type KitPermdock, type KitTableSpec, type KitUpgrade, type KitUpgradePlan, type MigrationOptionUse, PERMDOCK_SCHEMA, type PermdockCatalog, type PermdockKeyStatus, type SqlModule, permdockKeyStatus, permdockKeys };
+export { type CompiledReadSet, type InstalledKitModule, type KitAccessPermdock, type KitContext, type KitContractFunction, type KitDeprecation, type KitFile, type KitIdType, type KitLayout, type KitNames, type KitPermdock, type KitPermissionKey, type KitTableSpec, type KitUpgrade, type KitUpgradePlan, type MigrationOptionUse, PERMDOCK_SCHEMA, type PermdockCatalog, type PermdockKeyStatus, type SqlModule, permdockKeyStatus, permdockKeys };