better-supabase 0.5.0 → 0.6.0

package/dist/{read-set-DQFt1N_Y.js → read-set-DuKWC9Mj.js}

@@ -1,9 +1,11 @@
-import { r as builderFor, s as tableMeta } from "./simplify-_0oUKqCd.js";
+import { n as dbError } from "./errors-B11Duf73.js";
+import { i as tableMeta, t as builderFor } from "./build-BXIzE6Xv.js";
 import { n as touchedTables } from "./tables-Cb-3_VWc.js";
 //#region src/core/spec.ts
 const READ_METHODS = [
 	"findMany",
 	"findFirst",
+	"findOnly",
 	"findUnique",
 	"findById",
 	"count",
@@ -121,13 +123,29 @@ const PARAM = /^[a-z_][a-z0-9_]*$/i;
 const TYPE = /^(?:[a-z_][a-z0-9_]*\.)?[a-z_][a-z0-9_]*(?:\[\])?$/;
 /** `jsonb_build_object` takes at most 100 arguments. */
 const MAX_ENTRIES = 50;
-/** Placeholders are `NUL bs:<name> NUL`: no real parameter value holds a NUL. */
+/**
+* Placeholders are `NUL bs:<name> NUL`: no real parameter value holds a NUL.
+* Auth placeholders start with `@`, which no parameter name can.
+*/
 const NUL = "\0";
-const SENTINEL = new RegExp(`${NUL}bs:([a-z_][a-z0-9_]*)${NUL}`, "gi");
-const EXACT = new RegExp(`^${NUL}bs:([a-z_][a-z0-9_]*)${NUL}$`, "i");
+const SENTINEL = new RegExp(`${NUL}bs:(@?[a-z_][a-z0-9_]*)${NUL}`, "gi");
+const EXACT = new RegExp(`^${NUL}bs:(@?[a-z_][a-z0-9_]*)${NUL}$`, "i");
 function sentinel(name) {
 	return `${NUL}bs:${name}${NUL}`;
 }
+const AUTH = { uid: sentinel("@uid") };
+function tagged(name, array) {
+	if (!name.startsWith("@")) return {
+		kind: "param",
+		name,
+		array
+	};
+	return name === "@uid" ? {
+		kind: "auth",
+		name: "uid",
+		array
+	} : void 0;
+}
 /**
 * Registers reads that run as one round trip:
 *
@@ -155,7 +173,7 @@ function defineReadSet(betterSupabase, name, options, build) {
 		if (!TYPE.test(type)) throw new TypeError(`better-supabase: read set "${name}" parameter "${key}" has an invalid type "${type}"`);
 		placeholders[key] = type.endsWith("[]") ? [sentinel(key)] : sentinel(key);
 	}
-	const specs = build(betterSupabase.spec, placeholders);
+	const specs = build(betterSupabase.spec, placeholders, AUTH);
 	const entries = Object.entries(specs);
 	if (entries.length === 0 || entries.length > MAX_ENTRIES) throw new TypeError(`better-supabase: read set "${name}" needs between 1 and ${MAX_ENTRIES} reads`);
 	for (const [key, spec] of entries) if (!isQuerySpec(spec)) throw new TypeError(`better-supabase: read set "${name}" entry "${key}" is not a spec from betterSupabase.spec`);
@@ -176,14 +194,16 @@ function defineReadSet(betterSupabase, name, options, build) {
 * that only those plugins add never reach it.
 */
 function warnUnscopedReads(betterSupabase, name, specs) {
-	const scoping = betterSupabase.plugins.filter((plugin) => plugin.transformQuery !== void 0 && plugin.name !== "rules").map((plugin) => plugin.name);
-	if (scoping.length === 0) return;
+	const filtering = betterSupabase.plugins.filter((plugin) => plugin.transformQuery !== void 0 && plugin.scopes?.length !== 0);
+	if (filtering.length === 0) return;
 	const { meta } = betterSupabase;
-	const tables = [...new Set(Object.values(specs).flatMap((spec) => specTables(meta, spec)))].filter((key) => {
+	const filters = (plugin, key) => {
 		const flags = meta.tables[key]?.flags;
-		return flags?.tenant !== void 0 || flags?.softDelete !== void 0;
-	});
+		return plugin.scopes === void 0 || plugin.scopes.some((flag) => flags?.[flag] !== void 0);
+	};
+	const tables = [...new Set(Object.values(specs).flatMap((spec) => specTables(meta, spec)))].filter((key) => filtering.some((plugin) => filters(plugin, key)));
 	if (tables.length === 0) return;
+	const scoping = filtering.filter((plugin) => tables.some((key) => filters(plugin, key))).map((plugin) => plugin.name);
 	betterSupabase.events.logger.warn(`read set "${name}" reads ${tables.join(", ")}, which ${scoping.join(", ")} scope at runtime; its generated function only sees those filters when the specs spell them out (or RLS enforces them)`, {
 		readSet: name,
 		tables,
@@ -193,19 +213,16 @@ function warnUnscopedReads(betterSupabase, name, specs) {
 function isReadSet(value) {
 	return typeof value === "object" && value !== null && value.kind === "read-set" && typeof value.name === "string";
 }
-/** A parameter a string or array carries, if it is exactly a placeholder. */
+/** The placeholder a string or array carries, if it is exactly one. */
 function placeholderOf(value) {
 	if (typeof value === "string") {
 		const match = EXACT.exec(value);
-		return match ? {
-			name: match[1],
-			array: false
-		} : void 0;
+		return match ? tagged(match[1], false) : void 0;
 	}
 	if (Array.isArray(value) && value.length === 1) {
 		const inner = placeholderOf(value[0]);
 		return inner && !inner.array ? {
-			name: inner.name,
+			...inner,
 			array: true
 		} : inner;
 	}
@@ -216,7 +233,8 @@ function splitPlaceholders(value) {
 	let last = 0;
 	for (const match of value.matchAll(SENTINEL)) {
 		if (match.index > last) parts.push({ text: value.slice(last, match.index) });
-		parts.push({ param: match[1] });
+		const placeholder = tagged(match[1], false);
+		parts.push(placeholder ?? { text: match[0] });
 		last = match.index + match[0].length;
 	}
 	if (last < value.length) parts.push({ text: value.slice(last) });
@@ -232,6 +250,16 @@ function containsPlaceholder(value) {
 	if (typeof value === "object" && value !== null) return Object.values(value).some(containsPlaceholder);
 	return false;
 }
+/** Whether the set's specs read the caller's identity. */
+function readSetUsesAuth(set) {
+	return Object.values(set.specs).some((spec) => usesAuth(spec.args));
+}
+function usesAuth(value) {
+	if (typeof value === "string") return [...value.matchAll(SENTINEL)].some((match) => match[1].startsWith("@"));
+	if (Array.isArray(value)) return value.some(usesAuth);
+	if (typeof value === "object" && value !== null) return Object.values(value).some(usesAuth);
+	return false;
+}
 /** Missing or wrongly typed parameters, as messages. */
 function checkParams(set, values) {
 	const problems = [];
@@ -242,14 +270,25 @@ function checkParams(set, values) {
 	}
 	return problems;
 }
-/** The specs with every placeholder replaced by its value. */
-function bindParams(set, values) {
+/**
+* The specs with every placeholder replaced by its value; `auth.uid` takes
+* the `sub` claim, which must be verified. `noCaller` is set when the set
+* reads `auth.uid` and there is no `sub`: the specs then match no user, and
+* only the function, which reads `auth.uid()` itself, can run the set.
+*/
+function bindParams(set, values, context) {
+	const sub = context.claims?.["sub"];
+	const uid = typeof sub === "string" && sub !== "" ? sub : null;
+	const valueOf = (placeholder) => placeholder.kind === "auth" ? uid : values?.[placeholder.name];
 	const bind = (value) => {
 		const placeholder = placeholderOf(value);
-		if (placeholder) return values[placeholder.name];
+		if (placeholder) {
+			const bound = valueOf(placeholder);
+			return placeholder.kind === "auth" && placeholder.array ? [bound] : bound;
+		}
 		if (typeof value === "string") {
 			if (!hasPlaceholder(value)) return value;
-			return splitPlaceholders(value).map((part) => "text" in part ? part.text : String(values[part.param] ?? "")).join("");
+			return splitPlaceholders(value).map((part) => "text" in part ? part.text : String(valueOf(part) ?? "")).join("");
 		}
 		if (Array.isArray(value)) return value.map(bind);
 		if (typeof value === "object" && value !== null) {
@@ -258,10 +297,13 @@ function bindParams(set, values) {
 		}
 		return value;
 	};
-	return Object.fromEntries(Object.entries(set.specs).map(([key, spec]) => [key, {
-		...spec,
-		args: spec.args.map(bind)
-	}]));
+	return {
+		specs: Object.fromEntries(Object.entries(set.specs).map(([key, spec]) => [key, {
+			...spec,
+			args: spec.args.map(bind)
+		}])),
+		noCaller: uid === null && readSetUsesAuth(set) ? dbError("invalid_request", `db.$many(${set.name}): the read set reads auth.uid, but this connection has no user claims. Connect with the user's verified claims ({ claims: { sub } }), or call it over PostgREST, where the function reads auth.uid().`) : void 0
+	};
 }
 /** App keys of every table the set reads. */
 function readSetTables(set, meta) {

package/dist/realtime/index.d.ts

@@ -1,5 +1,4 @@
-import { S as PermdockTopicPolicy } from "../types-Dnf_wRDz.js";
-import { n as PermdockCatalog } from "../permdock-sql-C2Inc6Xc.js";
-import { n as TemplateValues, t as TemplateParams } from "../template-mbvlysOo.js";
-import { C as defineTopic, S as TriggerOptions, _ as TopicEvent, a as LiveSource, b as TopicOptions, c as liveQuery, d as RealtimeClient, f as RowChange, g as Topic, h as SubscriptionStatus, i as LiveQueryOptions, l as liveTopic, m as Subscription, n as LiveCountOptions, o as LiveSubscription, p as SubscribeOptions, r as LiveCountSeed, s as liveCount, t as CountRunner, u as EventSchemas, v as TopicHandlers, w as rowChange, x as TopicPayload, y as TopicMessage } from "../live-D9W2M5aO.js";
-export { type CountRunner, type EventSchemas, type LiveCountOptions, type LiveCountSeed, type LiveQueryOptions, type LiveSource, type LiveSubscription, type PermdockCatalog, type PermdockTopicPolicy, type RealtimeClient, type RowChange, type SubscribeOptions, type Subscription, type SubscriptionStatus, type TemplateParams, type TemplateValues, type Topic, type TopicEvent, type TopicHandlers, type TopicMessage, type TopicOptions, type TopicPayload, type TriggerOptions, defineTopic, liveCount, liveQuery, liveTopic, rowChange };
+import { n as AccessPolicySql, r as AccessTopicPolicy } from "../types-6BdhkmZe.js";
+import { n as TemplateValues, t as TemplateParams } from "../template-CwO38Do8.js";
+import { A as TopicSubscription, C as TopicEvent, D as TopicPayload, E as TopicOptions, F as rowChange, M as TriggerOptions, N as TriggerValue, O as TopicSqlOptions, P as defineTopic, S as Topic, T as TopicMessage, _ as RealtimeClient, a as LiveSource, b as Subscription, c as liveQuery, d as PresenceInput, f as PresenceMember, g as PresenceSubscription, h as PresenceSchema, i as LiveQueryOptions, j as TriggerLookup, k as TopicSubscribeOptions, l as liveTopic, m as PresenceOutput, n as LiveCountOptions, o as LiveSubscription, p as PresenceOptions, r as LiveCountSeed, s as liveCount, t as CountRunner, u as EventSchemas, v as RowChange, w as TopicHandlers, x as SubscriptionStatus, y as SubscribeOptions } from "../index-DunNRdnT.js";
+export { type AccessPolicySql, type AccessTopicPolicy, type CountRunner, type EventSchemas, type LiveCountOptions, type LiveCountSeed, type LiveQueryOptions, type LiveSource, type LiveSubscription, type PresenceInput, type PresenceMember, type PresenceOptions, type PresenceOutput, type PresenceSchema, type PresenceSubscription, type RealtimeClient, type RowChange, type SubscribeOptions, type Subscription, type SubscriptionStatus, type TemplateParams, type TemplateValues, type Topic, type TopicEvent, type TopicHandlers, type TopicMessage, type TopicOptions, type TopicPayload, type TopicSqlOptions, type TopicSubscribeOptions, type TopicSubscription, type TriggerLookup, type TriggerOptions, type TriggerValue, defineTopic, liveCount, liveQuery, liveTopic, rowChange };

package/dist/realtime/index.js

@@ -1,11 +1,12 @@
-import { n as dbError } from "../errors-DtwXa6b8.js";
-import { i as ok, n as err, t as AsyncResult } from "../result-BKiliPY7.js";
-import { i as tenantClaimPaths } from "../claims-BAf6c7is.js";
-import { n as liveQuery, r as liveTopic, t as liveCount } from "../live-CdJBOc4f.js";
-import { i as sqlString, n as slug, r as sqlIdent, t as parseTemplate } from "../template-TxrGI5jR.js";
-import { c as toApp } from "../shared-D1dRUrAg.js";
-import { n as permdockCheck } from "../permdock-sql-DgOfeixi.js";
-import { REALTIME_SUBSCRIBE_STATES } from "@supabase/supabase-js";
+import { n as dbError } from "../errors-B11Duf73.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-DzUbqgdW.js";
+import { a as tenantClaimPaths } from "../claims-PqzCxaTD.js";
+import { i as refreshRealtimeAuth, n as liveQuery, r as liveTopic, t as liveCount } from "../live-CTAZQkwl.js";
+import { i as sqlString, n as slug, r as sqlIdent, t as parseTemplate } from "../template--jDkl3UP.js";
+import { c as toApp } from "../shared-CxWmcyqB.js";
+import { t as joinTopic } from "../channels-CkgQ_X60.js";
+import { o as resolveProviderSql, r as accessCheck } from "../access-sql-B0dF-SoF.js";
+import "@supabase/supabase-js";
 //#region src/realtime/topic.ts
 const VALUE = /^[\w.@+=-]+$/;
 function validateValue(_name, value) {
@@ -43,15 +44,38 @@ function sendError(status, message) {
 	if (status === 429 || status >= 500 || status === 0) return dbError("network", message, status ? { status } : {});
 	return dbError("invalid_request", message, { status });
 }
+function columnSql(meta, column, where) {
+	const db = meta.columns[column]?.db;
+	if (!db) throw new TypeError(`defineTopic: no column for ${where} on "${meta.key}" ("${column}")`);
+	return sqlIdent(db);
+}
+/** A trigger value as SQL on `rec`, with one subquery per lookup. */
+function triggerValueSql(tables, meta, value, where, depth = 0) {
+	if (typeof value === "string") return `rec.${columnSql(meta, value, where)}`;
+	const joined = tables[value.from];
+	if (!joined) throw new TypeError(`defineTopic: unknown table "${value.from}" for ${where}`);
+	const key = value.key ?? (joined.primaryKey.length === 1 ? joined.primaryKey[0] : void 0);
+	if (key === void 0) throw new TypeError(`defineTopic: "${value.from}" has no single-column primary key; name its key for ${where}`);
+	const alias = `j${String(depth)}`;
+	const via = triggerValueSql(tables, meta, value.via, where, depth + 1);
+	return `(select ${alias}.${columnSql(joined, value.select, where)} from ${sqlIdent(joined.schema)}.${sqlIdent(joined.name)} ${alias} where ${alias}.${columnSql(joined, key, where)} = ${via} limit 1)`;
+}
+/** The event name: one for every operation, one per operation, or the operation. */
+function eventSql(event) {
+	if (event === void 0) return "tg_op";
+	if (typeof event === "string") return sqlString(event);
+	const cases = Object.entries(event).filter((entry) => entry[1] !== void 0).map(([operation, name]) => ` when ${sqlString(operation.toUpperCase())} then ${sqlString(name)}`);
+	return cases.length === 0 ? "tg_op" : `case tg_op${cases.join("")} else tg_op end`;
+}
 /**
 * A typed Realtime broadcast topic: names from a template, RLS policies for
 * private channels, row-change triggers, and disposable subscriptions.
 *
 * ```ts
-* export const notifications = defineTopic('org:{orgId}:notifications:{userId}', {
+* export const notifications = defineTopic('organization:{organizationId}:notifications:{userId}', {
 *   events: { created: v.object({ id: v.string(), title: v.string() }) },
 * });
-* using sub = notifications.subscribe(supabase, { orgId, userId }, { created: (n) => toast(n.title) });
+* using sub = notifications.subscribe(supabase, { organizationId, userId }, { created: (n) => toast(n.title) });
 * ```
 */
 function defineTopic(template, options = {}) {
@@ -60,25 +84,29 @@ function defineTopic(template, options = {}) {
 	const name = slug(options.name ?? literal) || "topic";
 	const isPrivate = options.private ?? true;
 	const schemas = options.events ?? {};
+	const hasPresence = options.presence !== void 0 && options.presence !== false;
+	const presenceSchema = typeof options.presence === "object" ? options.presence : void 0;
 	const segment = (param, kind) => {
 		const index = parsed.segmentOf(param);
 		if (index === void 0) throw new TypeError(`defineTopic: the ${kind} check needs {${param}} as a whole segment in "${template}"`);
 		return index;
 	};
 	const checks = [];
-	const permdock = options.permdock;
-	const tenantParam = options.tenant === false ? void 0 : options.tenant?.param ?? "orgId";
-	const permdockChecks = (() => {
-		if (!permdock) return void 0;
+	const access = options.access;
+	const tenantParam = options.tenant === false ? void 0 : options.tenant?.param ?? "organizationId";
+	const accessChecksFor = (functions) => {
+		if (!access) return void 0;
 		const where = `defineTopic(${template})`;
-		const id = permdock.scope === "global" ? void 0 : `split_part((select realtime.topic()), ':', ${String(permdock.segment ?? segment(tenantParam ?? "orgId", "PermDock"))})`;
-		const receive = permdockCheck(where, permdock, permdock.receive, id, options.catalog);
+		const target = resolveProviderSql(where, access, functions);
+		const id = access.scope === "platform" ? void 0 : `split_part((select realtime.topic()), ':', ${String(access.segment ?? segment(tenantParam ?? "organizationId", "access"))})`;
+		const receive = accessCheck(where, target, access.receive, id);
 		return {
 			receive,
-			send: permdock.send === void 0 ? receive : permdockCheck(where, permdock, permdock.send, id, options.catalog)
+			send: access.send === void 0 ? receive : accessCheck(where, target, access.send, id)
 		};
-	})();
-	if (!permdock && tenantParam && (options.tenant || parsed.params.includes(tenantParam))) {
+	};
+	const fixedChecks = access?.sql === "provider" ? void 0 : accessChecksFor();
+	if (!access && tenantParam && (options.tenant || parsed.params.includes(tenantParam))) {
 		const tenant = options.tenant === false ? {} : options.tenant ?? {};
 		const expression = tenant.sql ?? claimSql(tenant.claim ?? tenantClaimPaths());
 		checks.push(`split_part((select realtime.topic()), ':', ${String(segment(tenantParam, "tenant"))}) = (${expression})`);
@@ -91,10 +119,12 @@ function defineTopic(template, options = {}) {
 		name,
 		params: parsed.params,
 		private: isPrivate,
+		presence: hasPresence,
 		topic: topicOf,
 		match: (topic) => parsed.match(topic),
-		sql() {
-			const extensions = options.presence ? "('broadcast', 'presence')" : "('broadcast')";
+		sql(sqlOptions) {
+			const accessChecks = access?.sql === "provider" ? accessChecksFor(sqlOptions?.functions) : fixedChecks;
+			const extensions = hasPresence ? "('broadcast', 'presence')" : "('broadcast')";
 			const condition = (extra) => [
 				`(select realtime.topic()) ~ ${sqlString(parsed.sqlPattern)}`,
 				`realtime.messages.extension in ${extensions}`,
@@ -106,13 +136,13 @@ function defineTopic(template, options = {}) {
 				"receive",
 				"select",
 				"using",
-				condition(permdockChecks?.receive)
+				condition(accessChecks?.receive)
 			]];
-			if (options.send || options.presence || permdock?.send !== void 0) policies.push([
+			if (options.send || hasPresence || access?.send !== void 0) policies.push([
 				"send",
 				"insert",
 				"with check",
-				condition(permdockChecks?.send)
+				condition(accessChecks?.send)
 			]);
 			for (const [suffix, command, clause, check] of policies) {
 				const policy = sqlIdent(`bs_topic_${name}_${suffix}`);
@@ -124,13 +154,13 @@ function defineTopic(template, options = {}) {
 			const meta = betterSupabase.meta.tables[table];
 			if (!meta) throw new TypeError(`defineTopic: unknown table "${table}"`);
 			const values = trigger.values;
+			const tables = betterSupabase.meta.tables;
 			const parts = template.split(/(\{[^}]+\})/).filter(Boolean).map((part) => {
 				const param = /^\{(.+)\}$/.exec(part)?.[1];
 				if (param === void 0) return sqlString(part);
-				const column = values[param];
-				const db = column === void 0 ? void 0 : meta.columns[column]?.db;
-				if (!db) throw new TypeError(`defineTopic: no column for {${param}} on "${table}"`);
-				return `rec.${sqlIdent(db)}::text`;
+				const value = values[param];
+				if (value === void 0) throw new TypeError(`defineTopic: no column for {${param}} on "${table}"`);
+				return `${triggerValueSql(tables, meta, value, `{${param}}`)}::text`;
 			});
 			const schema = trigger.functionSchema ?? "better_supabase";
 			const fn = `${sqlIdent(schema)}.${sqlIdent(`bs_broadcast_${name}_${slug(meta.name)}`)}`;
@@ -141,6 +171,18 @@ function defineTopic(template, options = {}) {
 				"update",
 				"delete"
 			]).join(" or ");
+			const event = eventSql(trigger.event);
+			const payload = trigger.payload;
+			const send = payload ? [
+				"  perform realtime.send(",
+				`    jsonb_build_object(${Object.entries(payload).map(([key, value]) => `${sqlString(key)}, ${typeof value === "object" && "sql" in value ? `(${value.sql.replaceAll("{row}", "rec")})` : triggerValueSql(tables, meta, value, `payload.${key}`)}`).join(", ")}),`,
+				`    ${event}, topic, ${String(isPrivate)}`,
+				"  );"
+			] : [
+				"  perform realtime.broadcast_changes(",
+				`    topic, ${event}, tg_op, tg_table_name, tg_table_schema, new, old`,
+				"  );"
+			];
 			return [
 				`-- better-supabase: broadcast ${meta.name} changes to ${template}`,
 				`create schema if not exists ${sqlIdent(schema)};`,
@@ -152,12 +194,14 @@ function defineTopic(template, options = {}) {
 				"as $$",
 				"declare",
 				"  rec record;",
+				"  topic text;",
 				"begin",
 				"  if tg_op = 'DELETE' then rec := old; else rec := new; end if;",
-				"  perform realtime.broadcast_changes(",
-				`    ${parts.join(" || ")},`,
-				"    tg_op, tg_op, tg_table_name, tg_table_schema, new, old",
-				"  );",
+				`  topic := ${parts.join(" || ")};`,
+				"  if topic is null then",
+				"    return null;",
+				"  end if;",
+				...send,
 				"  return null;",
 				"end;",
 				"$$;",
@@ -169,68 +213,86 @@ function defineTopic(template, options = {}) {
 				""
 			].join("\n");
 		},
-		subscribe(client, values, handlers, subscribeOptions = {}) {
+		subscribe(client, values, handlers, given) {
 			const topic = topicOf(values);
-			const channel = client.channel(topic, { config: {
-				private: isPrivate,
-				broadcast: { self: subscribeOptions.self ?? false }
-			} });
 			const table = handlers;
-			channel.on("broadcast", { event: "*" }, (raw) => {
-				const message = {
-					event: raw.event,
-					payload: raw["payload"],
-					topic
-				};
-				const handler = table[message.event] ?? table["*"];
-				if (!handler) return;
-				validate(schemas[message.event], message.payload).then((checked) => {
-					if (checked.ok) handler(checked.value, message);
-					else subscribeOptions.onInvalid?.(message, checked.issues);
+			const subscribeOptions = given ?? {};
+			let members = [];
+			let syncs = 0;
+			const sync = async (state) => {
+				const run = ++syncs;
+				const checked = await Promise.all(Object.entries(state).flatMap(([key, metas]) => metas.map(async ({ presence_ref: _ref, ...meta }) => ({
+					key,
+					meta,
+					checked: await validate(presenceSchema, meta)
+				}))));
+				if (run !== syncs) return;
+				const valid = [];
+				for (const each of checked) if (each.checked.ok) valid.push({
+					key: each.key,
+					state: each.checked.value
 				});
-			});
-			let closed = false;
-			subscribeOptions.onStatus?.("joining");
-			const ready = (async () => {
-				if (isPrivate) await client.realtime.setAuth();
-				if (closed) return;
-				await new Promise((resolve, reject) => {
-					channel.subscribe((status, error) => {
-						switch (status) {
-							case REALTIME_SUBSCRIBE_STATES.SUBSCRIBED:
-								subscribeOptions.onStatus?.("subscribed");
-								resolve();
-								return;
-							case REALTIME_SUBSCRIBE_STATES.CLOSED:
-								subscribeOptions.onStatus?.("closed");
-								resolve();
-								return;
-							case REALTIME_SUBSCRIBE_STATES.CHANNEL_ERROR:
-							case REALTIME_SUBSCRIBE_STATES.TIMED_OUT: {
-								const failure = error ?? /* @__PURE__ */ new Error(`Realtime ${status.toLowerCase()} on ${topic}`);
-								subscribeOptions.onStatus?.("error", failure);
-								reject(failure);
-								return;
-							}
-							default: reject(/* @__PURE__ */ new Error(`Unknown realtime status ${String(status)}`));
-						}
+				else subscribeOptions.onInvalid?.({
+					event: "presence",
+					payload: each.meta,
+					topic
+				}, each.checked.issues);
+				members = valid;
+				subscribeOptions.onPresence?.(valid);
+			};
+			const subscriber = {
+				onStatus: subscribeOptions.onStatus,
+				receive: (message) => {
+					const handler = table[message.event] ?? table["*"];
+					if (!handler) return;
+					validate(schemas[message.event], message.payload).then((checked) => {
+						if (checked.ok) handler(checked.value, message);
+						else subscribeOptions.onInvalid?.(message, checked.issues);
 					});
-				});
-			})();
-			ready.catch(() => void 0);
+				},
+				...hasPresence ? { sync: (state) => void sync(state) } : {}
+			};
+			const { shared, leave } = joinTopic(client, topic, isPrivate, subscribeOptions.self ?? false, hasPresence, subscriber);
+			let closed = false;
 			const unsubscribe = async () => {
 				if (closed) return;
 				closed = true;
-				await client.removeChannel(channel);
+				await leave();
 			};
-			return {
+			const presenceCall = (action, run) => AsyncResult.from(async () => {
+				if (closed) return err(dbError("invalid_request", `Presence ${action} after unsubscribe on ${topic}`));
+				try {
+					await shared.ready;
+				} catch (cause) {
+					return err(dbError("network", `Presence ${action} on ${topic}: the join failed`, { details: cause instanceof Error ? cause.message : String(cause) }));
+				}
+				const answer = await run();
+				return answer === "ok" ? ok(void 0) : err(dbError("network", `Presence ${action} ${answer} on ${topic}`));
+			});
+			const subscription = {
 				topic,
-				channel,
-				ready,
+				channel: shared.channel,
+				ready: shared.ready,
 				unsubscribe,
 				[Symbol.dispose]: () => void unsubscribe(),
 				[Symbol.asyncDispose]: unsubscribe
 			};
+			return hasPresence ? {
+				...subscription,
+				track: (state) => AsyncResult.from(async () => {
+					const checked = await validate(presenceSchema, state);
+					if (!checked.ok) return err(dbError("validation", `Invalid presence state for ${topic}`, { issues: checked.issues }));
+					return presenceCall("track", async () => {
+						shared.tracker = subscriber;
+						return shared.channel.track(checked.value);
+					});
+				}),
+				untrack: () => presenceCall("untrack", async () => {
+					if (shared.tracker === subscriber) shared.tracker = void 0;
+					return shared.channel.untrack();
+				}),
+				members: () => members
+			} : subscription;
 		},
 		send(client, values, event, payload) {
 			return AsyncResult.from(async () => {
@@ -238,7 +300,7 @@ function defineTopic(template, options = {}) {
 				const checked = await validate(schemas[event], payload);
 				if (!checked.ok) return err(dbError("validation", `Invalid payload for ${event}`, { issues: checked.issues }));
 				const open = client.getChannels().some((existing) => existing.topic === `realtime:${topic}`);
-				if (isPrivate && !open) await client.realtime.setAuth();
+				if (isPrivate && !open) await refreshRealtimeAuth(client);
 				const channel = client.channel(topic, { config: { private: isPrivate } });
 				try {
 					const response = await channel.httpSend(event, checked.value);

package/dist/refusal-CeJWxmkH.js

@@ -0,0 +1,61 @@
+import { r as dbErrorOf } from "./errors-B11Duf73.js";
+import { a as problemResponse } from "./problem-BreOl8b8.js";
+import { t as defaultExpose } from "./respond-BUgsXNgk.js";
+import { i as requireCaller } from "./kit-Fm-Fv7q5.js";
+//#region src/server/refusal.ts
+function isAalRefusal(error) {
+	return error.kind === "forbidden" && "required" in error && error.required === "aal2";
+}
+/** The page a refused caller is sent to, with `?next=`, when one is configured. */
+function refusalTarget(error, request, redirects) {
+	const page = error.kind === "unauthorized" ? redirects.signIn : isAalRefusal(error) ? redirects.mfa : void 0;
+	if (page === void 0) return void 0;
+	const url = new URL(request.url);
+	const target = new URL(page, url);
+	if (target.pathname === url.pathname) return void 0;
+	target.searchParams.set("next", `${url.pathname}${url.search}`);
+	return target;
+}
+/** A refusal as a redirect to `signIn` or `mfa`, else Problem Details. */
+function refusalResponse(error, request, redirects, expose) {
+	const target = refusalTarget(error, request, redirects);
+	if (target) return new Response(null, {
+		status: 303,
+		headers: { location: target.href }
+	});
+	return problemResponse(error, {
+		instance: new URL(request.url).pathname,
+		expose
+	});
+}
+/** The refusal for a caller `options` refuses, or `undefined` to let it through. */
+async function routeRefusal(locals, request, options) {
+	const caller = await requireCaller(locals.bs.auth, options, locals.tenant);
+	if (!("kind" in caller)) return void 0;
+	return refusalResponse(caller, request, options, options.expose ?? defaultExpose());
+}
+/**
+* An `onError` mapper: a thrown `DbException` (or an error caused by a
+* `DbError`) becomes Problem Details; anything else is `undefined`, so the
+* framework's own handling stays.
+*/
+function errorResponse(cause, request, options = {}) {
+	const found = dbErrorOf(cause);
+	if (!found) return void 0;
+	return problemResponse(found, {
+		instance: new URL(request.url).pathname,
+		expose: options.expose ?? defaultExpose()
+	});
+}
+/** Reads the guard's view of a request's contributions; throws without `withBetterSupabase`. */
+function guardedLocals(contributions) {
+	const bs = "bs" in contributions ? contributions.bs : void 0;
+	if (typeof bs !== "object" || bs === null || !("auth" in bs)) throw new Error("better-supabase: the route guard needs withBetterSupabase(server) in the entries");
+	const tenant = "tenant" in contributions ? contributions.tenant : void 0;
+	return {
+		bs,
+		tenant: typeof tenant === "string" ? tenant : void 0
+	};
+}
+//#endregion
+export { routeRefusal as a, refusalTarget as i, guardedLocals as n, refusalResponse as r, errorResponse as t };

package/dist/refusal-D1rgbzNq.d.ts

@@ -0,0 +1,15 @@
+import { s as BlockRequireOptions } from "./kit-B5tid-q5.js";
+//#region src/server/refusal.d.ts
+/** Where refused callers go instead of a Problem Details response. */
+interface RefusalRedirects {
+  /** Sign-in page for callers without a session; gets `?next=<path>`. */
+  readonly signIn?: string;
+  /** Second-factor page for users below the route's `aal`; gets `?next=<path>`. */
+  readonly mfa?: string;
+}
+interface RouteGuardOptions<C = unknown, P = unknown> extends BlockRequireOptions<C, P>, RefusalRedirects {
+  /** Include internal error messages in Problem Details. Defaults to development only. */
+  readonly expose?: boolean;
+}
+//#endregion
+export { RouteGuardOptions as n, RefusalRedirects as t };