better-supabase 0.5.1 → 0.6.0

package/dist/vault-CSO7ss5C.d.ts

@@ -0,0 +1,50 @@
+import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
+import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
+import { c as SetCredentialOptions, i as CredentialRef, r as CredentialProvider } from "./provider-BH5UWZJ6.js";
+//#region src/credentials/vault.d.ts
+/** How a request the third party sends is signed with the stored secret. */
+type VaultInboundScheme = "standard-webhooks" | "hmac-sha256" | "shared-secret";
+/**
+ * A credential in Vault. `scope: 'user'` keeps one secret per user subject.
+ * The token goes out as `<header>: <scheme> <token>`, `Authorization: Bearer`
+ * by default; `scheme: null` sends it bare (`x-api-key`).
+ */
+interface VaultCredentialRef {
+  readonly provider: "vault";
+  readonly secret: string;
+  /** Stores the secret as `tenant/<tenant>/<secret>`, apart from every other tenant's. */
+  readonly tenant?: string;
+  readonly scope?: "app" | "user";
+  readonly header?: string;
+  readonly scheme?: string | null;
+  readonly inbound?: VaultInboundScheme;
+  /** Defaults to `x-hub-signature-256` for `hmac-sha256`, `authorization` for `shared-secret`. */
+  readonly signatureHeader?: string;
+}
+interface VaultCredentialsOptions {
+  /** `sqlTransport(postgres.asService())` or `rpcTransport` with the service role key. */
+  readonly transport: BlockTransport;
+  /** The schema of the `credentials` module. Defaults to `better_supabase`. */
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+  /**
+   * How long a read secret stays in memory, in milliseconds. Defaults to
+   * 60000; `0` reads Vault on every call. `set` and `revoke` clear it.
+   */
+  readonly cacheMs?: number;
+}
+interface VaultCredentials extends CredentialProvider {
+  readonly name: "vault";
+  /** Stores or replaces the credential a ref names, for `subject` when the ref is per user. */
+  set(ref: CredentialRef, value: string, options?: SetCredentialOptions): AsyncResult<void>;
+  verifyInbound(request: Request, ref: CredentialRef): AsyncResult<boolean>;
+}
+/**
+ * A `CredentialProvider` over the `credentials` SQL module: tokens and API
+ * keys in Supabase Vault, read through security definer functions only the
+ * service role may call. Static secrets only; OAuth connections come from
+ * a provider such as `better-supabase/vercel-connect`.
+ */
+declare function vaultCredentials(options: VaultCredentialsOptions): VaultCredentials;
+//#endregion
+export { vaultCredentials as a, VaultInboundScheme as i, VaultCredentials as n, VaultCredentialsOptions as r, VaultCredentialRef as t };

package/dist/vercel-connect/index.d.ts

@@ -0,0 +1,47 @@
+import { a as CredentialSubject, r as CredentialProvider } from "../provider-BH5UWZJ6.js";
+//#region src/vercel-connect/vercel-connect.d.ts
+interface ConnectTokenParams {
+  subject: CredentialSubject;
+  installationId?: string;
+  scopes?: string[];
+}
+interface ConnectOptions {
+  vercelToken?: string;
+}
+/** The part of `@vercel/connect` this provider calls, typed structurally. */
+interface VercelConnectModule {
+  getTokenResponse(connector: string, params: ConnectTokenParams, options?: ConnectOptions): Promise<{
+    token: string;
+    expiresAt: number;
+  }>;
+  revokeToken(connector: string, params: {
+    subject: CredentialSubject;
+    installationId?: string;
+  }, options?: ConnectOptions): Promise<void>;
+  startAuthorization(connector: string, params: ConnectTokenParams, options?: {
+    vercelToken?: string;
+    callbackUrl?: string;
+  }): Promise<{
+    url: string;
+  }>;
+}
+/** A Vercel Connect connector; `connector` is its UID. */
+interface VercelConnectRef {
+  readonly provider: "vercel-connect";
+  readonly connector: string;
+  readonly installationId?: string;
+  readonly scopes?: readonly string[];
+}
+interface VercelConnectCredentialsOptions {
+  /** Defaults to the OIDC token `@vercel/connect` reads on Vercel. */
+  readonly vercelToken?: string;
+  /** Returns `@vercel/connect`; defaults to importing it on first use. */
+  readonly load?: () => Promise<unknown>;
+}
+/**
+ * A `CredentialProvider` over Vercel Connect: OAuth tokens for a connector,
+ * for the app or a user, refreshed by Vercel. Needs `@vercel/connect`.
+ */
+export declare function vercelConnectCredentials(options?: VercelConnectCredentialsOptions): CredentialProvider;
+//#endregion
+export type { VercelConnectCredentialsOptions, VercelConnectModule, VercelConnectRef };

package/dist/vercel-connect/index.js

@@ -0,0 +1,119 @@
+import { n as dbError } from "../errors-B11Duf73.js";
+import { c as optionalTemporal } from "../temporal-BJGitm-h.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-DzUbqgdW.js";
+import { d as isRecord } from "../block-helpers-DWHxHsEQ.js";
+//#region src/vercel-connect/vercel-connect.ts
+const isModule = (value) => isRecord(value) && typeof value["getTokenResponse"] === "function" && typeof value["revokeToken"] === "function" && typeof value["startAuthorization"] === "function";
+/**
+* Loads `@vercel/connect` on first use. The specifier is a variable so
+* bundlers leave the optional peer out of apps that don't use it.
+*/
+async function loadConnect() {
+	const specifier = "@vercel/connect";
+	try {
+		return await import(specifier);
+	} catch {
+		return;
+	}
+}
+function connectRef(ref) {
+	const { connector, installationId, scopes } = ref;
+	if (ref.provider !== "vercel-connect" || typeof connector !== "string") return err(dbError("invalid_input", `vercel-connect resolves refs with a connector, not "${ref.provider}"`, { hint: "CREDENTIAL_REF_INVALID" }));
+	return ok({
+		provider: "vercel-connect",
+		connector,
+		...typeof installationId === "string" ? { installationId } : {},
+		...Array.isArray(scopes) ? { scopes: scopes.filter((scope) => typeof scope === "string") } : {}
+	});
+}
+/** Maps the `@vercel/connect` error classes by name, without importing them. */
+function connectError(cause) {
+	const name = cause instanceof Error ? cause.name : "";
+	const message = cause instanceof Error ? cause.message : String(cause);
+	switch (name) {
+		case "UserAuthorizationRequiredError": return err(dbError("forbidden", message, { hint: "CREDENTIAL_AUTHORIZATION_REQUIRED" }));
+		case "ConnectorInstallationRequiredError": return err(dbError("forbidden", message, { hint: "CREDENTIAL_INSTALLATION_REQUIRED" }));
+		case "NoValidTokenError": return err(dbError("not_found", message, { hint: "CREDENTIAL_NOT_FOUND" }));
+		default: return err(dbError("network", message));
+	}
+}
+/**
+* A `CredentialProvider` over Vercel Connect: OAuth tokens for a connector,
+* for the app or a user, refreshed by Vercel. Needs `@vercel/connect`.
+*/
+function vercelConnectCredentials(options = {}) {
+	let loaded;
+	const connect = () => loaded ??= (options.load ?? loadConnect)().then((value) => {
+		if (!isModule(value)) {
+			loaded = void 0;
+			throw new TypeError("vercelConnectCredentials needs the @vercel/connect package: pnpm add @vercel/connect");
+		}
+		return value;
+	});
+	const connectOptions = options.vercelToken === void 0 ? {} : { vercelToken: options.vercelToken };
+	const run = (ref, subject, fn) => {
+		if (ref.tenant !== void 0 && subject.type === "app") return AsyncResult.err(dbError("forbidden", "vercel-connect has no per-tenant credentials; use a user subject or a provider with tenant namespaces", { hint: "CREDENTIAL_REF_FOREIGN" }));
+		const parsed = connectRef(ref);
+		if (!parsed.ok) return AsyncResult.err(parsed.error);
+		return AsyncResult.from(async () => {
+			const module = await connect();
+			try {
+				return ok(await fn(module, parsed.data));
+			} catch (cause) {
+				return connectError(cause);
+			}
+		});
+	};
+	const params = (parsed, subject, scopes, installationId) => {
+		const chosen = scopes ?? parsed.scopes;
+		const installation = installationId ?? parsed.installationId;
+		return {
+			subject,
+			...installation === void 0 ? {} : { installationId: installation },
+			...chosen === void 0 ? {} : { scopes: [...chosen] }
+		};
+	};
+	return {
+		apiVersion: 1,
+		name: "vercel-connect",
+		getToken(ref, getOptions) {
+			return run(ref, getOptions.subject, async (module, parsed) => {
+				const response = await module.getTokenResponse(parsed.connector, params(parsed, getOptions.subject, getOptions.scopes, getOptions.installationId), connectOptions);
+				const temporal = optionalTemporal();
+				return {
+					token: response.token,
+					...temporal === void 0 ? {} : { expiresAt: temporal.Instant.fromEpochMilliseconds(response.expiresAt) },
+					headers: { authorization: `Bearer ${response.token}` }
+				};
+			});
+		},
+		capabilities() {
+			return {
+				userSubjects: true,
+				authorization: true,
+				revoke: true,
+				inbound: false
+			};
+		},
+		startAuthorization(ref, startOptions) {
+			return run(ref, startOptions.subject, async (module, parsed) => {
+				const { url } = await module.startAuthorization(parsed.connector, params(parsed, startOptions.subject, startOptions.scopes, void 0), {
+					...connectOptions,
+					callbackUrl: startOptions.redirectUri
+				});
+				return { url };
+			});
+		},
+		revoke(ref, revokeOptions) {
+			return run(ref, revokeOptions.subject, async (module, parsed) => {
+				await module.revokeToken(parsed.connector, {
+					subject: revokeOptions.subject,
+					...parsed.installationId === void 0 ? {} : { installationId: parsed.installationId }
+				}, connectOptions);
+				return true;
+			});
+		}
+	};
+}
+//#endregion
+export { vercelConnectCredentials };

package/dist/{verify-Ce49ETPz.js → verify-DL41hbvY.js}

@@ -1,10 +1,10 @@
-import { n as dbError } from "./errors-DtwXa6b8.js";
-import { n as nowInstant, r as optionalTemporal } from "./temporal-CVlIV2DZ.js";
-import { n as temporalMissing } from "./temporal-required-CAt4Dc9Z.js";
-import { i as ok, n as err } from "./result-BKiliPY7.js";
+import { n as dbError } from "./errors-B11Duf73.js";
+import { c as optionalTemporal, s as nowInstant } from "./temporal-BJGitm-h.js";
+import { n as temporalMissing } from "./temporal-required-BVvW7SYJ.js";
+import { a as ok, r as err } from "./result-DzUbqgdW.js";
 import { i as toBase64, r as fromBase64 } from "./base64-D2gsioCY.js";
-import { c as toApp } from "./shared-D1dRUrAg.js";
-//#region src/webhooks/verify.ts
+import { c as toApp } from "./shared-CxWmcyqB.js";
+//#region src/blocks/webhooks/verify.ts
 const encoder = /* @__PURE__ */ new TextEncoder();
 /** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
 function secretBytes(secret) {
@@ -65,14 +65,15 @@ async function signWebhook(secret, message) {
 }
 /**
 * Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
-* `webhook-signature`) and parses the JSON body. Pass several secrets while
-* rotating.
+* `webhook-signature`, or the `svix-` names Svix-based senders use) and
+* parses the JSON body. Pass several secrets while rotating.
 */
 async function verifyWebhook(input, secrets, options = {}) {
 	const headers = input.headers;
-	const id = header(headers, "webhook-id");
-	const timestamp = header(headers, "webhook-timestamp");
-	const signatures = header(headers, "webhook-signature");
+	const prefix = header(headers, "webhook-id") === null ? "svix" : "webhook";
+	const id = header(headers, `${prefix}-id`);
+	const timestamp = header(headers, `${prefix}-timestamp`);
+	const signatures = header(headers, `${prefix}-signature`);
 	if (!id || !timestamp || !signatures) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing webhook signature headers"));
 	const seconds = Number(timestamp);
 	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
@@ -106,6 +107,77 @@ async function verifyWebhook(input, secrets, options = {}) {
 function verifySharedSecret(request, secret, headerName = "authorization") {
 	return timingSafeEqual((request.headers.get(headerName) ?? "").replace(/^Bearer\s+/i, ""), secret);
 }
+const toHex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+/** Stripe signs with the endpoint secret's UTF-8 bytes, not its base64 decoding. */
+async function stripeSignature(secret, content) {
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return toHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(content))));
+}
+/** The `Stripe-Signature` header for `body`, for tests and local replays. */
+async function signStripeWebhook(secret, body, timestamp = nowInstant()) {
+	const seconds = String(Math.floor(timestamp.epochMilliseconds / 1e3));
+	return `t=${seconds},v1=${await stripeSignature(secret, `${seconds}.${body}`)}`;
+}
+/**
+* Verifies a `Stripe-Signature` header (`t=…,v1=…`) with the endpoint's
+* `whsec_…` secret and parses the event. Pass several secrets while rolling
+* the endpoint secret. Runs on WebCrypto, so it needs no `stripe` package.
+*/
+async function verifyStripeWebhook(input, secrets, options = {}) {
+	const value = header(input.headers, "stripe-signature");
+	if (!value) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing Stripe-Signature header"));
+	const parts = value.split(",").map((part) => {
+		const index = part.indexOf("=");
+		return [part.slice(0, index).trim(), part.slice(index + 1).trim()];
+	});
+	const timestamp = parts.find(([name]) => name === "t")?.[1] ?? "";
+	const offered = parts.filter(([name]) => name === "v1").map(([, sig]) => sig);
+	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
+	const namespace = optionalTemporal();
+	if (namespace === void 0) return err(temporalMissing());
+	const seconds = Number(timestamp);
+	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
+	if (Math.abs(now - seconds) > (options.tolerance ?? 300)) return err(unauthorized("WEBHOOK_TIMESTAMP_OUT_OF_RANGE", "Webhook timestamp is outside the tolerance"));
+	const body = input instanceof Request ? await input.text() : input.body;
+	let valid = false;
+	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
+		const expected = await stripeSignature(secret, `${timestamp}.${body}`);
+		for (const candidate of offered) if (timingSafeEqual(candidate, expected)) valid = true;
+	}
+	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
+	let payload;
+	try {
+		payload = JSON.parse(body);
+	} catch {
+		return err(dbError("invalid_request", "Webhook body is not JSON"));
+	}
+	const id = typeof payload === "object" && payload !== null && "id" in payload ? String(payload.id) : "";
+	return ok({
+		id,
+		timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
+		payload,
+		body
+	});
+}
+/**
+* `createWebhookInbox({ source: 'stripe', verify: stripeInboxVerify(secret) })`:
+* stores Stripe events keyed by their event id.
+*/
+function stripeInboxVerify(secrets, options = {}) {
+	return async (request, body) => {
+		const verified = await verifyStripeWebhook({
+			headers: request.headers,
+			body
+		}, secrets, options);
+		return verified.ok ? ok({
+			id: verified.data.id,
+			payload: verified.data.payload
+		}) : verified;
+	};
+}
 /** Rejects a hook with a status and message Supabase Auth passes to the client. */
 function hookError(status, message) {
 	return { error: {
@@ -119,7 +191,7 @@ function hookError(status, message) {
 *
 * ```ts
 * export const POST = authHook('custom_access_token', env.AUTH_HOOK_SECRET, async ({ claims, user_id }) => ({
-*   claims: { ...claims, tenant_id: await orgFor(user_id) },
+*   claims: { ...claims, tenant_id: await organizationFor(user_id) },
 * }));
 * ```
 */
@@ -157,4 +229,4 @@ function databaseChange(betterSupabase, table, payload) {
 	};
 }
 //#endregion
-export { signWebhook as a, verifyWebhook as c, isDatabaseWebhook as i, databaseChange as n, timingSafeEqual as o, hookError as r, verifySharedSecret as s, authHook as t };
+export { signStripeWebhook as a, timingSafeEqual as c, verifyWebhook as d, isDatabaseWebhook as i, verifySharedSecret as l, databaseChange as n, signWebhook as o, hookError as r, stripeInboxVerify as s, authHook as t, verifyStripeWebhook as u };

package/dist/verify-DPuWngD4.d.ts

@@ -0,0 +1,172 @@
+/// <reference lib="esnext.temporal" />
+import { f as Result } from "./result-D7y2fT87.js";
+import { L as TableKey, M as Row, a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
+import { t as BetterSupabase } from "./define-CJJkkr1-.js";
+//#region src/blocks/webhooks/verify.d.ts
+interface VerifiedWebhook<T = unknown> {
+  readonly id: string;
+  readonly timestamp: Temporal.Instant;
+  readonly payload: T;
+  readonly body: string;
+}
+interface VerifyOptions {
+  /** Allowed clock skew in seconds. Defaults to 300. */
+  readonly tolerance?: number;
+  readonly now?: () => Temporal.Instant;
+}
+type WebhookInput = Request | {
+  readonly headers: Headers | Readonly<Record<string, string>>;
+  readonly body: string;
+};
+/** Constant-time string comparison. */
+declare function timingSafeEqual(a: string, b: string): boolean;
+/** Headers for a signed Standard Webhooks request. */
+declare function signWebhook(secret: string, message: {
+  readonly id: string;
+  readonly body: string;
+  readonly timestamp?: Temporal.Instant;
+}): Promise<Record<string, string>>;
+/**
+ * Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
+ * `webhook-signature`, or the `svix-` names Svix-based senders use) and
+ * parses the JSON body. Pass several secrets while rotating.
+ */
+declare function verifyWebhook<T = unknown>(input: WebhookInput, secrets: string | readonly string[], options?: VerifyOptions): Promise<Result<VerifiedWebhook<T>>>;
+/** Checks a shared-secret header (database webhooks), in constant time. */
+declare function verifySharedSecret(request: Request, secret: string, headerName?: string): boolean;
+/** The `Stripe-Signature` header for `body`, for tests and local replays. */
+declare function signStripeWebhook(secret: string, body: string, timestamp?: Temporal.Instant): Promise<string>;
+/**
+ * Verifies a `Stripe-Signature` header (`t=…,v1=…`) with the endpoint's
+ * `whsec_…` secret and parses the event. Pass several secrets while rolling
+ * the endpoint secret. Runs on WebCrypto, so it needs no `stripe` package.
+ */
+declare function verifyStripeWebhook<T = unknown>(input: WebhookInput, secrets: string | readonly string[], options?: VerifyOptions): Promise<Result<VerifiedWebhook<T>>>;
+/**
+ * `createWebhookInbox({ source: 'stripe', verify: stripeInboxVerify(secret) })`:
+ * stores Stripe events keyed by their event id.
+ */
+declare function stripeInboxVerify(secrets: string | readonly string[], options?: VerifyOptions): (request: Request, body: string) => Promise<Result<{
+  id: string;
+  payload: unknown;
+}>>;
+interface HookUser {
+  readonly id: string;
+  readonly email?: string;
+  readonly phone?: string;
+  readonly app_metadata?: Readonly<Record<string, unknown>>;
+  readonly user_metadata?: Readonly<Record<string, unknown>>;
+  readonly [key: string]: unknown;
+}
+interface AuthHookError {
+  readonly error: {
+    readonly http_code: number;
+    readonly message: string;
+  };
+}
+interface AuthHooks {
+  custom_access_token: {
+    input: {
+      readonly user_id: string;
+      readonly claims: Readonly<Record<string, unknown>> & {
+        readonly sub: string;
+        readonly role: string;
+      };
+      readonly authentication_method: string;
+    };
+    output: {
+      readonly claims: Readonly<Record<string, unknown>>;
+    };
+  };
+  send_email: {
+    input: {
+      readonly user: HookUser;
+      readonly email_data: {
+        readonly token: string;
+        readonly token_hash: string;
+        readonly redirect_to: string;
+        readonly email_action_type: string;
+        readonly site_url: string;
+        readonly token_new: string;
+        readonly token_hash_new: string;
+        /** Auth adds fields over time (`old_email`, `factor_type`, ...). */
+        readonly [key: string]: unknown;
+      };
+    };
+    output: Record<never, never>;
+  };
+  send_sms: {
+    input: {
+      readonly user: HookUser;
+      readonly sms: {
+        readonly otp: string;
+      };
+    };
+    output: Record<never, never>;
+  };
+  mfa_verification_attempt: {
+    input: {
+      readonly factor_id: string;
+      readonly factor_type: string;
+      readonly user_id: string;
+      readonly valid: boolean;
+    };
+    output: {
+      readonly decision: "continue" | "reject";
+      readonly message?: string;
+    };
+  };
+  password_verification_attempt: {
+    input: {
+      readonly user_id: string;
+      readonly valid: boolean;
+    };
+    output: {
+      readonly decision: "continue" | "reject";
+      readonly message?: string;
+      readonly should_logout_user?: boolean;
+    };
+  };
+  before_user_created: {
+    input: {
+      readonly metadata: Readonly<Record<string, unknown>>;
+      readonly user: HookUser;
+    };
+    output: Record<never, never>;
+  };
+}
+type AuthHookKind = keyof AuthHooks;
+/** Rejects a hook with a status and message Supabase Auth passes to the client. */
+declare function hookError(status: number, message: string): AuthHookError;
+/**
+ * A `(request) => Response` handler for a Supabase Auth hook: verifies the
+ * Standard Webhooks signature, types the payload and serializes the answer.
+ *
+ * ```ts
+ * export const POST = authHook('custom_access_token', env.AUTH_HOOK_SECRET, async ({ claims, user_id }) => ({
+ *   claims: { ...claims, tenant_id: await organizationFor(user_id) },
+ * }));
+ * ```
+ */
+declare function authHook<K extends AuthHookKind>(_kind: K, secret: string | readonly string[], handler: (payload: AuthHooks[K]["input"], webhook: VerifiedWebhook<AuthHooks[K]["input"]>) => AuthHooks[K]["output"] | AuthHookError | Promise<AuthHooks[K]["output"] | AuthHookError>, options?: VerifyOptions): (request: Request) => Promise<Response>;
+interface DatabaseWebhookPayload {
+  readonly type: "INSERT" | "UPDATE" | "DELETE";
+  readonly table: string;
+  readonly schema: string;
+  readonly record: Readonly<Record<string, unknown>> | null;
+  readonly old_record: Readonly<Record<string, unknown>> | null;
+}
+interface DatabaseChange<R> {
+  readonly type: "INSERT" | "UPDATE" | "DELETE";
+  readonly table: string;
+  readonly record: R | null;
+  readonly oldRecord: Partial<R> | null;
+}
+declare function isDatabaseWebhook(value: unknown): value is DatabaseWebhookPayload;
+/**
+ * Reads a database webhook payload for `table` as an app-cased change.
+ * Returns `null` for other tables or payloads that aren't database webhooks.
+ */
+declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(betterSupabase: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
+//#endregion
+export { verifySharedSecret as _, DatabaseWebhookPayload as a, WebhookInput as c, hookError as d, isDatabaseWebhook as f, timingSafeEqual as g, stripeInboxVerify as h, DatabaseChange as i, authHook as l, signWebhook as m, AuthHookKind as n, VerifiedWebhook as o, signStripeWebhook as p, AuthHooks as r, VerifyOptions as s, AuthHookError as t, databaseChange as u, verifyStripeWebhook as v, verifyWebhook as y };

package/dist/{version-DOYTYwHP.js → version-Bvv6aLjZ.js}

@@ -1,4 +1,4 @@
 //#region src/core/version.ts
-const VERSION = "0.5.1";
+const VERSION = "0.6.0";
 //#endregion
 export { VERSION as t };

package/dist/view-BeFcRV6G.js

@@ -0,0 +1,99 @@
+import { n as dbError } from "./errors-B11Duf73.js";
+import { a as actorOf, o as delegationOf, r as impersonatorOf } from "./impersonation-DcqaTBHx.js";
+//#region src/auth/mfa.ts
+/** The session's assurance level from its claims; anything but `aal2` reads as `aal1`. */
+function aalOf(claims) {
+	return claims["aal"] === "aal2" ? "aal2" : "aal1";
+}
+/** The `amr` claim as typed entries, skipping malformed ones. */
+function amrOf(claims) {
+	const amr = claims["amr"];
+	if (!Array.isArray(amr)) return [];
+	return amr.flatMap((entry) => {
+		if (typeof entry !== "object" || entry === null) return [];
+		const { method, timestamp, provider } = entry;
+		if (typeof method !== "string" || typeof timestamp !== "number") return [];
+		return [typeof provider === "string" ? {
+			method,
+			timestamp,
+			provider
+		} : {
+			method,
+			timestamp
+		}];
+	});
+}
+/**
+* `undefined` when a user session meets `required`; otherwise a `forbidden`
+* error with `required` and code `INSUFFICIENT_AAL`, for the client to start
+* an MFA challenge. Non-user sessions pass: `allow` decides about them.
+*/
+function checkAal(auth, required) {
+	if (required === "aal1" || auth.kind !== "user" || !("claims" in auth)) return void 0;
+	if (aalOf(auth.claims) === "aal2") return void 0;
+	return dbError("forbidden", "Verify a second factor to continue", {
+		code: "INSUFFICIENT_AAL",
+		required
+	});
+}
+//#endregion
+//#region src/auth/view.ts
+/** Whether the token belongs to an anonymous user (`signInAnonymously()`). */
+function isAnonymousUser(claims) {
+	return "is_anonymous" in claims && claims.is_anonymous === true;
+}
+/** Drops the token from an `AuthState`, leaving only serializable fields. */
+function toSession(auth) {
+	switch (auth.kind) {
+		case "user": {
+			const impersonator = impersonatorOf(auth.claims);
+			const outcome = actorOf(auth.claims);
+			const actor = outcome.ok ? outcome.actor : void 0;
+			const client = actor?.kind === "oauth-client" ? actor : void 0;
+			const scopes = client ? delegationOf(auth.claims)?.scopes : void 0;
+			const delegation = client && (scopes || client.chain) ? {
+				scopes: scopes ?? [],
+				...client.chain ? { chain: client.chain } : {}
+			} : void 0;
+			return {
+				kind: "user",
+				user: auth.user,
+				claims: auth.claims,
+				expiresAt: auth.expiresAt,
+				...auth.profile === void 0 ? {} : { profile: auth.profile },
+				aal: aalOf(auth.claims),
+				anonymous: isAnonymousUser(auth.claims),
+				amr: amrOf(auth.claims),
+				...impersonator ? { impersonator } : {},
+				...actor ? { actor } : {},
+				...delegation ? { delegation } : {}
+			};
+		}
+		case "service": return {
+			kind: "service",
+			keyName: auth.keyName
+		};
+		case "apiKey": return {
+			kind: "apiKey",
+			keyId: auth.keyId,
+			name: auth.name,
+			...auth.organizationId ? { organizationId: auth.organizationId } : {},
+			...auth.userId ? { userId: auth.userId } : {},
+			scopes: auth.scopes,
+			...auth.createdAt ? { createdAt: Math.floor(auth.createdAt.epochMilliseconds / 1e3) } : {},
+			...auth.createdBy ? { createdBy: auth.createdBy } : {}
+		};
+		case "anon": return {
+			kind: "anon",
+			reason: auth.reason
+		};
+		case "invalid": return {
+			kind: "invalid",
+			reason: auth.reason,
+			error: auth.error
+		};
+		default: return auth;
+	}
+}
+//#endregion
+export { checkAal as a, amrOf as i, toSession as n, aalOf as r, isAnonymousUser as t };

package/dist/{view-CbgObAeb.d.ts → view-DbxLNu8L.d.ts}

@@ -1,7 +1,7 @@
-import { _ as DbError } from "./executor-BunPOO-k.js";
-import { n as Impersonator, o as AuthState, s as InvalidReason } from "./impersonation-BmePsuxz.js";
-import { n as AmrEntry, t as Aal } from "./mfa-Cu96oJdw.js";
-import { n as SessionActor, r as SessionDelegation } from "./actor-DaJjqD5R.js";
+import { b as DbError } from "./result-D7y2fT87.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-KW8nCeL6.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-Daak8ukG.js";
+import { n as SessionActor, r as SessionDelegation } from "./actor-CQTlc1Hh.js";
 import { JWTClaims, UserClaims } from "@supabase/server";
 //#region src/auth/view.d.ts
 /**
@@ -10,6 +10,12 @@ import { JWTClaims, UserClaims } from "@supabase/server";
  */
 type AuthSession<C = unknown, P = unknown> = {
   readonly kind: "user";
+  /**
+   * Read from the verified claims (`sub`, `email`, `role`,
+   * `app_metadata`, `user_metadata`), never from the user object in the
+   * cookie, so it is the same with `tokens-only` cookies. Call
+   * `auth.getUser()` when a flow must see a revoked or changed user.
+   */
   readonly user: UserClaims;
   /**
    * The verified JWT payload, including custom access token hook claims,
@@ -42,7 +48,7 @@ type AuthSession<C = unknown, P = unknown> = {
   /**
    * Who acts for the user: an OAuth client or agent (`client_id`, or an
    * `act` chain without `kind`), a support session or an impersonated
-   * session, as PermDock's `actorOf` reads it.
+   * session, read from the `act` and `client_id` claims.
    */
   readonly actor?: SessionActor;
   /**
@@ -53,6 +59,17 @@ type AuthSession<C = unknown, P = unknown> = {
 } | {
   readonly kind: "service";
   readonly keyName: string;
+} | {
+  readonly kind: "apiKey";
+  readonly keyId: string;
+  readonly name: string;
+  readonly organizationId?: string;
+  readonly userId?: string;
+  readonly scopes: readonly string[];
+  /** Seconds since epoch, when the key was created. */
+  readonly createdAt?: number;
+  /** The user who created the key. */
+  readonly createdBy?: string;
 } | {
   readonly kind: "anon";
   readonly reason: AnonReason;