better-supabase 0.5.1 → 0.6.0

package/dist/adapter-Bc1o3zyy.js

@@ -0,0 +1,1106 @@
+import { c as mapDbError, n as dbError, o as isDbError } from "./errors-B11Duf73.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-DzUbqgdW.js";
+import { a as postgrestExecutor, n as StatsRecorder } from "./stats-D_AD9GGu.js";
+import { a as problemResponse } from "./problem-BreOl8b8.js";
+import { loadEnv } from "./env/index.js";
+import { a as actorOf, i as userContext, n as impersonatorClaim, t as actClaim } from "./impersonation-DcqaTBHx.js";
+import { t as fromPgError } from "./executor-De1Of3m3.js";
+import { n as forwardBlockEvents } from "./cloud-event-BnmD5fb9.js";
+import { a as replicaState, i as primaryCookieWrite, o as routedExecutor, r as pinnedUntil, s as withPrimaryPin } from "./replicas-CwrYp5Zj.js";
+import { c as AUTH_CACHE_HEADERS, d as clearSessionAtScopes, f as parseCookies, h as sessionCookieName, i as resolveAuth, m as serializeCookie, r as prefetchJwks, t as authContext } from "./resolve-D_IcnvFd.js";
+import { t as credentialProviderOf } from "./provider-Di3sRutW.js";
+import { a as respond, n as defaultPrefetchJwks, r as guard, t as defaultExpose } from "./respond-BUgsXNgk.js";
+import { createClient } from "@supabase/supabase-js";
+import { defineMiddleware, getEnv, pipeline, seedContext } from "@supabase/middleware";
+import { PostgrestClient } from "@supabase/postgrest-js";
+//#region src/server/delete-account.ts
+const REMOVE_BATCH = 1e3;
+/** Maps an `AuthApiError` from `auth.admin.deleteUser` to a `DbError`. */
+function fromAuthError(raw) {
+	if (isDbError(raw)) return raw;
+	const failure = typeof raw === "object" && raw !== null ? raw : {};
+	const message = failure.message ?? "Auth request failed";
+	const base = {
+		table: "auth.users",
+		...failure.code ? { code: failure.code } : {}
+	};
+	if (failure.code === "user_not_found" || failure.status === 404) return dbError("not_found", message, base);
+	if (/database error deleting user/i.test(message)) return dbError("conflict", message, {
+		...base,
+		hint: "A foreign key to auth.users without on delete cascade or set null blocks the delete (doctor BS406)"
+	});
+	if (failure.status === 401) return dbError("unauthorized", message, base);
+	if (failure.status === 403) return dbError("forbidden", message, base);
+	return failure.name === "AuthRetryableFetchError" || (failure.status ?? 0) >= 500 ? dbError("network", message, base) : dbError("unexpected", message, base);
+}
+const UUID$1 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const PROBE = "better_supabase.delete_account_probe";
+/**
+* The database error that refuses deleting `userId`, from the delete and its
+* deferred checks run in a `do` block that always fails, so nothing is
+* deleted. Undefined when the delete itself would pass.
+*/
+async function databaseRefusal(sql, userId) {
+	if (!UUID$1.test(userId)) return void 0;
+	try {
+		await sql.queryRaw(`do $$
+begin
+  delete from auth.users where id = '${userId}';
+  set constraints all immediate;
+  raise exception '${PROBE}';
+end;
+$$`);
+	} catch (cause) {
+		const raw = isDbError(cause) ? void 0 : fromPgError(cause);
+		const error = isDbError(cause) ? cause : raw && mapDbError(raw);
+		if (!error || error.message === PROBE) return void 0;
+		return {
+			...error,
+			table: "auth.users"
+		};
+	}
+}
+/**
+* Deletes the Auth user, then removes their Storage objects, then announces
+* the delete. Rows referencing `auth.users` follow their foreign keys. The
+* objects are listed first and removed only once the user is gone, so a
+* delete the database refuses leaves them in place.
+*
+* `server.deleteAccount` calls it with the server's service client. Apps on
+* the `@supabase/server` pipeline call it with theirs:
+* `deleteAccount(betterSupabase, ctx.supabaseAdmin, userId)`.
+*/
+function deleteAccount(betterSupabase, service, userId, options = {}) {
+	return AsyncResult.from(async () => {
+		const client = typeof service === "function" ? service() : service;
+		const listedPaths = [];
+		for (const bucket of options.buckets ?? []) {
+			const param = bucket.owner;
+			if (!param) continue;
+			options.signal?.throwIfAborted();
+			const listed = await bucket.connect(client, { allTenants: true }).list({ [param]: userId }, options.signal ? { signal: options.signal } : {});
+			if (!listed.ok) return listed;
+			listedPaths.push([bucket, listed.data.map((object) => object.path).filter((path) => {
+				return bucket.match(path)?.[param] === userId;
+			})]);
+		}
+		options.signal?.throwIfAborted();
+		try {
+			const { error } = await client.auth.admin.deleteUser(userId);
+			if (error) {
+				const failure = fromAuthError(error);
+				const refusal = options.sql && (failure.kind === "conflict" || failure.kind === "network" || failure.kind === "unexpected") ? await databaseRefusal(options.sql, userId) : void 0;
+				return err(refusal ?? failure);
+			}
+		} catch (cause) {
+			return err(fromAuthError(cause));
+		}
+		const removed = {};
+		for (const [bucket, paths] of listedPaths) {
+			const storage = bucket.connect(client, { allTenants: true });
+			for (let start = 0; start < paths.length; start += REMOVE_BATCH) {
+				const batch = await storage.remove(paths.slice(start, start + REMOVE_BATCH));
+				if (!batch.ok) return batch;
+			}
+			removed[bucket.id] = paths.length;
+		}
+		const context = options.context ?? {};
+		betterSupabase.events.emit("mutation", {
+			table: "auth.users",
+			kind: "delete",
+			rows: [{ id: userId }],
+			context
+		});
+		for (const table of options.cascades ?? []) betterSupabase.events.emit("mutation", {
+			table,
+			kind: "delete",
+			rows: [],
+			context
+		});
+		return ok({
+			userId,
+			removed
+		});
+	});
+}
+//#endregion
+//#region src/server/suspend-account.ts
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const FOREVER = "876000h";
+const END_SESSIONS = `with ended as (
+  delete from auth.sessions where user_id = $1::uuid returning id
+), tokens as (
+  delete from auth.refresh_tokens where user_id = $1::text
+)
+select count(*)::int as ended from ended`;
+function invalidUser(userId) {
+	return dbError("invalid_request", `"${userId}" is not a user id`, { table: "auth.users" });
+}
+function fromSqlError(cause) {
+	if (isDbError(cause)) return cause;
+	const raw = fromPgError(cause);
+	if (raw) return {
+		...mapDbError(raw),
+		table: "auth.sessions"
+	};
+	return dbError("unexpected", cause instanceof Error ? cause.message : "Ending the sessions failed", { table: "auth.sessions" });
+}
+async function deleteSessions(sql, userId) {
+	const [row] = await sql.queryRaw(END_SESSIONS, [userId]);
+	return row?.ended ?? 0;
+}
+function endSessions(sql, userId) {
+	return AsyncResult.from(async () => {
+		if (!UUID.test(userId)) return err(invalidUser(userId));
+		try {
+			return ok({
+				userId,
+				ended: await deleteSessions(sql, userId)
+			});
+		} catch (cause) {
+			return err(fromSqlError(cause));
+		}
+	});
+}
+async function ban(client, userId, duration) {
+	try {
+		const { error } = await client.auth.admin.updateUserById(userId, { ban_duration: duration });
+		return error ? fromAuthError(error) : void 0;
+	} catch (cause) {
+		return fromAuthError(cause);
+	}
+}
+function suspendAccount(service, sql, userId, options) {
+	return AsyncResult.from(async () => {
+		if (!UUID.test(userId)) return err(invalidUser(userId));
+		const client = typeof service === "function" ? service() : service;
+		const { suspended } = options;
+		if (suspended) {
+			const refused = await ban(client, userId, options.duration ?? FOREVER);
+			if (refused) return err(refused);
+		}
+		let ended;
+		try {
+			ended = await deleteSessions(sql, userId);
+		} catch (cause) {
+			return err(fromSqlError(cause));
+		}
+		if (!suspended) {
+			const refused = await ban(client, userId, "none");
+			if (refused) return err(refused);
+		}
+		return ok({
+			userId,
+			suspended,
+			ended
+		});
+	});
+}
+//#endregion
+//#region src/server/audit.ts
+/** The CloudEvents `source` of the events the server sends to its `audit` sink. */
+const SERVER_EVENT_SOURCE = "/better-supabase/server";
+const OFF = { account: () => void 0 };
+/**
+* The server's audit trail: account actions are sent to `sink` as CloudEvents
+* typed `dev.better-supabase.account.*` with subject `users/<id>`, and
+* `support.denied` block events are forwarded to it.
+*/
+function serverAudit(betterSupabase, sink) {
+	if (sink === void 0) return OFF;
+	const { events } = betterSupabase;
+	forwardBlockEvents(betterSupabase, sink, {
+		source: SERVER_EVENT_SOURCE,
+		types: ["support.denied"]
+	});
+	const report = (cause) => {
+		events.logger.error("audit sink failed", { cause });
+	};
+	return { account(type, userId, data) {
+		const event = {
+			specversion: "1.0",
+			id: crypto.randomUUID(),
+			source: SERVER_EVENT_SOURCE,
+			type: `dev.better-supabase.${type}`,
+			subject: `users/${userId}`,
+			time: (/* @__PURE__ */ new Date()).toISOString(),
+			datacontenttype: "application/json",
+			data: {
+				userId,
+				...data
+			}
+		};
+		try {
+			events.track(Promise.resolve(sink.send([event])).catch(report));
+		} catch (cause) {
+			report(cause);
+		}
+	} };
+}
+//#endregion
+//#region src/server/entries/core.ts
+const cores = /* @__PURE__ */ new WeakMap();
+/** Records the core behind `server`, so `serverCore` finds it on copies too. */
+function registerCore(server, core) {
+	cores.set(server, core);
+}
+/** Copies the registration from `from` to `to` (`extendServer` builds a new object). */
+function shareCore(from, to) {
+	const core = cores.get(from);
+	if (core) cores.set(to, core);
+}
+/** The core of a server built by `createServer` or one of the adapter factories. */
+function serverCore(server) {
+	const core = cores.get(server);
+	if (!core) throw new TypeError("better-supabase: this server was not built by createServer(); pass the definition or a server from createServer");
+	return core;
+}
+const CALL = Symbol("better-supabase.call");
+const supportLookups = /* @__PURE__ */ new WeakMap();
+/**
+* Starts the support lookup for a signed-in caller, so `withTenant` can run
+* the tenant resolver while the support store answers. Other callers never
+* have a support session, so they skip it.
+*/
+function startSupportLookup(core, request, session) {
+	if (session.auth.kind !== "user" || supportLookups.has(session)) return;
+	const lookup = core.support(request, session.auth);
+	lookup.catch(() => void 0);
+	supportLookups.set(session, lookup);
+}
+/** The support session of a resolved request: the started lookup, else a new one. */
+function supportLookup(core, request, session) {
+	return supportLookups.get(session) ?? core.support(request, session.auth);
+}
+/** The call state on a context seeded by `server.context()`, if any. */
+function callOf(ctx) {
+	return ctx[CALL];
+}
+//#endregion
+//#region src/server/entries/context.ts
+/**
+* Entry contributing `ctx.bs`, the request's `ServerContext`: `auth`, `db`,
+* `sql`, `supabase`, `replica`, `stats()` and the rest, each built on first
+* read. In a support session `auth`, `db` and `sql` are the target's.
+*/
+function withServerContext(core) {
+	return defineMiddleware({
+		key: "bs",
+		run: () => (request, ctx) => {
+			const options = callOf(ctx)?.options ?? {};
+			const bs = core.context(ctx.session, request, ctx.support ? {
+				...options,
+				support: ctx.support
+			} : options, ctx.tenant);
+			return Promise.resolve({ bs });
+		}
+	})();
+}
+//#endregion
+//#region src/server/refresh.ts
+/** A router or browser prefetch, by its request headers. */
+function isPrefetch(request) {
+	const h = request.headers;
+	return h.has("next-router-prefetch") || h.get("purpose") === "prefetch" || (h.get("sec-purpose")?.includes("prefetch") ?? false);
+}
+const FORM_TYPES = ["application/x-www-form-urlencoded", "multipart/form-data"];
+/**
+* Whether a request should refresh an expired session cookie: page loads,
+* client navigations (`rsc`, `x-sveltekit-*`, `_data` loaders), form posts
+* and Server Actions. Prefetches, assets and `fetch` calls from scripts
+* read the session as it is, so a burst of parallel requests never races
+* on the single-use refresh token.
+*/
+function shouldRefresh(request) {
+	const h = request.headers;
+	if (request.method !== "GET" && request.method !== "HEAD") {
+		if (h.has("next-action") || h.has("x-sveltekit-action")) return true;
+		if (h.get("sec-fetch-dest") === "document") return true;
+		const type = h.get("content-type") ?? "";
+		return FORM_TYPES.some((form) => type.startsWith(form));
+	}
+	if (isPrefetch(request)) return false;
+	if (h.get("rsc") === "1") return true;
+	const dest = h.get("sec-fetch-dest");
+	if (dest) return dest === "document";
+	return h.get("accept")?.includes("text/html") ?? false;
+}
+/**
+* Whether a request should ask the Auth server if the session still exists
+* (`checkSession`): full page loads, and `paths` you list for client
+* navigations. Never prefetches or mutations.
+*/
+function shouldCheckSession(request, paths) {
+	if (request.method !== "GET" && request.method !== "HEAD") return false;
+	if (isPrefetch(request)) return false;
+	if (request.headers.get("sec-fetch-dest") === "document") return true;
+	return paths?.includes(new URL(request.url).pathname) ?? false;
+}
+/** `policy` for one request. */
+function refreshFor(policy, request) {
+	if (policy === void 0 || typeof policy === "boolean") return policy;
+	return policy === "navigation" ? shouldRefresh(request) : policy(request);
+}
+//#endregion
+//#region src/server/entries/session.ts
+function checkFor(policy, request) {
+	if (policy === void 0 || typeof policy === "boolean") return policy ?? false;
+	return policy === "navigation" ? shouldCheckSession(request) : policy(request);
+}
+/** Appends `Max-Age=0` writes for the session cookie at the old scopes, and the no-store headers. */
+function clearOldScopes(response, request, name, scopes) {
+	const writes = clearSessionAtScopes(parseCookies(request.headers.get("cookie")), name, scopes);
+	if (writes.length === 0) return response;
+	const headers = new Headers(response.headers);
+	for (const write of writes) headers.append("set-cookie", serializeCookie(write));
+	for (const [key, value] of Object.entries(AUTH_CACHE_HEADERS)) headers.set(key, value);
+	return new Response(response.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers
+	});
+}
+/**
+* Entry contributing `ctx.session`, the request's `AuthResolution`: a bearer
+* token first, the session cookie second. It is the only entry with a
+* response seam for cookies: on the way out it adds the refreshed session
+* cookies and the no-store headers, and hands pending event sends to
+* `waitUntil`.
+*/
+function withSession(core, config = {}) {
+	return defineMiddleware({
+		key: "session",
+		run: () => async function* (request, ctx) {
+			const call = callOf(ctx)?.options;
+			const refresh = call ? call.refresh ?? false : refreshFor(config.refresh, request);
+			const cookies = call ? call.cookies : config.cookies;
+			const checkSession = !call && checkFor(config.checkSession, request);
+			const session = await core.resolve(request, {
+				...refresh === void 0 ? {} : { refresh },
+				...cookies === void 0 ? {} : { cookies },
+				...checkSession ? { checkSession } : {},
+				...config.encode === void 0 ? {} : { encode: config.encode }
+			});
+			try {
+				const response = yield { session };
+				const applied = session.apply(response);
+				return config.cookieScopes?.length ? clearOldScopes(applied, request, core.sessionCookie(), config.cookieScopes) : applied;
+			} finally {
+				if (config.waitUntil && core.events.pending) config.waitUntil(core.events.settled());
+			}
+		}
+	})();
+}
+//#endregion
+//#region src/server/entries/support.ts
+/**
+* Entry contributing `ctx.support`: the support session ("view as user") the
+* request's support cookie names, when `ServerOptions.support` is set and
+* the caller is the admin who started it. `undefined` otherwise.
+*/
+function withSupport(core) {
+	return defineMiddleware({
+		key: "support",
+		run: () => async (request, ctx) => {
+			return { support: callOf(ctx)?.options.support ?? await supportLookup(core, request, ctx.session) };
+		}
+	})();
+}
+//#endregion
+//#region src/server/entries/tenant.ts
+/**
+* Entry contributing `ctx.tenant`: the active tenant from
+* `ServerOptions.tenant` (a URL slug, a header), or `undefined`. It becomes
+* `context.tenant` for the `tenant()` plugin, the `better_supabase.tenant`
+* setting over Postgres and the `x-bs-tenant` header over PostgREST. It
+* starts the support lookup that `withSupport` awaits, so both run at once.
+*/
+function withTenant(core) {
+	return defineMiddleware({
+		key: "tenant",
+		run: () => async (request, ctx) => {
+			const options = callOf(ctx)?.options;
+			if (options?.support === void 0) startSupportLookup(core, request, ctx.session);
+			return { tenant: options?.tenant ?? await core.tenant(request, ctx.session.auth) };
+		}
+	})();
+}
+//#endregion
+//#region src/auth/support-cookie.ts
+/** The cookie that carries the support session id. */
+const SUPPORT_COOKIE = "bs-support";
+/** Seconds until the session expires, rounded up so the cookie never outlives it by less than a second. */
+function supportCookieMaxAge(session, now = Date.now()) {
+	return Math.max(0, Math.ceil((session.expiresAt.epochMilliseconds - now) / 1e3));
+}
+/** `Set-Cookie` for a session: HttpOnly, SameSite=Lax, gone when the session expires. */
+function supportCookie(session, options = {}, now = Date.now()) {
+	return cookieLine(options, encodeURIComponent(session.id), supportCookieMaxAge(session, now));
+}
+/** `Set-Cookie` that removes the support cookie. */
+function clearSupportCookie(options = {}) {
+	return cookieLine(options, "", 0);
+}
+function cookieLine(options, value, maxAge) {
+	return [
+		`${options.name ?? "bs-support"}=${value}`,
+		`Path=${options.path ?? "/"}`,
+		`Max-Age=${String(maxAge)}`,
+		"HttpOnly",
+		"SameSite=Lax",
+		...options.secure === false ? [] : ["Secure"]
+	].join("; ");
+}
+/** The support session id in a `Cookie` header, or `undefined`. */
+function supportCookieValue(cookieHeader, name = SUPPORT_COOKIE) {
+	if (!cookieHeader) return void 0;
+	for (const part of cookieHeader.split(";")) {
+		const index = part.indexOf("=");
+		if (index === -1 || part.slice(0, index).trim() !== name) continue;
+		let value;
+		try {
+			value = decodeURIComponent(part.slice(index + 1).trim());
+		} catch {
+			return;
+		}
+		return value === "" ? void 0 : value;
+	}
+}
+//#endregion
+//#region src/server/support-off.ts
+const NOT_CONFIGURED = "Support sessions need createServer(betterSupabase, { support: supportSessions({ store }) })";
+const notConfigured = () => AsyncResult.err(dbError("unexpected", NOT_CONFIGURED));
+/** `bs.support` without `ServerOptions.support`: every call fails. */
+const supportOff = {
+	start: notConfigured,
+	stop: notConfigured,
+	revoke: notConfigured,
+	current: () => Promise.resolve(void 0),
+	list: notConfigured,
+	sessionIdOf: () => void 0,
+	clearCookie: () => clearSupportCookie()
+};
+//#endregion
+//#region src/server/server.ts
+/** The header `current_tenant_id()` reads over the Data API. */
+const TENANT_HEADER = "x-bs-tenant";
+/** The environment as `getEnv` resolves it, one variable at a time. */
+const RUNTIME_ENV = new Proxy({}, { get: (_target, key) => typeof key === "string" ? getEnv(key) : void 0 });
+const needsPostgres = (method) => dbError("invalid_request", `${method} needs createServer(betterSupabase, { postgres: createPostgres() })`);
+const STATELESS = {
+	persistSession: false,
+	autoRefreshToken: false,
+	detectSessionInUrl: false
+};
+/**
+* A framework adapter's server: `server` plus the adapter's own methods,
+* without reading the lazy `env` getter. `extra` can't replace a
+* `BetterServer` method.
+*/
+function extendServer(server, extra) {
+	const extended = Object.defineProperties({}, {
+		...Object.getOwnPropertyDescriptors(server),
+		...Object.getOwnPropertyDescriptors(extra)
+	});
+	shareCore(server, extended);
+	return extended;
+}
+/** `{ ...base, ...extra }` that keeps lazy getters lazy. */
+function withExtra(base, extra) {
+	return Object.defineProperties({}, {
+		...Object.getOwnPropertyDescriptors(base),
+		...Object.getOwnPropertyDescriptors(extra)
+	});
+}
+/**
+* Server-side entry point for APIs, jobs, MCP servers and framework
+* adapters. Holds the secrets; `betterSupabase` stays isomorphic.
+*/
+function createServer(betterSupabase, options = {}) {
+	const credentials = options.credentials === void 0 ? {} : { credentials: credentialProviderOf(options.credentials) };
+	let loaded;
+	const env = () => loaded ??= options.env ?? loadEnv(RUNTIME_ENV);
+	let adminClient;
+	let anonClient;
+	if ((options.prefetchJwks ?? defaultPrefetchJwks()) && options.auth?.jwks === void 0) try {
+		prefetchJwks({
+			...options.auth,
+			env: env()
+		});
+	} catch {}
+	const secretKey = () => {
+		const key = env().secretKey;
+		if (!key) throw new TypeError("admin() needs SUPABASE_SECRET_KEY; it is not set");
+		return key;
+	};
+	const customFetch = options.fetch ? { fetch: options.fetch } : void 0;
+	const definitionExecutor = betterSupabase.executorOptions();
+	const urlLengthLimit = options.db?.urlLengthLimit ?? definitionExecutor.urlLengthLimit;
+	const db = {
+		...options.db?.timeout === void 0 ? {} : { timeout: options.db.timeout },
+		...options.db?.retry === void 0 ? {} : { retry: options.db.retry },
+		...urlLengthLimit === void 0 ? {} : { urlLengthLimit }
+	};
+	const dbOptions = Object.keys(db).length > 0 ? { db } : {};
+	const sharedGlobal = {
+		...customFetch ? { global: customFetch } : {},
+		...dbOptions
+	};
+	/** postgrest-js options a bare `PostgrestClient` takes; `timeout` is the executor's. */
+	const restOptions = {
+		...db.retry === void 0 ? {} : { retry: db.retry },
+		...urlLengthLimit === void 0 ? {} : { urlLengthLimit }
+	};
+	const executorOptions = {
+		...definitionExecutor,
+		...urlLengthLimit === void 0 ? {} : { urlLengthLimit },
+		...db.timeout === void 0 ? {} : { timeout: db.timeout },
+		...db.retry === void 0 ? {} : { retry: db.retry }
+	};
+	/** Set when `db` options need an executor built with them. */
+	const tunedExecutor = options.db !== void 0;
+	const serviceClient = () => {
+		adminClient ??= createClient(env().url, secretKey(), {
+			auth: STATELESS,
+			...sharedGlobal
+		});
+		return adminClient;
+	};
+	const readUrl = () => options.readUrl === false ? void 0 : options.readUrl?.replace(/\/+$/, "") ?? env().readUrl;
+	const apiKeyClient = () => {
+		throw new TypeError("ctx.supabase and ctx.db.$client are not available for an API key: ctx.db and ctx.sql run over direct Postgres with the key's claims");
+	};
+	/** Clients for the primary share the service and anon clients; others don't. */
+	const supabaseAt = (url, auth, headers = {}) => {
+		const custom = Object.keys(headers).length > 0;
+		const global = custom ? {
+			global: {
+				headers,
+				...customFetch
+			},
+			...dbOptions
+		} : sharedGlobal;
+		const shared = !custom && url === env().url;
+		switch (auth.kind) {
+			case "user": return createClient(url, env().publishableKey, {
+				accessToken: () => Promise.resolve(auth.token),
+				...global
+			});
+			case "service": return shared ? serviceClient() : createClient(url, secretKey(), {
+				auth: STATELESS,
+				...global
+			});
+			case "anon":
+			case "invalid":
+				if (!shared) return createClient(url, env().publishableKey, {
+					auth: STATELESS,
+					...global
+				});
+				anonClient ??= createClient(url, env().publishableKey, {
+					auth: STATELESS,
+					...sharedGlobal
+				});
+				return anonClient;
+			case "apiKey": return apiKeyClient();
+			default: return auth;
+		}
+	};
+	const supabaseFor = (auth, headers = {}) => supabaseAt(env().url, auth, headers);
+	const restUrls = /* @__PURE__ */ new Map();
+	const restUrl = (url) => {
+		let rest = restUrls.get(url);
+		if (rest === void 0) {
+			rest = new URL("rest/v1", url.endsWith("/") ? url : `${url}/`).href;
+			restUrls.set(url, rest);
+		}
+		return rest;
+	};
+	/**
+	* The client queries run on. Requests need only PostgREST, so they skip
+	* building Realtime, Storage and Auth clients per request; the shared
+	* service and anon clients for the primary are built once anyway.
+	*/
+	const restAt = (url, auth, headers = {}) => {
+		let key;
+		let bearer;
+		switch (auth.kind) {
+			case "user":
+				key = env().publishableKey;
+				bearer = auth.token;
+				break;
+			case "service":
+			case "anon":
+			case "invalid":
+				if (Object.keys(headers).length === 0 && url === env().url) return supabaseAt(url, auth, headers);
+				key = auth.kind === "service" ? secretKey() : env().publishableKey;
+				bearer = key;
+				break;
+			case "apiKey": return apiKeyClient();
+			default: return auth;
+		}
+		return new PostgrestClient(restUrl(url), {
+			headers: {
+				...headers,
+				apikey: key,
+				Authorization: `Bearer ${bearer}`
+			},
+			...customFetch,
+			...restOptions
+		});
+	};
+	/** `$client` stays the full Supabase client, built when first read. */
+	const withLazyClient = (db, client) => Object.defineProperty(db, "$client", {
+		get: client,
+		enumerable: true,
+		configurable: true
+	});
+	const dbFor = (auth, context = {}) => {
+		let supabase;
+		const rest = restAt(env().url, auth);
+		const db = betterSupabase.connect(rest, {
+			...authContext(auth),
+			...context
+		}, tunedExecutor ? { executor: postgrestExecutor(rest, executorOptions) } : {});
+		return withLazyClient(db, () => supabase ??= supabaseFor(auth));
+	};
+	const sqlFor = (claims, context, stats, session) => {
+		if (!options.postgres) throw new TypeError("Direct Postgres access needs createServer(betterSupabase, { postgres: createPostgres() })");
+		return betterSupabase.connect(session ? options.postgres.executorFor(claims, session) : options.postgres.executorFor(claims), context, stats ? { stats } : {});
+	};
+	/** `ServerOptions.tenant` outside `context()`, where it can't be awaited. */
+	const syncTenant = (request, auth) => {
+		const tenant = options.tenant?.(request, auth);
+		if (tenant !== void 0 && typeof tenant !== "string") throw new TypeError("ServerOptions.tenant returned a promise: use context(request), or pass { tenant } to contextFromResolution");
+		return tenant;
+	};
+	const pinMs = options.replicas?.pinMs ?? 5e3;
+	if (options.support && !options.postgres) throw new TypeError("Support sessions need createServer(betterSupabase, { postgres: createPostgres(), support })");
+	const audit = serverAudit(betterSupabase, options.audit);
+	const support = options.support ? options.support.create(betterSupabase.events, options.auth?.claims ?? betterSupabase.claimsSchema) : supportOff;
+	/**
+	* The target's context in a support session. Queries run over direct
+	* Postgres with the target's claims plus `act`, read-only unless the
+	* session allows writes; nothing reaches Supabase with the admin's token.
+	*/
+	const supportContextFor = (resolution, active, parent, tenant) => {
+		const { session, claims } = active;
+		const record = (key) => {
+			const value = claims[key];
+			return typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : void 0;
+		};
+		const appMetadata = record("app_metadata");
+		const userMetadata = record("user_metadata");
+		const user = {
+			id: session.targetUserId,
+			role: typeof claims["role"] === "string" ? claims["role"] : "authenticated",
+			...typeof claims["email"] === "string" ? { email: claims["email"] } : {},
+			...appMetadata ? { appMetadata } : {},
+			...userMetadata ? { userMetadata } : {}
+		};
+		const auth = {
+			kind: "user",
+			token: "",
+			claims,
+			user,
+			source: "support",
+			expiresAt: Math.floor(session.expiresAt.epochMilliseconds / 1e3)
+		};
+		const scope = tenant ?? session.tenant;
+		const base = userContext(user, claims);
+		const context = scope === void 0 ? base : {
+			...base,
+			tenant: scope
+		};
+		const sessionOptions = {
+			...session.readOnly ? { readOnly: true } : {},
+			...scope === void 0 ? {} : { settings: { "better_supabase.tenant": scope } }
+		};
+		const recorder = new StatsRecorder(parent);
+		const sqlClaims = claims;
+		const unavailable = () => {
+			throw new TypeError("ctx.supabase and ctx.db.$client are not available in a support session; ctx.db and ctx.sql run as the target");
+		};
+		let db;
+		let sql;
+		return {
+			...credentials,
+			auth,
+			resolution,
+			support: active,
+			get supabase() {
+				return unavailable();
+			},
+			get db() {
+				db ??= Object.defineProperty(sqlFor(sqlClaims, context, recorder, sessionOptions), "$client", {
+					get: unavailable,
+					enumerable: true,
+					configurable: true
+				});
+				return db;
+			},
+			get sql() {
+				sql ??= sqlFor(sqlClaims, context, recorder, sessionOptions);
+				return sql;
+			},
+			replica: void 0,
+			stats: () => recorder.snapshot(),
+			apply: (response) => resolution.apply(response),
+			cookies: () => resolution.cookies
+		};
+	};
+	/**
+	* An API key's context. There is no JWT for PostgREST, so `ctx.db` and
+	* `ctx.sql` run over direct Postgres with the key's synthesized claims,
+	* scoped to its organization unless the tenant option names another.
+	*/
+	const apiKeyContextFor = (resolution, auth, parent, tenant) => {
+		const scope = tenant ?? auth.organizationId;
+		const base = authContext(auth);
+		const context = scope === void 0 ? base : {
+			...base,
+			tenant: scope
+		};
+		const session = scope === void 0 ? void 0 : { settings: { "better_supabase.tenant": scope } };
+		const recorder = new StatsRecorder(parent);
+		let db;
+		let sql;
+		return {
+			...credentials,
+			auth: resolution.auth,
+			resolution,
+			get supabase() {
+				return apiKeyClient();
+			},
+			get db() {
+				db ??= Object.defineProperty(sqlFor(auth.claims, context, recorder, session), "$client", {
+					get: apiKeyClient,
+					enumerable: true,
+					configurable: true
+				});
+				return db;
+			},
+			get sql() {
+				sql ??= sqlFor(auth.claims, context, recorder, session);
+				return sql;
+			},
+			replica: void 0,
+			stats: () => recorder.snapshot(),
+			apply: (response) => resolution.apply(response),
+			cookies: () => resolution.cookies
+		};
+	};
+	/** Clients and repositories are built on first access: most scopes use one of them. */
+	const contextFor = (resolution, requestHeaders, parent, until = 0, tenant, active) => {
+		if (active) return supportContextFor(resolution, active, parent, tenant);
+		const { auth } = resolution;
+		if (auth.kind === "apiKey") return apiKeyContextFor(resolution, auth, parent, tenant);
+		const context = tenant === void 0 ? authContext(auth) : {
+			...authContext(auth),
+			tenant
+		};
+		const headers = tenant === void 0 ? requestHeaders : {
+			...requestHeaders,
+			[TENANT_HEADER]: tenant
+		};
+		const session = tenant === void 0 ? void 0 : { settings: { "better_supabase.tenant": tenant } };
+		const recorder = new StatsRecorder(parent);
+		let supabase;
+		let db;
+		let sql;
+		const sqlClaims = auth.kind === "user" ? auth.claims : auth.kind === "anon" ? { role: "anon" } : void 0;
+		const client = () => supabase ??= supabaseFor(auth, headers);
+		let replica;
+		const replicaUrl = () => {
+			const url = readUrl();
+			if (url) replica ??= replicaState(until);
+			return url;
+		};
+		return {
+			...credentials,
+			auth,
+			resolution,
+			get supabase() {
+				return client();
+			},
+			get db() {
+				if (db) return db;
+				const url = replicaUrl();
+				const rest = supabase ?? restAt(env().url, auth, headers);
+				const connected = betterSupabase.connect(rest, context, {
+					stats: recorder,
+					...url && replica ? { executor: routedExecutor(postgrestExecutor(rest, executorOptions), postgrestExecutor(restAt(url, auth, headers), executorOptions), replica) } : tunedExecutor ? { executor: postgrestExecutor(rest, executorOptions) } : {}
+				});
+				db = withLazyClient(connected, client);
+				return db;
+			},
+			get replica() {
+				replicaUrl();
+				return replica;
+			},
+			get sql() {
+				if (!options.postgres || !sqlClaims) return;
+				sql ??= sqlFor(sqlClaims, context, recorder, session);
+				return sql;
+			},
+			stats: () => recorder.snapshot(),
+			apply: (response) => withPrimaryPin(resolution.apply(response), replica, pinMs),
+			cookies: () => {
+				const pin = primaryCookieWrite(replica, pinMs);
+				return pin ? [...resolution.cookies, pin] : resolution.cookies;
+			}
+		};
+	};
+	const fromResolution = (resolution, request, contextOptions, tenant) => contextFor(resolution, options.headers?.(request) ?? {}, contextOptions.stats, contextOptions.pinnedUntil ?? (readUrl() ? pinnedUntil(resolution.requestCookies) : 0), tenant, contextOptions.support);
+	const resolve = async (request, resolveOptions = {}) => {
+		const claims = options.auth?.claims ?? betterSupabase.claimsSchema;
+		const userMetadata = betterSupabase.userMetadataSchema;
+		const resolution = await resolveAuth(request, {
+			logger: betterSupabase.events.logger,
+			...options.auth,
+			...claims ? { claims } : {},
+			...userMetadata ? { userMetadata } : {},
+			env: env(),
+			...resolveOptions.refresh === void 0 ? {} : { refresh: resolveOptions.refresh },
+			...resolveOptions.cookies === void 0 ? {} : { cookies: resolveOptions.cookies },
+			...resolveOptions.checkSession ? { checkSession: true } : {},
+			...resolveOptions.encode === void 0 ? {} : { cookie: {
+				...options.auth?.cookie,
+				encode: resolveOptions.encode
+			} },
+			onRefresh: (event) => {
+				options.auth?.onRefresh?.(event);
+				betterSupabase.events.emit("refresh", event);
+			}
+		});
+		if (betterSupabase.events.has("auth")) {
+			const { auth } = resolution;
+			betterSupabase.events.emit("auth", {
+				source: auth.kind === "user" ? auth.source === "cookie" ? "cookie" : "bearer" : auth.kind === "service" || auth.kind === "apiKey" ? "bearer" : "none",
+				ok: auth.kind !== "invalid",
+				...auth.kind === "user" ? {
+					userId: auth.user.id,
+					rawSource: auth.source
+				} : {},
+				...auth.kind === "anon" || auth.kind === "invalid" ? { reason: auth.reason } : {}
+			});
+		}
+		return resolution;
+	};
+	/** One context per request and `refresh`/`cookies` pair: Server Components ask repeatedly. */
+	const contextMemo = /* @__PURE__ */ new WeakMap();
+	const server = {
+		get env() {
+			return env();
+		},
+		events: betterSupabase.events,
+		resolve,
+		supabaseFor,
+		dbFor,
+		contextFor: (auth, contextOptions = {}) => contextFor({
+			auth,
+			cookies: [],
+			headers: {},
+			requestCookies: [],
+			apply: (response) => response
+		}, {}, contextOptions.stats, contextOptions.pinnedUntil, contextOptions.tenant, contextOptions.support),
+		context(request, contextOptions = {}) {
+			const { refresh, cookies, ...rest } = contextOptions;
+			const key = Object.keys(rest).length === 0 ? `${String(refresh ?? false)}:${String(cookies ?? true)}` : void 0;
+			let byOptions = key ? contextMemo.get(request) : void 0;
+			const known = key ? byOptions?.get(key) : void 0;
+			if (known) return known;
+			const resolving = (async () => {
+				const call = { options: contextOptions };
+				await fold(request, {
+					...seedContext(),
+					[CALL]: call
+				});
+				return call.context;
+			})();
+			if (key) {
+				if (!byOptions) {
+					byOptions = /* @__PURE__ */ new Map();
+					contextMemo.set(request, byOptions);
+				}
+				const memo = byOptions;
+				memo.set(key, resolving);
+				resolving.catch(() => {
+					if (memo.get(key) === resolving) memo.delete(key);
+				});
+			}
+			return resolving;
+		},
+		contextFromResolution: (resolution, request, contextOptions = {}) => fromResolution(resolution, request, contextOptions, contextOptions.tenant ?? syncTenant(request, resolution.auth)),
+		admin: (context = {}) => {
+			const client = serviceClient();
+			return betterSupabase.connect(client, {
+				actor: {
+					id: "service",
+					kind: "service",
+					role: "service_role"
+				},
+				claims: { role: "service_role" },
+				...context
+			}, tunedExecutor ? { executor: postgrestExecutor(client, executorOptions) } : {});
+		},
+		support,
+		deleteAccount: (userId, deleteOptions) => deleteAccount(betterSupabase, serviceClient, userId, {
+			...options.postgres ? { sql: options.postgres.admin } : {},
+			...deleteOptions
+		}).map((deleted) => {
+			audit.account("account.deleted", userId, { removed: deleted.removed });
+			return deleted;
+		}),
+		endSessions: (userId) => options.postgres ? endSessions(options.postgres.admin, userId).map((ended) => {
+			audit.account("account.sessions_ended", userId, { ended: ended.ended });
+			return ended;
+		}) : AsyncResult.err(needsPostgres("endSessions")),
+		suspendAccount: (userId, suspendOptions) => options.postgres ? suspendAccount(serviceClient, options.postgres.admin, userId, suspendOptions).map((suspended) => {
+			audit.account(suspended.suspended ? "account.suspended" : "account.unsuspended", userId, {
+				ended: suspended.ended,
+				...suspendOptions.duration === void 0 ? {} : { duration: suspendOptions.duration }
+			});
+			return suspended;
+		}) : AsyncResult.err(needsPostgres("suspendAccount")),
+		actingAs: (userId, claims = {}, impersonation) => {
+			const full = {
+				role: "authenticated",
+				...claims,
+				sub: userId,
+				...impersonation ? { act: actClaim(impersonation) } : {}
+			};
+			return sqlFor(full, {
+				actor: {
+					id: userId,
+					kind: "user",
+					role: full.role ?? "authenticated",
+					...impersonation ? { impersonator: impersonation.actor } : {}
+				},
+				claims: full
+			});
+		},
+		forContext: (context, forOptions = {}) => {
+			const { actor, tenant } = context;
+			if (actor?.kind !== "user") return AsyncResult.err(dbError("forbidden", `forContext needs a user actor, got ${actor ? actor.kind : "none"}: use admin() for service work`));
+			if (!options.postgres) return AsyncResult.err(dbError("invalid_request", "Direct Postgres access needs createServer(betterSupabase, { postgres: createPostgres() })"));
+			const recorded = actorOf(context.claims ?? {});
+			if (!recorded.ok) return AsyncResult.err(dbError("forbidden", "forContext got an invalid act claim"));
+			const support = recorded.actor?.kind === "support" ? recorded.actor : void 0;
+			const impersonator = support?.id ?? actor.impersonator;
+			return AsyncResult.from(async () => {
+				const claims = {
+					...await options.claimsFor?.(actor.id, context) ?? {},
+					role: "authenticated",
+					sub: actor.id,
+					...tenant === void 0 ? {} : { tenant_id: tenant },
+					...support ? { act: impersonatorClaim(support) } : actor.impersonator ? { act: actClaim({
+						actor: actor.impersonator,
+						reason: forOptions.reason ?? "job"
+					}) } : {}
+				};
+				const session = {
+					...support?.readOnly ? { readOnly: true } : {},
+					...tenant === void 0 ? {} : { settings: { "better_supabase.tenant": tenant } }
+				};
+				return ok(sqlFor(claims, {
+					actor: {
+						id: actor.id,
+						kind: "user",
+						role: "authenticated",
+						...impersonator ? { impersonator } : {}
+					},
+					claims,
+					...tenant === void 0 ? {} : { tenant }
+				}, void 0, Object.keys(session).length === 0 ? void 0 : session));
+			});
+		}
+	};
+	const core = {
+		events: betterSupabase.events,
+		pinMs,
+		resolve,
+		sessionCookie: () => options.auth?.cookie?.name ?? sessionCookieName(env().url),
+		tenant: (request, auth) => options.tenant?.(request, auth),
+		support: (request, auth) => support.current(request, auth),
+		context: (resolution, request, contextOptions, tenant) => fromResolution(resolution, request, contextOptions, tenant)
+	};
+	registerCore(server, core);
+	const fold = pipeline([
+		withSession(core),
+		withTenant(core),
+		withSupport(core),
+		withServerContext(core)
+	], (_request, ctx) => {
+		const call = callOf(ctx);
+		if (call) call.context = ctx.bs;
+		return Promise.resolve(new Response(null, { status: 204 }));
+	});
+	return server;
+}
+//#endregion
+//#region src/server/adapter.ts
+/** Hands event sink sends still running to `waitUntil`; a no-op without either. */
+function flushEvents(server, waitUntil) {
+	if (waitUntil && server.events.pending) waitUntil(server.events.settled());
+}
+/** The 500 for an error a handler threw; the message only when `expose` is set. */
+function unexpectedResponse(cause, options) {
+	return problemResponse(dbError("unexpected", options.expose && cause instanceof Error ? cause.message : "Internal server error"), options);
+}
+/**
+* Runs `run` as the request's caller, the way every built-in adapter does:
+* resolves the context, applies the guard (401/403 Problem Details), turns
+* the return value into a response with `respond()`, turns other thrown
+* errors into a 500, adds the context's cookies with `ctx.apply()` and
+* hands pending event sink sends to `waitUntil`.
+*
+* ```ts
+* export default { fetch: (request, env, ctx) =>
+*   handle(server, request, (c) => c.db.notes.findMany(), { waitUntil: (p) => ctx.waitUntil(p) }) }
+* ```
+*/
+async function handle(server, request, run, options = {}) {
+	const expose = options.expose ?? defaultExpose();
+	const instance = options.instance ?? new URL(request.url).pathname;
+	const ctx = await server.context(request, {
+		...options.context,
+		refresh: refreshFor(options.refresh, request) ?? false
+	});
+	const denied = guard(ctx.auth, options.allow, options.aal, options.scopes);
+	try {
+		let response;
+		try {
+			response = denied ? problemResponse(denied, {
+				instance,
+				expose
+			}) : await respond(() => run(ctx), {
+				instance,
+				expose,
+				...options.status === void 0 ? {} : { status: options.status }
+			});
+		} catch (cause) {
+			options.rethrow?.(cause);
+			response = unexpectedResponse(cause, {
+				instance,
+				expose
+			});
+		}
+		return ctx.apply(response);
+	} finally {
+		flushEvents(server, options.waitUntil);
+	}
+}
+/** A request carrying only `token` as a bearer, for resolvers that read headers. */
+function bearerRequest(token) {
+	return new Request("http://localhost/", { headers: token ? { authorization: `Bearer ${token}` } : {} });
+}
+/**
+* Verifies a bare access token (an MCP transport's, a WebSocket's) without
+* cookies or a refresh. An empty token resolves to `anon`.
+*/
+async function resolveToken(server, token) {
+	const { auth } = await server.resolve(bearerRequest(token), { cookies: false });
+	return auth;
+}
+//#endregion
+export { serverCore as C, deleteAccount as D, suspendAccount as E, withServerContext as S, endSessions as T, withSession as _, unexpectedResponse as a, shouldCheckSession as b, extendServer as c, clearSupportCookie as d, supportCookie as f, withSupport as g, withTenant as h, resolveToken as i, withExtra as l, supportCookieValue as m, flushEvents as n, TENANT_HEADER as o, supportCookieMaxAge as p, handle as r, createServer as s, bearerRequest as t, SUPPORT_COOKIE as u, isPrefetch as v, SERVER_EVENT_SOURCE as w, shouldRefresh as x, refreshFor as y };