better-supabase 0.5.1 → 0.6.0

package/dist/json-schema-CvER4kgT.js

@@ -0,0 +1,502 @@
+import { t as isList } from "./guards-BnzDvFrz.js";
+//#region src/generators/shared.ts
+const INTEGER = /* @__PURE__ */ new Set([
+	"int2",
+	"int4",
+	"int8"
+]);
+const NUMBER = /* @__PURE__ */ new Set([
+	"float4",
+	"float8",
+	"numeric",
+	"oid",
+	"money"
+]);
+const DATETIME = /* @__PURE__ */ new Set(["timestamptz"]);
+function scalarKind(column) {
+	if (column.enum) return {
+		kind: "enum",
+		values: column.enum
+	};
+	if (column.json) return { kind: "json" };
+	if (column.codec === "instant") return { kind: "instant" };
+	if (column.codec === "plainDateTime") return { kind: "plainDateTime" };
+	if (column.codec === "bigint") return { kind: "bigint" };
+	if (column.codec === "string") return { kind: "string" };
+	if (column.type === "uuid") return { kind: "uuid" };
+	if (INTEGER.has(column.type)) return { kind: "integer" };
+	if (NUMBER.has(column.type)) return { kind: "number" };
+	if (column.type === "bool") return { kind: "boolean" };
+	if (DATETIME.has(column.type)) return { kind: "datetime" };
+	if (column.type === "date") return { kind: "date" };
+	if (column.type === "record" || column.type === "void") return { kind: "unknown" };
+	return { kind: "string" };
+}
+/** App names of the columns that plugins fill from the table's flags. */
+function managedColumns(table) {
+	const { timestamps, actor, softDelete } = table.flags;
+	return new Set([
+		timestamps?.createdAt,
+		timestamps?.updatedAt,
+		actor?.createdBy,
+		actor?.updatedBy,
+		actor?.impersonatedBy,
+		softDelete
+	].filter((name) => name !== void 0));
+}
+/**
+* The generated row type of a field (its element type for arrays). Storage
+* path columns validate as strings and are cast to their `StoragePath` brand.
+*/
+function rowType(table, plan) {
+	const type = `NonNullable<RowOf<'${table}'>['${plan.name}']>`;
+	return plan.column.array ? `${type}[number]` : type;
+}
+/** The fields a variant accepts; read-only columns are left out of writes. */
+function fieldsFor(table, variant, input) {
+	const fields = [];
+	const managed = managedColumns(table);
+	for (const [name, column] of Object.entries(table.columns)) {
+		if (variant === "Insert" && (column.generated || column.insertable === false)) continue;
+		if (variant === "Update" && (column.generated || column.updatable === false)) continue;
+		fields.push({
+			name,
+			column,
+			scalar: scalarKind(column),
+			nullable: column.nullable,
+			optional: variant === "Update" || variant === "Insert" && (column.nullable || column.hasDefault),
+			customJson: Boolean(column.json && (input.config.json[`${table.schema}.${table.name}.${column.db}`] ?? input.config.json[`${table.name}.${column.db}`])),
+			managed: managed.has(name)
+		});
+	}
+	return fields;
+}
+const TEMPORAL_GUARDS = {
+	instant: "isInstant",
+	plainDateTime: "isPlainDateTime"
+};
+/**
+* The `better-supabase` guards the generated validators call. They check
+* `Symbol.toStringTag`, so the module never reads `Temporal` when it loads.
+*/
+function temporalGuardImport(input) {
+	const names = /* @__PURE__ */ new Set();
+	for (const [, table] of tableEntries(input)) for (const plan of fieldsFor(table, "Row", input)) {
+		if (plan.customJson || plan.column.storage !== void 0) continue;
+		const guard = TEMPORAL_GUARDS[plan.scalar.kind];
+		if (guard) names.add(guard);
+	}
+	return names.size === 0 ? void 0 : `import { ${[...names].sort().join(", ")} } from "better-supabase";`;
+}
+const EXAMPLE = /^\s*@example\s+(.+?)\s*$/gm;
+/**
+* Splits a comment into its description and `@example` lines. An example is
+* JSON (`@example 42`, `@example "KVK-1"`) or, when it doesn't parse, text.
+*/
+function parseComment(comment) {
+	if (!comment) return { examples: [] };
+	const examples = [...comment.matchAll(EXAMPLE)].map((match) => {
+		const raw = match[1] ?? "";
+		try {
+			return JSON.parse(raw);
+		} catch {
+			return raw;
+		}
+	});
+	const description = comment.replace(EXAMPLE, "").trim();
+	return description ? {
+		description,
+		examples
+	} : { examples };
+}
+const COMPARISON = /^(?:(char_length|length)\(\(?"?(\w+)"?\)?(?:::[\w ]+)?\)|\(?"?(\w+)"?\)?(?:::[\w ]+)?)\s*(>=|>|<=|<)\s*\(?'?(-?\d+(?:\.\d+)?)'?\)?(?:::[\w ]+)?$/;
+const REVERSED = /^\(?'?(-?\d+(?:\.\d+)?)'?\)?(?:::[\w ]+)?\s*(>=|>|<=|<)\s*(?:(char_length|length)\(\(?"?(\w+)"?\)?(?:::[\w ]+)?\)|\(?"?(\w+)"?\)?(?:::[\w ]+)?)$/;
+const FLIP = {
+	">=": "<=",
+	">": "<",
+	"<=": ">=",
+	"<": ">"
+};
+/** Drops parentheses that wrap the whole expression. */
+function unwrap(expression) {
+	let text = expression.trim().replace(/^CHECK\s*/, "");
+	while (text.startsWith("(") && text.endsWith(")")) {
+		let depth = 0;
+		let wraps = true;
+		for (let i = 0; i < text.length - 1; i++) {
+			if (text[i] === "(") depth++;
+			else if (text[i] === ")") depth--;
+			if (depth === 0) {
+				wraps = false;
+				break;
+			}
+		}
+		if (!wraps) break;
+		text = text.slice(1, -1).trim();
+	}
+	return text;
+}
+/** Terms of a top-level `AND` chain. */
+function conjuncts(expression) {
+	const terms = [];
+	let depth = 0;
+	let start = 0;
+	for (let i = 0; i < expression.length; i++) {
+		const char = expression[i];
+		if (char === "(") depth++;
+		else if (char === ")") depth--;
+		else if (depth === 0 && expression.startsWith(" AND ", i)) {
+			terms.push(expression.slice(start, i));
+			start = i + 5;
+		}
+	}
+	terms.push(expression.slice(start));
+	return terms.map(unwrap);
+}
+function comparison(term) {
+	const forward = COMPARISON.exec(term);
+	if (forward) return {
+		column: forward[2] ?? forward[3] ?? "",
+		length: forward[1] !== void 0,
+		operator: forward[4],
+		value: Number(forward[5])
+	};
+	const reversed = REVERSED.exec(term);
+	if (!reversed) return void 0;
+	return {
+		column: reversed[4] ?? reversed[5] ?? "",
+		length: reversed[3] !== void 0,
+		operator: FLIP[reversed[2]],
+		value: Number(reversed[1])
+	};
+}
+/**
+* Bounds from simple CHECK constraints, by column: `price >= 0`,
+* `rating between 1 and 5`, `char_length(name) <= 200`. Terms joined by
+* `OR`, functions other than `length` and `char_length`, and comparisons
+* between columns are left out.
+*/
+function parseCheckBounds(definition) {
+	const bounds = /* @__PURE__ */ new Map();
+	for (const term of conjuncts(unwrap(definition))) {
+		if (/\sOR\s/i.test(term)) continue;
+		const parsed = comparison(term);
+		if (!parsed?.column || Number.isNaN(parsed.value)) continue;
+		const current = bounds.get(parsed.column) ?? {};
+		bounds.set(parsed.column, {
+			...current,
+			...boundOf(parsed)
+		});
+	}
+	return bounds;
+}
+function boundOf({ length, operator, value }) {
+	if (length) switch (operator) {
+		case ">=": return { minLength: value };
+		case ">": return { minLength: value + 1 };
+		case "<=": return { maxLength: value };
+		case "<": return { maxLength: value - 1 };
+		default: return operator;
+	}
+	switch (operator) {
+		case ">=": return { minimum: value };
+		case ">": return { exclusiveMinimum: value };
+		case "<=": return { maximum: value };
+		case "<": return { exclusiveMaximum: value };
+		default: return operator;
+	}
+}
+/** `customer_tags` → `Customer tags`. */
+function titleOf(name) {
+	const words = name.replaceAll("_", " ").trim();
+	return words.charAt(0).toUpperCase() + words.slice(1);
+}
+const docsIndexes = /* @__PURE__ */ new WeakMap();
+const checkIndexes = /* @__PURE__ */ new WeakMap();
+/** CHECK definitions by `schema.name`, built once per extras. */
+function checksIndex(extras) {
+	let index = checkIndexes.get(extras);
+	if (index) return index;
+	const map = /* @__PURE__ */ new Map();
+	for (const table of extras.tables) {
+		const key = `${table.schema}.${table.name}`;
+		map.set(key, [...map.get(key) ?? [], ...table.checks.map((check) => check.definition)]);
+	}
+	index = map;
+	checkIndexes.set(extras, index);
+	return index;
+}
+/** The catalog keyed for `tableDocs`, built once per catalog. */
+function docsIndex(catalog) {
+	let index = docsIndexes.get(catalog);
+	if (index) return index;
+	const entries = /* @__PURE__ */ new Map();
+	for (const item of [
+		...catalog.tables,
+		...catalog.views,
+		...catalog.materializedViews ?? []
+	]) {
+		const key = `${item.schema}.${item.name}`;
+		if (!entries.has(key)) entries.set(key, item);
+	}
+	const columns = /* @__PURE__ */ new Map();
+	for (const column of catalog.columns) {
+		const list = columns.get(column.table_id);
+		if (list) list.push(column);
+		else columns.set(column.table_id, [column]);
+	}
+	index = {
+		entries,
+		columns
+	};
+	docsIndexes.set(catalog, index);
+	return index;
+}
+/** Title, description and per-column docs, or `undefined` without a catalog. */
+function tableDocs(input, table) {
+	const catalog = input.introspection;
+	if (!catalog) return void 0;
+	const index = docsIndex(catalog);
+	const entry = index.entries.get(`${table.schema}.${table.name}`);
+	const checks = /* @__PURE__ */ new Map();
+	const addChecks = (definition) => {
+		for (const [column, bounds] of parseCheckBounds(definition)) checks.set(column, {
+			...checks.get(column),
+			...bounds
+		});
+	};
+	const extras = input.extras;
+	for (const definition of extras ? checksIndex(extras).get(`${table.schema}.${table.name}`) ?? [] : []) addChecks(definition);
+	const fields = /* @__PURE__ */ new Map();
+	for (const column of entry ? index.columns.get(entry.id) ?? [] : []) {
+		if (column.check) addChecks(column.check);
+		const { description, examples } = parseComment(column.comment);
+		fields.set(column.name, {
+			...description === void 0 ? {} : { description },
+			...examples.length > 0 ? { examples } : {}
+		});
+	}
+	for (const [column, bounds] of checks) fields.set(column, {
+		...fields.get(column),
+		...bounds
+	});
+	const { description } = parseComment(entry?.comment ?? null);
+	return {
+		title: titleOf(table.name),
+		...description === void 0 ? {} : { description },
+		fields
+	};
+}
+/** A variant's title: `Customers`, `Customers insert`, `Customers update`. */
+function variantTitle(docs, variant) {
+	return variant === "Row" ? docs.title : `${docs.title} ${variant.toLowerCase()}`;
+}
+function exampleFits(scalar, value) {
+	switch (scalar.kind) {
+		case "uuid":
+		case "string":
+		case "datetime":
+		case "date": return typeof value === "string";
+		case "enum": return typeof value === "string" && scalar.values.includes(value);
+		case "integer": return Number.isInteger(value);
+		case "number": return typeof value === "number";
+		case "boolean": return typeof value === "boolean";
+		case "json":
+		case "unknown": return true;
+		case "instant":
+		case "plainDateTime":
+		case "bigint": return false;
+		default: return scalar;
+	}
+}
+/**
+* The docs a field's validator can carry: value bounds on numbers, length
+* bounds on text, and only examples its type accepts.
+*/
+function fieldDocs(docs, plan) {
+	const found = docs?.fields.get(plan.column.db);
+	if (!found || plan.customJson || plan.column.storage !== void 0) return {};
+	const numeric = !plan.column.array && (plan.scalar.kind === "integer" || plan.scalar.kind === "number");
+	const text = !plan.column.array && plan.scalar.kind === "string";
+	const fits = (value) => value === null && plan.nullable || (plan.column.array ? Array.isArray(value) && value.every((item) => exampleFits(plan.scalar, item)) : exampleFits(plan.scalar, value));
+	const examples = found.examples?.filter(fits) ?? [];
+	return {
+		...found.description === void 0 ? {} : { description: found.description },
+		...examples.length > 0 ? { examples } : {},
+		...numeric ? pick(found, [
+			"minimum",
+			"exclusiveMinimum",
+			"maximum",
+			"exclusiveMaximum"
+		]) : {},
+		...text ? pick(found, ["minLength", "maxLength"]) : {}
+	};
+}
+function pick(bounds, keys) {
+	const out = {};
+	for (const key of keys) {
+		const value = bounds[key];
+		if (value !== void 0) out[key] = value;
+	}
+	return out;
+}
+function optionalLine(line) {
+	return line === void 0 ? [] : [line];
+}
+function variantsFor(table) {
+	if (table.kind !== "view") return [
+		"Row",
+		"Insert",
+		"Update"
+	];
+	const columns = Object.values(table.columns).filter((column) => !column.generated);
+	return [
+		"Row",
+		...columns.some((column) => column.insertable !== false) ? ["Insert"] : [],
+		...columns.some((column) => column.updatable !== false) ? ["Update"] : []
+	];
+}
+function tableEntries(input) {
+	return Object.entries(input.meta.tables).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+}
+function propertyKey(name) {
+	return /^[A-Za-z_$][\w$]*$/.test(name) ? name : JSON.stringify(name);
+}
+/** `customerTags` + `Insert` → `customerTagsInsert`. */
+function schemaName(table, variant) {
+	return `${table.replace(/^[A-Z]/, (c) => c.toLowerCase())}${variant}`;
+}
+/** Output path next to the main module: `generated.ts` → `generated.zod.ts`. */
+function siblingPath(output, suffix) {
+	return output.replace(/(\.[cm]?ts)?$/, `.${suffix}`);
+}
+const HEADER = "// Generated by better-supabase. Do not edit; run `better-supabase gen`.\n";
+/** `./metadata.ts#metadataSchema` → `{ from: './metadata.ts', name: 'metadataSchema' }`. */
+function parseImport(spec) {
+	const [from, name] = spec.split("#");
+	if (!from || !name) throw new Error(`Expected "path#export", got "${spec}"`);
+	return {
+		from,
+		name
+	};
+}
+//#endregion
+//#region src/generators/json-schema.ts
+function scalar(kind) {
+	switch (kind.kind) {
+		case "uuid": return {
+			type: "string",
+			format: "uuid"
+		};
+		case "string": return { type: "string" };
+		case "integer": return { type: "integer" };
+		case "number": return { type: "number" };
+		case "boolean": return { type: "boolean" };
+		case "datetime": return {
+			type: "string",
+			format: "date-time"
+		};
+		case "date": return {
+			type: "string",
+			format: "date"
+		};
+		case "instant": return {
+			type: "string",
+			format: "date-time"
+		};
+		case "plainDateTime": return {
+			type: "string",
+			pattern: "^\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?$"
+		};
+		case "bigint": return {
+			type: "string",
+			pattern: "^-?\\d+$"
+		};
+		case "json":
+		case "unknown": return {};
+		case "enum": return {
+			type: "string",
+			enum: [...kind.values]
+		};
+		default: return kind;
+	}
+}
+function property(plan, docs) {
+	const { description, examples, ...bounds } = docs;
+	const schema = {
+		...nullable(plan, bounds),
+		...description === void 0 ? {} : { description },
+		...examples === void 0 ? {} : { examples: [...examples] }
+	};
+	return plan.managed ? {
+		...schema,
+		readOnly: true
+	} : schema;
+}
+function nullable(plan, bounds) {
+	let schema = {
+		...scalar(plan.scalar),
+		...bounds
+	};
+	if (plan.column.array) schema = {
+		type: "array",
+		items: schema
+	};
+	if (!plan.nullable) return schema;
+	if (Object.keys(schema).length === 0) return schema;
+	const { enum: values, ...rest } = schema;
+	if (isList(values)) return {
+		...rest,
+		type: ["string", "null"],
+		enum: [...values, null]
+	};
+	return typeof schema["type"] === "string" ? {
+		...schema,
+		type: [schema["type"], "null"]
+	} : { anyOf: [schema, { type: "null" }] };
+}
+/** JSON Schema (2020-12) `$defs` for every table: `customersRow`, `customersInsert`, ... */
+function buildJsonSchema(input, id) {
+	const defs = {};
+	for (const [key, table] of tableEntries(input)) {
+		const docs = tableDocs(input, table);
+		for (const variant of variantsFor(table)) {
+			const properties = {};
+			const required = [];
+			for (const plan of fieldsFor(table, variant, input)) {
+				properties[plan.name] = property(plan, fieldDocs(docs, plan));
+				if (!plan.optional) required.push(plan.name);
+			}
+			defs[`${key}${variant}`] = {
+				...docs ? {
+					title: variantTitle(docs, variant),
+					...docs.description === void 0 ? {} : { description: docs.description }
+				} : {},
+				type: "object",
+				properties,
+				...required.length > 0 ? { required } : {},
+				additionalProperties: false
+			};
+		}
+	}
+	return {
+		$schema: "https://json-schema.org/draft/2020-12/schema",
+		...id ? { $id: id } : {},
+		$defs: defs
+	};
+}
+/** Writes the JSON Schema document; `createOpenApi` reuses the same `$defs`. */
+function jsonSchema(options = {}) {
+	return {
+		apiVersion: 1,
+		name: "json-schema",
+		generate(input) {
+			return [{
+				path: options.output ?? siblingPath(input.config.output, "schema.json"),
+				contents: `${JSON.stringify(buildJsonSchema(input, options.id), null, 2)}\n`
+			}];
+		}
+	};
+}
+//#endregion
+export { fieldsFor as a, propertyKey as c, siblingPath as d, tableDocs as f, variantsFor as g, variantTitle as h, fieldDocs as i, rowType as l, temporalGuardImport as m, jsonSchema as n, optionalLine as o, tableEntries as p, HEADER as r, parseImport as s, buildJsonSchema as t, schemaName as u };

package/dist/keys-4MnkWTTh.js

@@ -0,0 +1,35 @@
+import { n as decodeJwtPayload } from "./base64-D2gsioCY.js";
+import { a as tenantClaimPaths, i as claimsOf, n as claimAt } from "./claims-PqzCxaTD.js";
+//#region src/bindings/keys.ts
+/**
+* The session's user id. With `tokens-only` cookies and no stored user,
+* auth-js puts a placeholder in `session.user` whose getters throw, so the
+* id falls back to the token's `sub`.
+*/
+function sessionUserId(session) {
+	try {
+		if (typeof session.user.id === "string") return session.user.id;
+	} catch {}
+	const sub = decodeJwtPayload(session.access_token)?.["sub"];
+	return typeof sub === "string" ? sub : null;
+}
+/** The tenant claim `config.claims.tenant` names, for a signed-in caller. */
+function claimedTenant(auth, meta) {
+	if (auth.status !== "signed-in") return void 0;
+	for (const path of tenantClaimPaths(claimsOf(meta).tenant)) {
+		const value = claimAt(auth.claims, path);
+		if (value !== void 0) return value;
+	}
+}
+const specKeys = /* @__PURE__ */ new WeakMap();
+/** Specs are immutable, so a memoized or module-level spec is serialized once. */
+function specKey(spec) {
+	let key = specKeys.get(spec);
+	if (key === void 0) {
+		key = JSON.stringify(spec, (_key, value) => typeof value === "bigint" ? { $bigint: value.toString() } : value);
+		specKeys.set(spec, key);
+	}
+	return key;
+}
+//#endregion
+export { sessionUserId as n, specKey as r, claimedTenant as t };

package/dist/kit-B5tid-q5.d.ts

@@ -0,0 +1,60 @@
+import { b as DbError } from "./result-D7y2fT87.js";
+import { r as AuthState } from "./resolve-KW8nCeL6.js";
+import { t as AuthSession } from "./view-DbxLNu8L.js";
+import { r as GuardOptions } from "./respond-DoBijysA.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/server/kit.d.ts
+/** What a server action returns: plain data, safe across any serialization boundary. */
+type ActionResult<T> = {
+  readonly ok: true;
+  readonly data: T;
+  readonly error: null;
+} | {
+  readonly ok: false;
+  readonly data: null;
+  readonly error: DbError;
+};
+/**
+ * Checks after `allow`, `aal` and `scopes`. A caller who fails one gets
+ * `forbidden`: an `ActionResult` error, a 403, or the framework's refusal.
+ */
+interface AuthorizeOptions<I, C, P, R extends boolean> {
+  /** Refuse callers without an active tenant, so `ctx.tenant` is a string. */
+  readonly requireTenant?: R;
+  /** Admit only users holding one of these roles at `roleClaim`. */
+  readonly roles?: readonly string[];
+  /** The dotted claim path `roles` reads: one string or an array. Defaults to `app_metadata.role`. */
+  readonly roleClaim?: string;
+  /** Return `false` to refuse the caller, e.g. `(session, input) => input.ownerId === session.user.id`. */
+  readonly authorize?: (session: AuthSession<C, P>, input: I) => boolean | Promise<boolean>;
+}
+/** What `requireTenant` and `authorize` add to the context. */
+interface AuthorizedContext<C, P, R extends boolean> {
+  readonly session: AuthSession<C, P>;
+  /**
+   * The active tenant: the action's `tenant`, then the server's `tenant`
+   * option, then the tenant claim (`tenantOf(session)`).
+   */
+  readonly tenant: R extends true ? string : string | undefined;
+}
+type ActionInput<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferInput<S> | FormData : unknown;
+type ActionParsed<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<S> : unknown;
+type Unwrapped<T> = T extends {
+  readonly ok: true;
+  readonly data: infer D;
+} ? D : T extends {
+  readonly ok: false;
+} ? never : T;
+/** Guard, authorize and validate options of a framework-neutral action. */
+interface BlockActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R> {
+  /** Validates the input (plain object or `FormData`) with any Standard Schema. */
+  readonly input?: S;
+}
+/** The guard and authorize checks of a loader, page or route. */
+interface BlockRequireOptions<C = unknown, P = unknown, R extends boolean = boolean> extends GuardOptions, AuthorizeOptions<undefined, C, P, R> {}
+/** The strings at a dotted claim path: one string, or every string in an array. */
+declare function rolesAt(claims: Readonly<Record<string, unknown>> | undefined, path: string): readonly string[];
+/** Whether a signed-in caller holds one of `roles` at the claim `path`. */
+declare function hasRole(auth: AuthState, roles: readonly string[], path?: string): boolean;
+//#endregion
+export { AuthorizedContext as a, Unwrapped as c, AuthorizeOptions as i, hasRole as l, ActionParsed as n, BlockActionOptions as o, ActionResult as r, BlockRequireOptions as s, ActionInput as t, rolesAt as u };

package/dist/kit-Fm-Fv7q5.js

@@ -0,0 +1,78 @@
+import { n as dbError } from "./errors-B11Duf73.js";
+import { n as validate } from "./standard-BK0cqJ7y.js";
+import { n as claimAt } from "./claims-PqzCxaTD.js";
+import { n as toSession } from "./view-BeFcRV6G.js";
+import { o as settle, r as guard } from "./respond-BUgsXNgk.js";
+//#region src/server/kit.ts
+/** `FormData` as a plain object; repeated keys become arrays. */
+function formDataObject(form) {
+	const out = {};
+	for (const key of new Set(form.keys())) {
+		const values = form.getAll(key);
+		out[key] = values.length > 1 ? values : values[0];
+	}
+	return out;
+}
+/** A failed `ActionResult`. */
+function actionError(error) {
+	return {
+		ok: false,
+		data: null,
+		error
+	};
+}
+/** `requireTenant` and `authorize`: the session and tenant, or why the caller is refused. */
+async function authorizeCaller(auth, checks, input, tenant) {
+	const session = toSession(auth);
+	if (checks.requireTenant && tenant === void 0) return dbError("forbidden", "Choose an organization first", { code: "NO_TENANT" });
+	if (checks.roles && !hasRole(auth, checks.roles, checks.roleClaim)) return dbError("forbidden", "You do not have the role this needs", { code: "MISSING_ROLE" });
+	if (checks.authorize && !await checks.authorize(session, input)) return dbError("forbidden", "You are not allowed to do this", { code: "NOT_AUTHORIZED" });
+	return {
+		session,
+		tenant
+	};
+}
+/** `guard`, then `authorizeCaller`: the caller, or the refusal. */
+async function requireCaller(auth, options, tenant) {
+	return guard(auth, options.allow, options.aal, options.scopes) ?? authorizeCaller(auth, options, void 0, tenant);
+}
+/**
+* Runs an action body with the guard, input validation and authorize checks
+* every adapter shares, and settles it into an `ActionResult`: `Result`s
+* unwrap, thrown `DbException`s become errors, other throws propagate (so
+* framework redirects keep working).
+*/
+async function runAction(auth, options, input, tenant, body) {
+	const denied = guard(auth, options.allow, options.aal, options.scopes);
+	if (denied) return actionError(denied);
+	let parsed = input instanceof FormData ? formDataObject(input) : input;
+	if (options.input) {
+		const checked = await validate(options.input, parsed, "input");
+		if (!checked.ok) return actionError(checked.error);
+		parsed = checked.data;
+	}
+	const caller = await authorizeCaller(auth, options, parsed, tenant);
+	if ("kind" in caller) return actionError(caller);
+	const settled = await settle(() => body(parsed, caller));
+	return settled.ok ? {
+		ok: true,
+		data: settled.data,
+		error: null
+	} : actionError(settled.error);
+}
+/** The strings at a dotted claim path: one string, or every string in an array. */
+function rolesAt(claims, path) {
+	const single = claimAt(claims, path);
+	if (single !== void 0) return [single];
+	let value = claims;
+	for (const segment of path.split(".")) value = typeof value === "object" && value !== null ? value[segment] : void 0;
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/** Whether a signed-in caller holds one of `roles` at the claim `path`. */
+function hasRole(auth, roles, path = "app_metadata.role") {
+	if (auth.kind !== "user") return false;
+	const held = rolesAt(auth.claims, path);
+	return roles.some((role) => held.includes(role));
+}
+//#endregion
+export { rolesAt as a, requireCaller as i, formDataObject as n, runAction as o, hasRole as r, authorizeCaller as t };