better-supabase 0.5.1 → 0.6.0

package/dist/replicas-CwrYp5Zj.js

@@ -0,0 +1,94 @@
+import { parseCookieHeader, serializeCookieHeader } from "@supabase/ssr";
+//#region src/server/replicas.ts
+/** Cookie holding the epoch ms until which reads stay on the primary. */
+const PRIMARY_COOKIE = "bs-primary-until";
+/** Default time reads stay on the primary after a write. */
+const DEFAULT_PIN_MS = 5e3;
+function replicaState(pinnedUntil = 0, now = Date.now()) {
+	let wrote = false;
+	const inherited = pinnedUntil > now;
+	return {
+		get pinned() {
+			return wrote || inherited;
+		},
+		get wrote() {
+			return wrote;
+		},
+		pin() {
+			wrote = true;
+		}
+	};
+}
+/** `bs-primary-until` from a `cookie` header or parsed cookies, or 0. */
+function pinnedUntil(cookies) {
+	if (!cookies) return 0;
+	const value = (typeof cookies === "string" ? parseCookieHeader(cookies) : cookies).find((cookie) => cookie.name === PRIMARY_COOKIE)?.value;
+	const until = Number(value);
+	return value !== void 0 && Number.isFinite(until) ? until : 0;
+}
+/** Options of the `bs-primary-until` cookie. */
+function primaryCookieOptions(pinMs) {
+	return {
+		path: "/",
+		maxAge: Math.max(1, Math.ceil(pinMs / 1e3)),
+		httpOnly: true,
+		sameSite: "lax"
+	};
+}
+/** The `bs-primary-until` cookie write after a write, for cookie-jar APIs. */
+function primaryCookieWrite(replica, pinMs, now = Date.now()) {
+	if (!replica?.wrote) return void 0;
+	return {
+		name: PRIMARY_COOKIE,
+		value: String(now + pinMs),
+		options: primaryCookieOptions(pinMs)
+	};
+}
+/** A `Set-Cookie` value keeping the next requests on the primary for `pinMs`. */
+function primaryCookie(pinMs, now = Date.now()) {
+	return serializeCookieHeader(PRIMARY_COOKIE, String(now + pinMs), primaryCookieOptions(pinMs));
+}
+/**
+* `response` with the `bs-primary-until` cookie when the request wrote, so the
+* caller's next requests read their own writes. A response with immutable
+* headers is copied.
+*/
+function withPrimaryPin(response, replica, pinMs) {
+	if (!replica?.wrote) return response;
+	const cookie = primaryCookie(pinMs);
+	try {
+		response.headers.append("set-cookie", cookie);
+		return response;
+	} catch {
+		const copy = new Response(response.body, response);
+		copy.headers.append("set-cookie", cookie);
+		return copy;
+	}
+}
+/**
+* Reads go to `replica` until the context is pinned; writes, and every read
+* after a successful write, go to `primary`.
+*/
+function routedExecutor(primary, replica, state) {
+	const batch = primary.batch?.bind(primary);
+	const replicaBatch = replica.batch?.bind(replica);
+	return {
+		name: primary.name,
+		...primary.functionSources && replica.functionSources ? { functionSources: true } : {},
+		async execute(op, context) {
+			if (op.kind === "select" && !state.pinned) return replica.execute(op, context);
+			const result = await primary.execute(op, context);
+			if (op.kind !== "select" && result.ok) state.pin();
+			return result;
+		},
+		...primary.rpc ? { async rpc(name, args, context) {
+			if (context.get && !state.pinned && replica.rpc) return replica.rpc(name, args, context);
+			const result = await primary.rpc(name, args, context);
+			if (!context.get && result.ok) state.pin();
+			return result;
+		} } : {},
+		...batch ? { batch: (ops, context) => !state.pinned && replicaBatch ? replicaBatch(ops, context) : batch(ops, context) } : {}
+	};
+}
+//#endregion
+export { replicaState as a, primaryCookieWrite as i, PRIMARY_COOKIE as n, routedExecutor as o, pinnedUntil as r, withPrimaryPin as s, DEFAULT_PIN_MS as t };

package/dist/{view-Bn6HNKUe.js → resolve-D_IcnvFd.js}

@@ -1,9 +1,184 @@
-import { n as dbError } from "./errors-DtwXa6b8.js";
+import { n as dbError } from "./errors-B11Duf73.js";
 import { t as consoleLogger } from "./logger-glM28NVN.js";
 import { n as decodeJwtPayload } from "./base64-D2gsioCY.js";
-import { a as delegationOf, i as actorOf, n as impersonatorOf, r as userContext } from "./impersonation-BgSHAYLf.js";
+import { a as actorOf, i as userContext } from "./impersonation-DcqaTBHx.js";
 import { DEFAULT_COOKIE_OPTIONS, createChunks, isChunkLike, parseCookieHeader, serializeCookieHeader, stringFromBase64URL, stringToBase64URL } from "@supabase/ssr";
 import { extractCredentials, verifyCredentials } from "@supabase/server/core";
+//#region src/auth/session.ts
+const DEFAULT_SESSION_ENCODING = "user-and-tokens";
+const BASE64_PREFIX = "base64-";
+/** Headers that keep responses carrying session cookies out of shared caches. */
+const AUTH_CACHE_HEADERS = {
+	"Cache-Control": "private, no-cache, no-store, must-revalidate, max-age=0",
+	Expires: "0",
+	Pragma: "no-cache"
+};
+/** `sb-<first label of the hostname>-auth-token`, the supabase-js default. */
+function sessionCookieName(url) {
+	let name = cookieNames.get(url);
+	if (name === void 0) {
+		name = `sb-${new URL(url).hostname.split(".")[0] ?? ""}-auth-token`;
+		if (cookieNames.size < 16) cookieNames.set(url, name);
+	}
+	return name;
+}
+/** Project URLs come from configuration, so a handful of entries suffice. */
+const cookieNames = /* @__PURE__ */ new Map();
+function parseCookies(header) {
+	return header ? parseCookieHeader(header) : [];
+}
+function serializeCookie(write) {
+	return serializeCookieHeader(write.name, write.value, write.options);
+}
+/** Cookie values by name, per parsed cookie list: one request reads its session more than once. */
+const cookieMaps = /* @__PURE__ */ new WeakMap();
+function combine(cookies, name) {
+	let byName = cookieMaps.get(cookies);
+	if (!byName) {
+		byName = new Map(cookies.map((cookie) => [cookie.name, cookie.value]));
+		cookieMaps.set(cookies, byName);
+	}
+	const whole = byName.get(name);
+	if (whole) return whole;
+	const parts = [];
+	for (let index = 0;; index++) {
+		const part = byName.get(`${name}.${index}`);
+		if (!part) break;
+		parts.push(part);
+	}
+	return parts.length > 0 ? parts.join("") : void 0;
+}
+function isStoredSession(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const session = value;
+	return typeof session["access_token"] === "string" && typeof session["refresh_token"] === "string";
+}
+/**
+* Reads the session written by `@supabase/ssr` (plain or `base64-`, whole or
+* chunked, `user-and-tokens` or `tokens-only`). Mismatched chunks from a
+* partial write read as no session.
+*/
+function readSession(cookies, name) {
+	const raw = combine(cookies, name);
+	if (!raw) return null;
+	try {
+		const json = raw.startsWith(BASE64_PREFIX) ? stringFromBase64URL(raw.slice(7)) : raw;
+		const parsed = JSON.parse(json);
+		return isStoredSession(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+/** The encoding a stored session was written with: `tokens-only` without a `user`. */
+function sessionEncoding(session) {
+	return session.user === void 0 || session.user === null ? "tokens-only" : "user-and-tokens";
+}
+function encoded(session, encode) {
+	switch (encode) {
+		case "user-and-tokens": return JSON.stringify(session);
+		case "tokens-only": {
+			const { user: _user, ...tokens } = session;
+			return JSON.stringify(tokens);
+		}
+		default: return encode;
+	}
+}
+/**
+* Cookie writes that store `session` (or clear it with `null`) exactly like
+* `@supabase/ssr` with the same `encode`, and expire chunks the new value no
+* longer uses.
+*/
+function writeSession(existing, name, session, options = {}, { encode = DEFAULT_SESSION_ENCODING } = {}) {
+	const base = {
+		...DEFAULT_COOKIE_OPTIONS,
+		...options
+	};
+	const chunks = session ? createChunks(name, BASE64_PREFIX + stringToBase64URL(encoded(session, encode))) : [];
+	const kept = new Set(chunks.map((chunk) => chunk.name));
+	return [...existing.filter((cookie) => isChunkLike(cookie.name, name) && !kept.has(cookie.name)).map((cookie) => ({
+		name: cookie.name,
+		value: "",
+		options: {
+			...base,
+			maxAge: 0
+		}
+	})), ...chunks.map((chunk) => ({
+		name: chunk.name,
+		value: chunk.value,
+		options: base
+	}))];
+}
+/**
+* `Max-Age=0` writes for every chunk of the session cookie at each of
+* `scopes`, like `clearAuthCookiesAtScopes` from `@supabase/ssr`. Use it once
+* the cookie `domain` or `path` changed, for the scopes earlier deploys
+* wrote: browsers ignore writes for scopes the host doesn't own, but a scope
+* equal to the current one clears the live session.
+*/
+function clearSessionAtScopes(existing, name, scopes) {
+	if (scopes.length === 0) return [];
+	const chunks = existing.map((cookie) => cookie.name).filter((cookie) => isChunkLike(cookie, name));
+	return scopes.flatMap((scope) => {
+		const options = {
+			...DEFAULT_COOKIE_OPTIONS,
+			...scope.domain === void 0 ? {} : { domain: scope.domain },
+			...scope.path === void 0 ? {} : { path: scope.path },
+			maxAge: 0
+		};
+		return chunks.map((chunk) => ({
+			name: chunk,
+			value: "",
+			options
+		}));
+	});
+}
+/** Applies cookie writes to a cookie list, as the next request would see it. */
+function applyCookieWrites(cookies, writes) {
+	const next = new Map(cookies.map((cookie) => [cookie.name, cookie.value]));
+	for (const write of writes) if (write.options.maxAge === 0) next.delete(write.name);
+	else next.set(write.name, write.value);
+	return [...next].map(([name, value]) => ({
+		name,
+		value
+	}));
+}
+//#endregion
+//#region src/auth/ended.ts
+const DEFAULT_TIMEOUT_MS$1 = 5e3;
+function accessTokenOf(request, options) {
+	const bearer = extractCredentials(request).token;
+	if (bearer) return bearer;
+	return readSession(parseCookies(request.headers.get("cookie")), options.cookieName ?? sessionCookieName(options.url))?.access_token;
+}
+async function sessionStatus(input, options) {
+	const token = typeof input === "string" ? input : accessTokenOf(input, options);
+	if (!token) return "unknown";
+	const exp = decodeJwtPayload(token)?.["exp"];
+	if (typeof exp === "number" && exp * 1e3 <= (options.now ?? Date.now)()) return "unknown";
+	const doFetch = options.fetch ?? fetch;
+	try {
+		const response = await doFetch(`${options.url}/auth/v1/user`, {
+			headers: {
+				apikey: options.publishableKey,
+				authorization: `Bearer ${token}`
+			},
+			signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS$1)
+		});
+		await response.body?.cancel();
+		if (response.status === 401 || response.status === 403) return "ended";
+		return response.ok ? "active" : "unknown";
+	} catch {
+		return "unknown";
+	}
+}
+function clearSessionCookies(request, response, options) {
+	const writes = writeSession(parseCookies(request.headers.get("cookie")), options.cookieName ?? sessionCookieName(options.url), null, options.cookie);
+	if (writes.length === 0) return response;
+	for (const write of writes) response.headers.append("set-cookie", serializeCookie(write));
+	for (const [key, value] of Object.entries(AUTH_CACHE_HEADERS)) response.headers.set(key, value);
+	return response;
+}
+//#endregion
 //#region src/auth/refresh.ts
 /**
 * How long a finished refresh is reused for requests still carrying the old
@@ -12,6 +187,8 @@ import { extractCredentials, verifyCredentials } from "@supabase/server/core";
 */
 const REUSE_MS = 1e4;
 const DEFAULT_TIMEOUT_MS = 5e3;
+/** Finished refreshes kept for reuse; a burst of sign-ins can't grow it past this. */
+const RECENT_MAX = 1e3;
 const inflight = /* @__PURE__ */ new Map();
 const recent = /* @__PURE__ */ new Map();
 function shared(outcome) {
@@ -80,120 +257,34 @@ async function request(refreshToken, options, now) {
 * window so parallel requests carrying the old cookie converge on one session.
 */
 function refreshSession(refreshToken, options) {
-	const now = (options.now ?? Date.now)();
+	const clock = options.now ?? Date.now;
+	const now = clock();
 	prune(now);
-	const cached = recent.get(refreshToken);
+	const key = `${options.url}\n${refreshToken}`;
+	const cached = recent.get(key);
 	if (cached) return Promise.resolve(shared(cached.outcome));
-	const pending = inflight.get(refreshToken);
+	const pending = inflight.get(key);
 	if (pending) return pending.then(shared);
 	const promise = request(refreshToken, options, now).then((outcome) => {
 		if (outcome.ok || outcome.reason === "rejected") {
-			recent.delete(refreshToken);
-			recent.set(refreshToken, {
+			recent.delete(key);
+			recent.set(key, {
 				outcome,
-				until: now + REUSE_MS
+				until: clock() + REUSE_MS
 			});
+			if (recent.size > RECENT_MAX) {
+				const oldest = recent.keys().next();
+				if (!oldest.done) recent.delete(oldest.value);
+			}
 		}
 		return outcome;
 	}).finally(() => {
-		inflight.delete(refreshToken);
+		inflight.delete(key);
 	});
-	inflight.set(refreshToken, promise);
+	inflight.set(key, promise);
 	return promise;
 }
 //#endregion
-//#region src/auth/session.ts
-const BASE64_PREFIX = "base64-";
-/** Headers that keep responses carrying session cookies out of shared caches. */
-const AUTH_CACHE_HEADERS = {
-	"Cache-Control": "private, no-cache, no-store, must-revalidate, max-age=0",
-	Expires: "0",
-	Pragma: "no-cache"
-};
-/** `sb-<first label of the hostname>-auth-token`, the supabase-js default. */
-function sessionCookieName(url) {
-	let name = cookieNames.get(url);
-	if (name === void 0) {
-		name = `sb-${new URL(url).hostname.split(".")[0] ?? ""}-auth-token`;
-		if (cookieNames.size < 16) cookieNames.set(url, name);
-	}
-	return name;
-}
-/** Project URLs come from configuration, so a handful of entries suffice. */
-const cookieNames = /* @__PURE__ */ new Map();
-function parseCookies(header) {
-	return header ? parseCookieHeader(header) : [];
-}
-function serializeCookie(write) {
-	return serializeCookieHeader(write.name, write.value, write.options);
-}
-function combine(cookies, name) {
-	const byName = new Map(cookies.map((cookie) => [cookie.name, cookie.value]));
-	const whole = byName.get(name);
-	if (whole) return whole;
-	const parts = [];
-	for (let index = 0;; index++) {
-		const part = byName.get(`${name}.${index}`);
-		if (!part) break;
-		parts.push(part);
-	}
-	return parts.length > 0 ? parts.join("") : void 0;
-}
-function isStoredSession(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const session = value;
-	return typeof session["access_token"] === "string" && typeof session["refresh_token"] === "string";
-}
-/**
-* Reads the session written by `@supabase/ssr` (plain or `base64-`, whole or
-* chunked). Mismatched chunks from a partial write read as no session.
-*/
-function readSession(cookies, name) {
-	const raw = combine(cookies, name);
-	if (!raw) return null;
-	try {
-		const json = raw.startsWith(BASE64_PREFIX) ? stringFromBase64URL(raw.slice(7)) : raw;
-		const parsed = JSON.parse(json);
-		return isStoredSession(parsed) ? parsed : null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Cookie writes that store `session` (or clear it with `null`) exactly like
-* `@supabase/ssr`, and expire chunks the new value no longer uses.
-*/
-function writeSession(existing, name, session, options = {}) {
-	const base = {
-		...DEFAULT_COOKIE_OPTIONS,
-		...options
-	};
-	const chunks = session ? createChunks(name, BASE64_PREFIX + stringToBase64URL(JSON.stringify(session))) : [];
-	const kept = new Set(chunks.map((chunk) => chunk.name));
-	return [...existing.filter((cookie) => isChunkLike(cookie.name, name) && !kept.has(cookie.name)).map((cookie) => ({
-		name: cookie.name,
-		value: "",
-		options: {
-			...base,
-			maxAge: 0
-		}
-	})), ...chunks.map((chunk) => ({
-		name: chunk.name,
-		value: chunk.value,
-		options: base
-	}))];
-}
-/** Applies cookie writes to a cookie list, as the next request would see it. */
-function applyCookieWrites(cookies, writes) {
-	const next = new Map(cookies.map((cookie) => [cookie.name, cookie.value]));
-	for (const write of writes) if (write.options.maxAge === 0) next.delete(write.name);
-	else next.set(write.name, write.value);
-	return [...next].map(([name, value]) => ({
-		name,
-		value
-	}));
-}
-//#endregion
 //#region src/auth/resolve.ts
 function expiryOf(session) {
 	if (typeof session.expires_at === "number") return session.expires_at;
@@ -215,60 +306,28 @@ let memoByJwks = /* @__PURE__ */ new WeakMap();
 /**
 * Tokens that already verified, until they expire. Every private-cache scope
 * and island resolves the same token again; this skips the signature check.
+* A hit skips the audience and issuer checks too, so both are part of the key.
 */
 function memoFor(options) {
 	const jwks = options.jwks ?? options.env.jwks;
-	if (jwks && typeof jwks === "object" && !(jwks instanceof URL)) {
-		let memo = memoByJwks.get(jwks);
-		if (!memo) memoByJwks.set(jwks, memo = /* @__PURE__ */ new Map());
-		return memo;
-	}
+	const inline = jwks && typeof jwks === "object" && !(jwks instanceof URL);
 	const key = JSON.stringify([
-		String(jwks ?? options.env.jwksUrl),
+		inline ? null : String(jwks ?? options.env.jwksUrl),
 		options.env.url,
 		options.audience ?? null,
 		options.issuer ?? null
 	]);
+	if (inline) {
+		let byKey = memoByJwks.get(jwks);
+		if (!byKey) memoByJwks.set(jwks, byKey = /* @__PURE__ */ new Map());
+		let memo = byKey.get(key);
+		if (!memo) byKey.set(key, memo = /* @__PURE__ */ new Map());
+		return memo;
+	}
 	let memo = memoByUrl.get(key);
 	if (!memo) memoByUrl.set(key, memo = /* @__PURE__ */ new Map());
 	return memo;
 }
-function sameJson(a, b) {
-	if (a === b) return true;
-	if (typeof a !== "object" || typeof b !== "object" || !a || !b) return false;
-	if (Array.isArray(a) !== Array.isArray(b)) return false;
-	const left = Object.entries(a);
-	const right = new Map(Object.entries(b));
-	return left.length === right.size && left.every(([key, value]) => right.has(key) && sameJson(value, right.get(key)));
-}
-/**
-* Records a token that `@supabase/server` verified for this request, so the
-* next `resolveAuth` with these options doesn't verify it again. Only when
-* `claims` is the token's own payload, it hasn't expired, and its `iss` and
-* `aud` pass the checks these options would apply; otherwise returns false
-* and the token is verified as usual.
-*/
-function rememberVerified(options, verified) {
-	const { token, claims, user } = verified;
-	const now = Math.floor((options.now ?? Date.now)() / 1e3);
-	const expiresAt = typeof claims.exp === "number" ? claims.exp : null;
-	if (expiresAt === null || expiresAt <= now) return false;
-	if (!sameJson(decodeJwtPayload(token), claims)) return false;
-	const issuers = [options.issuer ?? `${options.env.url}/auth/v1`].flat();
-	if (typeof claims.iss !== "string" || !issuers.includes(claims.iss)) return false;
-	const audiences = [options.audience ?? "authenticated"].flat();
-	const aud = claims.aud;
-	const given = Array.isArray(aud) ? aud : [aud];
-	if (!audiences.some((audience) => given.includes(audience))) return false;
-	remember(memoFor(options), token, {
-		kind: "user",
-		token,
-		claims,
-		user,
-		expiresAt
-	}, expiresAt);
-	return true;
-}
 function remembered(memo, token, now) {
 	const hit = memo.get(token);
 	if (!hit) return void 0;
@@ -443,11 +502,12 @@ async function verifyOnce(credentials, modes, options, source) {
 		reason: "none"
 	};
 }
-function resolution(auth, cookies, writes = []) {
+function resolution(auth, cookies, writes = [], ended = false) {
 	const headers = writes.length > 0 ? AUTH_CACHE_HEADERS : {};
 	let requestCookies;
 	return {
 		auth,
+		...ended ? { sessionEnded: true } : {},
 		cookies: writes,
 		headers,
 		/** Parsed on first read: bearer requests rarely need their cookies. */
@@ -509,10 +569,11 @@ async function resolveAuth(request, options) {
 		reason: "none"
 	}, cookies);
 	const name = options.cookie?.name ?? sessionCookieName(options.env.url);
+	const encoding = options.cookie?.encode === void 0 ? {} : { encode: options.cookie.encode };
 	const session = readSession(cookies(), name);
 	if (!session) {
 		const stale = cookies().some((cookie) => cookie.name === name || cookie.name.startsWith(`${name}.`));
-		const writes = stale && options.refresh ? writeSession(cookies(), name, null, options.cookie?.options) : [];
+		const writes = stale && options.refresh ? writeSession(cookies(), name, null, options.cookie?.options, encoding) : [];
 		return resolution({
 			kind: "anon",
 			reason: stale ? "signed_out" : "none"
@@ -521,11 +582,22 @@ async function resolveAuth(request, options) {
 	const now = Math.floor((options.now ?? Date.now)() / 1e3);
 	const expiry = expiryOf(session);
 	const leeway = options.refresh ? options.leeway ?? 60 : 0;
-	if (expiry !== void 0 && expiry - leeway > now) {
+	const fresh = expiry !== void 0 && expiry - leeway > now;
+	if (fresh) {
 		const state = await verify({
 			token: session.access_token,
 			apikey: null
 		}, ["user"], options, "cookie");
+		if (state.kind === "user" && options.checkSession && await sessionStatus(state.token, {
+			url: options.env.url,
+			publishableKey: options.env.publishableKey,
+			...options.fetch ? { fetch: options.fetch } : {},
+			...options.refreshTimeoutMs === void 0 ? {} : { timeoutMs: options.refreshTimeoutMs },
+			...options.now ? { now: options.now } : {}
+		}) === "ended") return resolution({
+			kind: "anon",
+			reason: "signed_out"
+		}, cookies, options.refresh ? writeSession(cookies(), name, null, options.cookie?.options, encoding) : [], true);
 		if (state.kind !== "invalid" || state.reason !== "token" || state.error.kind === "network") return resolution(state, cookies);
 		if (!options.refresh) return resolution({
 			kind: "anon",
@@ -555,16 +627,25 @@ async function resolveAuth(request, options) {
 		durationMs: performance.now() - started
 	});
 	if (!outcome.ok) {
-		if (outcome.reason === "network") return resolution({
-			kind: "anon",
-			reason: "refresh_failed"
-		}, cookies);
+		if (outcome.reason === "network") {
+			if (!fresh && expiry !== void 0 && expiry > now) {
+				const state = await verify({
+					token: session.access_token,
+					apikey: null
+				}, ["user"], options, "cookie");
+				if (state.kind !== "invalid") return resolution(state, cookies);
+			}
+			return resolution({
+				kind: "anon",
+				reason: "refresh_failed"
+			}, cookies);
+		}
 		return resolution({
 			kind: "anon",
 			reason: "signed_out"
-		}, cookies, writeSession(cookies(), name, null, options.cookie?.options));
+		}, cookies, writeSession(cookies(), name, null, options.cookie?.options, encoding));
 	}
-	const writes = writeSession(cookies(), name, outcome.session, options.cookie?.options);
+	const writes = writeSession(cookies(), name, outcome.session, options.cookie?.options, encoding);
 	return resolution(await verify({
 		token: outcome.session.access_token,
 		apikey: null
@@ -582,6 +663,19 @@ function authContext(auth) {
 			},
 			claims: { role: "service_role" }
 		};
+		case "apiKey": return {
+			actor: auth.userId ? {
+				id: auth.userId,
+				kind: "user",
+				role: "authenticated"
+			} : {
+				id: `api-key:${auth.keyId}`,
+				kind: "service",
+				role: "authenticated"
+			},
+			claims: auth.claims,
+			...auth.organizationId ? { tenant: auth.organizationId } : {}
+		};
 		case "anon":
 		case "invalid": return {
 			actor: {
@@ -595,90 +689,4 @@ function authContext(auth) {
 	}
 }
 //#endregion
-//#region src/auth/mfa.ts
-/** The session's assurance level from its claims; anything but `aal2` reads as `aal1`. */
-function aalOf(claims) {
-	return claims["aal"] === "aal2" ? "aal2" : "aal1";
-}
-/** The `amr` claim as typed entries, skipping malformed ones. */
-function amrOf(claims) {
-	const amr = claims["amr"];
-	if (!Array.isArray(amr)) return [];
-	return amr.flatMap((entry) => {
-		if (typeof entry !== "object" || entry === null) return [];
-		const { method, timestamp, provider } = entry;
-		if (typeof method !== "string" || typeof timestamp !== "number") return [];
-		return [typeof provider === "string" ? {
-			method,
-			timestamp,
-			provider
-		} : {
-			method,
-			timestamp
-		}];
-	});
-}
-/**
-* `undefined` when a user session meets `required`; otherwise a `forbidden`
-* error with `required` and code `INSUFFICIENT_AAL`, for the client to start
-* an MFA challenge. Non-user sessions pass: `allow` decides about them.
-*/
-function checkAal(auth, required) {
-	if (required === "aal1" || auth.kind !== "user" || !("claims" in auth)) return void 0;
-	if (aalOf(auth.claims) === "aal2") return void 0;
-	return dbError("forbidden", "Verify a second factor to continue", {
-		code: "INSUFFICIENT_AAL",
-		required
-	});
-}
-//#endregion
-//#region src/auth/view.ts
-/** Whether the token belongs to an anonymous user (`signInAnonymously()`). */
-function isAnonymousUser(claims) {
-	return "is_anonymous" in claims && claims.is_anonymous === true;
-}
-/** Drops the token from an `AuthState`, leaving only serializable fields. */
-function toSession(auth) {
-	switch (auth.kind) {
-		case "user": {
-			const impersonator = impersonatorOf(auth.claims);
-			const outcome = actorOf(auth.claims);
-			const actor = outcome.ok ? outcome.actor : void 0;
-			const client = actor?.kind === "oauth-client" ? actor : void 0;
-			const scopes = client ? delegationOf(auth.claims)?.scopes : void 0;
-			const delegation = client && (scopes || client.chain) ? {
-				scopes: scopes ?? [],
-				...client.chain ? { chain: client.chain } : {}
-			} : void 0;
-			return {
-				kind: "user",
-				user: auth.user,
-				claims: auth.claims,
-				expiresAt: auth.expiresAt,
-				...auth.profile === void 0 ? {} : { profile: auth.profile },
-				aal: aalOf(auth.claims),
-				anonymous: isAnonymousUser(auth.claims),
-				amr: amrOf(auth.claims),
-				...impersonator ? { impersonator } : {},
-				...actor ? { actor } : {},
-				...delegation ? { delegation } : {}
-			};
-		}
-		case "service": return {
-			kind: "service",
-			keyName: auth.keyName
-		};
-		case "anon": return {
-			kind: "anon",
-			reason: auth.reason
-		};
-		case "invalid": return {
-			kind: "invalid",
-			reason: auth.reason,
-			error: auth.error
-		};
-		default: return auth;
-	}
-}
-//#endregion
-export { writeSession as _, checkAal as a, prefetchJwks as c, AUTH_CACHE_HEADERS as d, applyCookieWrites as f, sessionCookieName as g, serializeCookie as h, amrOf as i, rememberVerified as l, readSession as m, toSession as n, authContext as o, parseCookies as p, aalOf as r, clientIp as s, isAnonymousUser as t, resolveAuth as u, refreshSession as v };
+export { writeSession as _, refreshSession as a, AUTH_CACHE_HEADERS as c, clearSessionAtScopes as d, parseCookies as f, sessionEncoding as g, sessionCookieName as h, resolveAuth as i, DEFAULT_SESSION_ENCODING as l, serializeCookie as m, clientIp as n, clearSessionCookies as o, readSession as p, prefetchJwks as r, sessionStatus as s, authContext as t, applyCookieWrites as u };