better-supabase 0.5.1 → 0.6.1

package/dist/{react-C_s7kiNz.js → hooks-1BTCJsiw.js}

@@ -1,9 +1,8 @@
-import { i as tenantClaimPaths, n as claimAt, r as claimsOf } from "./claims-BAf6c7is.js";
-import { n as invalidateTables, t as clearOnUserChange } from "./user-change-CHFEUro1.js";
-import { n as liveQuery, t as liveCount } from "./live-CdJBOc4f.js";
+import { r as invalidateTables, t as clearOnUserChange } from "./user-change-XzvgafU4.js";
+import { n as sessionUserId, r as specKey, t as claimedTenant } from "./keys-4MnkWTTh.js";
+import { n as liveQuery, t as liveCount } from "./live-CTAZQkwl.js";
 import { useSession } from "./react/session.js";
-import { REALTIME_SUBSCRIBE_STATES } from "@supabase/supabase-js";
-import { createContext, createElement, useCallback, useContext, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
+import { createContext, createElement, useContext, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
 //#region src/react/hooks.ts
 const ClientContext = createContext(null);
 const LOADING = {
@@ -66,12 +65,15 @@ function createHooks() {
 * resubscribes when the topic or the signed-in user changes.
 *
 * ```ts
-* useBroadcast(customersTopic, orgId ? { orgId } : null, {}, { invalidate: ['customers'] });
+* useBroadcast(customersTopic, organizationId ? { organizationId } : null, {}, { invalidate: ['customers'] });
 * ```
 */
 function useBroadcast(topic, values, handlers, options) {
-	const { client, queryClient } = useClientContext();
-	const auth = useAuth();
+	const context = useContext(ClientContext);
+	const supabase = options?.client ?? context?.client.supabase;
+	if (!supabase) throw new Error("better-supabase: useBroadcast needs <BetterSupabaseProvider client={bs}> or { client: supabase }");
+	const queryClient = options?.queryClient ?? context?.queryClient;
+	const auth = useBroadcastAuth(options?.client === void 0 ? context?.client : void 0, supabase);
 	const [status, setStatus] = useState("closed");
 	const latest = useRef({
 		handlers,
@@ -82,8 +84,9 @@ function useBroadcast(topic, values, handlers, options) {
 		options
 	};
 	const name = values ? topic.topic(values) : null;
-	const userId = auth.user?.id ?? null;
-	if (options?.invalidate && !queryClient) throw new Error("better-supabase: useBroadcast({ invalidate }) needs <BetterSupabaseProvider queryClient={...}>");
+	const userId = auth.userId;
+	const self = options?.self;
+	if (options?.invalidate && !queryClient) throw new Error("better-supabase: useBroadcast({ invalidate }) needs <BetterSupabaseProvider queryClient={...}> or { queryClient }");
 	useEffect(() => {
 		if (!name || auth.status === "loading") return;
 		const matched = topic.match(name);
@@ -100,8 +103,8 @@ function useBroadcast(topic, values, handlers, options) {
 			}
 			for (const queryKey of invalidate(message)) queryClient.invalidateQueries({ queryKey });
 		};
-		const subscription = topic.subscribe(client.supabase, matched, { "*": forward }, {
-			...latest.current.options?.self === void 0 ? {} : { self: latest.current.options.self },
+		const subscription = topic.subscribe(supabase, matched, { "*": forward }, {
+			...self === void 0 ? {} : { self },
 			onStatus: setStatus,
 			onInvalid: (message, issues) => latest.current.options?.onInvalid?.(message, issues)
 		});
@@ -110,21 +113,61 @@ function useBroadcast(topic, values, handlers, options) {
 			setStatus("closed");
 		};
 	}, [
-		client,
+		supabase,
 		topic,
 		name,
 		userId,
 		auth.status,
-		queryClient
+		queryClient,
+		self
 	]);
 	return status;
 }
-function claimedTenant(auth, meta) {
-	if (auth.status !== "signed-in") return void 0;
-	for (const path of tenantClaimPaths(claimsOf(meta).tenant)) {
-		const value = claimAt(auth.claims, path);
-		if (value !== void 0) return value;
-	}
+const NO_AUTH = () => () => void 0;
+/**
+* The user `useBroadcast` subscribes as: the provider's auth snapshot, or
+* for a plain supabase-js client, its auth state.
+*/
+function useBroadcastAuth(client, supabase) {
+	const snapshot = useSyncExternalStore(client?.auth.subscribe ?? NO_AUTH, client?.auth.current ?? (() => LOADING), () => LOADING);
+	const [plain, setPlain] = useState({
+		status: "loading",
+		userId: null
+	});
+	useEffect(() => {
+		if (client) return;
+		const { data } = supabase.auth.onAuthStateChange((_event, session) => {
+			setPlain({
+				status: session ? "signed-in" : "signed-out",
+				userId: session ? sessionUserId(session) : null
+			});
+		});
+		return () => {
+			data.subscription.unsubscribe();
+		};
+	}, [client, supabase]);
+	return client ? {
+		status: snapshot.status,
+		userId: snapshot.user?.id ?? null
+	} : plain;
+}
+/**
+* The spec from the render whose key last changed, so effects keep the
+* original values (`bigint`, Temporal) and only rerun on a different query.
+*/
+function useHeldSpec(spec) {
+	const key = spec ? specKey(spec) : null;
+	const [held, setHeld] = useState({
+		key,
+		spec: spec ?? null
+	});
+	if (held.key === key) return held;
+	const next = {
+		key,
+		spec: spec ?? null
+	};
+	setHeld(next);
+	return next;
 }
 /**
 * Keeps a query fresh: invalidates every cached query that read a table the
@@ -142,25 +185,30 @@ function useLiveQuery(spec, options = {}) {
 	const auth = useAuth();
 	const [status, setStatus] = useState("closed");
 	if (spec && !queryClient) throw new Error("better-supabase: useLiveQuery needs <BetterSupabaseProvider queryClient={...}>");
-	const key = spec ? JSON.stringify(spec) : null;
+	const held = useHeldSpec(spec);
+	const joined = useRef(null);
 	const tenant = options.tenant ?? claimedTenant(auth, client.betterSupabase.meta);
 	const userId = auth.user?.id ?? null;
 	const debounceMs = options.debounceMs;
 	useEffect(() => {
-		if (!key || !queryClient || auth.status === "loading") return;
-		const live = liveQuery(client.betterSupabase, client.supabase, JSON.parse(key), {
+		if (!held.spec || !queryClient || auth.status === "loading") return;
+		const resumed = joined.current === held.key;
+		joined.current = held.key;
+		const live = liveQuery(client.betterSupabase, client.supabase, held.spec, {
 			onChange: (tables) => void invalidateTables(queryClient, tables),
 			onStatus: setStatus,
 			...tenant === void 0 ? {} : { tenant },
+			...userId === null ? {} : { user: userId },
 			...debounceMs === void 0 ? {} : { debounceMs }
 		});
+		if (resumed) live.ready.then(() => void invalidateTables(queryClient, live.tables), () => void 0);
 		return () => {
 			live.unsubscribe();
 		};
 	}, [
 		client,
 		queryClient,
-		key,
+		held,
 		tenant,
 		userId,
 		auth.status,
@@ -187,34 +235,53 @@ function useLiveCount(source, options = {}) {
 	const [state, setState] = useState({
 		key: null,
 		count: void 0,
+		at: 0,
 		error: void 0
 	});
 	const [status, setStatus] = useState("closed");
-	const key = spec ? JSON.stringify(spec) : null;
+	const held = useHeldSpec(spec);
+	const joined = useRef(null);
 	const tenant = options.tenant ?? claimedTenant(auth, client.betterSupabase.meta);
 	const userId = auth.user?.id ?? null;
 	const debounceMs = options.debounceMs;
 	const hasInitial = initial !== void 0;
+	const seedAt = seed?.at;
 	useEffect(() => {
-		if (!key || auth.status === "loading") return;
-		const live = liveCount(client.betterSupabase, client.supabase, client.db, JSON.parse(key), {
-			immediate: !hasInitial,
+		if (!held.spec || auth.status === "loading") return;
+		const key = held.key;
+		const previous = joined.current?.key === key ? joined.current : null;
+		joined.current = {
+			key,
+			at: previous?.at ?? seedAt ?? 0
+		};
+		const since = previous ? previous.at : seedAt;
+		const live = liveCount(client.betterSupabase, client.supabase, client.db, held.spec, {
+			immediate: !hasInitial && !previous,
+			...since === void 0 ? {} : { since },
 			onCount: (count) => {
+				const at = Date.now();
+				if (joined.current?.key === key) joined.current = {
+					key,
+					at
+				};
 				setState({
 					key,
 					count,
+					at,
 					error: void 0
 				});
 			},
 			onError: (error) => {
-				setState((previous) => ({
+				setState((last) => ({
 					key,
-					count: previous.key === key ? previous.count : void 0,
+					count: last.key === key ? last.count : void 0,
+					at: last.key === key ? last.at : 0,
 					error
 				}));
 			},
 			onStatus: setStatus,
 			...tenant === void 0 ? {} : { tenant },
+			...userId === null ? {} : { user: userId },
 			...debounceMs === void 0 ? {} : { debounceMs }
 		});
 		return () => {
@@ -222,117 +289,21 @@ function useLiveCount(source, options = {}) {
 		};
 	}, [
 		client,
-		key,
+		held,
 		tenant,
 		userId,
 		auth.status,
 		debounceMs,
-		hasInitial
+		hasInitial,
+		seedAt
 	]);
-	const fresh = state.key === key;
+	const fresh = state.key === held.key;
+	const seedNewer = seedAt !== void 0 && seed?.count !== null && seedAt > state.at;
 	return {
-		count: fresh && state.count !== void 0 ? state.count : initial,
+		count: fresh && state.count !== void 0 && !seedNewer ? state.count : initial,
 		status,
 		error: fresh ? state.error : void 0
 	};
 }
 //#endregion
-//#region src/react/notifications.ts
-const unread = (items) => items.filter((item) => typeof item === "object" && item !== null && "readAt" in item && item.readAt === null).length;
-/** Joins a private topic and returns the function that leaves it. */
-function watchTopic(supabase, topic, watch) {
-	let closed = false;
-	let joined = false;
-	const channel = supabase.channel(topic, { config: { private: true } });
-	channel.on("broadcast", { event: "*" }, (message) => {
-		watch.onMessage(message.event, message["payload"]);
-	});
-	(async () => {
-		watch.onStatus("joining");
-		await supabase.realtime.setAuth();
-		if (closed) return;
-		channel.subscribe((state) => {
-			switch (state) {
-				case REALTIME_SUBSCRIBE_STATES.SUBSCRIBED:
-					if (joined) watch.onRejoin();
-					joined = true;
-					watch.onStatus("subscribed");
-					return;
-				case REALTIME_SUBSCRIBE_STATES.CLOSED:
-					watch.onStatus("closed");
-					return;
-				case REALTIME_SUBSCRIBE_STATES.CHANNEL_ERROR:
-				case REALTIME_SUBSCRIBE_STATES.TIMED_OUT:
-					watch.onStatus("error");
-					return;
-				default: throw new Error(`Unknown realtime status ${String(state)}`);
-			}
-		});
-	})();
-	return () => {
-		closed = true;
-		supabase.removeChannel(channel);
-		watch.onStatus("closed");
-	};
-}
-/**
-* The signed-in user's notifications, kept current: loads them, then loads
-* again after each broadcast on `topic` and after the channel rejoins.
-*
-* ```tsx
-* const { items, count } = useNotifications({
-*   topic: `org:${orgId}:notifications:${userId}`,
-*   load: () => listNotifications(orgId),
-* });
-* ```
-*/
-function useNotifications(options) {
-	const supabase = useSupabase();
-	const auth = useAuth();
-	const [items, setItems] = useState(void 0);
-	const [error, setError] = useState(void 0);
-	const [status, setStatus] = useState("closed");
-	const latest = useRef(options);
-	latest.current = options;
-	const userId = auth.user?.id ?? null;
-	const refresh = useCallback(async () => {
-		const current = latest.current;
-		try {
-			const merged = (await Promise.all([current.load, ...current.sources ?? []].map((source) => source()))).flat();
-			setItems(current.sort ? [...merged].sort(current.sort) : merged);
-			setError(void 0);
-		} catch (cause) {
-			setError(cause);
-		}
-	}, []);
-	const topic = options.topic;
-	useEffect(() => {
-		if (auth.status !== "signed-in") return;
-		refresh();
-		if (!topic) return;
-		return watchTopic(supabase, topic, {
-			onMessage: (event, payload) => {
-				latest.current.onMessage?.(event, payload);
-				refresh();
-			},
-			onRejoin: () => void refresh(),
-			onStatus: setStatus
-		});
-	}, [
-		supabase,
-		topic,
-		userId,
-		auth.status,
-		refresh
-	]);
-	const list = items ?? [];
-	return {
-		items,
-		count: (options.count ?? unread)(list),
-		status,
-		error,
-		refresh
-	};
-}
-//#endregion
-export { useBroadcast as a, useSupabase as c, useAuth as i, BetterSupabaseProvider as n, useLiveCount as o, createHooks as r, useLiveQuery as s, useNotifications as t };
+export { useBroadcast as a, useLiveQuery as c, useAuth as i, useSupabase as l, ClientContext as n, useBroadcastAuth as o, createHooks as r, useLiveCount as s, BetterSupabaseProvider as t };

package/dist/http-Cv4T29xh.js

@@ -0,0 +1,40 @@
+import { i as toWebHeaders, r as nodeRequestUrl, t as applyWebHeaders } from "./node-headers-C71zNQHe.js";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+//#region src/node/http.ts
+/**
+* A Node `IncomingMessage` as a Web `Request`. Express, Fastify and Koa
+* pass theirs (`req`, `request.raw`, `ctx.req`). With `body: false` the
+* stream stays unread, for middleware that runs before a body parser.
+*/
+function toWebRequest(req, options = {}) {
+	const method = req.method ?? "GET";
+	const hasBody = (options.body ?? true) && method !== "GET" && method !== "HEAD";
+	const controller = new AbortController();
+	req.once("close", () => {
+		if (!req.complete) controller.abort();
+	});
+	return new Request(nodeRequestUrl(req, options.trustProxy ?? false), {
+		method,
+		headers: toWebHeaders(req.headers),
+		signal: controller.signal,
+		...hasBody ? {
+			body: Readable.toWeb(req),
+			duplex: "half"
+		} : {}
+	});
+}
+/** Writes a Web `Response` to a Node `ServerResponse`, streaming the body. */
+async function sendWebResponse(res, response) {
+	res.statusCode = response.status;
+	if (response.statusText) res.statusMessage = response.statusText;
+	applyWebHeaders(res, response.headers);
+	if (!response.body) {
+		res.end();
+		return;
+	}
+	const body = response.body;
+	await pipeline(Readable.fromWeb(body), res);
+}
+//#endregion
+export { toWebRequest as n, sendWebResponse as t };

package/dist/http-DdYadv-o.js

@@ -0,0 +1,126 @@
+import { getEnv } from "@supabase/middleware";
+import { fromSupabaseUrl } from "@supabase/server/oauth-protected-resource";
+//#region src/mcp/http.ts
+/** The RFC 9728 well-known prefix. The Supabase Edge Functions gateway never routes it to a function. */
+const WELL_KNOWN = "/.well-known/oauth-protected-resource";
+/** The path suffix `withOAuthProtectedResource` serves, reachable through `/functions/v1/<slug>`. */
+const SUFFIX = "/oauth-protected-resource";
+/** The prefix the Edge Functions gateway strips before the function sees the request. */
+const EDGE_PREFIX = "/functions/v1";
+const ALLOW_HEADERS = "Authorization, Content-Type, Accept, Mcp-Protocol-Version, Mcp-Session-Id, Mcp-Method, Mcp-Name";
+const trim = (value) => value.replace(/\/+$/, "");
+/**
+* Whether the request runs on Supabase Edge Functions, detected as
+* `@supabase/server` 1.9 does, minus its plain-Deno fallback so a Deno Deploy
+* server keeps its own URLs.
+*/
+function onEdgeFunctions() {
+	return ["SUPABASE_FUNCTION_SLUG", "SB_EXECUTION_ID"].some((key) => Boolean(getEnv(key)));
+}
+/** The public origin: `SUPABASE_PUBLIC_URL`, else the gateway's `X-Forwarded-*` headers. */
+function edgeOrigin(request) {
+	const publicUrl = getEnv("SUPABASE_PUBLIC_URL");
+	if (publicUrl) return trim(publicUrl);
+	const url = new URL(request.url);
+	const host = request.headers.get("x-forwarded-host") ?? url.hostname;
+	const proto = (request.headers.get("x-forwarded-proto") ?? url.protocol.slice(0, -1)).toLowerCase();
+	const port = host.includes(":") ? "" : request.headers.get("x-forwarded-port") ?? url.port;
+	return `${proto}://${host}${port && !(proto === "https" && port === "443" || proto === "http" && port === "80") ? `:${port}` : ""}`;
+}
+function stripMetadata(pathname) {
+	if (pathname.startsWith(WELL_KNOWN)) return pathname.slice(37);
+	if (pathname.endsWith(SUFFIX)) return pathname.slice(0, -25);
+	return pathname;
+}
+function edgePath(request) {
+	const slug = getEnv("SUPABASE_FUNCTION_SLUG");
+	if (slug) return `${EDGE_PREFIX}/${slug}`;
+	return trim(`${EDGE_PREFIX}${stripMetadata(new URL(request.url).pathname)}`);
+}
+/** A request for the RFC 9728 metadata, at the well-known prefix or the `{resource}/oauth-protected-resource` suffix. */
+function isMetadataRequest(request) {
+	const { pathname } = new URL(request.url);
+	if (pathname === WELL_KNOWN || pathname.startsWith(`${WELL_KNOWN}/`)) return true;
+	return pathname.endsWith(SUFFIX) && request.method !== "POST";
+}
+/**
+* The public URLs of an MCP endpoint. On Supabase Edge Functions they come
+* from the gateway (the request URL is internal there, without
+* `/functions/v1`), and the metadata is advertised at the suffix route.
+*/
+function discovery(options, supabaseUrl) {
+	const resource = (request) => {
+		if (typeof options.resource === "function") return options.resource(request);
+		if (options.resource) return options.resource;
+		if (onEdgeFunctions()) return `${edgeOrigin(request)}${edgePath(request)}`;
+		const url = new URL(request.url);
+		return trim(`${url.origin}${stripMetadata(url.pathname)}`);
+	};
+	return {
+		resource,
+		metadataUrl: (request) => {
+			const target = new URL(resource(request));
+			const path = trim(target.pathname);
+			return onEdgeFunctions() ? `${target.origin}${path}${SUFFIX}` : `${target.origin}${WELL_KNOWN}${path}`;
+		},
+		authorizationServers: (request) => {
+			if (options.authorizationServers) return options.authorizationServers;
+			return onEdgeFunctions() ? [`${edgeOrigin(request)}/auth/v1`] : [fromSupabaseUrl(supabaseUrl())];
+		},
+		host: (request) => {
+			return (onEdgeFunctions() ? request.headers.get("x-forwarded-host") : null) ?? request.headers.get("host");
+		}
+	};
+}
+/** The `OPTIONS` answer for the metadata route. */
+function metadataPreflight() {
+	return new Response(null, {
+		status: 204,
+		headers: {
+			"access-control-allow-origin": "*",
+			"access-control-allow-methods": "GET, OPTIONS",
+			"access-control-allow-headers": "Content-Type, Mcp-Protocol-Version"
+		}
+	});
+}
+/** The `OPTIONS` answer for the MCP endpoint. */
+function endpointPreflight(request, allowedOrigins) {
+	return withCors(new Response(null, {
+		status: 204,
+		headers: {
+			"access-control-allow-methods": "POST, OPTIONS",
+			"access-control-allow-headers": ALLOW_HEADERS,
+			"access-control-max-age": "86400"
+		}
+	}), request, allowedOrigins);
+}
+/**
+* Adds CORS headers to an endpoint response, keeping any the handler set.
+* With `allowedOrigins` a listed origin is echoed; otherwise any origin may
+* call, which is safe because the token travels in a header, not a cookie.
+*/
+function withCors(response, request, allowedOrigins) {
+	const origin = request.headers.get("origin");
+	const allow = allowedOrigins ? origin && allowedOrigins.includes(origin) ? origin : null : "*";
+	const apply = (headers) => {
+		if (allow && !headers.has("access-control-allow-origin")) {
+			headers.set("access-control-allow-origin", allow);
+			if (allow !== "*") headers.append("vary", "Origin");
+		}
+		if (!headers.has("access-control-expose-headers")) headers.set("access-control-expose-headers", "WWW-Authenticate");
+	};
+	try {
+		apply(response.headers);
+		return response;
+	} catch {
+		const headers = new Headers(response.headers);
+		apply(headers);
+		return new Response(response.body, {
+			status: response.status,
+			statusText: response.statusText,
+			headers
+		});
+	}
+}
+//#endregion
+export { withCors as a, metadataPreflight as i, endpointPreflight as n, isMetadataRequest as r, discovery as t };

package/dist/image-url-pIVlO6R1.js

@@ -0,0 +1,41 @@
+//#region src/storage/image-url.ts
+/** Storage's image transformation limits. */
+const MAX_SIDE = 2500;
+const QUALITY = {
+	min: 20,
+	max: 100
+};
+const clamp = (value, min, max) => Math.min(max, Math.max(min, Math.round(value)));
+/**
+* Turns public Storage object URLs into Supabase image transformation URLs
+* (`/render/image/public`) at a given size. Any other URL (local files,
+* other hosts, signed URLs) comes back as `undefined`: a signed URL's token
+* covers the transform it was signed with, so sign it with `renderUrl()`.
+*
+* ```ts
+* const imageUrl = storageImageUrl({ url: SUPABASE_URL })
+* imageUrl(avatar, { width: 96 }) ?? avatar
+* ```
+*/
+function storageImageUrl(options) {
+	const storage = `${options.url.replace(/\/+$/, "")}/storage/v1`;
+	const publicPrefixes = [`${storage}/object/public/`, `${storage}/render/image/public/`].map((prefix) => ({
+		prefix,
+		length: new URL(prefix).pathname.length
+	}));
+	return (src, size) => {
+		const prefix = publicPrefixes.find((candidate) => src.startsWith(candidate.prefix));
+		if (prefix === void 0) return;
+		const source = new URL(src);
+		const object = source.pathname.slice(prefix.length);
+		const target = new URL(`${storage}/render/image/public/${object}`);
+		for (const [key, value] of source.searchParams) target.searchParams.set(key, value);
+		target.searchParams.set("width", String(clamp(size.width, 1, MAX_SIDE)));
+		if (size.height !== void 0) target.searchParams.set("height", String(clamp(size.height, 1, MAX_SIDE)));
+		if (size.quality !== void 0) target.searchParams.set("quality", String(clamp(size.quality, QUALITY.min, QUALITY.max)));
+		if (options.resize) target.searchParams.set("resize", options.resize);
+		return target.toString();
+	};
+}
+//#endregion
+export { storageImageUrl as t };

package/dist/{impersonation-BgSHAYLf.js → impersonation-DcqaTBHx.js}

@@ -15,7 +15,7 @@ function actorAt(outer, id) {
 	const sessionId = outer["session_id"];
 	const readOnly = outer["read_only"];
 	const reason = outer["reason"];
-	if (kind === "support" || kind === void 0 && sessionId !== void 0) {
+	if (kind === "support") {
 		if (typeof sessionId !== "string" || sessionId === "") return INVALID;
 		if (readOnly !== void 0 && typeof readOnly !== "boolean") return INVALID;
 		return {
@@ -37,7 +37,7 @@ function actorAt(outer, id) {
 			...typeof reason === "string" ? { reason } : {}
 		}
 	};
-	if (kind !== void 0) return INVALID;
+	if (kind !== void 0 || sessionId !== void 0) return INVALID;
 	return {
 		ok: true,
 		actor: {
@@ -48,10 +48,10 @@ function actorAt(outer, id) {
 	};
 }
 /**
-* Reads only `act` and `client_id`, the way PermDock's `actorOf` does. An
+* Reads only `act` and `client_id`. An
 * `act` that is not a chain of objects each with a non-empty `sub`, a
-* `kind` other than `support` or `impersonation`, or a support level without
-* a `session_id` is `{ ok: false }`: the session must not pass as the user
+* `kind` other than `support` or `impersonation`, a support level without
+* a `session_id`, or a `session_id` without `kind` is `{ ok: false }`: the session must not pass as the user
 * alone.
 */
 function actorOf(claims) {
@@ -95,6 +95,21 @@ function actClaim(options) {
 		reason: options.reason
 	};
 }
+/** The `act` claim that `impersonatorOf` reads back as `impersonator`. */
+function impersonatorClaim(impersonator) {
+	const reason = impersonator.reason === void 0 ? {} : { reason: impersonator.reason };
+	return impersonator.kind === "support" ? {
+		kind: "support",
+		sub: impersonator.id,
+		session_id: impersonator.sessionId,
+		read_only: impersonator.readOnly ?? true,
+		...reason
+	} : {
+		kind: "impersonation",
+		sub: impersonator.id,
+		...reason
+	};
+}
 /**
 * The admin in `claims.act`: a support session or an impersonated session
 * (`actorOf` reads the same level, so the two always agree). `undefined`
@@ -130,4 +145,4 @@ function userContext(user, claims) {
 	};
 }
 //#endregion
-export { delegationOf as a, actorOf as i, impersonatorOf as n, userContext as r, actClaim as t };
+export { actorOf as a, userContext as i, impersonatorClaim as n, delegationOf as o, impersonatorOf as r, actClaim as t };