better-supabase 0.5.1 → 0.6.1

package/dist/{respond-BR1fJWOB.d.ts → server-C6DWVEVG.d.ts}

@@ -1,16 +1,106 @@
-import { n as AnyFunctions, r as AnyModels } from "./types-Dnf_wRDz.js";
-import { _ as DbError, a as AsyncResult } from "./executor-BunPOO-k.js";
-import { a as EventHub } from "./events-aIO7vsIk.js";
-import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "./define-Bp_BZa5h.js";
-import { g as RequestContext } from "./plugin-o144f322.js";
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult } from "./result-D7y2fT87.js";
+import { a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
+import { t as SqlClient } from "./executor-DbvExCFC.js";
+import { m as RequestContext } from "./plugin-FGY8UhYm.js";
+import { a as EventHub } from "./events-DWDhx77e.js";
 import { t as BetterSupabaseEnv } from "./index-CLg87OBW.js";
-import { s as SqlClaims, t as BetterPostgres } from "./pool-C9voM4Kw.js";
-import { c as ResolveAuthOptions, i as AuthResolution, o as AuthState, t as ImpersonationOptions } from "./impersonation-BmePsuxz.js";
-import { a as SupportSession, i as SupportListFilter, o as SupportSessionStore } from "./support-CEPwlw2G.js";
-import { c as Bucket } from "./index-SaTsEfGP.js";
-import { t as Aal } from "./mfa-Cu96oJdw.js";
+import { a as CookieWrite } from "./session-ChiXDZdZ.js";
+import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-KW8nCeL6.js";
+import { r as CredentialProvider } from "./provider-BH5UWZJ6.js";
+import { B as DbStats, H as StatsRecorder, b as Db, t as BetterSupabase } from "./define-CJJkkr1-.js";
+import { r as EventSink } from "./cloud-event-C1JCc1bH.js";
+import { s as SqlClaims, t as BetterPostgres } from "./pool-CAu2nLrL.js";
+import { o as ImpersonationOptions } from "./mfa-Daak8ukG.js";
+import { n as Bucket } from "./bucket-Cl46E3jS.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/auth/support.d.ts
+type SupportEndedBy = "admin" | "expired" | "revoked";
+/** A support session: a platform admin viewing the app as `targetUserId`. */
+interface SupportSession {
+  readonly id: string;
+  readonly adminId: string;
+  readonly targetUserId: string;
+  readonly reason: string;
+  /** Writes fail while it is true (`begin read only`). */
+  readonly readOnly: boolean;
+  readonly tenant?: string;
+  readonly startedAt: Temporal.Instant;
+  readonly expiresAt: Temporal.Instant;
+  readonly endedAt?: Temporal.Instant;
+  readonly endedBy?: SupportEndedBy;
+  /** App data, such as a ticket id. */
+  readonly metadata: Readonly<Record<string, unknown>>;
+}
+interface SupportStartInput {
+  readonly adminId: string;
+  /**
+   * The admin's verified claims. The SQL store runs `start_support_session`
+   * with them, so `is_platform()` checks the admin in the database too.
+   */
+  readonly adminClaims: Readonly<Record<string, unknown>>;
+  readonly targetUserId: string;
+  readonly reason: string;
+  readonly ttlSeconds: number;
+  readonly readOnly: boolean;
+  readonly tenant?: string;
+  readonly metadata: Readonly<Record<string, unknown>>;
+}
+/** A caller's verified claims, which the store runs a call with. */
+type SupportCallerClaims = Readonly<Record<string, unknown>>;
+interface SupportListFilter {
+  readonly adminId?: string;
+  readonly targetUserId?: string;
+  /** `true`: running sessions only; `false`: ended or expired ones only. */
+  readonly active?: boolean;
+  /** Defaults to 50. */
+  readonly limit?: number;
+}
+/**
+ * Where support sessions live. `sqlSupportStore` uses the `support-sessions`
+ * SQL module; implement this for another store and check it with
+ * `testSupportSessionStore` from `better-supabase/testing`.
+ */
+interface SupportSessionStore {
+  readonly apiVersion: 1;
+  readonly name: string;
+  /** Starts a session and ends the admin's previous one. Rejects when the store refuses. */
+  start(input: SupportStartInput): Promise<SupportSession>;
+  /**
+   * The admin's session while it is running; `undefined` once ended or
+   * expired. With the admin's `claims`, the store also checks that the admin
+   * may still start sessions.
+   */
+  get(sessionId: string, adminId: string, claims?: SupportCallerClaims): Promise<SupportSession | undefined>;
+  /**
+   * `false` when it was not running. With `claims`, it runs as that caller:
+   * the session's admin, or staff with the revoke permission.
+   */
+  end(sessionId: string, endedBy: SupportEndedBy, claims?: SupportCallerClaims): Promise<boolean>;
+  /** With `claims`, only what that caller may view. */
+  list(filter?: SupportListFilter, claims?: SupportCallerClaims): Promise<readonly SupportSession[]>;
+  /** The claims `targetUserId` would get, when the store can build them. */
+  claims?(targetUserId: string): Promise<Readonly<Record<string, unknown>>>;
+}
+interface SqlSupportStoreOptions {
+  /** `sql.modules.support-sessions.schema`. Defaults to `better_supabase`. */
+  readonly schema?: string;
+}
+/**
+ * Support sessions in the `support-sessions` SQL module. `start` runs
+ * as the admin, so the module's `is_platform()` gate applies; the reads run
+ * on the admin connection.
+ */
+declare function sqlSupportStore(postgres: Pick<BetterPostgres, "admin" | "asUser">, options?: SqlSupportStoreOptions): SupportSessionStore;
+/**
+ * The claims a support session runs with: the target's, plus `act` naming
+ * the admin, the reason and the session (the audit module records all three),
+ * marked `kind: "support"` so `actorOf` never reads it as an OAuth client.
+ * `role` falls back to `authenticated`; the admin's claims never leak in.
+ */
+declare function supportClaims(session: Pick<SupportSession, "id" | "adminId" | "targetUserId" | "reason" | "readOnly">, target: Readonly<Record<string, unknown>>): Record<string, unknown>;
+//#endregion
 //#region src/auth/support-cookie.d.ts
 /** The cookie that carries the support session id. */
 declare const SUPPORT_COOKIE = "bs-support";
@@ -59,7 +149,7 @@ interface SupportOptions {
   /**
    * Whether `admin` may view the app as the target. A throw or rejection
    * counts as a deny. Defaults to allowing, so the store decides: the SQL
-   * store checks `is_platform(kits.support-sessions.permissions.start)`.
+   * store checks `is_platform(modules.support-sessions.permissions.start)`.
    */
   readonly authorize?: (input: SupportAuthorizeInput) => boolean | Promise<boolean>;
   /**
@@ -148,12 +238,32 @@ interface DeleteAccountOptions {
   readonly cascades?: readonly string[];
   readonly context?: RequestContext;
   readonly signal?: AbortSignal;
+  /**
+   * Direct Postgres with rights on `auth.users` (`postgres.admin`). When the
+   * Auth server reports a database error, the delete is replayed in a
+   * statement that is rolled back, and the database's own error (its
+   * SQLSTATE and hint, such as `ORGANIZATION_OWNER_REQUIRED`) is returned
+   * instead of Auth's generic one. `server.deleteAccount` passes its
+   * `postgres.admin`.
+   */
+  readonly sql?: SqlClient;
 }
 interface DeleteAccountResult {
   readonly userId: string;
   /** Removed objects per bucket id. */
   readonly removed: Readonly<Record<string, number>>;
 }
+/**
+ * Deletes the Auth user, then removes their Storage objects, then announces
+ * the delete. Rows referencing `auth.users` follow their foreign keys. The
+ * objects are listed first and removed only once the user is gone, so a
+ * delete the database refuses leaves them in place.
+ *
+ * `server.deleteAccount` calls it with the server's service client. Apps on
+ * the `@supabase/server` pipeline call it with theirs:
+ * `deleteAccount(betterSupabase, ctx.supabaseAdmin, userId)`.
+ */
+declare function deleteAccount<M extends AnyModels, D, F extends AnyFunctions, E, C>(betterSupabase: BetterSupabase<M, D, F, E, C>, service: SupabaseClient | (() => SupabaseClient), userId: string, options?: DeleteAccountOptions): AsyncResult<DeleteAccountResult>;
 //#endregion
 //#region src/server/replicas.d.ts
 /** Cookie holding the epoch ms until which reads stay on the primary. */
@@ -168,9 +278,55 @@ interface ReplicaState {
   pin(): void;
 }
 //#endregion
+//#region src/server/request-ids.d.ts
+interface RequestIdOptions {
+  readonly requestHeader?: string;
+  readonly correlationHeader?: string;
+  readonly incoming?: boolean;
+  readonly generate?: boolean;
+}
+//#endregion
+//#region src/server/suspend-account.d.ts
+interface EndSessionsResult {
+  readonly userId: string;
+  readonly ended: number;
+}
+interface SuspendAccountOptions {
+  readonly suspended: boolean;
+  readonly duration?: string;
+}
+interface SuspendAccountResult {
+  readonly userId: string;
+  readonly suspended: boolean;
+  readonly ended: number;
+}
+declare function endSessions(sql: SqlClient, userId: string): AsyncResult<EndSessionsResult>;
+declare function suspendAccount(service: SupabaseClient | (() => SupabaseClient), sql: SqlClient, userId: string, options: SuspendAccountOptions): AsyncResult<SuspendAccountResult>;
+//#endregion
 //#region src/server/server.d.ts
+/**
+ * PostgREST request settings for the caller's repositories and the shared
+ * service and anon clients, the `db` options supabase-js takes.
+ */
+interface ServerDbOptions {
+  /** Aborts each PostgREST request after this many milliseconds with a `timeout` error. */
+  readonly timeout?: number;
+  /**
+   * postgrest-js retries of idempotent requests (GET and HEAD) on network
+   * errors, 503 and 520. Defaults to postgrest-js's setting, which is on.
+   */
+  readonly retry?: boolean;
+  /**
+   * The longest query string one read sends. Defaults to the definition's
+   * `urlLengthLimit`, else 6000.
+   */
+  readonly urlLengthLimit?: number;
+}
 interface ServerOptions {
-  /** Defaults to `loadEnv()`. */
+  /**
+   * Defaults to the variables `getEnv` from `@supabase/middleware` reads:
+   * Workers bindings, then `process.env`, then `Deno.env`.
+   */
   readonly env?: BetterSupabaseEnv;
   /** Enables `ctx.sql` and `actingAs()`. */
   readonly postgres?: BetterPostgres;
@@ -186,6 +342,7 @@ interface ServerOptions {
    * `current_setting('request.headers')` (channel, request id, client IP for audit).
    */
   readonly headers?: (request: Request) => Readonly<Record<string, string>>;
+  readonly requestIds?: RequestIdOptions | false;
   /**
    * PostgREST URL for the caller's reads: a read replica or the `<ref>-all`
    * load balancer. Defaults to `SUPABASE_READ_URL`; `false` reads from the
@@ -203,12 +360,14 @@ interface ServerOptions {
   };
   /**
    * The active tenant of a request when it doesn't come from a claim, e.g.
-   * from a URL slug (`kits.access.activeTenant: 'resolver'`). It becomes
+   * from a URL slug (`sql.modules.access.activeTenant: 'resolver'`). It becomes
    * `context.tenant` for the `tenant()` plugin, the `better_supabase.tenant`
    * setting over Postgres and the `x-bs-tenant` header over PostgREST, which
    * `current_tenant_id()` reads only while the caller is a member. Async
    * resolvers need `context(request)`; `contextFromResolution` takes
-   * `options.tenant` instead.
+   * `options.tenant` instead. Under `createNext`, Server Components and
+   * actions pass a request with the incoming headers and a placeholder URL,
+   * so read a header there, not the path.
    */
   readonly tenant?: (request: Request, auth: AuthState) => string | undefined | PromiseLike<string | undefined>;
   /**
@@ -217,6 +376,33 @@ interface ServerOptions {
    * `postgres`, since the target's queries run over direct Postgres.
    */
   readonly support?: SupportSessions;
+  /**
+   * The claims `forContext()` adds for a user, the ones a custom access token
+   * hook would put in their token (roles, organization lists). Read them
+   * fresh: a job can run after the user lost access. `sub`, `role`, `act` and
+   * `tenant_id` come from the context and win.
+   */
+  readonly claimsFor?: (userId: string, context: RequestContext) => SqlClaims | PromiseLike<SqlClaims>;
+  /** PostgREST request settings: `timeout`, `retry` and `urlLengthLimit`. */
+  readonly db?: ServerDbOptions;
+  /**
+   * Resolves the `credential_ref`s third-party calls use, e.g.
+   * `vaultCredentials()` from `better-supabase/credentials`. It becomes
+   * `ctx.credentials`; pass `subjectFor(ctx)` as the subject.
+   */
+  readonly credentials?: CredentialProvider;
+  /**
+   * Where the server's audit trail goes, such as `audit.sink()` from
+   * `better-supabase/blocks/audit`. `suspendAccount`, `deleteAccount` and
+   * `endSessions` send `dev.better-supabase.account.*` CloudEvents, and
+   * `support.denied` events are forwarded. A failed send is logged and never
+   * fails the action.
+   */
+  readonly audit?: EventSink;
+}
+interface ForContextOptions {
+  /** Recorded as `act.reason` when the context carries an impersonator. Defaults to `"job"`. */
+  readonly reason?: string;
 }
 /** The header `current_tenant_id()` reads over the Data API. */
 declare const TENANT_HEADER = "x-bs-tenant";
@@ -241,11 +427,21 @@ interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unkn
    * (`resolution.apply`) and, after a write, `bs-primary-until`.
    */
   apply(response: Response): Response;
+  /**
+   * The cookies `apply` would set, for frameworks that write cookies through
+   * a cookie store instead of a response (`cookies().set`, `setResponseHeaders`).
+   * Read it after the handler ran: a write adds `bs-primary-until`.
+   */
+  cookies(): readonly CookieWrite[];
   /**
    * Set while an admin views the app as another user: `auth`, `db` and
    * `sql` are the target's, and `resolution` stays the admin's.
    */
   readonly support?: ActiveSupport;
+  /** `options.credentials`, when the server has one. */
+  readonly credentials?: CredentialProvider;
+  readonly requestId?: string;
+  readonly correlationId?: string;
 }
 interface ContextOptions {
   readonly refresh?: boolean;
@@ -262,12 +458,17 @@ interface ContextOptions {
    * looks it up itself; `contextFromResolution` only uses this.
    */
   readonly support?: ActiveSupport;
+  readonly requestId?: string;
+  readonly correlationId?: string;
 }
 interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
   readonly env: BetterSupabaseEnv;
+  /** The definition's events; adapters pass `events.settled()` to `waitUntil`. */
+  readonly events: EventHub;
   resolve(request: Request, options?: {
     readonly refresh?: boolean;
     readonly cookies?: boolean;
+    readonly checkSession?: boolean;
   }): Promise<AuthResolution<C, P>>;
   /**
    * Resolves auth and binds repositories to the caller. Refreshes an expired
@@ -288,90 +489,41 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
   /** Service-role repositories. Bypasses RLS; the actor is `service`. */
   admin(context?: RequestContext): Db<M, F, E, SupabaseClient>;
   /**
-   * Deletes a user: their objects in `buckets`, then the Auth user, then a
-   * `mutation` notice for `auth.users`. Needs the secret key. Access tokens
-   * already issued stay valid until they expire.
+   * Deletes a user: the Auth user, then their objects in `buckets`, then a
+   * `mutation` notice for `auth.users`. Needs the secret key. With
+   * `postgres`, a delete the database refuses returns its own error and
+   * hint. Access tokens already issued stay valid until they expire.
    */
   deleteAccount(userId: string, options?: DeleteAccountOptions): AsyncResult<DeleteAccountResult>;
+  endSessions(userId: string): AsyncResult<EndSessionsResult>;
+  suspendAccount(userId: string, options: SuspendAccountOptions): AsyncResult<SuspendAccountResult>;
   /**
    * Repositories running as a user, with RLS, over direct Postgres. With
    * `impersonation`, the claims carry `act: { kind: "impersonation", sub, reason }`, which
-   * the `audit` and `actor` SQL kit modules record.
+   * the `audit` and `actor` SQL modules record.
    */
   actingAs(userId: string, claims?: Omit<SqlClaims, "sub" | "act">, impersonation?: ImpersonationOptions): Db<M, F, E, undefined>;
+  /**
+   * Repositories for the user in a recorded context (`job.context`), with
+   * RLS, over direct Postgres: `actingAs` with the context's tenant and
+   * `ServerOptions.claimsFor`. Fails with `forbidden` when the actor is not a
+   * user; it never falls back to `admin()`.
+   */
+  forContext(context: RequestContext, options?: ForContextOptions): AsyncResult<Db<M, F, E, undefined>>;
   /** Support sessions; every method fails without `ServerOptions.support`. */
   readonly support: SupportApi;
 }
+type ServerKeys = keyof BetterServer<AnyModels, AnyFunctions, unknown>;
+/**
+ * A framework adapter's server: `server` plus the adapter's own methods,
+ * without reading the lazy `env` getter. `extra` can't replace a
+ * `BetterServer` method.
+ */
+declare function extendServer<R extends object>(server: object, extra: Omit<R, ServerKeys>): R;
 /**
  * Server-side entry point for APIs, jobs, MCP servers and framework
  * adapters. Holds the secrets; `betterSupabase` stays isomorphic.
  */
 declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
 //#endregion
-//#region src/server/respond.d.ts
-type AuthKind = AuthState["kind"];
-/**
- * An auth kind a guard lets through. `anonymous` admits users signed in with
- * `signInAnonymously()` (`is_anonymous`); `anon` admits callers without a
- * session only.
- */
-type AllowedCaller = Exclude<AuthKind, "invalid"> | "anonymous";
-interface GuardOptions {
-  /**
-   * Callers allowed through. Defaults to `['user']`, which refuses anonymous
-   * sign-ins. Only `'anonymous'` admits them: `['anonymous']` alone admits
-   * anonymous sign-ins and refuses other users, and `'anon'` (no session)
-   * never admits them.
-   */
-  readonly allow?: readonly AllowedCaller[];
-  /**
-   * Assurance level user sessions need. `aal2` answers 403 with
-   * `required: 'aal2'` until the user verifies a second factor.
-   */
-  readonly aal?: Aal;
-  /**
-   * OAuth scopes a delegated token (an OAuth client or an `act` chain) needs.
-   * A missing one answers 403 with `error="insufficient_scope"`. The user's
-   * own session is not limited by scopes.
-   */
-  readonly scopes?: readonly string[];
-}
-/** Guard options for middleware and fetch handlers that resolve the caller themselves. */
-interface MiddlewareOptions extends GuardOptions {
-  /**
-   * Refresh an expired cookie session and send the new cookies. Only for
-   * routes browsers call with cookies; bearer tokens never refresh.
-   */
-  readonly refresh?: boolean;
-}
-/** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
-declare function guard(auth: AuthState, allow?: GuardOptions["allow"], aal?: Aal, scopes?: readonly string[]): DbError | undefined;
-declare function isResult(value: unknown): value is {
-  ok: boolean;
-  data: unknown;
-  error: unknown;
-};
-type Settled = {
-  readonly ok: true;
-  readonly data: unknown;
-} | {
-  readonly ok: false;
-  readonly error: DbError;
-};
-/**
- * Settles a handler's return value: `Result`s and `AsyncResult`s unwrap,
- * thrown `DbException`s (or errors whose `cause` is a `DbError`) become
- * errors, anything else is data. Other thrown
- * errors propagate.
- */
-declare function settle(run: () => unknown): Promise<Settled>;
-interface RespondOptions {
-  readonly instance?: string;
-  readonly expose?: boolean;
-  /** Status for data responses. Defaults to 200 (204 without data). */
-  readonly status?: number;
-}
-/** A handler's value as a response: `Response` as is, data as JSON, errors as Problem Details. */
-declare function respond(run: () => unknown, options?: RespondOptions): Promise<Response>;
-//#endregion
-export { clearSupportCookie as A, SupportOptions as C, supportSessions as D, SupportStartRequest as E, supportCookieValue as M, SUPPORT_COOKIE as O, SupportAuthorizeInput as S, SupportSessions as T, ReplicaState as _, Settled as a, ActiveSupport as b, respond as c, ContextOptions as d, ServerContext as f, PRIMARY_COOKIE as g, createServer as h, RespondOptions as i, supportCookie as j, SupportCookieOptions as k, settle as l, TENANT_HEADER as m, GuardOptions as n, guard as o, ServerOptions as p, MiddlewareOptions as r, isResult as s, AuthKind as t, BetterServer as u, DeleteAccountOptions as v, SupportPolicy as w, SupportApi as x, DeleteAccountResult as y };
+export { SupportCookieOptions as A, SupportStartInput as B, SupportAuthorizeInput as C, SupportStartRequest as D, SupportSessions as E, SupportCallerClaims as F, supportClaims as H, SupportEndedBy as I, SupportListFilter as L, supportCookie as M, supportCookieValue as N, supportSessions as O, SqlSupportStoreOptions as P, SupportSession as R, SupportApi as S, SupportPolicy as T, sqlSupportStore as V, ReplicaState as _, ServerDbOptions as a, deleteAccount as b, createServer as c, SuspendAccountOptions as d, SuspendAccountResult as f, PRIMARY_COOKIE as g, RequestIdOptions as h, ServerContext as i, clearSupportCookie as j, SUPPORT_COOKIE as k, extendServer as l, suspendAccount as m, ContextOptions as n, ServerOptions as o, endSessions as p, ForContextOptions as r, TENANT_HEADER as s, BetterServer as t, EndSessionsResult as u, DeleteAccountOptions as v, SupportOptions as w, ActiveSupport as x, DeleteAccountResult as y, SupportSessionStore as z };

package/dist/session-ChiXDZdZ.d.ts

@@ -0,0 +1,72 @@
+import { CookieOptions } from "@supabase/ssr";
+//#region src/auth/session.d.ts
+/**
+ * The session object auth-js persists (`sb-<ref>-auth-token`). A
+ * `tokens-only` cookie has no `user`: auth-js keeps it in `auth.userStorage`.
+ */
+interface StoredSession {
+  readonly access_token: string;
+  readonly refresh_token: string;
+  readonly expires_at?: number;
+  readonly expires_in?: number;
+  readonly token_type?: string;
+  readonly user?: unknown;
+  readonly [key: string]: unknown;
+}
+/**
+ * `cookies.encode` in `@supabase/ssr`: `user-and-tokens` stores the user
+ * object in the cookie, `tokens-only` stores the access and refresh tokens
+ * alone. The server and the browser client must use the same value.
+ */
+type SessionEncoding = "user-and-tokens" | "tokens-only";
+declare const DEFAULT_SESSION_ENCODING: SessionEncoding;
+interface WriteSessionOptions {
+  /** Defaults to `user-and-tokens`, the `@supabase/ssr` default. */
+  readonly encode?: SessionEncoding;
+}
+/** A cookie scope an earlier deploy wrote the session at. */
+interface CookieScope {
+  readonly domain?: string;
+  readonly path?: string;
+}
+interface CookieRecord {
+  readonly name: string;
+  readonly value: string;
+}
+interface CookieWrite {
+  readonly name: string;
+  readonly value: string;
+  readonly options: CookieOptions;
+}
+/** Headers that keep responses carrying session cookies out of shared caches. */
+declare const AUTH_CACHE_HEADERS: Readonly<Record<string, string>>;
+/** `sb-<first label of the hostname>-auth-token`, the supabase-js default. */
+declare function sessionCookieName(url: string): string;
+declare function parseCookies(header: string | null | undefined): CookieRecord[];
+declare function serializeCookie(write: CookieWrite): string;
+/**
+ * Reads the session written by `@supabase/ssr` (plain or `base64-`, whole or
+ * chunked, `user-and-tokens` or `tokens-only`). Mismatched chunks from a
+ * partial write read as no session.
+ */
+declare function readSession(cookies: readonly CookieRecord[], name: string): StoredSession | null;
+/** The encoding a stored session was written with: `tokens-only` without a `user`. */
+declare function sessionEncoding(session: StoredSession): SessionEncoding;
+/**
+ * Cookie writes that store `session` (or clear it with `null`) exactly like
+ * `@supabase/ssr` with the same `encode`, and expire chunks the new value no
+ * longer uses.
+ */
+declare function writeSession(existing: readonly CookieRecord[], name: string, session: StoredSession | null, options?: CookieOptions, { encode }?: WriteSessionOptions): CookieWrite[];
+/**
+ * `Max-Age=0` writes for every chunk of the session cookie at each of
+ * `scopes`, like `clearAuthCookiesAtScopes` from `@supabase/ssr`. Use it once
+ * the cookie `domain` or `path` changed, for the scopes earlier deploys
+ * wrote: browsers ignore writes for scopes the host doesn't own, but a scope
+ * equal to the current one clears the live session.
+ */
+declare function clearSessionAtScopes(existing: readonly CookieRecord[], name: string, scopes: readonly CookieScope[]): CookieWrite[];
+/** Applies cookie writes to a cookie list, as the next request would see it. */
+declare function applyCookieWrites(cookies: readonly CookieRecord[], writes: readonly CookieWrite[]): CookieRecord[];
+//#endregion
+export { writeSession as _, CookieWrite as a, StoredSession as c, clearSessionAtScopes as d, parseCookies as f, sessionEncoding as g, sessionCookieName as h, CookieScope as i, WriteSessionOptions as l, serializeCookie as m, CookieOptions as n, DEFAULT_SESSION_ENCODING as o, readSession as p, CookieRecord as r, SessionEncoding as s, AUTH_CACHE_HEADERS as t, applyCookieWrites as u };

package/dist/shared-CBxosKK3.js

@@ -0,0 +1,75 @@
+import { pipeline, seedContext } from "@supabase/middleware";
+//#region src/bridges/shared.ts
+/** The string keys of a pipeline context: every contribution, without the seed's symbols. */
+function contributionsOf(ctx) {
+	const contributions = {};
+	for (const [key, value] of Object.entries(ctx)) contributions[key] = value;
+	return contributions;
+}
+/** The per-request value a bridge seeds under `key`. */
+function handoffOf(ctx, key) {
+	return ctx[key];
+}
+/**
+* Makes the body of `request` readable more than once, in place: the first
+* reader drains the stream into a cache and later readers are served from
+* it, so an entry and the route both see the body. For frameworks that hand
+* the route the same `Request` the middleware saw (TanStack Start,
+* SvelteKit, React Router), where `bufferRequest`'s wrapped copy can't go.
+*/
+function bufferInPlace(request) {
+	if (!request.body || request.bodyUsed) return;
+	const readOnce = request.arrayBuffer.bind(request);
+	let buffer;
+	const arrayBuffer = () => buffer ??= readOnce();
+	const text = async () => new TextDecoder().decode(await arrayBuffer());
+	const readers = {
+		arrayBuffer,
+		text,
+		json: async () => JSON.parse(await text()),
+		bytes: async () => new Uint8Array(await arrayBuffer()),
+		blob: async () => new Blob([await arrayBuffer()]),
+		formData: async () => new Response(await arrayBuffer(), { headers: request.headers }).formData(),
+		clone: () => request
+	};
+	for (const [name, value] of Object.entries(readers)) Object.defineProperty(request, name, {
+		value,
+		configurable: true
+	});
+}
+const DOWNSTREAM = Symbol("bridge.downstream");
+/**
+* The shared shape of the upstream bridges: the pipeline folds once, each
+* request seeds the framework's `next` under a symbol, and the terminal
+* hands it the contributions, so response-phase entries see the
+* framework's response. `platform` is the host's env object, if any, which
+* `getEnv` reads first.
+*/
+function around(entries) {
+	const run = pipeline(entries, (_request, ctx) => handoffOf(ctx, DOWNSTREAM)(contributionsOf(ctx)));
+	return (request, platform, downstream) => run(request, {
+		...seedContext(platform),
+		[DOWNSTREAM]: downstream
+	});
+}
+/**
+* A framework handler's value as a `Response`: responses as is, `undefined`
+* as 204, other values as JSON. `init` carries the status and headers the
+* handler set on the framework's response object.
+*/
+function toResponse(value, init = {}) {
+	if (value instanceof Response) return value;
+	const options = {
+		...init.status === void 0 ? {} : { status: init.status },
+		...init.statusText === void 0 ? {} : { statusText: init.statusText },
+		...init.headers === void 0 ? {} : { headers: init.headers }
+	};
+	if (value === void 0 || value === null) return new Response(null, {
+		status: 204,
+		...options
+	});
+	if (typeof value === "string") return new Response(value, options);
+	return Response.json(value, options);
+}
+//#endregion
+export { toResponse as i, bufferInPlace as n, handoffOf as r, around as t };

package/dist/{shared-D1dRUrAg.js → shared-CxWmcyqB.js}

@@ -1,4 +1,5 @@
-import { n as dbError, t as DbException } from "./errors-DtwXa6b8.js";
+import { t as DbException } from "./db-exception-CnWcYPxL.js";
+import { n as dbError } from "./errors-B11Duf73.js";
 import { t as lookupOf } from "./lookup-BaP5bI27.js";
 //#region src/plugins/shared.ts
 /** Database column name for an app column, or `undefined` if it is unknown. */

package/dist/shared-DDSjEGDR.d.ts

@@ -0,0 +1,11 @@
+import { AnyEntry, ValidateEntries } from "@supabase/middleware";
+//#region src/bridges/shared.d.ts
+/**
+ * `unknown` when the entries compose, so a parameter typed
+ * `Entries & Validated<Entries>` stays `Entries`. Otherwise the engine's
+ * error string, and the intersection fails the call with the
+ * `middleware-conflict` or `middleware-prereq` message.
+ */
+type Validated<Entries extends readonly AnyEntry[]> = [ValidateEntries<Entries>] extends [true] ? unknown : ValidateEntries<Entries>;
+//#endregion
+export { Validated as t };

package/dist/sign-in-BCV5S2WZ.d.ts

@@ -0,0 +1,49 @@
+import { t as AuthFailure } from "./auth-link-BjFPqwLz.js";
+import { Provider, SignInWithOAuthCredentials, SignInWithPasswordlessCredentials, SupabaseClient, VerifyOtpParams } from "@supabase/supabase-js";
+//#region src/react/sign-in.d.ts
+type AuthApi = Pick<SupabaseClient["auth"], "signInWithPassword" | "signInWithOtp" | "verifyOtp" | "signInWithOAuth" | "signOut">;
+interface AuthHookOptions {
+  /** A supabase-js client for apps without `<BetterSupabaseProvider>`. */
+  readonly client?: {
+    readonly auth: AuthApi;
+  };
+  /** Called after a call succeeds, e.g. to navigate. */
+  readonly onSuccess?: () => void;
+}
+interface PendingState {
+  /** A call is in flight. */
+  readonly pending: boolean;
+  /** The last call's error; cleared when the next call starts. */
+  readonly error: AuthFailure | undefined;
+}
+interface SignIn extends PendingState {
+  readonly password: (credentials: {
+    readonly email: string;
+    readonly password: string;
+  }) => Promise<AuthFailure | undefined>;
+  /** Sends a magic link or a one-time code to an email or a phone. */
+  readonly otp: (credentials: SignInWithPasswordlessCredentials) => Promise<AuthFailure | undefined>;
+  /** Checks the code `otp` sent. */
+  readonly verifyOtp: (params: VerifyOtpParams) => Promise<AuthFailure | undefined>;
+  /** Starts the OAuth redirect. In a browser the page navigates away. */
+  readonly oauth: (provider: Provider, options?: SignInWithOAuthCredentials["options"]) => Promise<AuthFailure | undefined>;
+}
+interface SignOut extends PendingState {
+  readonly signOut: (options?: {
+    readonly scope?: "global" | "local" | "others";
+  }) => Promise<AuthFailure | undefined>;
+}
+/**
+ * Sign-in calls with `pending` and `error` state. The session lands in the
+ * client's auth store, so `useAuth()` updates on its own.
+ *
+ * ```tsx
+ * const signIn = useSignIn({ onSuccess: () => router.push('/') });
+ * <button disabled={signIn.pending} onClick={() => signIn.password({ email, password })} />
+ * ```
+ */
+declare function useSignIn(options?: AuthHookOptions): SignIn;
+/** `auth.signOut()` with `pending` and `error` state. The provider clears cached queries. */
+declare function useSignOut(options?: AuthHookOptions): SignOut;
+//#endregion
+export { useSignIn as a, SignOut as i, PendingState as n, useSignOut as o, SignIn as r, AuthHookOptions as t };