better-supabase 0.7.0 → 0.8.0

package/dist/{adapter-B-tL8hqg.js → adapter-CN45ibbV.js}

@@ -1,16 +1,18 @@
-import { c as mapDbError, n as dbError, o as isDbError, r as dbErrorOf } from "./errors-B11Duf73.js";
-import { t as temporal } from "./temporal-required-BVvW7SYJ.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-DzUbqgdW.js";
-import { a as postgrestExecutor, n as StatsRecorder } from "./stats-D_AD9GGu.js";
-import { a as problemResponse } from "./problem-BreOl8b8.js";
+import { c as mapDbError, n as dbError, o as isDbError, r as dbErrorOf } from "./errors-2M6CKMP4.js";
+import { t as temporal } from "./temporal-required-BtynQtM-.js";
+import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-DEqHCMKP.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { a as postgrestExecutor, n as StatsRecorder } from "./stats-DhU78Ctf.js";
+import { o as problemResponse } from "./problem-CJvFeGu7.js";
 import { loadEnv } from "./env/index.js";
 import { a as actorOf, i as userContext, n as impersonatorClaim, t as actClaim } from "./impersonation-DcqaTBHx.js";
-import { t as fromPgError } from "./executor-De1Of3m3.js";
-import { n as forwardBlockEvents } from "./cloud-event-BnmD5fb9.js";
+import { t as fromPgError } from "./executor-B_Hfobee.js";
+import { i as forwardBlockEvents, t as DEFAULT_TYPE_PREFIX } from "./cloud-event-CTh9Sr5w.js";
 import { a as replicaState, i as primaryCookieWrite, o as routedExecutor, r as pinnedUntil, s as withPrimaryPin } from "./replicas-CwrYp5Zj.js";
-import { c as AUTH_CACHE_HEADERS, d as clearSessionAtScopes, f as parseCookies, h as sessionCookieName, i as resolveAuth, m as serializeCookie, r as prefetchJwks, t as authContext } from "./resolve-tJZY3FEa.js";
-import { t as credentialProviderOf } from "./provider-Di3sRutW.js";
-import { a as respond, n as defaultPrefetchJwks, r as guard, t as defaultExpose } from "./respond-BUgsXNgk.js";
+import { t as authContext } from "./context-nPDvQ-Zl.js";
+import { d as parseCookies, m as sessionCookieName, n as prefetchJwks, p as serializeCookie, r as resolveAuth, s as AUTH_CACHE_HEADERS, u as clearSessionAtScopes } from "./resolve-Bvgf3ut_.js";
+import { t as credentialProviderOf } from "./provider-DxRTex4x.js";
+import { a as respond, n as defaultPrefetchJwks, r as guard, t as defaultExpose } from "./respond-volM3ByS.js";
 import { createClient } from "@supabase/supabase-js";
 import { defineMiddleware, getEnv, pipeline, seedContext } from "@supabase/middleware";
 import { PostgrestClient } from "@supabase/postgrest-js";
@@ -203,6 +205,11 @@ function suspendAccount(service, sql, userId, options) {
 		if (suspended) {
 			const refused = await ban(client, userId, options.duration ?? FOREVER);
 			if (refused) return err(refused);
+			if (options.endSessions !== true) return ok({
+				userId,
+				suspended,
+				ended: 0
+			});
 		}
 		let ended;
 		try {
@@ -246,7 +253,7 @@ function serverAudit(betterSupabase, sink) {
 			specversion: "1.0",
 			id: crypto.randomUUID(),
 			source: SERVER_EVENT_SOURCE,
-			type: `dev.better-supabase.${type}`,
+			type: `${DEFAULT_TYPE_PREFIX}.${type}`,
 			subject: `users/${userId}`,
 			time: (/* @__PURE__ */ new Date()).toISOString(),
 			datacontenttype: "application/json",
@@ -263,6 +270,149 @@ function serverAudit(betterSupabase, sink) {
 	} };
 }
 //#endregion
+//#region src/server/clients.ts
+const STATELESS = {
+	persistSession: false,
+	autoRefreshToken: false,
+	detectSessionInUrl: false
+};
+/** The Supabase and PostgREST clients of one server: shared service and anon clients, per-request user clients. */
+function createClients(input) {
+	const { options, env, definitionExecutor, lite, createClient } = input;
+	let adminClient;
+	let anonClient;
+	const secretKey = () => {
+		const key = env().secretKey;
+		if (!key) throw new TypeError("admin() needs SUPABASE_SECRET_KEY; it is not set");
+		return key;
+	};
+	const customFetch = options.fetch ? { fetch: options.fetch } : void 0;
+	const urlLengthLimit = options.db?.urlLengthLimit ?? definitionExecutor.urlLengthLimit;
+	const db = {
+		...options.db?.timeout === void 0 ? {} : { timeout: options.db.timeout },
+		...options.db?.retry === void 0 ? {} : { retry: options.db.retry },
+		...urlLengthLimit === void 0 ? {} : { urlLengthLimit }
+	};
+	const dbOptions = Object.keys(db).length > 0 ? { db } : {};
+	const sharedGlobal = {
+		...customFetch ? { global: customFetch } : {},
+		...dbOptions
+	};
+	/** postgrest-js options a bare `PostgrestClient` takes; `timeout` is the executor's. */
+	const restOptions = {
+		...db.retry === void 0 ? {} : { retry: db.retry },
+		...urlLengthLimit === void 0 ? {} : { urlLengthLimit }
+	};
+	const rpcUnavailable = lite?.rpcUnavailable;
+	const executorOptions = {
+		...definitionExecutor,
+		...urlLengthLimit === void 0 ? {} : { urlLengthLimit },
+		...db.timeout === void 0 ? {} : { timeout: db.timeout },
+		...db.retry === void 0 ? {} : { retry: db.retry },
+		...rpcUnavailable === void 0 ? {} : { rpcUnavailable }
+	};
+	/** Set when `db` options or the backend need an executor built with them. */
+	const tunedExecutor = options.db !== void 0 || rpcUnavailable !== void 0;
+	const serviceClient = () => {
+		adminClient ??= createClient(env().url, secretKey(), {
+			auth: STATELESS,
+			...sharedGlobal
+		});
+		return adminClient;
+	};
+	const readUrl = () => options.readUrl === false ? void 0 : options.readUrl?.replace(/\/+$/, "") ?? env().readUrl;
+	const apiKeyClient = () => {
+		throw new TypeError("ctx.supabase and ctx.db.$client are not available for an API key: ctx.db and ctx.sql run over direct Postgres with the key's claims");
+	};
+	/** Clients for the primary share the service and anon clients; others don't. */
+	const supabaseAt = (url, auth, headers = {}) => {
+		const custom = Object.keys(headers).length > 0;
+		const global = custom ? {
+			global: {
+				headers,
+				...customFetch
+			},
+			...dbOptions
+		} : sharedGlobal;
+		const shared = !custom && url === env().url;
+		switch (auth.kind) {
+			case "user": return createClient(url, env().publishableKey, {
+				accessToken: () => Promise.resolve(auth.token),
+				...global
+			});
+			case "service": return shared ? serviceClient() : createClient(url, secretKey(), {
+				auth: STATELESS,
+				...global
+			});
+			case "anon":
+			case "invalid":
+				if (!shared) return createClient(url, env().publishableKey, {
+					auth: STATELESS,
+					...global
+				});
+				anonClient ??= createClient(url, env().publishableKey, {
+					auth: STATELESS,
+					...sharedGlobal
+				});
+				return anonClient;
+			case "apiKey": return apiKeyClient();
+			default: return auth;
+		}
+	};
+	const supabaseFor = (auth, headers = {}) => supabaseAt(env().url, auth, headers);
+	const restUrls = /* @__PURE__ */ new Map();
+	const restUrl = (url) => {
+		let rest = restUrls.get(url);
+		if (rest === void 0) {
+			rest = new URL("rest/v1", url.endsWith("/") ? url : `${url}/`).href;
+			restUrls.set(url, rest);
+		}
+		return rest;
+	};
+	/**
+	* The client queries run on. Requests need only PostgREST, so they skip
+	* building Realtime, Storage and Auth clients per request; the shared
+	* service and anon clients for the primary are built once anyway.
+	*/
+	const restAt = (url, auth, headers = {}) => {
+		let key;
+		let bearer;
+		switch (auth.kind) {
+			case "user":
+				key = env().publishableKey;
+				bearer = auth.token;
+				break;
+			case "service":
+			case "anon":
+			case "invalid":
+				if (Object.keys(headers).length === 0 && url === env().url) return supabaseAt(url, auth, headers);
+				key = auth.kind === "service" ? secretKey() : env().publishableKey;
+				bearer = key;
+				break;
+			case "apiKey": return apiKeyClient();
+			default: return auth;
+		}
+		return new PostgrestClient(restUrl(url), {
+			headers: {
+				...headers,
+				apikey: key,
+				Authorization: `Bearer ${bearer}`
+			},
+			...customFetch,
+			...restOptions
+		});
+	};
+	return {
+		executorOptions,
+		tunedExecutor,
+		serviceClient,
+		readUrl,
+		apiKeyClient,
+		supabaseFor,
+		restAt
+	};
+}
+//#endregion
 //#region src/server/entries/core.ts
 const cores = /* @__PURE__ */ new WeakMap();
 /** Records the core behind `server`, so `serverCore` finds it on copies too. */
@@ -451,6 +601,58 @@ function withTenant(core) {
 	})();
 }
 //#endregion
+//#region src/server/lite.ts
+/** Lite's default driver, the one `lite init` scaffolds. */
+const DEFAULT_LITE_DRIVER = "sqlite-postgres";
+/** Whether the driver stores data in SQLite, where Lite has no database functions. */
+function isSqliteDriver(driver) {
+	switch (driver) {
+		case "sqlite-postgres":
+		case "sqlite": return true;
+		case "pglite":
+		case "postgres": return false;
+		default: return driver;
+	}
+}
+function liteRpcUnavailable(driver) {
+	return `rpc() is not available on Supabase Lite with the ${driver} driver. Set [db] driver = "pglite" or "postgres" in supabase/config.toml, or call an HTTP endpoint instead.`;
+}
+/** What `backend: "lite"` changes in `createServer`; `undefined` for Supabase. */
+function liteBackend(options, env) {
+	if (options.backend !== "lite") return void 0;
+	const driver = options.liteDriver ?? DEFAULT_LITE_DRIVER;
+	if (options.postgres && driver !== "postgres") throw new TypeError(`Supabase Lite with the ${driver} driver has no Postgres connection for ctx.sql. Remove the postgres option, or run Lite with [db] driver = "postgres".`);
+	return {
+		auth() {
+			if (options.auth?.jwtSecret !== void 0) return options.auth;
+			const jwtSecret = env().jwtSecret;
+			if (jwtSecret === void 0) throw new TypeError("backend: \"lite\" needs SUPABASE_JWT_SECRET, the auth.jwt_secret Supabase Lite signs user tokens with");
+			return {
+				...options.auth,
+				jwtSecret
+			};
+		},
+		rpcUnavailable: isSqliteDriver(driver) ? liteRpcUnavailable(driver) : void 0
+	};
+}
+//#endregion
+//#region src/server/refusing-executor.ts
+/**
+* An executor for credentials that did not verify: every query, function
+* call and batch answers `error`, so a handler that skips the route guard
+* gets a 401 `Result` and never queries as anon.
+*/
+function refusingExecutor(error) {
+	const refuse = () => err(error);
+	return {
+		name: "refused",
+		functionSources: true,
+		execute: () => Promise.resolve(refuse()),
+		rpc: () => Promise.resolve(refuse()),
+		batch: (ops) => Promise.resolve(ops.map(() => refuse()))
+	};
+}
+//#endregion
 //#region src/server/request-ids.ts
 const REQUEST_ID_PATTERN = /^[A-Za-z0-9._:;,@/+=-]{1,128}$/;
 function requestIdOrUndefined(value) {
@@ -502,6 +704,10 @@ function requestIdPolicy(options = {}) {
 	};
 }
 //#endregion
+//#region src/server/server-types.ts
+/** The header `current_tenant_id()` reads over the Data API. */
+const TENANT_HEADER = "x-bs-tenant";
+//#endregion
 //#region src/auth/support-cookie.ts
 /** The cookie that carries the support session id. */
 const SUPPORT_COOKIE = "bs-support";
@@ -553,21 +759,415 @@ const supportOff = {
 	revoke: notConfigured,
 	current: () => Promise.resolve(void 0),
 	list: notConfigured,
+	expire: notConfigured,
+	expireRoute: () => () => Promise.resolve(problemResponse(dbError("unexpected", NOT_CONFIGURED))),
 	sessionIdOf: () => void 0,
 	clearCookie: () => clearSupportCookie()
 };
 //#endregion
+//#region src/server/support-storage.ts
+const VISIBLE_OBJECT = "select exists (select 1 from storage.objects o where o.bucket_id = $1 and o.name = $2) as visible";
+const VISIBLE_OBJECTS = `select n.path from unnest($2::text[]) as n(path)
+where exists (select 1 from storage.objects o where o.bucket_id = $1 and o.name = n.path)`;
+const OBJECT_INFO = "select to_jsonb(o) as object from storage.objects o where o.bucket_id = $1 and o.name = $2";
+const SEARCH = `select s.name, s.id::text as id, s.updated_at, s.created_at, s.last_accessed_at, s.metadata
+from storage.search($1::text, $2::text, $3::int, $4::int, $5::int, $6::text, $7::text, $8::text) s`;
+const SEARCH_V2 = `select s.key, s.name, s.id::text as id, s.updated_at, s.created_at, s.last_accessed_at, s.metadata
+from storage.search_v2($1::text, $2::text, $3::int, $4::int, $5::text, $6::text, $7::text, $8::text) s`;
+const HIDDEN_URL = "Either the object does not exist or you do not have access to it";
+const LIST_SORT_COLUMNS = /* @__PURE__ */ new Set([
+	"name",
+	"updated_at",
+	"created_at",
+	"last_accessed_at"
+]);
+const LIST_V2_SORT_COLUMNS = /* @__PURE__ */ new Set([
+	"name",
+	"updated_at",
+	"created_at"
+]);
+const FLAT_SORT_COLUMNS = /* @__PURE__ */ new Set(["updated_at", "created_at"]);
+const SORT_ORDERS = /* @__PURE__ */ new Set(["asc", "desc"]);
+const CURSOR_PARTS = {
+	l: "startAfter",
+	o: "sortOrder",
+	c: "sortColumn",
+	a: "sortColumnAfter"
+};
+const isCursorKey = (key) => Object.hasOwn(CURSOR_PARTS, key);
+/** The path storage-js sends for an upload: no leading or trailing `/`, and no empty folders. */
+function normalizePath(path) {
+	return path.replaceAll(/^\/|\/$/g, "").replaceAll(/\/+/g, "/");
+}
+/** `undefined` for an empty string, which storage-api treats as absent. */
+const filled = (value) => value === "" ? void 0 : value;
+/** `LIKE` escaping as storage-api applies it. */
+function escapeLike(text) {
+	return text.replaceAll("\\", "\\\\").replaceAll(/([%_])/g, "\\$1");
+}
+function iso(value) {
+	if (value instanceof Date) return value.toISOString();
+	if (typeof value !== "string") return value;
+	const time = Date.parse(value);
+	return Number.isNaN(time) ? value : new Date(time).toISOString();
+}
+/** storage-api's continuation token: `key:value` lines, base64 encoded. */
+function encodeCursor(cursor) {
+	const text = Object.entries(CURSOR_PARTS).flatMap(([key, part]) => cursor[part] ? [`${key}:${cursor[part]}`] : []).join("\n");
+	let binary = "";
+	for (const byte of new TextEncoder().encode(text)) binary += String.fromCodePoint(byte);
+	return btoa(binary);
+}
+function decodeCursor(token) {
+	let text;
+	try {
+		text = new TextDecoder().decode(Uint8Array.from(atob(token), (char) => char.codePointAt(0) ?? 0));
+	} catch {
+		return;
+	}
+	const cursor = {
+		startAfter: "",
+		sortOrder: "asc"
+	};
+	for (const part of text.split("\n")) {
+		const match = /^(\S):(.*)/.exec(part);
+		const key = match?.[1];
+		if (!key || !isCursorKey(key)) return void 0;
+		cursor[CURSOR_PARTS[key]] = match[2] ?? "";
+	}
+	return cursor;
+}
+const apiError = (status, message, code) => ({
+	name: "StorageApiError",
+	message,
+	status,
+	statusCode: String(status),
+	code
+});
+const failed = (error) => ({
+	data: null,
+	error
+});
+/** Storage answers a hidden object like a missing one: HTTP 400 with `statusCode` 404. */
+const NOT_FOUND = {
+	name: "StorageApiError",
+	message: "Object not found",
+	status: 400,
+	statusCode: "404",
+	code: "NoSuchKey"
+};
+const invalid = (message) => apiError(400, message, "InvalidRequest");
+/** A database failure as a Storage `error` that `fromStorageError` passes through unchanged. */
+function sqlFailure(cause) {
+	const raw = fromPgError(cause);
+	return {
+		name: "DbError",
+		...raw ? mapDbError(raw) : toDbError(cause)
+	};
+}
+async function settled(run) {
+	try {
+		return await run();
+	} catch (cause) {
+		return failed(sqlFailure(cause));
+	}
+}
+function listProblem(options) {
+	const { limit, offset, sortBy } = options;
+	if (limit !== void 0 && (!Number.isInteger(limit) || limit < 1)) return "body/limit must be an integer of at least 1";
+	if (offset !== void 0 && (!Number.isInteger(offset) || offset < 0)) return "body/offset must be an integer of at least 0";
+	if (sortBy?.column !== void 0 && !LIST_SORT_COLUMNS.has(sortBy.column)) return "body/sortBy/column must be name, updated_at, created_at or last_accessed_at";
+	if (sortBy?.order !== void 0 && !SORT_ORDERS.has(sortBy.order)) return "body/sortBy/order must be asc or desc";
+}
+function listV2Problem(options) {
+	const { limit, sortBy } = options;
+	if (limit !== void 0 && (!Number.isInteger(limit) || limit < 1)) return "body/limit must be an integer of at least 1";
+	if (sortBy !== void 0 && !LIST_V2_SORT_COLUMNS.has(sortBy.column)) return "body/sortBy/column must be name, updated_at or created_at";
+	if (sortBy?.order !== void 0 && !SORT_ORDERS.has(sortBy.order)) return "body/sortBy/order must be asc or desc";
+}
+/** The query storage-api runs for a `list-v2` page without a delimiter. */
+function flatPage(bucket, prefix, maxKeys, cursor, column, order) {
+	const values = [bucket, maxKeys];
+	const conditions = ["bucket_id = $1"];
+	const sortColumn = column && FLAT_SORT_COLUMNS.has(column) ? column : void 0;
+	const sortOrder = order && SORT_ORDERS.has(order) ? order : "asc";
+	const operator = sortOrder === "asc" ? ">" : "<";
+	const param = () => `$${String(values.length)}`;
+	if (prefix) {
+		values.push(`${escapeLike(prefix)}%`);
+		conditions.push(`name like ${param()}`);
+	}
+	const startAfter = cursor?.startAfter;
+	if (startAfter && sortColumn && cursor.sortColumnAfter) {
+		values.push(cursor.sortColumnAfter);
+		const afterParam = param();
+		values.push(startAfter);
+		conditions.push(`row(date_trunc('milliseconds', ${sortColumn}), name collate "C") ${operator} row(coalesce(nullif(${afterParam}, '')::timestamptz, 'epoch'::timestamptz), ${param()})`);
+	} else if (startAfter) {
+		values.push(startAfter);
+		conditions.push(`name collate "C" ${operator} ${param()}`);
+	}
+	return {
+		text: `select id::text as id, name, metadata, updated_at, created_at, last_accessed_at
+from storage.objects
+where ${conditions.join(" and ")}
+order by ${sortColumn ? `${sortColumn} ${sortOrder}, ` : ""}name collate "C" ${sortOrder}
+limit $2::int`,
+		values
+	};
+}
+/** Groups the entries below the next delimiter into folders, as storage-api does. */
+function delimited(entries, prefix) {
+	const grouped = [];
+	let previous = "";
+	for (const entry of entries) {
+		const name = String(entry["name"]);
+		const index = name.replace(prefix, "").indexOf("/");
+		if (index < 0) {
+			grouped.push(entry);
+			continue;
+		}
+		const folder = name.slice(0, prefix.length + index + 1);
+		if (folder === previous) continue;
+		previous = folder;
+		grouped.push({
+			id: null,
+			name: folder
+		});
+	}
+	return grouped;
+}
+const text = (value) => typeof value === "string" ? value : void 0;
+const metadataOf = (value) => isRecord(value) ? value : null;
+function listEntryOf(row) {
+	return {
+		name: String(row["name"]),
+		id: text(row["id"]) ?? null,
+		updated_at: text(iso(row["updated_at"])) ?? null,
+		created_at: text(iso(row["created_at"])) ?? null,
+		last_accessed_at: text(iso(row["last_accessed_at"])) ?? null,
+		metadata: metadataOf(row["metadata"])
+	};
+}
+function folderOf(row) {
+	const name = String(row["name"]);
+	const key = text(row["key"]);
+	return {
+		name: name.endsWith("/") ? name : `${name}/`,
+		...key === void 0 ? {} : { key }
+	};
+}
+function objectOf(row) {
+	const key = text(row["key"]);
+	const lastAccessed = text(iso(row["last_accessed_at"]));
+	return {
+		name: String(row["name"]),
+		...key === void 0 ? {} : { key },
+		id: text(row["id"]) ?? "",
+		updated_at: text(iso(row["updated_at"])) ?? "",
+		created_at: text(iso(row["created_at"])) ?? "",
+		...lastAccessed === void 0 ? {} : { last_accessed_at: lastAccessed },
+		metadata: metadataOf(row["metadata"])
+	};
+}
+function infoOf(row) {
+	const metadata = isRecord(row["metadata"]) ? row["metadata"] : {};
+	const size = metadata["size"];
+	const contentType = text(metadata["mimetype"]);
+	const cacheControl = text(metadata["cacheControl"]);
+	const etag = text(metadata["eTag"]);
+	const lastModified = text(iso(row["updated_at"]));
+	const userMetadata = row["user_metadata"];
+	const archivedAt = row["archived_at"];
+	const deleteMarker = row["is_delete_marker"];
+	const versioned = row["is_versioned"];
+	return {
+		id: text(row["id"]) ?? "",
+		name: text(row["name"]) ?? "",
+		version: text(row["version"]) ?? "",
+		bucketId: text(row["bucket_id"]) ?? "",
+		createdAt: text(iso(row["created_at"])) ?? "",
+		...typeof size === "number" ? { size } : {},
+		...contentType === void 0 ? {} : { contentType },
+		...cacheControl === void 0 ? {} : { cacheControl },
+		...etag === void 0 ? {} : { etag },
+		...lastModified === void 0 ? {} : { lastModified },
+		...isRecord(userMetadata) ? { metadata: userMetadata } : {},
+		...archivedAt === void 0 ? {} : { archivedAt: text(iso(archivedAt)) ?? null },
+		...typeof deleteMarker === "boolean" ? { isDeleteMarker: deleteMarker } : {},
+		...typeof versioned === "boolean" ? { isVersioned: versioned } : {}
+	};
+}
+/**
+* Storage for a support session, with the same `from(bucket)` file API as
+* `supabase.storage`, so `bucket.connect()` and the blocks take it.
+*
+* Storage policies read `auth.uid()` from the request's token, and there is
+* no token for the target, so reads go through Postgres as the target.
+* `exists`, `info`, `list` and `listV2` run entirely there: the listings
+* call the invoker-rights `storage.search` functions storage-api calls, so
+* RLS filters each page as it would for the target's own request.
+* `download` and the signed URLs first check there that the target may see
+* the object, then the service client serves it. A hidden object answers
+* like a missing one. `getPublicUrl` is built without a check, as it is
+* built without a request.
+*
+* Writes resolve to a `403` error: `SUPPORT_READ_ONLY` in a read-only
+* session and `SUPPORT_STORAGE_WRITES` in a writable one. The service client
+* would store the object with no owner, and Storage never sees the session's
+* `act` claim, so the write could be neither attributed to the target nor
+* audited as the admin's.
+*/
+function supportStorage(options) {
+	const refusal = options.readOnly ?? true ? apiError(403, "The support session is read-only", "SUPPORT_READ_ONLY") : apiError(403, "Storage writes are not available in a support session", "SUPPORT_STORAGE_WRITES");
+	const refuse = () => Promise.resolve(failed(refusal));
+	const rows = (query, values) => options.sql.queryRaw(query, values);
+	return { from(bucket) {
+		const admin = () => options.admin.from(bucket);
+		const visible = async (path) => {
+			const [row] = await rows(VISIBLE_OBJECT, [bucket, path]);
+			return row?.["visible"] === true;
+		};
+		const checked = (path, read) => settled(async () => {
+			const name = normalizePath(path);
+			if (!await visible(name)) return failed(NOT_FOUND);
+			return read(name);
+		});
+		const list = (path, listOptions = {}) => settled(async () => {
+			const problem = listProblem(listOptions);
+			if (problem) return failed(invalid(problem));
+			let prefix = path ?? "";
+			if (prefix.length > 0 && !prefix.endsWith("/")) prefix = `${prefix}/`;
+			const column = listOptions.sortBy?.column ?? "name";
+			const escape = column !== "name";
+			const safePrefix = escape ? escapeLike(prefix) : prefix;
+			const search = listOptions.search ?? "";
+			const safeSearch = escape ? escapeLike(search) : search;
+			return {
+				data: (await rows(SEARCH, [
+					safePrefix,
+					bucket,
+					listOptions.limit ?? 100,
+					(safePrefix + safeSearch).split("/").length,
+					listOptions.offset ?? 0,
+					safeSearch,
+					column,
+					listOptions.sortBy?.order ?? "asc"
+				])).map(listEntryOf),
+				error: null
+			};
+		});
+		const listV2 = (listOptions = {}) => settled(async () => {
+			const problem = listV2Problem(listOptions);
+			if (problem) return failed(invalid(problem));
+			const limit = Math.min(listOptions.limit ?? 1e3, 1e3);
+			const prefix = listOptions.prefix ?? "";
+			const cursor = listOptions.cursor ? decodeCursor(listOptions.cursor) : void 0;
+			if (listOptions.cursor && !cursor) return failed(apiError(400, "Invalid continuation token", "InvalidParameter"));
+			const sortOrder = filled(cursor?.sortOrder) ?? listOptions.sortBy?.order;
+			const sortColumn = filled(cursor?.sortColumn) ?? listOptions.sortBy?.column;
+			let found;
+			if (listOptions.with_delimiter) found = await rows(SEARCH_V2, [
+				prefix,
+				bucket,
+				limit + 1,
+				prefix ? prefix.split("/").length : 1,
+				cursor?.startAfter ?? "",
+				sortOrder ?? "asc",
+				sortColumn ?? "name",
+				filled(cursor?.sortColumnAfter) ?? null
+			]);
+			else {
+				const page = flatPage(bucket, listOptions.prefix, limit + 1, cursor, sortColumn, sortOrder);
+				found = await rows(page.text, page.values);
+			}
+			const entries = listOptions.with_delimiter ? delimited(found, prefix) : found;
+			const hasNext = entries.length > limit;
+			const count = hasNext ? limit : entries.length;
+			const folders = [];
+			const objects = [];
+			for (const entry of entries.slice(0, count)) if (entry["id"] === null || entry["id"] === void 0) folders.push(folderOf(entry));
+			else objects.push(objectOf(entry));
+			const last = entries[count - 1];
+			const after = last && sortColumn && sortColumn !== "name" ? iso(last[sortColumn]) : void 0;
+			const nextCursor = hasNext && last ? encodeCursor({
+				startAfter: String(last["name"]),
+				...sortOrder ? { sortOrder } : {},
+				...sortColumn ? { sortColumn } : {},
+				...typeof after === "string" ? { sortColumnAfter: new Date(after).toISOString() } : {}
+			}) : void 0;
+			return {
+				data: {
+					hasNext,
+					...nextCursor === void 0 ? {} : { nextCursor },
+					folders,
+					objects
+				},
+				error: null
+			};
+		});
+		return {
+			exists: (path) => settled(async () => ({
+				data: await visible(normalizePath(path)),
+				error: null
+			})).then((reply) => reply.error === null ? reply : {
+				data: false,
+				error: reply.error
+			}),
+			info: (path, infoOptions) => settled(async () => {
+				const versionId = infoOptions?.versionId;
+				const name = normalizePath(path);
+				const [row] = await rows(versionId === void 0 ? OBJECT_INFO : `${OBJECT_INFO} and o.version = $3`, versionId === void 0 ? [bucket, name] : [
+					bucket,
+					name,
+					versionId
+				]);
+				const object = row?.["object"];
+				return isRecord(object) ? {
+					data: infoOf(object),
+					error: null
+				} : failed(NOT_FOUND);
+			}),
+			download: (path, downloadOptions, parameters) => checked(path, (name) => admin().download(name, downloadOptions, parameters)),
+			createSignedUrl: (path, expiresIn, urlOptions) => checked(path, (name) => admin().createSignedUrl(name, expiresIn, urlOptions)),
+			createSignedUrls: (paths, expiresIn, urlOptions) => settled(async () => {
+				const names = paths.map(normalizePath);
+				const seen = new Set((await rows(VISIBLE_OBJECTS, [bucket, names])).map((row) => String(row["path"])));
+				const shown = [...new Set(names.filter((name) => seen.has(name)))];
+				const signed = /* @__PURE__ */ new Map();
+				if (shown.length > 0) {
+					const reply = await admin().createSignedUrls(shown, expiresIn, urlOptions);
+					if (reply.error) return failed(reply.error);
+					for (const entry of reply.data) if (entry.path !== null) signed.set(entry.path, entry);
+				}
+				return {
+					data: names.map((name) => signed.get(name) ?? {
+						error: HIDDEN_URL,
+						path: name,
+						signedUrl: null
+					}),
+					error: null
+				};
+			}),
+			getPublicUrl: (path, urlOptions) => admin().getPublicUrl(path, urlOptions),
+			list,
+			listV2,
+			upload: refuse,
+			update: refuse,
+			createSignedUploadUrl: refuse,
+			uploadToSignedUrl: refuse,
+			remove: refuse,
+			copy: refuse,
+			move: refuse,
+			purgeCache: refuse
+		};
+	} };
+}
+//#endregion
 //#region src/server/server.ts
-/** The header `current_tenant_id()` reads over the Data API. */
-const TENANT_HEADER = "x-bs-tenant";
 /** The environment as `getEnv` resolves it, one variable at a time. */
 const RUNTIME_ENV = new Proxy({}, { get: (_target, key) => typeof key === "string" ? getEnv(key) : void 0 });
 const needsPostgres = (method) => dbError("invalid_request", `${method} needs createServer(betterSupabase, { postgres: createPostgres() })`);
-const STATELESS = {
-	persistSession: false,
-	autoRefreshToken: false,
-	detectSessionInUrl: false
-};
 /**
 * A framework adapter's server: `server` plus the adapter's own methods,
 * without reading the lazy `env` getter. `extra` can't replace a
@@ -581,13 +1181,6 @@ function extendServer(server, extra) {
 	shareCore(server, extended);
 	return extended;
 }
-/** `{ ...base, ...extra }` that keeps lazy getters lazy. */
-function withExtra(base, extra) {
-	return Object.defineProperties({}, {
-		...Object.getOwnPropertyDescriptors(base),
-		...Object.getOwnPropertyDescriptors(extra)
-	});
-}
 /**
 * Server-side entry point for APIs, jobs, MCP servers and framework
 * adapters. Holds the secrets; `betterSupabase` stays isomorphic.
@@ -596,134 +1189,20 @@ function createServer(betterSupabase, options = {}) {
 	const credentials = options.credentials === void 0 ? {} : { credentials: credentialProviderOf(options.credentials) };
 	let loaded;
 	const env = () => loaded ??= options.env ?? loadEnv(RUNTIME_ENV);
-	let adminClient;
-	let anonClient;
-	if ((options.prefetchJwks ?? defaultPrefetchJwks()) && options.auth?.jwks === void 0) try {
+	const lite = liteBackend(options, env);
+	if (lite === void 0 && (options.prefetchJwks ?? defaultPrefetchJwks()) && options.auth?.jwks === void 0) try {
 		prefetchJwks({
 			...options.auth,
 			env: env()
 		});
 	} catch {}
-	const secretKey = () => {
-		const key = env().secretKey;
-		if (!key) throw new TypeError("admin() needs SUPABASE_SECRET_KEY; it is not set");
-		return key;
-	};
-	const customFetch = options.fetch ? { fetch: options.fetch } : void 0;
-	const definitionExecutor = betterSupabase.executorOptions();
-	const urlLengthLimit = options.db?.urlLengthLimit ?? definitionExecutor.urlLengthLimit;
-	const db = {
-		...options.db?.timeout === void 0 ? {} : { timeout: options.db.timeout },
-		...options.db?.retry === void 0 ? {} : { retry: options.db.retry },
-		...urlLengthLimit === void 0 ? {} : { urlLengthLimit }
-	};
-	const dbOptions = Object.keys(db).length > 0 ? { db } : {};
-	const sharedGlobal = {
-		...customFetch ? { global: customFetch } : {},
-		...dbOptions
-	};
-	/** postgrest-js options a bare `PostgrestClient` takes; `timeout` is the executor's. */
-	const restOptions = {
-		...db.retry === void 0 ? {} : { retry: db.retry },
-		...urlLengthLimit === void 0 ? {} : { urlLengthLimit }
-	};
-	const executorOptions = {
-		...definitionExecutor,
-		...urlLengthLimit === void 0 ? {} : { urlLengthLimit },
-		...db.timeout === void 0 ? {} : { timeout: db.timeout },
-		...db.retry === void 0 ? {} : { retry: db.retry }
-	};
-	/** Set when `db` options need an executor built with them. */
-	const tunedExecutor = options.db !== void 0;
-	const serviceClient = () => {
-		adminClient ??= createClient(env().url, secretKey(), {
-			auth: STATELESS,
-			...sharedGlobal
-		});
-		return adminClient;
-	};
-	const readUrl = () => options.readUrl === false ? void 0 : options.readUrl?.replace(/\/+$/, "") ?? env().readUrl;
-	const apiKeyClient = () => {
-		throw new TypeError("ctx.supabase and ctx.db.$client are not available for an API key: ctx.db and ctx.sql run over direct Postgres with the key's claims");
-	};
-	/** Clients for the primary share the service and anon clients; others don't. */
-	const supabaseAt = (url, auth, headers = {}) => {
-		const custom = Object.keys(headers).length > 0;
-		const global = custom ? {
-			global: {
-				headers,
-				...customFetch
-			},
-			...dbOptions
-		} : sharedGlobal;
-		const shared = !custom && url === env().url;
-		switch (auth.kind) {
-			case "user": return createClient(url, env().publishableKey, {
-				accessToken: () => Promise.resolve(auth.token),
-				...global
-			});
-			case "service": return shared ? serviceClient() : createClient(url, secretKey(), {
-				auth: STATELESS,
-				...global
-			});
-			case "anon":
-			case "invalid":
-				if (!shared) return createClient(url, env().publishableKey, {
-					auth: STATELESS,
-					...global
-				});
-				anonClient ??= createClient(url, env().publishableKey, {
-					auth: STATELESS,
-					...sharedGlobal
-				});
-				return anonClient;
-			case "apiKey": return apiKeyClient();
-			default: return auth;
-		}
-	};
-	const supabaseFor = (auth, headers = {}) => supabaseAt(env().url, auth, headers);
-	const restUrls = /* @__PURE__ */ new Map();
-	const restUrl = (url) => {
-		let rest = restUrls.get(url);
-		if (rest === void 0) {
-			rest = new URL("rest/v1", url.endsWith("/") ? url : `${url}/`).href;
-			restUrls.set(url, rest);
-		}
-		return rest;
-	};
-	/**
-	* The client queries run on. Requests need only PostgREST, so they skip
-	* building Realtime, Storage and Auth clients per request; the shared
-	* service and anon clients for the primary are built once anyway.
-	*/
-	const restAt = (url, auth, headers = {}) => {
-		let key;
-		let bearer;
-		switch (auth.kind) {
-			case "user":
-				key = env().publishableKey;
-				bearer = auth.token;
-				break;
-			case "service":
-			case "anon":
-			case "invalid":
-				if (Object.keys(headers).length === 0 && url === env().url) return supabaseAt(url, auth, headers);
-				key = auth.kind === "service" ? secretKey() : env().publishableKey;
-				bearer = key;
-				break;
-			case "apiKey": return apiKeyClient();
-			default: return auth;
-		}
-		return new PostgrestClient(restUrl(url), {
-			headers: {
-				...headers,
-				apikey: key,
-				Authorization: `Bearer ${bearer}`
-			},
-			...customFetch,
-			...restOptions
-		});
-	};
+	const { executorOptions, tunedExecutor, serviceClient, readUrl, apiKeyClient, supabaseFor, restAt } = createClients({
+		options,
+		env,
+		definitionExecutor: betterSupabase.executorOptions(),
+		lite,
+		createClient
+	});
 	/** `$client` stays the full Supabase client, built when first read. */
 	const withLazyClient = (db, client) => Object.defineProperty(db, "$client", {
 		get: client,
@@ -736,12 +1215,15 @@ function createServer(betterSupabase, options = {}) {
 		const db = betterSupabase.connect(rest, {
 			...authContext(auth),
 			...context
-		}, tunedExecutor ? { executor: postgrestExecutor(rest, executorOptions) } : {});
+		}, auth.kind === "invalid" ? { executor: refusingExecutor(auth.error) } : tunedExecutor ? { executor: postgrestExecutor(rest, executorOptions) } : {});
 		return withLazyClient(db, () => supabase ??= supabaseFor(auth));
 	};
-	const sqlFor = (claims, context, stats, session) => {
+	const sqlFor = (claims, context, stats, session, storage) => {
 		if (!options.postgres) throw new TypeError("Direct Postgres access needs createServer(betterSupabase, { postgres: createPostgres() })");
-		return betterSupabase.connect(session ? options.postgres.executorFor(claims, session) : options.postgres.executorFor(claims), context, stats ? { stats } : {});
+		return betterSupabase.connect(session ? options.postgres.executorFor(claims, session) : options.postgres.executorFor(claims), context, {
+			...stats ? { stats } : {},
+			...storage ? { storage } : {}
+		});
 	};
 	/** `ServerOptions.tenant` outside `context()`, where it can't be awaited. */
 	const syncTenant = (request, auth) => {
@@ -753,7 +1235,7 @@ function createServer(betterSupabase, options = {}) {
 	const idPolicy = requestIdPolicy(options.requestIds);
 	if (options.support && !options.postgres) throw new TypeError("Support sessions need createServer(betterSupabase, { postgres: createPostgres(), support })");
 	const audit = serverAudit(betterSupabase, options.audit);
-	const support = options.support ? options.support.create(betterSupabase.events, options.auth?.claims ?? betterSupabase.claimsSchema) : supportOff;
+	const support = options.support ? options.support.create(betterSupabase.events, options.auth?.claims ?? betterSupabase.claimsSchema, betterSupabase.temporal) : supportOff;
 	/**
 	* The target's context in a support session. Queries run over direct
 	* Postgres with the target's claims plus `act`, read-only unless the
@@ -796,17 +1278,32 @@ function createServer(betterSupabase, options = {}) {
 		};
 		let db;
 		let sql;
+		let storage;
+		const targetStorage = () => {
+			const postgres = options.postgres;
+			if (!postgres) throw new TypeError("Support sessions need createServer(betterSupabase, { postgres: createPostgres(), support })");
+			let asTarget;
+			storage ??= supportStorage({
+				admin: { from: (bucket) => serviceClient().storage.from(bucket) },
+				sql: { queryRaw: (text, params) => (asTarget ??= postgres.asUser(sqlClaims, sessionOptions)).queryRaw(text, params) },
+				readOnly: session.readOnly
+			});
+			return storage;
+		};
 		return {
 			...credentials,
 			...ids,
 			auth,
 			resolution,
 			support: active,
+			get storage() {
+				return targetStorage();
+			},
 			get supabase() {
 				return unavailable();
 			},
 			get db() {
-				db ??= Object.defineProperty(sqlFor(sqlClaims, context, recorder, sessionOptions), "$client", {
+				db ??= Object.defineProperty(sqlFor(sqlClaims, context, recorder, sessionOptions, targetStorage()), "$client", {
 					get: unavailable,
 					enumerable: true,
 					configurable: true
@@ -814,7 +1311,7 @@ function createServer(betterSupabase, options = {}) {
 				return db;
 			},
 			get sql() {
-				sql ??= sqlFor(sqlClaims, context, recorder, sessionOptions);
+				sql ??= sqlFor(sqlClaims, context, recorder, sessionOptions, targetStorage());
 				return sql;
 			},
 			replica: void 0,
@@ -910,7 +1407,7 @@ function createServer(betterSupabase, options = {}) {
 				const rest = (sharesClient ? void 0 : supabase) ?? restAt(env().url, auth, headers);
 				const connected = betterSupabase.connect(rest, context, {
 					stats: recorder,
-					...url && replica ? { executor: routedExecutor(postgrestExecutor(rest, executorOptions), postgrestExecutor(restAt(url, auth, headers), executorOptions), replica) } : tunedExecutor ? { executor: postgrestExecutor(rest, executorOptions) } : {}
+					...auth.kind === "invalid" ? { executor: refusingExecutor(auth.error) } : url && replica ? { executor: routedExecutor(postgrestExecutor(rest, executorOptions), postgrestExecutor(restAt(url, auth, headers), executorOptions), replica) } : tunedExecutor ? { executor: postgrestExecutor(rest, executorOptions) } : {}
 				});
 				db = withLazyClient(connected, client);
 				return db;
@@ -938,7 +1435,7 @@ function createServer(betterSupabase, options = {}) {
 		const userMetadata = betterSupabase.userMetadataSchema;
 		const resolution = await resolveAuth(request, {
 			logger: betterSupabase.events.logger,
-			...options.auth,
+			...lite ? lite.auth() : options.auth,
 			...claims ? { claims } : {},
 			...userMetadata ? { userMetadata } : {},
 			env: env(),
@@ -975,6 +1472,7 @@ function createServer(betterSupabase, options = {}) {
 			return env();
 		},
 		events: betterSupabase.events,
+		authorizer: options.authorizer,
 		resolve,
 		supabaseFor,
 		dbFor,
@@ -1122,6 +1620,14 @@ function createServer(betterSupabase, options = {}) {
 function flushEvents(server, waitUntil) {
 	if (waitUntil && server.events.pending) waitUntil(server.events.settled());
 }
+/** Runs `run`, then hands pending event sink sends to `waitUntil` even when it throws. */
+async function withFlush(server, waitUntil, run) {
+	try {
+		return await run();
+	} finally {
+		flushEvents(server, waitUntil);
+	}
+}
 /** The 500 for an error a handler threw; the message only when `expose` is set. */
 function unexpectedResponse(cause, options) {
 	return problemResponse(dbError("unexpected", options.expose && cause instanceof Error ? cause.message : "Internal server error"), options);
@@ -1182,4 +1688,4 @@ async function resolveToken(server, token) {
 	return auth;
 }
 //#endregion
-export { serverCore as C, suspendAccount as D, lastSignIns as E, deleteAccount as O, withServerContext as S, endSessions as T, withSession as _, unexpectedResponse as a, shouldCheckSession as b, extendServer as c, clearSupportCookie as d, supportCookie as f, withSupport as g, withTenant as h, resolveToken as i, withExtra as l, supportCookieValue as m, flushEvents as n, TENANT_HEADER as o, supportCookieMaxAge as p, handle as r, createServer as s, bearerRequest as t, SUPPORT_COOKIE as u, isPrefetch as v, SERVER_EVENT_SOURCE as w, shouldRefresh as x, refreshFor as y };
+export { withServerContext as C, lastSignIns as D, endSessions as E, suspendAccount as O, shouldRefresh as S, SERVER_EVENT_SOURCE as T, withSupport as _, unexpectedResponse as a, refreshFor as b, extendServer as c, clearSupportCookie as d, supportCookie as f, withTenant as g, TENANT_HEADER as h, resolveToken as i, deleteAccount as k, supportStorage as l, supportCookieValue as m, flushEvents as n, withFlush as o, supportCookieMaxAge as p, handle as r, createServer as s, bearerRequest as t, SUPPORT_COOKIE as u, withSession as v, serverCore as w, shouldCheckSession as x, isPrefetch as y };