better-supabase 0.7.0 → 0.8.0

package/dist/react/native/index.js

@@ -1,6 +1,6 @@
 import { r as signInWithOAuthBrowser, t as handleAuthDeepLink } from "../../auth-link-DrDX9KOT.js";
-import { i as useAuth, n as ClientContext } from "../../hooks-1BTCJsiw.js";
-import { t as usePending } from "../../sign-in-Cb1mwv6X.js";
+import { i as useAuth, n as ClientContext } from "../../hooks-Bhza9Hnr.js";
+import { t as usePending } from "../../sign-in-D_yoP0PF.js";
 import { useContext, useEffect, useMemo, useRef, useState } from "react";
 //#region src/react/native/index.ts
 function useClientOf(explicit, hook) {

package/dist/react/server.d.ts

@@ -1,13 +1,13 @@
-import { t as escapeLike } from "../escape-like-ImTK0ps_.js";
-import { it as QuerySpec } from "../define-CJJkkr1-.js";
-import { s as Impersonator } from "../mfa-Daak8ukG.js";
-import { t as tenantOf } from "../tenant-BxNFk9bx.js";
-import { t as AuthSession } from "../view-CF7ihnkg.js";
-import { r as LiveCountSeed } from "../index-DunNRdnT.js";
-import { r as MembershipClaim } from "../entitlements-BKSVGtrG.js";
-import { n as supportOf, t as SupportView } from "../support-view-CVOJJLpc.js";
-import { a as BroadcastOptions, f as UseActionOptions, l as LiveQueryHookOptions, n as ActionInputOf, o as ClientLike, r as ActionResultOf, s as LiveCountHookOptions, t as fieldErrorsOf } from "../field-errors-BFOa7WhB.js";
-import { C as BetterSupabaseProviderProps, E as ProfileOf, M as useSupabase, O as useAuth, S as BetterSupabaseProvider, T as LiveCount, _ as ActionHandle, a as UploadTarget, c as useUpload$1, d as useDebouncedSearch$1, f as Presence, g as ActionForm, h as usePresence$1, i as UploadStatus, j as useLiveQuery, k as useBroadcast, l as DebouncedSearch, m as PresenceTopic, n as SignedUrlSource, o as UseUploadOptions, p as PresenceHookOptions, r as Upload, s as useSignedUrl$1, t as SignedUrl, u as DebouncedSearchOptions, v as UseActionFormOptions, w as ClaimsOf, x as BetterHooks } from "../index-CewnYSpv.js";
+import { t as escapeLike } from "../escape-like-DDWoHzh_.js";
+import { at as QuerySpec } from "../define-DmcfoNXB.js";
+import { s as Impersonator } from "../mfa-SZc9YYyb.js";
+import { t as tenantOf } from "../tenant-CM368LXb.js";
+import { t as AuthSession } from "../view-TpXEUcVN.js";
+import { r as LiveCountSeed } from "../index-BCHR4Ucl.js";
+import { r as MembershipClaim } from "../entitlements-Ds8qoYZ-.js";
+import { n as supportOf, t as SupportView } from "../support-view-scqMgtOo.js";
+import { a as BroadcastOptions, c as LiveCountHookOptions, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-DIe9XYWL.js";
+import { A as useSupabase, C as BetterSupabaseProviderProps, D as useBroadcast, E as useAuth, S as BetterSupabaseProvider, _ as ActionHandle, a as UploadTarget, c as useUpload$1, d as useDebouncedSearch$1, f as Presence, g as ActionForm, h as usePresence$1, i as UploadStatus, k as useLiveQuery, l as DebouncedSearch, m as PresenceTopic, n as SignedUrlSource, o as UseUploadOptions, p as PresenceHookOptions, r as Upload, s as useSignedUrl$1, t as SignedUrl, u as DebouncedSearchOptions, v as UseActionFormOptions, w as LiveCount, x as BetterHooks } from "../index-_4R4b01v.js";
 import { SessionProvider, SessionProviderProps } from "./session.js";
 import { a as useSignIn$1, i as SignOut, n as PendingState, o as useSignOut$1, r as SignIn, t as AuthHookOptions } from "../sign-in-BCV5S2WZ.js";
 //#region src/react/server.d.ts

package/dist/react/server.js

@@ -1,8 +1,8 @@
 import { t as escapeLike } from "../escape-like-DHfx6jRr.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { a as useBroadcast, c as useLiveQuery, i as useAuth, l as useSupabase, t as BetterSupabaseProvider } from "../hooks-1BTCJsiw.js";
-import { t as fieldErrorsOf } from "../field-errors-VF1yb8yI.js";
-import "../react-F80mF4-t.js";
+import { a as useBroadcast, c as useLiveQuery, i as useAuth, l as useSupabase, t as BetterSupabaseProvider } from "../hooks-Bhza9Hnr.js";
+import { t as fieldErrorsOf } from "../field-errors-DZVRWRkf.js";
+import "../react-Bmpo59D7.js";
 import { t as tenantOf } from "../tenant-I1TEZ_BX.js";
 import { SessionProvider } from "./session.js";
 //#region src/react/server.ts

package/dist/react/session.d.ts

@@ -1,5 +1,5 @@
-import { t as AuthSession } from "../view-CF7ihnkg.js";
-import { t as SupportView } from "../support-view-CVOJJLpc.js";
+import { t as AuthSession } from "../view-TpXEUcVN.js";
+import { t as SupportView } from "../support-view-scqMgtOo.js";
 import { ReactNode } from "react";
 //#region src/react/session.d.ts
 export interface SessionProviderProps {

package/dist/{react-F80mF4-t.js → react-Bmpo59D7.js}

@@ -1,9 +1,9 @@
-import { n as dbError } from "./errors-B11Duf73.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
 import { t as escapeLike } from "./escape-like-DHfx6jRr.js";
-import { r as err, s as toDbError } from "./result-DzUbqgdW.js";
+import { r as err, s as toDbError } from "./result-DEqHCMKP.js";
 import "./react/session.js";
-import { n as ClientContext, o as useBroadcastAuth } from "./hooks-1BTCJsiw.js";
-import { t as fieldErrorsOf } from "./field-errors-VF1yb8yI.js";
+import { n as ClientContext, o as useBroadcastAuth } from "./hooks-Bhza9Hnr.js";
+import { t as fieldErrorsOf } from "./field-errors-DZVRWRkf.js";
 import { n as ttlSeconds } from "./ttl-Hr34gRu8.js";
 import { useCallback, useContext, useEffect, useMemo, useRef, useState, useTransition } from "react";
 //#region src/react/actions.ts

package/dist/react-router/index.d.ts

@@ -1,9 +1,9 @@
-import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
-import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-ZSJ9rCcV.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
-import { t as RefusalRedirects } from "../refusal-DhSU2Vvr.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-KIPvRQJU.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-CoE5Zwy4.js";
+import { t as BetterSupabase } from "../define-DmcfoNXB.js";
+import { t as BetterServer } from "../server-types-CrAmZ8jv.js";
+import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-W99LCPBS.js";
+import { t as RefusalRedirects } from "../refusal-CFI8-5nf.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-148t1m3C.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/react-router/index.js

@@ -1,10 +1,10 @@
-import { a as problemResponse } from "../problem-BreOl8b8.js";
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-B-tL8hqg.js";
-import { o as settle, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
+import { o as problemResponse } from "../problem-CJvFeGu7.js";
+import { c as extendServer, o as withFlush, s as createServer } from "../adapter-CN45ibbV.js";
+import { o as settle, t as defaultExpose } from "../respond-volM3ByS.js";
+import { i as requireCaller, o as runAction } from "../kit-BhHr9T9v.js";
 import { n as bufferInPlace, t as around } from "../shared-CBxosKK3.js";
-import { i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-BDCpJI7o.js";
-import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
+import { i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-3ey3QmrO.js";
+import { r as refusalResponse } from "../refusal-K78A1Vmq.js";
 //#region src/bridges/react-router.ts
 /**
 * Runs an entry array as React Router server middleware. The contributions
@@ -51,16 +51,14 @@ function createReactRouter(betterSupabase, options) {
 			bufferInPlace(args.request);
 			return run(args.request, options.platformEnv?.(args), async (contributions) => {
 				args.context.set(key, localsOf(contributions));
-				const response = await next();
-				flushEvents(server, options.waitUntil);
-				return response;
+				return withFlush(server, options.waitUntil, next);
 			});
 		},
 		locals,
 		loader(loaderOptions, fn) {
 			return async (args) => {
 				const scope = locals(args);
-				const caller = await requireCaller(scope.bs.auth, loaderOptions, scope.tenant);
+				const caller = await requireCaller(scope.bs.auth, loaderOptions, scope.tenant, options.authorizer);
 				if ("kind" in caller) throw refusalResponse(caller, args.request, options, expose);
 				const ctx = {
 					...scope,
@@ -80,7 +78,7 @@ function createReactRouter(betterSupabase, options) {
 				return await runAction(scope.bs.auth, actionOptions, await actionInput(args.request), scope.tenant, (parsed, caller) => fn(parsed, {
 					...scope,
 					...caller
-				}, args));
+				}, args), options.authorizer);
 			};
 		}
 	});

package/dist/{read-set-DuKWC9Mj.js → read-set-DAeWhqPf.js}

@@ -1,5 +1,5 @@
-import { n as dbError } from "./errors-B11Duf73.js";
-import { i as tableMeta, t as builderFor } from "./build-BXIzE6Xv.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
+import { i as tableMeta, t as builderFor } from "./build-meLuYGri.js";
 import { n as touchedTables } from "./tables-Cb-3_VWc.js";
 //#region src/core/spec.ts
 const READ_METHODS = [

package/dist/realtime/index.d.ts

@@ -1,4 +1,4 @@
-import { n as AccessPolicySql, r as AccessTopicPolicy } from "../types-6BdhkmZe.js";
-import { n as TemplateValues, t as TemplateParams } from "../template-CwO38Do8.js";
-import { A as TopicSubscription, C as TopicEvent, D as TopicPayload, E as TopicOptions, F as rowChange, M as TriggerOptions, N as TriggerValue, O as TopicSqlOptions, P as defineTopic, S as Topic, T as TopicMessage, _ as RealtimeClient, a as LiveSource, b as Subscription, c as liveQuery, d as PresenceInput, f as PresenceMember, g as PresenceSubscription, h as PresenceSchema, i as LiveQueryOptions, j as TriggerLookup, k as TopicSubscribeOptions, l as liveTopic, m as PresenceOutput, n as LiveCountOptions, o as LiveSubscription, p as PresenceOptions, r as LiveCountSeed, s as liveCount, t as CountRunner, u as EventSchemas, v as RowChange, w as TopicHandlers, x as SubscriptionStatus, y as SubscribeOptions } from "../index-DunNRdnT.js";
+import { n as AccessPolicySql, r as AccessTopicPolicy } from "../types-CoE5Zwy4.js";
+import { J as TemplateValues, q as TemplateParams } from "../storage-api-CB7Zl1Ci.js";
+import { A as TopicSubscription, C as TopicEvent, D as TopicPayload, E as TopicOptions, F as rowChange, M as TriggerOptions, N as TriggerValue, O as TopicSqlOptions, P as defineTopic, S as Topic, T as TopicMessage, _ as RealtimeClient, a as LiveSource, b as Subscription, c as liveQuery, d as PresenceInput, f as PresenceMember, g as PresenceSubscription, h as PresenceSchema, i as LiveQueryOptions, j as TriggerLookup, k as TopicSubscribeOptions, l as liveTopic, m as PresenceOutput, n as LiveCountOptions, o as LiveSubscription, p as PresenceOptions, r as LiveCountSeed, s as liveCount, t as CountRunner, u as EventSchemas, v as RowChange, w as TopicHandlers, x as SubscriptionStatus, y as SubscribeOptions } from "../index-BCHR4Ucl.js";
 export { type AccessPolicySql, type AccessTopicPolicy, type CountRunner, type EventSchemas, type LiveCountOptions, type LiveCountSeed, type LiveQueryOptions, type LiveSource, type LiveSubscription, type PresenceInput, type PresenceMember, type PresenceOptions, type PresenceOutput, type PresenceSchema, type PresenceSubscription, type RealtimeClient, type RowChange, type SubscribeOptions, type Subscription, type SubscriptionStatus, type TemplateParams, type TemplateValues, type Topic, type TopicEvent, type TopicHandlers, type TopicMessage, type TopicOptions, type TopicPayload, type TopicSqlOptions, type TopicSubscribeOptions, type TopicSubscription, type TriggerLookup, type TriggerOptions, type TriggerValue, defineTopic, liveCount, liveQuery, liveTopic, rowChange };

package/dist/realtime/index.js

@@ -1,25 +1,42 @@
-import { n as dbError } from "../errors-B11Duf73.js";
-import { a as ok, r as err, t as AsyncResult } from "../result-DzUbqgdW.js";
+import { n as dbError } from "../errors-2M6CKMP4.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-DEqHCMKP.js";
 import { a as tenantClaimPaths } from "../claims-PqzCxaTD.js";
 import { i as refreshRealtimeAuth, n as liveQuery, r as liveTopic, t as liveCount } from "../live-CTAZQkwl.js";
-import { i as sqlString, n as slug, r as sqlIdent, t as parseTemplate } from "../template--jDkl3UP.js";
-import { c as toApp } from "../shared-CxWmcyqB.js";
+import { a as sqlString, i as sqlIdent, n as parseTemplate, r as slug, t as claimSql } from "../template-lPVh-EwW.js";
 import { t as joinTopic } from "../channels-CkgQ_X60.js";
-import { o as resolveProviderSql, r as accessCheck } from "../access-sql-B0dF-SoF.js";
+import { t as toApp } from "../casing-DdFWEtqr.js";
+import { o as resolveProviderSql, r as accessCheck } from "../access-sql-CrSbK1q-.js";
 import "@supabase/supabase-js";
+//#region src/realtime/topic-sql.ts
+function columnSql(meta, column, where) {
+	const db = meta.columns[column]?.db;
+	if (!db) throw new TypeError(`defineTopic: no column for ${where} on "${meta.key}" ("${column}")`);
+	return sqlIdent(db);
+}
+/** A trigger value as SQL on `rec`, with one subquery per lookup. */
+function triggerValueSql(tables, meta, value, where, depth = 0) {
+	if (typeof value === "string") return `rec.${columnSql(meta, value, where)}`;
+	const joined = tables[value.from];
+	if (!joined) throw new TypeError(`defineTopic: unknown table "${value.from}" for ${where}`);
+	const key = value.key ?? (joined.primaryKey.length === 1 ? joined.primaryKey[0] : void 0);
+	if (key === void 0) throw new TypeError(`defineTopic: "${value.from}" has no single-column primary key; name its key for ${where}`);
+	const alias = `j${String(depth)}`;
+	const via = triggerValueSql(tables, meta, value.via, where, depth + 1);
+	return `(select ${alias}.${columnSql(joined, value.select, where)} from ${sqlIdent(joined.schema)}.${sqlIdent(joined.name)} ${alias} where ${alias}.${columnSql(joined, key, where)} = ${via} limit 1)`;
+}
+/** The event name: one for every operation, one per operation, or the operation. */
+function eventSql(event) {
+	if (event === void 0) return "tg_op";
+	if (typeof event === "string") return sqlString(event);
+	const cases = Object.entries(event).filter((entry) => entry[1] !== void 0).map(([operation, name]) => ` when ${sqlString(operation.toUpperCase())} then ${sqlString(name)}`);
+	return cases.length === 0 ? "tg_op" : `case tg_op${cases.join("")} else tg_op end`;
+}
+//#endregion
 //#region src/realtime/topic.ts
 const VALUE = /^[\w.@+=-]+$/;
 function validateValue(_name, value) {
 	return VALUE.test(value) ? void 0 : "contains characters topics do not allow";
 }
-function claimSql(claim) {
-	const expressions = (typeof claim === "string" ? [claim] : claim).map((path) => {
-		const keys = path.split(".");
-		const last = keys.pop();
-		return `(select auth.jwt())${keys.map((key) => ` -> ${sqlString(key)}`).join("")} ->> ${sqlString(last)}`;
-	});
-	return expressions.length === 1 ? expressions[0] : `coalesce(${expressions.join(", ")})`;
-}
 async function validate(schema, value) {
 	if (!schema) return {
 		ok: true,
@@ -44,29 +61,6 @@ function sendError(status, message) {
 	if (status === 429 || status >= 500 || status === 0) return dbError("network", message, status ? { status } : {});
 	return dbError("invalid_request", message, { status });
 }
-function columnSql(meta, column, where) {
-	const db = meta.columns[column]?.db;
-	if (!db) throw new TypeError(`defineTopic: no column for ${where} on "${meta.key}" ("${column}")`);
-	return sqlIdent(db);
-}
-/** A trigger value as SQL on `rec`, with one subquery per lookup. */
-function triggerValueSql(tables, meta, value, where, depth = 0) {
-	if (typeof value === "string") return `rec.${columnSql(meta, value, where)}`;
-	const joined = tables[value.from];
-	if (!joined) throw new TypeError(`defineTopic: unknown table "${value.from}" for ${where}`);
-	const key = value.key ?? (joined.primaryKey.length === 1 ? joined.primaryKey[0] : void 0);
-	if (key === void 0) throw new TypeError(`defineTopic: "${value.from}" has no single-column primary key; name its key for ${where}`);
-	const alias = `j${String(depth)}`;
-	const via = triggerValueSql(tables, meta, value.via, where, depth + 1);
-	return `(select ${alias}.${columnSql(joined, value.select, where)} from ${sqlIdent(joined.schema)}.${sqlIdent(joined.name)} ${alias} where ${alias}.${columnSql(joined, key, where)} = ${via} limit 1)`;
-}
-/** The event name: one for every operation, one per operation, or the operation. */
-function eventSql(event) {
-	if (event === void 0) return "tg_op";
-	if (typeof event === "string") return sqlString(event);
-	const cases = Object.entries(event).filter((entry) => entry[1] !== void 0).map(([operation, name]) => ` when ${sqlString(operation.toUpperCase())} then ${sqlString(name)}`);
-	return cases.length === 0 ? "tg_op" : `case tg_op${cases.join("")} else tg_op end`;
-}
 /**
 * A typed Realtime broadcast topic: names from a template, RLS policies for
 * private channels, row-change triggers, and disposable subscriptions.

package/dist/{refusal-DhSU2Vvr.d.ts → refusal-CFI8-5nf.d.ts}

@@ -1,4 +1,5 @@
-import { s as BlockRequireOptions } from "./kit-CkNzZUqv.js";
+import { t as AnyAuthorizer } from "./authorizer-eiOjo-3l.js";
+import { s as BlockRequireOptions } from "./kit-W99LCPBS.js";
 //#region src/server/refusal.d.ts
 /** Where refused callers go instead of a Problem Details response. */
 interface RefusalRedirects {
@@ -10,6 +11,8 @@ interface RefusalRedirects {
 interface RouteGuardOptions<C = unknown, P = unknown> extends BlockRequireOptions<C, P>, RefusalRedirects {
   /** Include internal error messages in Problem Details. Defaults to development only. */
   readonly expose?: boolean;
+  /** Decides `permission`; without one, a route with a `permission` refuses every caller. */
+  readonly authorizer?: AnyAuthorizer;
 }
 //#endregion
 export { RouteGuardOptions as n, RefusalRedirects as t };

package/dist/{refusal-CeJWxmkH.js → refusal-K78A1Vmq.js}

@@ -1,7 +1,7 @@
-import { r as dbErrorOf } from "./errors-B11Duf73.js";
-import { a as problemResponse } from "./problem-BreOl8b8.js";
-import { t as defaultExpose } from "./respond-BUgsXNgk.js";
-import { i as requireCaller } from "./kit-Fm-Fv7q5.js";
+import { r as dbErrorOf } from "./errors-2M6CKMP4.js";
+import { o as problemResponse } from "./problem-CJvFeGu7.js";
+import { t as defaultExpose } from "./respond-volM3ByS.js";
+import { i as requireCaller } from "./kit-BhHr9T9v.js";
 //#region src/server/refusal.ts
 function isAalRefusal(error) {
 	return error.kind === "forbidden" && "required" in error && error.required === "aal2";
@@ -30,7 +30,7 @@ function refusalResponse(error, request, redirects, expose) {
 }
 /** The refusal for a caller `options` refuses, or `undefined` to let it through. */
 async function routeRefusal(locals, request, options) {
-	const caller = await requireCaller(locals.bs.auth, options, locals.tenant);
+	const caller = await requireCaller(locals.bs.auth, options, locals.tenant, options.authorizer);
 	if (!("kind" in caller)) return void 0;
 	return refusalResponse(caller, request, options, options.expose ?? defaultExpose());
 }

package/dist/{resolve-tJZY3FEa.js → resolve-Bvgf3ut_.js}

@@ -1,7 +1,7 @@
-import { n as dbError } from "./errors-B11Duf73.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
 import { t as consoleLogger } from "./logger-glM28NVN.js";
-import { n as decodeJwtPayload } from "./base64-D2gsioCY.js";
-import { a as actorOf, i as userContext } from "./impersonation-DcqaTBHx.js";
+import { n as decodeJwtPayload, r as fromBase64, t as base64ToText } from "./base64-D2gsioCY.js";
+import { a as actorOf } from "./impersonation-DcqaTBHx.js";
 import { DEFAULT_COOKIE_OPTIONS, createChunks, isChunkLike, parseCookieHeader, serializeCookieHeader, stringFromBase64URL, stringToBase64URL } from "@supabase/ssr";
 import { extractCredentials, verifyCredentials } from "@supabase/server/core";
 //#region src/auth/session.ts
@@ -179,6 +179,92 @@ function clearSessionCookies(request, response, options) {
 	return response;
 }
 //#endregion
+//#region src/auth/hs256.ts
+const encoder = /* @__PURE__ */ new TextEncoder();
+/** The most HMAC keys kept at once; the oldest goes first. */
+const KEYS_SIZE = 64;
+const keys = /* @__PURE__ */ new Map();
+function keyFor(secret) {
+	let key = keys.get(secret);
+	if (!key) {
+		key = crypto.subtle.importKey("raw", encoder.encode(secret), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["verify"]);
+		keys.set(secret, key);
+		if (keys.size > KEYS_SIZE) {
+			const oldest = keys.keys().next();
+			if (!oldest.done) keys.delete(oldest.value);
+		}
+	}
+	return key;
+}
+function parseJson(part) {
+	try {
+		const parsed = JSON.parse(base64ToText(part));
+		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Whether the token is HS256 without a `kid`, the shape Supabase Lite (and
+* legacy shared-secret projects) issue.
+*/
+function isSharedSecretToken(token) {
+	const part = token.split(".", 1)[0];
+	const header = part ? parseJson(part) : void 0;
+	return header?.["alg"] === "HS256" && header["kid"] === void 0;
+}
+function fail(message) {
+	return {
+		ok: false,
+		code: "INVALID_JWT",
+		message
+	};
+}
+function matches(claim, expected) {
+	const wanted = typeof expected === "string" ? [expected] : expected;
+	return (Array.isArray(claim) ? claim : [claim]).some((value) => typeof value === "string" && wanted.includes(value));
+}
+/**
+* Verifies an HS256 user token against a shared secret with WebCrypto:
+* the signature, `exp`, `nbf`, and `aud` and `iss` when they are given.
+*/
+async function verifyHs256(token, secret, options) {
+	const parts = token.split(".");
+	const [encodedHeader, encodedPayload, encodedSignature] = parts;
+	if (parts.length !== 3 || !encodedHeader || !encodedPayload || encodedSignature === void 0) return fail("The token is not a JWT");
+	if (parseJson(encodedHeader)?.["alg"] !== "HS256") return fail("The token is not signed with HS256");
+	let signature;
+	try {
+		signature = fromBase64(encodedSignature);
+	} catch {
+		return fail("The token signature is not base64url");
+	}
+	if (!await crypto.subtle.verify("HMAC", await keyFor(secret), signature, encoder.encode(`${encodedHeader}.${encodedPayload}`))) return fail("The token signature does not match the JWT secret");
+	const payload = parseJson(encodedPayload);
+	if (!payload) return fail("The token payload is not a JSON object");
+	const { exp, nbf, sub } = payload;
+	if (typeof exp === "number" && exp <= options.now) return fail("The token has expired");
+	if (typeof nbf === "number" && nbf > options.now) return fail("The token is not valid yet");
+	if (options.audience !== void 0 && !matches(payload["aud"], options.audience)) return fail("The token audience does not match");
+	if (options.issuer !== void 0 && !matches(payload["iss"], options.issuer)) return fail("The token issuer does not match");
+	if (typeof sub !== "string") return fail("The token has no sub claim, so it identifies no user");
+	const claims = payload;
+	return {
+		ok: true,
+		claims,
+		user: {
+			id: sub,
+			...typeof claims.role === "string" ? { role: claims.role } : {},
+			...typeof claims.email === "string" ? { email: claims.email } : {},
+			...claims.app_metadata ? { appMetadata: claims.app_metadata } : {},
+			...claims.user_metadata ? { userMetadata: claims.user_metadata } : {}
+		}
+	};
+}
+//#endregion
 //#region src/auth/refresh.ts
 /**
 * How long a finished refresh is reused for requests still carrying the old
@@ -304,6 +390,24 @@ function serverEnv(options) {
 const MEMO_SIZE = 256;
 const memoByUrl = /* @__PURE__ */ new Map();
 let memoByJwks = /* @__PURE__ */ new WeakMap();
+/** The most JWT secrets remembered at once; the oldest goes first. */
+const SECRET_IDS_SIZE = 64;
+/** A number per JWT secret, so memo keys tell secrets apart. Bounded, and never reuses a number. */
+const secretIds = /* @__PURE__ */ new Map();
+let nextSecretId = 1;
+function secretId(secret) {
+	if (secret === void 0) return null;
+	let id = secretIds.get(secret);
+	if (id === void 0) {
+		id = nextSecretId++;
+		secretIds.set(secret, id);
+		if (secretIds.size > SECRET_IDS_SIZE) {
+			const oldest = secretIds.keys().next();
+			if (!oldest.done) secretIds.delete(oldest.value);
+		}
+	}
+	return id;
+}
 /**
 * Tokens that already verified, until they expire. Every private-cache scope
 * and island resolves the same token again; this skips the signature check.
@@ -316,7 +420,8 @@ function memoFor(options) {
 		inline ? null : String(jwks ?? options.env.jwksUrl),
 		options.env.url,
 		options.audience ?? null,
-		options.issuer ?? null
+		options.issuer ?? null,
+		secretId(options.jwtSecret)
 	]);
 	if (inline) {
 		let byKey = memoByJwks.get(jwks);
@@ -472,6 +577,27 @@ function prefetchJwks(options) {
 	}).then(() => {}, () => {});
 }
 async function verifyOnce(credentials, modes, options, source) {
+	const token = credentials.token;
+	if (options.jwtSecret !== void 0 && token && modes.length === 1 && modes[0] === "user" && isSharedSecretToken(token)) {
+		const verified = await verifyHs256(token, options.jwtSecret, {
+			now: Math.floor((options.now ?? Date.now)() / 1e3),
+			...options.audience === void 0 ? {} : { audience: options.audience },
+			...options.issuer === void 0 ? {} : { issuer: options.issuer }
+		});
+		if (!verified.ok) return {
+			kind: "invalid",
+			reason: "token",
+			error: dbError("unauthorized", verified.message, { code: verified.code })
+		};
+		return {
+			kind: "user",
+			token,
+			claims: verified.claims,
+			user: verified.user,
+			source,
+			expiresAt: typeof verified.claims.exp === "number" ? verified.claims.exp : null
+		};
+	}
 	const { data, error } = await verifyCredentials(credentials, {
 		auth: modes,
 		env: serverEnv(options),
@@ -656,42 +782,5 @@ async function resolveAuth(request, options) {
 		apikey: null
 	}, ["user"], options, "cookie"), cookies, writes);
 }
-/** The repository context (`actor`, `claims`) for an auth state. */
-function authContext(auth) {
-	switch (auth.kind) {
-		case "user": return userContext(auth.user, auth.claims);
-		case "service": return {
-			actor: {
-				id: `service:${auth.keyName}`,
-				kind: "service",
-				role: "service_role"
-			},
-			claims: { role: "service_role" }
-		};
-		case "apiKey": return {
-			actor: auth.userId ? {
-				id: auth.userId,
-				kind: "user",
-				role: "authenticated"
-			} : {
-				id: `api-key:${auth.keyId}`,
-				kind: "service",
-				role: "authenticated"
-			},
-			claims: auth.claims,
-			...auth.organizationId ? { tenant: auth.organizationId } : {}
-		};
-		case "anon":
-		case "invalid": return {
-			actor: {
-				id: "anon",
-				kind: "anon",
-				role: "anon"
-			},
-			claims: { role: "anon" }
-		};
-		default: return auth;
-	}
-}
 //#endregion
-export { writeSession as _, refreshSession as a, AUTH_CACHE_HEADERS as c, clearSessionAtScopes as d, parseCookies as f, sessionEncoding as g, sessionCookieName as h, resolveAuth as i, DEFAULT_SESSION_ENCODING as l, serializeCookie as m, clientIp as n, clearSessionCookies as o, readSession as p, prefetchJwks as r, sessionStatus as s, authContext as t, applyCookieWrites as u };
+export { clearSessionCookies as a, DEFAULT_SESSION_ENCODING as c, parseCookies as d, readSession as f, writeSession as g, sessionEncoding as h, refreshSession as i, applyCookieWrites as l, sessionCookieName as m, prefetchJwks as n, sessionStatus as o, serializeCookie as p, resolveAuth as r, AUTH_CACHE_HEADERS as s, clientIp as t, clearSessionAtScopes as u };

package/dist/{resolve-ChTYeTEl.d.ts → resolve-MxXVWyhd.d.ts}

@@ -1,10 +1,9 @@
 /// <reference lib="esnext.temporal" />
-import { b as DbError } from "./result-D7y2fT87.js";
-import { m as RequestContext } from "./plugin-FGY8UhYm.js";
-import { l as RefreshEvent } from "./events-DWDhx77e.js";
+import { b as DbError } from "./result-BchM1XZn.js";
+import { l as RefreshEvent } from "./events-D1BOCll8.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as StandardSchemaV1 } from "./standard-CYsm7xpT.js";
-import { t as BetterSupabaseEnv } from "./index-CLg87OBW.js";
+import { t as StandardSchemaV1 } from "./standard-lmkbOtPB.js";
+import { t as BetterSupabaseEnv } from "./index-BUK7jUzR.js";
 import { a as CookieWrite, n as CookieOptions, r as CookieRecord, s as SessionEncoding } from "./session-ChiXDZdZ.js";
 import { JWTClaims, SupabaseEnv, UserClaims } from "@supabase/server";
 //#region src/auth/resolve.d.ts
@@ -110,6 +109,13 @@ interface ResolveAuthOptions {
   readonly cookies?: boolean;
   /** Inline JWKS instead of fetching `env.jwksUrl` (tests, air-gapped). */
   readonly jwks?: SupabaseEnv["jwks"];
+  /**
+   * Verify HS256 tokens without a `kid` locally with this shared secret, the
+   * tokens Supabase Lite issues (`auth.jwt_secret`). Tokens with a `kid`
+   * still verify against the JWKS. `createServer` sets it from
+   * `SUPABASE_JWT_SECRET` with `backend: "lite"`.
+   */
+  readonly jwtSecret?: string;
   /**
    * Validates the verified claims (`betterSupabase.claims(schema)` sets it). A failure
    * resolves to `{ kind: 'invalid', reason: 'claims' }`.
@@ -163,7 +169,5 @@ declare function clientIp(request: Request): string | undefined;
  * set, through a single-flight request, and only then are cookies written.
  */
 declare function resolveAuth(request: Request, options: ResolveAuthOptions): Promise<AuthResolution>;
-/** The repository context (`actor`, `claims`) for an auth state. */
-declare function authContext(auth: AuthState): RequestContext;
 //#endregion
-export { ResolveAuthOptions as a, clientIp as c, InvalidReason as i, resolveAuth as l, AuthResolver as n, ResolvedState as o, AuthState as r, authContext as s, AuthResolution as t };
+export { ResolveAuthOptions as a, resolveAuth as c, InvalidReason as i, AuthResolver as n, ResolvedState as o, AuthState as r, clientIp as s, AuthResolution as t };

package/dist/resource--vTrBe6I.d.ts

@@ -0,0 +1,103 @@
+import { R as TableMeta } from "./types-CoE5Zwy4.js";
+import { D as SecurityRequirement, E as ResourceOperation, r as JsonObject } from "./model-OgBxvk3N.js";
+//#region src/spec/schemas.d.ts
+/** A Standard Schema, or anything else that might carry `~standard`. */
+interface StandardLike {
+  readonly "~standard": object;
+}
+//#endregion
+//#region src/spec/resource.d.ts
+type ResourcePagination = "offset" | "cursor";
+type ActionMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+/** A custom endpoint on a resource, documented next to its CRUD operations. */
+interface ResourceActionSpec<Ref = string> {
+  readonly method: ActionMethod;
+  /**
+   * Relative to the collection: `/{id}/send` acts on one row (the key
+   * parameter is the table's primary key), `/export` on the table.
+   */
+  readonly path: string;
+  /** The JSON body. */
+  readonly input?: StandardLike;
+  /** The query parameters, as an object schema. */
+  readonly query?: StandardLike;
+  /** The JSON response. Without it the action answers 204. */
+  readonly output?: StandardLike;
+  /** Success status. Defaults to 200 with an output, 204 without. */
+  readonly status?: number;
+  readonly summary?: string;
+  readonly description?: string;
+  readonly deprecated?: boolean;
+  readonly permission?: Ref;
+  /** Names of the events the action emits, for AsyncAPI. */
+  readonly emits?: readonly string[];
+}
+/** One shared error response: its component name, status and description. */
+interface ErrorResponse {
+  readonly name: string;
+  readonly status: number;
+  readonly description: string;
+}
+/**
+ * What a resource serves and documents. `defineResource` and `defineApi`
+ * read the same object, so the routes and the spec cannot drift.
+ */
+interface ResourceDescription<Ref = string> {
+  /** Defaults to every operation for tables, `list` and `get` for views. */
+  readonly operations?: readonly ResourceOperation[];
+  /** Filters, search and sorts for `list`, from `defineListQuery`. */
+  readonly list?: {
+    readonly openapi: readonly unknown[];
+    readonly pagination?: ResourcePagination;
+  };
+  /** Paging of the default list. Defaults to `offset`. */
+  readonly pagination?: ResourcePagination;
+  /** Largest page of the default list. Defaults to 200. */
+  readonly maxPageSize?: number;
+  /** Path of the collection in the spec. Defaults to `/<table>`. */
+  readonly path?: string;
+  readonly tag?: string;
+  readonly description?: string;
+  /** Validates request bodies; their JSON Schema replaces the table's in the spec. */
+  readonly input?: {
+    readonly create?: StandardLike;
+    readonly update?: StandardLike;
+  };
+  /** The response shape of an operation whose hooks change it. */
+  readonly output?: Partial<Readonly<Record<ResourceOperation, StandardLike>>>;
+  readonly actions?: Readonly<Record<string, ResourceActionSpec<Ref>>>;
+  /**
+   * The permission of each operation. `true` asks the authorizer
+   * (`forOperation`) for every enabled operation.
+   */
+  readonly permissions?: true | Partial<Readonly<Record<ResourceOperation, Ref>>>;
+  /** Overrides the model's security for this resource; `[]` makes it public. */
+  readonly security?: readonly SecurityRequirement[];
+  /** The shared error responses. Defaults to the API's `errors`. */
+  readonly errors?: readonly ErrorResponse[];
+  /** Deep-merged into the lowered operation, by operation or action name (`*` for all). */
+  readonly extend?: Readonly<Record<string, JsonObject>>;
+}
+interface PlannedAction<Ref = string> extends ResourceActionSpec<Ref> {
+  readonly name: string;
+  /** The `{name}` segments of `path`. */
+  readonly params: readonly string[];
+  /** The path split into segments; `{name}` segments are params. */
+  readonly segments: readonly string[];
+}
+/** A resolved `ResourceDescription`. */
+interface ResourcePlan<Ref = string> {
+  readonly table: string;
+  readonly meta: TableMeta;
+  readonly operations: readonly ResourceOperation[];
+  /** Name of the key parameter, or `undefined` for tables without a single-column key. */
+  readonly keyParam: string | undefined;
+  readonly pagination: ResourcePagination;
+  readonly maxPageSize: number;
+  readonly description: ResourceDescription<Ref>;
+  readonly actions: readonly PlannedAction<Ref>[];
+  /** The permission reference of each operation and action that has one. */
+  readonly permissions: Readonly<Record<string, Ref>>;
+}
+//#endregion
+export { ResourcePlan as a, ResourcePagination as i, ResourceActionSpec as n, StandardLike as o, ResourceDescription as r, ErrorResponse as t };