better-supabase 0.7.0 → 0.8.0

package/dist/{server-ZSJ9rCcV.d.ts → server-types-CrAmZ8jv.d.ts}

@@ -1,20 +1,34 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult } from "./result-D7y2fT87.js";
-import { a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
-import { t as SqlClient } from "./executor-DbvExCFC.js";
-import { m as RequestContext } from "./plugin-FGY8UhYm.js";
-import { a as EventHub } from "./events-DWDhx77e.js";
-import { t as BetterSupabaseEnv } from "./index-CLg87OBW.js";
+import { t as AsyncResult } from "./result-BchM1XZn.js";
+import { a as AnyModels, i as AnyFunctions } from "./types-CoE5Zwy4.js";
+import { t as SqlClient } from "./executor-ngjKL_Pe.js";
+import { m as RequestContext } from "./plugin-CPK2HsbY.js";
+import { a as EventHub } from "./events-D1BOCll8.js";
+import { t as BetterSupabaseEnv } from "./index-BUK7jUzR.js";
 import { a as CookieWrite } from "./session-ChiXDZdZ.js";
-import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-ChTYeTEl.js";
-import { r as CredentialProvider } from "./provider-D-UEMvSD.js";
-import { B as DbStats, H as StatsRecorder, b as Db, t as BetterSupabase } from "./define-CJJkkr1-.js";
-import { r as EventSink } from "./cloud-event-C1JCc1bH.js";
-import { s as SqlClaims, t as BetterPostgres } from "./pool-CAu2nLrL.js";
-import { o as ImpersonationOptions } from "./mfa-Daak8ukG.js";
-import { n as Bucket } from "./bucket-Cl46E3jS.js";
+import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-MxXVWyhd.js";
+import { r as CredentialProvider } from "./provider-ib9wzUDz.js";
+import { a as ProblemFormat } from "./problem-TvGdxO1t.js";
+import { t as AnyAuthorizer } from "./authorizer-eiOjo-3l.js";
+import { i as EventSink } from "./cloud-event-Dune0KI7.js";
+import { S as Bucket, t as StorageApi } from "./storage-api-CB7Zl1Ci.js";
+import { Kt as StatsRecorder, Wt as DbStats, _ as Db, t as BetterSupabase } from "./define-DmcfoNXB.js";
+import { o as ImpersonationOptions } from "./mfa-SZc9YYyb.js";
+import { s as SqlClaims, t as BetterPostgres } from "./pool-gkhbGp2E.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/server/lite.d.ts
+/** The `[db] driver` values Supabase Lite reads from `supabase/config.toml`. */
+type LiteDriver = "sqlite-postgres" | "sqlite" | "pglite" | "postgres";
+//#endregion
+//#region src/server/request-ids.d.ts
+interface RequestIdOptions {
+  readonly requestHeader?: string;
+  readonly correlationHeader?: string;
+  readonly incoming?: boolean;
+  readonly generate?: boolean;
+}
+//#endregion
 //#region src/auth/support.d.ts
 type SupportEndedBy = "admin" | "expired" | "revoked";
 /** A support session: a platform admin viewing the app as `targetUserId`. */
@@ -82,10 +96,27 @@ interface SupportSessionStore {
   list(filter?: SupportListFilter, claims?: SupportCallerClaims): Promise<readonly SupportSession[]>;
   /** The claims `targetUserId` would get, when the store can build them. */
   claims?(targetUserId: string): Promise<Readonly<Record<string, unknown>>>;
+  /**
+   * Ends every running session past its expiry with `endedBy: "expired"`
+   * and returns them. Optional; `support.expire()` fails without it.
+   */
+  expire?(): Promise<readonly SupportSession[]>;
+  /**
+   * The store with `namespace` for its time values, unless it was given one
+   * itself. Optional; `createServer` calls it with the definition's
+   * `temporal`.
+   */
+  withTemporal?(namespace: typeof Temporal): SupportSessionStore;
 }
 interface SqlSupportStoreOptions {
   /** `sql.modules.support-sessions.schema`. Defaults to `better_supabase`. */
   readonly schema?: string;
+  /**
+   * The Temporal namespace for the sessions' time values, for runtimes
+   * without a global one. Defaults to the one `createServer` passes from the
+   * definition, then the provided or global Temporal.
+   */
+  readonly temporal?: typeof Temporal;
 }
 /**
  * Support sessions in the `support-sessions` SQL module. `start` runs
@@ -170,6 +201,13 @@ interface SupportStartRequest {
   readonly tenant?: string;
   readonly metadata?: Readonly<Record<string, unknown>>;
 }
+/** Options for `support.expireRoute`. */
+interface SupportExpireRouteOptions {
+  /** The bearer token the cron caller sends, such as `process.env.CRON_SECRET`. */
+  readonly secret: string | undefined;
+  /** Rewrites the Problem Details bodies of the route's errors. */
+  readonly problem?: ProblemFormat;
+}
 /** A running support session, as the request that carries its cookie sees it. */
 interface ActiveSupport {
   readonly session: SupportSession;
@@ -205,6 +243,17 @@ interface SupportApi {
   current(request: Request, auth: AuthState): Promise<ActiveSupport | undefined>;
   /** The sessions `caller` may view (the SQL store checks the view permission). */
   list(caller: AuthState, filter?: SupportListFilter): AsyncResult<readonly SupportSession[]>;
+  /**
+   * Ends every session past its expiry through the store and emits
+   * `support.ended` with `endedBy: "expired"` for each; the SQL store runs
+   * over `postgres.admin`. Returns the sessions it ended.
+   */
+  expire(): AsyncResult<readonly SupportSession[]>;
+  /**
+   * A `GET` or `POST` handler for a cron caller that runs `expire()` and
+   * answers `{ expired }`, the number of sessions it ended.
+   */
+  expireRoute(options: SupportExpireRouteOptions): (request: Request) => Promise<Response>;
   /** The support session id in a request's cookie. */
   sessionIdOf(request: Request): string | undefined;
   /** `Set-Cookie` that clears the support cookie. */
@@ -213,8 +262,11 @@ interface SupportApi {
 /** `ServerOptions.support`, from `supportSessions(options)`. */
 interface SupportSessions {
   readonly options: SupportOptions;
-  /** Builds `bs.support`; `createServer` calls it once. */
-  readonly create: (events: EventHub, claimsSchema: StandardSchemaV1 | undefined) => SupportApi;
+  /**
+   * Builds `bs.support`; `createServer` calls it once, with the definition's
+   * `temporal`, which goes on to the store's `withTemporal`.
+   */
+  readonly create: (events: EventHub, claimsSchema: StandardSchemaV1 | undefined, temporal?: typeof Temporal) => SupportApi;
 }
 /**
  * Support sessions for `createServer(betterSupabase, { support })`. Apps that
@@ -278,14 +330,6 @@ interface ReplicaState {
   pin(): void;
 }
 //#endregion
-//#region src/server/request-ids.d.ts
-interface RequestIdOptions {
-  readonly requestHeader?: string;
-  readonly correlationHeader?: string;
-  readonly incoming?: boolean;
-  readonly generate?: boolean;
-}
-//#endregion
 //#region src/server/suspend-account.d.ts
 interface EndSessionsResult {
   readonly userId: string;
@@ -293,11 +337,24 @@ interface EndSessionsResult {
 }
 interface SuspendAccountOptions {
   readonly suspended: boolean;
+  /** A Go duration for the ban, such as `"24h"`. Defaults to 100 years. */
   readonly duration?: string;
+  /**
+   * Also end the sessions when suspending. Defaults to `false`: the sessions
+   * stay, so Auth answers refresh and `/user` with `user_banned` and the app
+   * can show why. Without the `sessions` SQL module, an access token keeps
+   * working against the Data API until it expires; set this to end the
+   * sessions at once instead.
+   */
+  readonly endSessions?: boolean;
 }
 interface SuspendAccountResult {
   readonly userId: string;
   readonly suspended: boolean;
+  /**
+   * The sessions deleted: `0` on a suspension (unless `endSessions` is set),
+   * and the user's remaining sessions when the ban is lifted.
+   */
   readonly ended: number;
 }
 declare function endSessions(sql: SqlClient, userId: string): AsyncResult<EndSessionsResult>;
@@ -314,7 +371,7 @@ interface LastSignIn {
 declare function lastSignIns(sql: SqlClient, userIds: readonly string[]): AsyncResult<ReadonlyMap<string, LastSignIn>>;
 declare function suspendAccount(service: SupabaseClient | (() => SupabaseClient), sql: SqlClient, userId: string, options: SuspendAccountOptions): AsyncResult<SuspendAccountResult>;
 //#endregion
-//#region src/server/server.d.ts
+//#region src/server/server-types.d.ts
 /**
  * PostgREST request settings for the caller's repositories and the shared
  * service and anon clients, the `db` options supabase-js takes.
@@ -342,6 +399,13 @@ interface ServerOptions {
   /** Enables `ctx.sql` and `actingAs()`. */
   readonly postgres?: BetterPostgres;
   readonly auth?: Omit<ResolveAuthOptions, "env">;
+  /**
+   * `"lite"` for Supabase Lite: tokens verify with `SUPABASE_JWT_SECRET`, no
+   * JWKS prefetch, and `rpc()` is `unsupported` on its SQLite drivers.
+   */
+  readonly backend?: "supabase" | "lite";
+  /** Lite's `[db] driver`, default `sqlite-postgres`; `postgres` needs `postgres`. */
+  readonly liteDriver?: LiteDriver;
   /**
    * Fetch the JWKS when the server is created, so the first request verifies
    * its token without waiting for it. Applies when neither `auth.jwks` nor
@@ -410,6 +474,12 @@ interface ServerOptions {
    * fails the action.
    */
   readonly audit?: EventSink;
+  /**
+   * The authorization decision point (`Authorizer` v1) that resources,
+   * actions, routes and MCP tools ask for their `permission`. Without one, a
+   * declared permission denies.
+   */
+  readonly authorizer?: AnyAuthorizer;
 }
 interface ForContextOptions {
   /** Recorded as `act.reason` when the context carries an impersonator. Defaults to `"job"`. */
@@ -449,6 +519,14 @@ interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unkn
    * `sql` are the target's, and `resolution` stays the admin's.
    */
   readonly support?: ActiveSupport;
+  /**
+   * Set in a support session, where `ctx.supabase` throws: Storage read as
+   * the target, with the file API of `supabase.storage`. Listings, `exists`
+   * and `info` run over Postgres as the target; downloads and signed URLs
+   * are checked there, then served with the service client. Writes are
+   * refused. Needs `SUPABASE_SECRET_KEY`.
+   */
+  readonly storage?: StorageApi;
   /** `options.credentials`, when the server has one. */
   readonly credentials?: CredentialProvider;
   readonly requestId?: string;
@@ -507,6 +585,11 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
    */
   deleteAccount(userId: string, options?: DeleteAccountOptions): AsyncResult<DeleteAccountResult>;
   endSessions(userId: string): AsyncResult<EndSessionsResult>;
+  /**
+   * Bans the user in Auth and keeps their sessions, so Auth answers with
+   * `user_banned` (`endSessions: true` deletes them too). Lifting the ban
+   * ends the sessions first, so the user signs in again.
+   */
   suspendAccount(userId: string, options: SuspendAccountOptions): AsyncResult<SuspendAccountResult>;
   /**
    * Repositories running as a user, with RLS, over direct Postgres. With
@@ -523,18 +606,9 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
   forContext(context: RequestContext, options?: ForContextOptions): AsyncResult<Db<M, F, E, undefined>>;
   /** Support sessions; every method fails without `ServerOptions.support`. */
   readonly support: SupportApi;
+  /** `options.authorizer`, when the server has one. */
+  readonly authorizer: AnyAuthorizer | undefined;
 }
 type ServerKeys = keyof BetterServer<AnyModels, AnyFunctions, unknown>;
-/**
- * A framework adapter's server: `server` plus the adapter's own methods,
- * without reading the lazy `env` getter. `extra` can't replace a
- * `BetterServer` method.
- */
-declare function extendServer<R extends object>(server: object, extra: Omit<R, ServerKeys>): R;
-/**
- * Server-side entry point for APIs, jobs, MCP servers and framework
- * adapters. Holds the secrets; `betterSupabase` stays isomorphic.
- */
-declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
 //#endregion
-export { supportSessions as A, SupportSession as B, ActiveSupport as C, SupportPolicy as D, SupportOptions as E, supportCookieValue as F, SupportStartInput as H, SqlSupportStoreOptions as I, SupportCallerClaims as L, SupportCookieOptions as M, clearSupportCookie as N, SupportSessions as O, supportCookie as P, SupportEndedBy as R, deleteAccount as S, SupportAuthorizeInput as T, sqlSupportStore as U, SupportSessionStore as V, supportClaims as W, RequestIdOptions as _, ServerDbOptions as a, DeleteAccountOptions as b, createServer as c, LastSignIn as d, SuspendAccountOptions as f, suspendAccount as g, lastSignIns as h, ServerContext as i, SUPPORT_COOKIE as j, SupportStartRequest as k, extendServer as l, endSessions as m, ContextOptions as n, ServerOptions as o, SuspendAccountResult as p, ForContextOptions as r, TENANT_HEADER as s, BetterServer as t, EndSessionsResult as u, PRIMARY_COOKIE as v, SupportApi as w, DeleteAccountResult as x, ReplicaState as y, SupportListFilter as z };
+export { SUPPORT_COOKIE as A, SupportSessionStore as B, SupportAuthorizeInput as C, SupportSessions as D, SupportPolicy as E, SqlSupportStoreOptions as F, LiteDriver as G, sqlSupportStore as H, SupportCallerClaims as I, SupportEndedBy as L, clearSupportCookie as M, supportCookie as N, SupportStartRequest as O, supportCookieValue as P, SupportListFilter as R, SupportApi as S, SupportOptions as T, supportClaims as U, SupportStartInput as V, RequestIdOptions as W, ReplicaState as _, ServerDbOptions as a, deleteAccount as b, TENANT_HEADER as c, SuspendAccountOptions as d, SuspendAccountResult as f, PRIMARY_COOKIE as g, suspendAccount as h, ServerContext as i, SupportCookieOptions as j, supportSessions as k, EndSessionsResult as l, lastSignIns as m, ContextOptions as n, ServerKeys as o, endSessions as p, ForContextOptions as r, ServerOptions as s, BetterServer as t, LastSignIn as u, DeleteAccountOptions as v, SupportExpireRouteOptions as w, ActiveSupport as x, DeleteAccountResult as y, SupportSession as z };

package/dist/{shared-CxWmcyqB.js → shared-DHjhfRdV.js}

@@ -1,6 +1,5 @@
 import { t as DbException } from "./db-exception-CnWcYPxL.js";
-import { n as dbError } from "./errors-B11Duf73.js";
-import { t as lookupOf } from "./lookup-BaP5bI27.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
 //#region src/plugins/shared.ts
 /** Database column name for an app column, or `undefined` if it is unknown. */
 function dbName(table, app) {
@@ -57,17 +56,5 @@ function insertsOnly(op) {
 function forbidden(message) {
 	throw new DbException(dbError("forbidden", message));
 }
-/** Database-keyed row to app-keyed row. */
-function toApp(table, row) {
-	const out = {};
-	for (const [app, meta] of lookupOf(table).entries) if (meta.db in row) out[app] = row[meta.db];
-	return out;
-}
-/** App-keyed row to database-keyed row. Unknown keys are dropped. */
-function toDb(table, row) {
-	const out = {};
-	for (const [app, meta] of lookupOf(table).entries) if (app in row) out[meta.db] = row[app];
-	return out;
-}
 //#endregion
-export { insertsOnly as a, toApp as c, guardManaged as i, toDb as l, equals as n, isNotNull as o, forbidden as r, isNull as s, dbName as t, withDefault as u };
+export { insertsOnly as a, withDefault as c, guardManaged as i, equals as n, isNotNull as o, forbidden as r, isNull as s, dbName as t };

package/dist/shared-DTneRoxi.js

@@ -0,0 +1,14 @@
+import { n as invalidRequest } from "./build-meLuYGri.js";
+//#region src/compile/shared.ts
+/** A row-count or offset value that is safe to inline into SQL text. */
+function integer(value) {
+	if (!Number.isInteger(value) || value < 0) invalidRequest(`Expected a non-negative integer, got ${value}`);
+	return value;
+}
+/** The ` where a and b` clause for the parts that are present, or an empty string. */
+function whereClause(parts) {
+	const present = parts.filter((part) => part !== void 0);
+	return present.length > 0 ? ` where ${present.join(" and ")}` : "";
+}
+//#endregion
+export { whereClause as n, integer as t };

package/dist/{sign-in-Cb1mwv6X.js → sign-in-D_yoP0PF.js}

@@ -1,4 +1,4 @@
-import { n as ClientContext } from "./hooks-1BTCJsiw.js";
+import { n as ClientContext } from "./hooks-Bhza9Hnr.js";
 import { useContext, useMemo, useRef, useState } from "react";
 //#region src/react/sign-in.ts
 function useAuthApi(options, hook) {

package/dist/signatures-BRS_p3WD.d.ts

@@ -0,0 +1,34 @@
+/// <reference lib="esnext.temporal" />
+import { f as Result } from "./result-BchM1XZn.js";
+//#region src/core/signatures.d.ts
+interface VerifiedWebhook<T = unknown> {
+  readonly id: string;
+  readonly timestamp: Temporal.Instant;
+  readonly payload: T;
+  readonly body: string;
+}
+interface VerifyOptions {
+  /** Allowed clock skew in seconds. Defaults to 300. */
+  readonly tolerance?: number;
+  readonly now?: () => Temporal.Instant;
+}
+type WebhookInput = Request | {
+  readonly headers: Headers | Readonly<Record<string, string>>;
+  readonly body: string;
+};
+/** Headers for a signed Standard Webhooks request. */
+declare function signWebhook(secret: string, message: {
+  readonly id: string;
+  readonly body: string;
+  readonly timestamp?: Temporal.Instant;
+}): Promise<Record<string, string>>;
+/**
+ * Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
+ * `webhook-signature`, or the `svix-` names Svix-based senders use) and
+ * parses the JSON body. Pass several secrets while rotating.
+ */
+declare function verifyWebhook<T = unknown>(input: WebhookInput, secrets: string | readonly string[], options?: VerifyOptions): Promise<Result<VerifiedWebhook<T>>>;
+/** Checks a shared-secret header (database webhooks), in constant time. */
+declare function verifySharedSecret(request: Request, secret: string, headerName?: string): boolean;
+//#endregion
+export { verifySharedSecret as a, signWebhook as i, VerifyOptions as n, verifyWebhook as o, WebhookInput as r, VerifiedWebhook as t };

package/dist/signatures-DsWv_bYR.js

@@ -0,0 +1,103 @@
+import { n as dbError } from "./errors-2M6CKMP4.js";
+import { c as optionalTemporal, s as nowInstant } from "./temporal-BJGitm-h.js";
+import { n as temporalMissing } from "./temporal-required-BtynQtM-.js";
+import { a as ok, r as err } from "./result-DEqHCMKP.js";
+import { i as toBase64, r as fromBase64 } from "./base64-D2gsioCY.js";
+import { r as timingSafeEqual, t as encoder } from "./hmac-DCud0myt.js";
+//#region src/core/signatures.ts
+/** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
+function secretBytes(secret) {
+	const raw = secret.replace(/^v1,/, "").replace(/^whsec_/, "");
+	try {
+		return fromBase64(raw);
+	} catch {
+		throw new TypeError("Webhook secret is not valid base64");
+	}
+}
+/** Secrets come from configuration, so a handful of keys suffice. */
+const keys = /* @__PURE__ */ new Map();
+function keyFor(secret) {
+	let key = keys.get(secret);
+	if (!key) {
+		key = crypto.subtle.importKey("raw", secretBytes(secret), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["sign", "verify"]);
+		if (keys.size < 16) {
+			keys.set(secret, key);
+			key.catch(() => keys.delete(secret));
+		}
+	}
+	return key;
+}
+async function signature(secret, content) {
+	return toBase64(new Uint8Array(await crypto.subtle.sign("HMAC", await keyFor(secret), encoder.encode(content))));
+}
+function decodeSignature(value) {
+	try {
+		return fromBase64(value);
+	} catch {
+		return;
+	}
+}
+function header(headers, name) {
+	if (headers instanceof Headers) return headers.get(name);
+	return Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1] ?? null;
+}
+const unauthorized = (code, message) => dbError("unauthorized", message, { code });
+/** Headers for a signed Standard Webhooks request. */
+async function signWebhook(secret, message) {
+	const timestamp = String(Math.floor((message.timestamp ?? nowInstant()).epochMilliseconds / 1e3));
+	return {
+		"webhook-id": message.id,
+		"webhook-timestamp": timestamp,
+		"webhook-signature": `v1,${await signature(secret, `${message.id}.${timestamp}.${message.body}`)}`
+	};
+}
+/**
+* Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
+* `webhook-signature`, or the `svix-` names Svix-based senders use) and
+* parses the JSON body. Pass several secrets while rotating.
+*/
+async function verifyWebhook(input, secrets, options = {}) {
+	const headers = input.headers;
+	const prefix = header(headers, "webhook-id") === null ? "svix" : "webhook";
+	const id = header(headers, `${prefix}-id`);
+	const timestamp = header(headers, `${prefix}-timestamp`);
+	const signatures = header(headers, `${prefix}-signature`);
+	if (!id || !timestamp || !signatures) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing webhook signature headers"));
+	const seconds = Number(timestamp);
+	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
+	const namespace = optionalTemporal();
+	if (namespace === void 0) return err(temporalMissing());
+	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
+	const tolerance = options.tolerance ?? 300;
+	if (seconds < now - tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_OLD", "Webhook timestamp is too old"));
+	if (seconds > now + tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_NEW", "Webhook timestamp is in the future"));
+	const body = input instanceof Request ? await input.text() : input.body;
+	const content = encoder.encode(`${id}.${timestamp}.${body}`);
+	const offered = signatures.split(" ").map((entry) => entry.split(",")).filter(([version, value]) => version === "v1" && value).flatMap(([, value]) => decodeSignature(value) ?? []);
+	let valid = false;
+	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
+		const key = await keyFor(secret);
+		for (const candidate of offered) if (await crypto.subtle.verify("HMAC", key, candidate, content)) valid = true;
+	}
+	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
+	try {
+		return ok({
+			id,
+			timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
+			payload: JSON.parse(body),
+			body
+		});
+	} catch {
+		return err(dbError("invalid_request", "Webhook body is not JSON"));
+	}
+}
+/** Checks a shared-secret header (database webhooks), in constant time. */
+function verifySharedSecret(request, secret, headerName = "authorization") {
+	const token = (request.headers.get(headerName) ?? "").replace(/^Bearer\s+/i, "");
+	return timingSafeEqual(token, secret);
+}
+//#endregion
+export { verifyWebhook as a, verifySharedSecret as i, signWebhook as n, unauthorized as r, header as t };

package/dist/{signers-4y62_VIi.d.ts → signers-cpdmZYrv.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
+import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
 //#region src/blocks/webhooks/url-policy.d.ts
 /**
  * Decides whether a webhook may be sent to `url`. Throwing means the check

package/dist/solid/index.d.ts

@@ -1,14 +1,13 @@
-import { b as DbError } from "../result-D7y2fT87.js";
-import { it as QuerySpec } from "../define-CJJkkr1-.js";
-import { n as TemplateValues } from "../template-CwO38Do8.js";
-import { t as AuthSnapshot } from "../bind-Bu_ZNa3W.js";
-import { t as AuthSession } from "../view-CF7ihnkg.js";
-import { S as Topic, f as PresenceMember, u as EventSchemas, w as TopicHandlers, x as SubscriptionStatus } from "../index-DunNRdnT.js";
-import { t as SupportView } from "../support-view-CVOJJLpc.js";
-import { a as BroadcastOptions, c as LiveCountSource, d as PresenceTopic, f as UseActionOptions, i as ActionState, l as LiveQueryHookOptions, n as ActionInputOf, o as ClientLike, r as ActionResultOf, s as LiveCountHookOptions, t as fieldErrorsOf, u as PresenceHookOptions } from "../field-errors-BFOa7WhB.js";
+import { b as DbError } from "../result-BchM1XZn.js";
+import { J as TemplateValues } from "../storage-api-CB7Zl1Ci.js";
+import { at as QuerySpec } from "../define-DmcfoNXB.js";
+import { t as AuthSnapshot } from "../bind-CQ5mPyX1.js";
+import { t as AuthSession } from "../view-TpXEUcVN.js";
+import { S as Topic, f as PresenceMember, u as EventSchemas, w as TopicHandlers, x as SubscriptionStatus } from "../index-BCHR4Ucl.js";
+import { t as SupportView } from "../support-view-scqMgtOo.js";
+import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-DIe9XYWL.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Accessor, JSX } from "solid-js";
-import { StandardSchemaV1 } from "@standard-schema/spec";
 import { QueryClient } from "@tanstack/query-core";
 //#region src/solid/index.d.ts
 /** A value, or an accessor Solid tracks. */
@@ -30,14 +29,6 @@ export declare function useSupabase(): SupabaseClient;
 export declare function useSession<C = unknown, P = unknown>(): Accessor<AuthSession<C, P> | undefined>;
 /** The support session the page renders in, or `undefined` for a normal session. */
 export declare function useSupportSession(): Accessor<SupportView | undefined>;
-/** The claims type of a client's `betterSupabase.claims(schema)`, `unknown` without one. */
-export type ClaimsOf<B extends ClientLike> = B["betterSupabase"] extends {
-  readonly claimsSchema: StandardSchemaV1<unknown, infer C> | undefined;
-} ? C : unknown;
-/** The profile type of a client's `betterSupabase.userMetadata(schema)`, `unknown` without one. */
-export type ProfileOf<B extends ClientLike> = B["betterSupabase"] extends {
-  readonly userMetadataSchema: StandardSchemaV1<unknown, infer P> | undefined;
-} ? P : unknown;
 export interface BetterPrimitives<B extends ClientLike> {
   /** Repositories bound to the current session. */
   readonly useDb: () => B["db"];
@@ -128,4 +119,4 @@ export interface ActionHandle<I, T> extends ActionState<I, T> {
  */
 export declare function useAction<I, T>(action: (input: I) => Promise<ActionResultOf<T>>, options?: UseActionOptions<ActionInputOf<I>, T>): ActionHandle<ActionInputOf<I>, T>;
 //#endregion
-export { type ActionInputOf, type ActionResultOf, type ActionState, type AuthSession, type AuthSnapshot, type BroadcastOptions, type ClientLike, type LiveCountHookOptions, type LiveCountSource, type LiveQueryHookOptions, type PresenceHookOptions, type PresenceTopic, type SupportView, type UseActionOptions, fieldErrorsOf };
+export { type ActionInputOf, type ActionResultOf, type ActionState, type AuthSession, type AuthSnapshot, type BroadcastOptions, type ClaimsOf, type ClientLike, type LiveCountHookOptions, type LiveCountSource, type LiveQueryHookOptions, type PresenceHookOptions, type PresenceTopic, type ProfileOf, type SupportView, type UseActionOptions, fieldErrorsOf };

package/dist/solid/index.js

@@ -1,7 +1,7 @@
 import { t as clearOnUserChange } from "../user-change-XzvgafU4.js";
+import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-wxeTQFtB.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { t as fieldErrorsOf } from "../field-errors-VF1yb8yI.js";
-import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-CI0Z2zWX.js";
+import { t as fieldErrorsOf } from "../field-errors-DZVRWRkf.js";
 import { createComponent, createContext, createEffect, createMemo, createSignal, onCleanup, onMount, untrack, useContext } from "solid-js";
 //#region src/solid/index.ts
 function read(value) {

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
-import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
-import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-ZSJ9rCcV.js";
-import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
-import { t as RefusalRedirects } from "../refusal-DhSU2Vvr.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-KIPvRQJU.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-CoE5Zwy4.js";
+import { t as BetterSupabase } from "../define-DmcfoNXB.js";
+import { t as BetterServer } from "../server-types-CrAmZ8jv.js";
+import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-W99LCPBS.js";
+import { t as RefusalRedirects } from "../refusal-CFI8-5nf.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-148t1m3C.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/solid-start/index.d.ts
 /** The part of a SolidStart `FetchEvent` the integration reads and writes. */

package/dist/solid-start/index.js

@@ -1,8 +1,8 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-B-tL8hqg.js";
-import { t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-BDCpJI7o.js";
-import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CN45ibbV.js";
+import { t as defaultExpose } from "../respond-volM3ByS.js";
+import { i as requireCaller, o as runAction } from "../kit-BhHr9T9v.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-3ey3QmrO.js";
+import { r as refusalResponse } from "../refusal-K78A1Vmq.js";
 import { t as beforeRoute } from "../before-route-CnR0C0Jr.js";
 //#region src/solid-start/index.ts
 /** SolidStart integration: middleware, guards and server function actions. */
@@ -36,7 +36,7 @@ function createSolidStart(betterSupabase, options) {
 		require: async (requireOptions = {}) => {
 			const event = eventOf();
 			const scope = scopeOf(event);
-			const caller = await requireCaller(scope.bs.auth, requireOptions, scope.tenant);
+			const caller = await requireCaller(scope.bs.auth, requireOptions, scope.tenant, options.authorizer);
 			if ("kind" in caller) throw refusalResponse(caller, event.request, options, expose);
 			return {
 				...scope,
@@ -49,7 +49,7 @@ function createSolidStart(betterSupabase, options) {
 				return await runAction(scope.bs.auth, actionOptions, input, scope.tenant, (parsed, caller) => fn(parsed, {
 					...scope,
 					...caller
-				}));
+				}), options.authorizer);
 			};
 		}
 	});