better-supabase 0.7.0 → 0.8.0

package/dist/{bucket-Cl46E3jS.d.ts → storage-api-CB7Zl1Ci.d.ts}

@@ -1,10 +1,24 @@
 /// <reference lib="esnext.temporal" />
-import { b as DbError, f as Result, t as AsyncResult } from "./result-D7y2fT87.js";
-import { G as ObjectVersion, K as VersioningStatus, U as BucketLifecycle, s as BucketPolicyName, t as AccessBucketPolicy } from "./types-6BdhkmZe.js";
-import { m as RequestContext } from "./plugin-FGY8UhYm.js";
-import { n as StoragePath, t as PathIn } from "./path-Cv__-OTj.js";
-import { n as TemplateValues, t as TemplateParams } from "./template-CwO38Do8.js";
+import { b as DbError, f as Result, t as AsyncResult } from "./result-BchM1XZn.js";
+import { G as ObjectVersion, K as VersioningStatus, U as BucketLifecycle, s as BucketPolicyName, t as AccessBucketPolicy } from "./types-CoE5Zwy4.js";
+import { m as RequestContext } from "./plugin-CPK2HsbY.js";
 import { SupabaseClient } from "@supabase/supabase-js";
+//#region src/storage/path.d.ts
+declare const bucketOf: unique symbol;
+/**
+ * An object path in bucket `B`, e.g. `org-1/cust-1/logo/3.webp`. Returned by
+ * `bucket.path()` and `upload()`, and the type of columns listed in the
+ * `storagePaths` config. Store paths, not URLs: signed URLs expire and public
+ * URLs pin the project host.
+ */
+type StoragePath<B extends string = string> = string & {
+  readonly [bucketOf]: B;
+};
+/** A plain string or a `StoragePath` of bucket `B`; paths of other buckets are rejected. */
+type PathIn<B extends string> = string & {
+  readonly [bucketOf]?: B;
+};
+//#endregion
 //#region src/storage/ttl.d.ts
 declare const TTL: {
   readonly minute: 60;
@@ -14,6 +28,11 @@ declare const TTL: {
 };
 type TtlPreset = keyof typeof TTL;
 //#endregion
+//#region src/core/template.d.ts
+/** Placeholder names in a `{name}` template; a rest placeholder `{...name}` is `name`. */
+type TemplateParams<P extends string> = P extends `${string}{${infer K}}${infer R}` ? (K extends `...${infer N}` ? N : K) | TemplateParams<R> : never;
+type TemplateValues<P extends string> = { readonly [K in TemplateParams<P>]: string | number; };
+//#endregion
 //#region src/storage/apply.d.ts
 interface AppliedBucket {
   /** The bucket did not exist and was created. */
@@ -203,7 +222,8 @@ interface ActualBucket {
   /** `storage.buckets.lifecycle_configuration`; leave it out to skip the comparison. */
   readonly lifecycle?: unknown;
 }
-type StorageClient = Pick<SupabaseClient, "storage">;
+/** A supabase-js client with the secret key: `apply()` needs the bucket admin API. */
+type StorageAdminClient = Pick<SupabaseClient, "storage">;
 interface BucketClient<P extends string, Id extends string = string> {
   readonly bucket: Bucket<P, Id>;
   /** The object path, checked against the template and, with `tenant`, the caller's tenant. */
@@ -303,7 +323,7 @@ interface Bucket<P extends string, Id extends string = string> {
    * versioning and the lifecycle policy, which `sql()` can't set. Needs the
    * secret key. Idempotent.
    */
-  apply(client: StorageClient): AsyncResult<AppliedBucket>;
+  apply(client: StorageAdminClient): AsyncResult<AppliedBucket>;
   connect(client: StorageClient, options?: BucketConnectOptions): BucketClient<P, Id>;
 }
 interface BucketConnectOptions {
@@ -344,4 +364,219 @@ declare function parseSize(value: string | number): number;
  */
 declare function defineBucket<const P extends string, const Id extends string = string>(config: BucketConfig<P, Id>): Bucket<P, Id>;
 //#endregion
-export { UrlOptions as C, TTL as D, AppliedBucket as E, TtlPreset as O, UploadOptions as S, parseSize as T, SweepOptions as _, BucketConnectOptions as a, TransformOptions as b, DownloadOptions as c, PurgeCacheOptions as d, ReplaceOptions as f, StoredObject as g, StorageClient as h, BucketConfig as i, ObjectTarget as l, Reservation as m, Bucket as n, BucketDrift as o, ReplaceResult as p, BucketClient as r, BucketPolicy as s, ActualBucket as t, PathValues as u, SweepResult as v, defineBucket as w, UploadBody as x, TransferOptions as y };
+//#region src/storage/storage-api.d.ts
+/** A failed Storage call's `error`, as supabase-js returns it (`StorageApiError`, `StorageUnknownError`). */
+interface StorageFailure {
+  readonly name: string;
+  readonly message: string;
+  readonly status?: number | undefined;
+  readonly statusCode?: string | undefined;
+  /** The Storage error code, such as `NoSuchKey` or `AccessDenied`. */
+  readonly code?: string | undefined;
+}
+/** What a supabase-js Storage call resolves to: `data` or `error`, never both. */
+type StorageResponse<T> = {
+  readonly data: T;
+  readonly error: null;
+} | {
+  readonly data: null;
+  readonly error: StorageFailure;
+};
+interface StorageTransform {
+  readonly width?: number;
+  readonly height?: number;
+  readonly resize?: "cover" | "contain" | "fill";
+  readonly quality?: number;
+  readonly format?: "origin";
+}
+interface StorageUrlOptions {
+  readonly download?: string | boolean;
+  readonly transform?: StorageTransform;
+  readonly cacheNonce?: string;
+  readonly versionId?: string;
+}
+interface StorageDownloadOptions {
+  readonly transform?: StorageTransform;
+  readonly cacheNonce?: string;
+  readonly versionId?: string;
+}
+interface StorageFetchParameters {
+  readonly signal?: AbortSignal;
+  readonly cache?: "default" | "no-store" | "reload" | "no-cache" | "force-cache" | "only-if-cached";
+}
+interface StorageFileOptions {
+  readonly cacheControl?: string;
+  readonly contentType?: string;
+  readonly upsert?: boolean;
+  readonly duplex?: string;
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  readonly headers?: Readonly<Record<string, string>>;
+}
+interface StorageDestinationOptions {
+  readonly destinationBucket?: string;
+  readonly sourceVersionId?: string;
+}
+/** `list(prefix, options)`: one folder level, folders first when sorted by name. */
+interface StorageSearchOptions {
+  /** Defaults to 100. */
+  readonly limit?: number;
+  readonly offset?: number;
+  /** Defaults to `{ column: "name", order: "asc" }`. */
+  readonly sortBy?: {
+    readonly column?: string;
+    readonly order?: string;
+  };
+  /** Entries whose name starts with this text, ignoring case. */
+  readonly search?: string;
+  readonly noncurrentVersions?: "exclude" | "include" | "only";
+  readonly deleteMarkers?: "exclude" | "include" | "only";
+  readonly exactMatch?: boolean;
+}
+interface StorageSearchV2Options {
+  /** Defaults to 1000, the most one page returns. */
+  readonly limit?: number;
+  readonly prefix?: string;
+  /** `nextCursor` of the previous page. */
+  readonly cursor?: string;
+  /** Group the objects below the next `/` into folders. */
+  readonly with_delimiter?: boolean;
+  readonly sortBy?: {
+    readonly column: "name" | "updated_at" | "created_at";
+    readonly order?: "asc" | "desc";
+  };
+  readonly noncurrentVersions?: "exclude" | "include" | "only";
+  readonly deleteMarkers?: "exclude" | "include" | "only";
+  readonly exactMatch?: boolean;
+}
+/** An entry of `list`: a file, or a folder when `id` is `null`. */
+interface StorageListEntry {
+  readonly name: string;
+  readonly id: string | null;
+  readonly updated_at: string | null;
+  readonly created_at: string | null;
+  readonly last_accessed_at?: string | null;
+  readonly metadata: Readonly<Record<string, unknown>> | null;
+}
+interface StorageListV2Object {
+  readonly name: string;
+  readonly key?: string;
+  readonly id: string;
+  readonly updated_at: string;
+  readonly created_at: string;
+  readonly last_accessed_at?: string;
+  readonly metadata: Readonly<Record<string, unknown>> | null;
+  readonly version?: string;
+  readonly archived_at?: string | null;
+  readonly is_delete_marker?: boolean;
+  readonly is_versioned?: boolean;
+}
+interface StorageListV2Folder {
+  /** The folder's full path, ending in `/`. */
+  readonly name: string;
+  readonly key?: string;
+}
+interface StorageListV2Result {
+  readonly hasNext: boolean;
+  readonly nextCursor?: string;
+  readonly folders: readonly StorageListV2Folder[];
+  readonly objects: readonly StorageListV2Object[];
+}
+/** `info(path)`, in camelCase as supabase-js returns it. */
+interface StorageObjectInfo {
+  readonly id: string;
+  readonly name: string;
+  readonly version: string;
+  readonly bucketId: string;
+  readonly createdAt: string;
+  readonly size?: number;
+  readonly contentType?: string;
+  readonly cacheControl?: string;
+  readonly etag?: string;
+  readonly lastModified?: string;
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  readonly updatedAt?: string;
+  readonly archivedAt?: string | null;
+  readonly isDeleteMarker?: boolean;
+  readonly isVersioned?: boolean;
+}
+interface StorageSignedUrlEntry {
+  readonly error: string | null;
+  readonly path: string | null;
+  readonly signedUrl: string | null;
+}
+type StorageRemoveEntry = string | {
+  readonly path: string;
+  readonly versionId: string;
+};
+/**
+ * One bucket's file API: the methods of supabase-js
+ * `supabase.storage.from(bucket)` that bucket clients and blocks call,
+ * typed structurally so another implementation (such as `supportStorage`)
+ * can stand in for it.
+ */
+interface StorageBucketApi {
+  upload(path: string, body: UploadBody, options?: StorageFileOptions): PromiseLike<StorageResponse<{
+    readonly path: string;
+  }>>;
+  update(path: string, body: UploadBody, options?: StorageFileOptions): PromiseLike<StorageResponse<{
+    readonly path: string;
+  }>>;
+  createSignedUploadUrl(path: string, options?: {
+    upsert: boolean;
+  }): PromiseLike<StorageResponse<{
+    readonly signedUrl: string;
+    readonly token: string;
+    readonly path: string;
+  }>>;
+  uploadToSignedUrl(path: string, token: string, body: UploadBody, options?: StorageFileOptions): PromiseLike<StorageResponse<{
+    readonly path: string;
+  }>>;
+  download(path: string, options?: StorageDownloadOptions, parameters?: StorageFetchParameters): PromiseLike<StorageResponse<Blob>>;
+  info(path: string, options?: {
+    versionId?: string;
+  }): PromiseLike<StorageResponse<StorageObjectInfo>>;
+  /** `data` is `false` with an `error` when Storage answers 400 or 404. */
+  exists(path: string): PromiseLike<{
+    readonly data: boolean;
+    readonly error: null;
+  } | {
+    readonly data: boolean;
+    readonly error: StorageFailure;
+  }>;
+  createSignedUrl(path: string, expiresIn: number, options?: StorageUrlOptions): PromiseLike<StorageResponse<{
+    readonly signedUrl: string;
+  }>>;
+  createSignedUrls(paths: string[], expiresIn: number, options?: {
+    download?: string | boolean;
+    cacheNonce?: string;
+  }): PromiseLike<StorageResponse<readonly StorageSignedUrlEntry[]>>;
+  getPublicUrl(path: string, options?: StorageUrlOptions): {
+    readonly data: {
+      readonly publicUrl: string;
+    };
+  };
+  remove(paths: StorageRemoveEntry[]): PromiseLike<StorageResponse<readonly StorageListEntry[]>>;
+  copy(from: string, to: string, options?: StorageDestinationOptions): PromiseLike<StorageResponse<{
+    readonly path: string;
+  }>>;
+  move(from: string, to: string, options?: StorageDestinationOptions): PromiseLike<StorageResponse<{
+    readonly message: string;
+  }>>;
+  purgeCache(path: string, options?: {
+    transformations?: true;
+  }, parameters?: StorageFetchParameters): PromiseLike<StorageResponse<{
+    readonly message: string;
+  }>>;
+  list(path?: string, options?: StorageSearchOptions, parameters?: StorageFetchParameters): PromiseLike<StorageResponse<readonly StorageListEntry[]>>;
+  listV2(options?: StorageSearchV2Options, parameters?: StorageFetchParameters): PromiseLike<StorageResponse<StorageListV2Result>>;
+}
+/** Storage's file API: `supabase.storage`, or anything with the same `from(bucket)`. */
+interface StorageApi {
+  from(bucket: string): StorageBucketApi;
+}
+/** What `bucket.connect()` takes: a `StorageApi`, or a client that carries one as `storage` (a supabase-js client). */
+type StorageClient = StorageApi | {
+  readonly storage: StorageApi;
+};
+//#endregion
+export { PathValues as A, TransformOptions as B, BucketClient as C, BucketPolicy as D, BucketDrift as E, StorageAdminClient as F, parseSize as G, UploadOptions as H, StoredObject as I, TemplateValues as J, AppliedBucket as K, SweepOptions as L, ReplaceOptions as M, ReplaceResult as N, DownloadOptions as O, Reservation as P, StoragePath as Q, SweepResult as R, Bucket as S, BucketConnectOptions as T, UrlOptions as U, UploadBody as V, defineBucket as W, TtlPreset as X, TTL as Y, PathIn as Z, StorageSearchV2Options as _, StorageDownloadOptions as a, StorageUrlOptions as b, StorageFileOptions as c, StorageListV2Object as d, StorageListV2Result as f, StorageSearchOptions as g, StorageResponse as h, StorageDestinationOptions as i, PurgeCacheOptions as j, ObjectTarget as k, StorageListEntry as l, StorageRemoveEntry as m, StorageBucketApi as n, StorageFailure as o, StorageObjectInfo as p, TemplateParams as q, StorageClient as r, StorageFetchParameters as s, StorageApi as t, StorageListV2Folder as u, StorageSignedUrlEntry as v, BucketConfig as w, ActualBucket as x, StorageTransform as y, TransferOptions as z };

package/dist/{store-CGjgWu5n.d.ts → store-DsIYEBnv.d.ts}

@@ -1,4 +1,4 @@
-import { t as AsyncResult } from "./result-D7y2fT87.js";
+import { t as AsyncResult } from "./result-BchM1XZn.js";
 //#region src/streams/store.d.ts
 /** How a stream is opened. */
 interface StreamOpenOptions {

package/dist/streams/index.d.ts

@@ -1,6 +1,6 @@
-import { t as AsyncResult, w as ErrorMapper } from "../result-D7y2fT87.js";
-import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../block-transport-DvaoPuZ9.js";
-import { a as StreamStatus, i as StreamReadOptions, n as StreamOpenOptions, o as StreamStore, r as StreamPurgeOptions, t as StreamAppendResult } from "../store-CGjgWu5n.js";
+import { t as AsyncResult, w as ErrorMapper } from "../result-BchM1XZn.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-inD4fFq-.js";
+import { a as StreamStatus, i as StreamReadOptions, n as StreamOpenOptions, o as StreamStore, r as StreamPurgeOptions, t as StreamAppendResult } from "../store-DsIYEBnv.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 //#region src/streams/postgres.d.ts
 interface PostgresStreamStoreOptions {
@@ -73,4 +73,4 @@ interface ResumeFromStoreOptions {
  */
 export declare function resumeFromStore(store: StreamStore, id: string, options?: ResumeFromStoreOptions): AsyncResult<ReadableStream<string> | undefined>;
 //#endregion
-export { type BlockTransport, type PostgresStreamStoreOptions, type ResumeFromStoreOptions, type StreamAppendResult, type StreamOpenOptions, type StreamPurgeOptions, type StreamReadOptions, type StreamStatus, type StreamStore, type TeeToStoreOptions, type TeedStream, rpcTransport, sqlTransport };
+export { type BlockTransport, type PostgresStreamStoreOptions, type ResumeFromStoreOptions, type StreamAppendResult, type StreamOpenOptions, type StreamPurgeOptions, type StreamReadOptions, type StreamStatus, type StreamStore, type TeeToStoreOptions, type TeedStream, dbTransport, rpcTransport, sqlTransport };

package/dist/streams/index.js

@@ -1,6 +1,7 @@
-import { n as rpcTransport, r as sqlTransport } from "../block-transport-BLr-ZgLc.js";
-import { D as stringsOf, d as isRecord, i as blockCall, w as seconds, y as recordOf } from "../block-helpers-DWHxHsEQ.js";
-import { n as teeToStore, r as writeToStore, t as resumeFromStore } from "../tee-CoEppCER.js";
+import { n as isRecord } from "../guards-6F2bCtQR.js";
+import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-bAKh-dGc.js";
+import { A as stringsOf, D as seconds, S as recordOf, i as blockCall } from "../block-helpers-Cy3pB96I.js";
+import { n as teeToStore, r as writeToStore, t as resumeFromStore } from "../tee-Cb98Vn3b.js";
 import { t as pollingRead } from "../store-BdH5ruDx.js";
 //#region src/streams/postgres.ts
 function statusOf(value) {
@@ -74,4 +75,4 @@ function postgresStreamStore(options) {
 	};
 }
 //#endregion
-export { postgresStreamStore, resumeFromStore, rpcTransport, sqlTransport, teeToStore, writeToStore };
+export { dbTransport, postgresStreamStore, resumeFromStore, rpcTransport, sqlTransport, teeToStore, writeToStore };

package/dist/streams/redis/index.d.ts

@@ -1,4 +1,4 @@
-import { o as StreamStore } from "../../store-CGjgWu5n.js";
+import { o as StreamStore } from "../../store-DsIYEBnv.js";
 //#region src/streams/redis/redis.d.ts
 /**
  * The commands the store sends, as node-redis 5 and 6 (`createClient()`)

package/dist/streams/redis/index.js

@@ -1,6 +1,7 @@
-import { n as dbError } from "../../errors-B11Duf73.js";
-import { a as ok, r as err, t as AsyncResult } from "../../result-DzUbqgdW.js";
-import { d as isRecord } from "../../block-helpers-DWHxHsEQ.js";
+import { n as dbError } from "../../errors-2M6CKMP4.js";
+import { a as ok, r as err, t as AsyncResult } from "../../result-DEqHCMKP.js";
+import { n as isRecord } from "../../guards-6F2bCtQR.js";
+import { t as importOptionalPeer } from "../../optional-peer-D1pi-skw.js";
 import { t as pollingRead } from "../../store-BdH5ruDx.js";
 //#region src/streams/redis/redis.ts
 const isNodeRedis = (value) => isRecord(value) && typeof value["createClient"] === "function";
@@ -8,14 +9,7 @@ const isNodeRedis = (value) => isRecord(value) && typeof value["createClient"] =
 * Loads `redis` on first use. The specifier is a variable so bundlers leave
 * the optional peer out of apps that pass their own client.
 */
-async function loadRedis() {
-	const specifier = "redis";
-	try {
-		return await import(specifier);
-	} catch {
-		return;
-	}
-}
+const loadRedis = () => importOptionalPeer("redis");
 async function connectUrl(url, load) {
 	const module = await load();
 	if (!isNodeRedis(module)) throw new TypeError("redisStreamStore({ url }) needs the redis package: pnpm add redis, or pass a connected client");

package/dist/{stripe-BMj5LtsT.js → stripe-v-Y2lmop.js}

@@ -1,3 +1,4 @@
+import { t as importOptionalPeer } from "./optional-peer-D1pi-skw.js";
 //#region src/blocks/stripe.ts
 const isModule = (value) => typeof value === "object" && value !== null && "default" in value && typeof value.default === "function" && "createFetchHttpClient" in value.default;
 /**
@@ -5,14 +6,7 @@ const isModule = (value) => typeof value === "object" && value !== null && "defa
 * the optional peer out of apps that pass their own client; a missing
 * install returns `undefined` and the caller explains how to add it.
 */
-async function loadStripeModule() {
-	const specifier = "stripe";
-	try {
-		return await import(specifier);
-	} catch {
-		return;
-	}
-}
+const loadStripeModule = () => importOptionalPeer("stripe");
 /**
 * The client `source` names: itself, or one created with Stripe's fetch HTTP
 * client so it runs on every WinterTC runtime.

package/dist/supabase-mcp-C6tMoEjn.d.ts

@@ -0,0 +1,43 @@
+//#region src/core/supabase-mcp.d.ts
+/** The feature groups Supabase's MCP server turns on with `features`. */
+type SupabaseMcpFeature = "account" | "branching" | "database" | "debugging" | "development" | "docs" | "functions" | "storage";
+/** Which project and tools a Supabase MCP server exposes. */
+interface SupabaseMcpScope {
+  /**
+   * Scopes the server to one project. Without it the tools reach every
+   * project the Management API token can.
+   */
+  readonly projectRef?: string;
+  /** Runs SQL read-only and leaves out the tools that write. Defaults to true. */
+  readonly readOnly?: boolean;
+  /** The feature groups to turn on; the server's defaults when unset. */
+  readonly features?: readonly SupabaseMcpFeature[];
+}
+/** The parts of `@supabase/mcp-server-supabase` better-supabase calls. */
+interface SupabaseMcpModule {
+  createToolSchemas(options: {
+    features?: readonly SupabaseMcpFeature[];
+    projectScoped?: boolean;
+    readOnly?: boolean;
+  }): Record<string, unknown>;
+  createSupabaseMcpHandler(options: {
+    platform: unknown;
+    projectId?: string;
+    readOnly?: boolean;
+    features?: string[];
+  }): {
+    fetch(request: Request, options?: {
+      readonly authInfo?: unknown;
+    }): Promise<Response>;
+    close(): Promise<void>;
+  };
+}
+/** The part of `@supabase/mcp-server-supabase/platform/api` better-supabase calls. */
+interface SupabaseMcpPlatformModule {
+  createSupabaseApiPlatform(options: {
+    accessToken: string;
+    apiUrl?: string;
+  }): unknown;
+}
+//#endregion
+export { SupabaseMcpScope as i, SupabaseMcpModule as n, SupabaseMcpPlatformModule as r, SupabaseMcpFeature as t };

package/dist/supabase-mcp-Cpn5A4i-.js

@@ -0,0 +1,28 @@
+import { t as importOptionalPeer } from "./optional-peer-D1pi-skw.js";
+//#region src/core/supabase-mcp.ts
+const INSTALL = "Supabase's MCP server needs @supabase/mcp-server-supabase: pnpm add @supabase/mcp-server-supabase";
+const isRecord = (value) => typeof value === "object" && value !== null;
+function isServerModule(value) {
+	return isRecord(value) && "createToolSchemas" in value && "createSupabaseMcpHandler" in value && typeof value["createToolSchemas"] === "function" && typeof value["createSupabaseMcpHandler"] === "function";
+}
+function isPlatformModule(value) {
+	return isRecord(value) && "createSupabaseApiPlatform" in value && typeof value["createSupabaseApiPlatform"] === "function";
+}
+/**
+* Loads `@supabase/mcp-server-supabase` on first use. The specifiers are
+* variables so bundlers leave the optional peer out of apps that don't call
+* Supabase's MCP server; a missing install throws how to add it.
+*/
+async function loadSupabaseMcp() {
+	const loaded = await importOptionalPeer("@supabase/mcp-server-supabase");
+	if (!isServerModule(loaded)) throw new TypeError(INSTALL);
+	return loaded;
+}
+/** Loads the Management API platform of `@supabase/mcp-server-supabase`. */
+async function loadSupabaseMcpPlatform() {
+	const loaded = await importOptionalPeer("@supabase/mcp-server-supabase/platform/api");
+	if (!isPlatformModule(loaded)) throw new TypeError(INSTALL);
+	return loaded;
+}
+//#endregion
+export { loadSupabaseMcp as n, loadSupabaseMcpPlatform as r, isRecord as t };

package/dist/{support-DWwzVf-O.js → support-D1pFFouF.js}

@@ -1,15 +1,22 @@
-import { c as mapDbError, n as dbError } from "./errors-B11Duf73.js";
-import { t as temporal } from "./temporal-required-BVvW7SYJ.js";
-import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-DzUbqgdW.js";
-import { n as validate } from "./standard-BK0cqJ7y.js";
-import { t as fromPgError } from "./executor-De1Of3m3.js";
-import { d as clearSupportCookie, f as supportCookie, m as supportCookieValue } from "./adapter-B-tL8hqg.js";
-import { r as sqlIdent } from "./template--jDkl3UP.js";
-import { i as emitBlockEvent } from "./block-events-CrT8r7Fe.js";
+import { c as mapDbError, n as dbError } from "./errors-2M6CKMP4.js";
+import { t as temporal } from "./temporal-required-BtynQtM-.js";
+import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-DEqHCMKP.js";
+import { n as validate } from "./standard-DkzZUneg.js";
+import { o as problemResponse } from "./problem-CJvFeGu7.js";
+import { t as fromPgError } from "./executor-B_Hfobee.js";
+import { d as clearSupportCookie, f as supportCookie, m as supportCookieValue } from "./adapter-CN45ibbV.js";
+import { i as sqlIdent } from "./template-lPVh-EwW.js";
+import { a as emitBlockEvent } from "./block-events-DTxU5tfr.js";
+import { t as cronRoute } from "./cron-route-D2AN9SA1.js";
+import { t as boundedTtlCache } from "./ttl-cache-XzZ-Q2eX.js";
 //#region src/auth/support.ts
-/** A session from the jsonb the `support-sessions` functions return. */
-function supportSessionFromRow(row) {
-	const instant = (value) => temporal().Instant.from(value);
+/**
+* A session from the jsonb the `support-sessions` functions return, with
+* `namespace` (else the provided or global Temporal) for its time values.
+*/
+function supportSessionFromRow(row, namespace) {
+	const Instant = (namespace ?? temporal()).Instant;
+	const instant = (value) => Instant.from(value);
 	return {
 		id: row.id,
 		adminId: row.admin_id,
@@ -50,11 +57,11 @@ function sqlSupportStore(postgres, options = {}) {
 				input.adminId
 			]);
 			if (!row) throw new Error("start_support_session returned no session");
-			return supportSessionFromRow(row);
+			return supportSessionFromRow(row, options.temporal);
 		},
 		async get(sessionId, adminId, claims) {
 			const row = await one(as(claims), `select ${fn("active_support_session")}($1, $2) as session`, [sessionId, adminId]);
-			return row ? supportSessionFromRow(row) : void 0;
+			return row ? supportSessionFromRow(row, options.temporal) : void 0;
 		},
 		async end(sessionId, endedBy, claims) {
 			const [row] = await as(claims).queryRaw(`select ${fn("end_support_session")}($1, $2) as ended`, [sessionId, endedBy]);
@@ -66,8 +73,15 @@ function sqlSupportStore(postgres, options = {}) {
 				filter.targetUserId ?? null,
 				filter.active ?? null,
 				filter.limit ?? 50
-			])).map((row) => supportSessionFromRow(row.session));
+			])).map((row) => supportSessionFromRow(row.session, options.temporal));
+		},
+		async expire() {
+			return (await postgres.admin.queryRaw(`select session from ${fn("expire_support_sessions")}() as session`)).map((row) => supportSessionFromRow(row.session, options.temporal));
 		},
+		withTemporal: (namespace) => options.temporal === void 0 ? sqlSupportStore(postgres, {
+			...options,
+			temporal: namespace
+		}) : sqlSupportStore(postgres, options),
 		async claims(targetUserId) {
 			const [row] = await postgres.admin.queryRaw(`select ${fn("support_target_claims")}($1) as claims`, [targetUserId]);
 			return row?.claims ?? {};
@@ -113,10 +127,11 @@ function storeError(cause) {
 function supportSessions(options) {
 	return {
 		options,
-		create: (events, claimsSchema) => createSupport(options, events, claimsSchema)
+		create: (events, claimsSchema, temporal) => createSupport(options, events, claimsSchema, temporal)
 	};
 }
-function createSupport(options, events, claimsSchema) {
+function createSupport(options, events, claimsSchema, temporal) {
+	const store = temporal !== void 0 && options.store.withTemporal ? options.store.withTemporal(temporal) : options.store;
 	const policy = options.policy ?? {};
 	const ttl = policy.ttl ?? 1800;
 	const maxTtl = policy.maxTtl ?? 14400;
@@ -133,21 +148,12 @@ function createSupport(options, events, claimsSchema) {
 		return { role: "authenticated" };
 	};
 	/** Target claims per support session; the session itself is loaded every time, so revoking stays immediate. */
-	const claimsCache = /* @__PURE__ */ new Map();
+	const claimsCache = boundedTtlCache({ max: CLAIMS_CACHE_SIZE });
 	const cachedTargetClaims = async (session) => {
-		const now = Date.now();
 		const cached = claimsCache.get(session.id);
-		if (cached && cached.until > now) return cached.claims;
-		const claims = await targetClaims(options.store, session.targetUserId);
-		claimsCache.delete(session.id);
-		if (claimsCache.size >= CLAIMS_CACHE_SIZE) {
-			const oldest = claimsCache.keys().next();
-			if (!oldest.done) claimsCache.delete(oldest.value);
-		}
-		claimsCache.set(session.id, {
-			claims,
-			until: Math.min(session.expiresAt.epochMilliseconds, now + CLAIMS_TTL_MS)
-		});
+		if (cached) return cached;
+		const claims = await targetClaims(store, session.targetUserId);
+		claimsCache.set(session.id, claims, Math.min(session.expiresAt.epochMilliseconds, Date.now() + CLAIMS_TTL_MS));
 		return claims;
 	};
 	const checkPolicy = (admin, request, reason, seconds) => {
@@ -164,7 +170,37 @@ function createSupport(options, events, claimsSchema) {
 			return false;
 		}
 	};
+	const expire = () => AsyncResult.from(async () => {
+		if (!store.expire) return err(dbError("unsupported", `The "${store.name}" support session store has no expire()`, { code: "SUPPORT_EXPIRE_UNSUPPORTED" }));
+		let expired;
+		try {
+			expired = await store.expire();
+		} catch (cause) {
+			return err(storeError(cause));
+		}
+		for (const session of expired) emit("support.ended", {
+			sessionId: session.id,
+			adminId: session.adminId,
+			targetUserId: session.targetUserId,
+			reason: session.reason,
+			endedBy: "expired",
+			...session.tenant === void 0 ? {} : { organizationId: session.tenant }
+		});
+		return ok(expired);
+	});
 	return {
+		expire,
+		expireRoute: (routeOptions) => cronRoute({
+			name: "expire",
+			secret: routeOptions.secret,
+			problem: routeOptions.problem
+		}, async (_request, instance) => {
+			const result = await expire();
+			return result.ok ? Response.json({ expired: result.data.length }) : problemResponse(result.error, {
+				instance,
+				format: routeOptions.problem
+			});
+		}),
 		start(admin, request) {
 			return AsyncResult.from(async () => {
 				if (admin.kind !== "user") return err(dbError("unauthorized", "Sign in to start a support session"));
@@ -193,7 +229,7 @@ function createSupport(options, events, claimsSchema) {
 				if (!await authorized(input)) return deny(denied("Not allowed to start a support session", "SUPPORT_FORBIDDEN"), "authorize");
 				let session;
 				try {
-					session = await options.store.start({
+					session = await store.start({
 						adminId: admin.user.id,
 						adminClaims: admin.claims,
 						targetUserId: request.targetUserId,
@@ -226,12 +262,12 @@ function createSupport(options, events, claimsSchema) {
 				const cookie = clearSupportCookie(options.cookie);
 				if (admin.kind !== "user") return err(dbError("unauthorized", "Sign in to stop a support session"));
 				try {
-					const session = await options.store.get(sessionId, admin.user.id, admin.claims);
+					const session = await store.get(sessionId, admin.user.id, admin.claims);
 					if (!session) return ok({
 						ended: false,
 						cookie
 					});
-					const ended = await options.store.end(sessionId, "admin", admin.claims);
+					const ended = await store.end(sessionId, "admin", admin.claims);
 					if (ended) emit("support.ended", {
 						sessionId,
 						adminId: session.adminId,
@@ -251,7 +287,7 @@ function createSupport(options, events, claimsSchema) {
 			return AsyncResult.from(async () => {
 				if (caller.kind !== "user") return err(dbError("unauthorized", "Sign in to revoke a support session"));
 				try {
-					return ok(await options.store.end(sessionId, "revoked", caller.claims));
+					return ok(await store.end(sessionId, "revoked", caller.claims));
 				} catch (cause) {
 					return err(storeError(cause));
 				}
@@ -265,7 +301,7 @@ function createSupport(options, events, claimsSchema) {
 			let session;
 			let claims;
 			try {
-				session = await options.store.get(id, auth.user.id, auth.claims);
+				session = await store.get(id, auth.user.id, auth.claims);
 				if (!session || session.expiresAt.epochMilliseconds <= Date.now()) return;
 				if (policy.readOnly !== "default" && !session.readOnly) session = {
 					...session,
@@ -300,7 +336,7 @@ function createSupport(options, events, claimsSchema) {
 			return AsyncResult.from(async () => {
 				if (caller.kind !== "user") return err(dbError("unauthorized", "Sign in to list support sessions"));
 				try {
-					return ok(await options.store.list(filter, caller.claims));
+					return ok(await store.list(filter, caller.claims));
 				} catch (cause) {
 					return err(storeError(cause));
 				}

package/dist/{support-view-CVOJJLpc.d.ts → support-view-scqMgtOo.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSession } from "./view-CF7ihnkg.js";
+import { t as AuthSession } from "./view-TpXEUcVN.js";
 //#region src/auth/support-view.d.ts
 /** A running support session as the target's view shows it, for a banner. */
 interface SupportView {