better-supabase 0.7.1 → 0.8.0

package/dist/resource-types-CqB6GWGT.d.ts

@@ -0,0 +1,141 @@
+import { E as ValidationIssue, f as Result } from "./result-BchM1XZn.js";
+import { H as Update, L as TableKey, M as Row, R as TableMeta, a as AnyModels, x as Insert } from "./types-CoE5Zwy4.js";
+import { m as RequestContext } from "./plugin-CPK2HsbY.js";
+import { E as ResourceOperation } from "./model-OgBxvk3N.js";
+import { a as ResourcePlan, i as ResourcePagination, n as ResourceActionSpec, r as ResourceDescription } from "./resource--vTrBe6I.js";
+import { Lt as SelectArg } from "./define-DmcfoNXB.js";
+import { a as RespondOptions } from "./respond-Cw-zanCm.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/server/resource-types.d.ts
+/** What a resource needs from `defineListQuery`. */
+interface ResourceList {
+  readonly table: string;
+  readonly pagination?: ResourcePagination;
+  readonly openapi: readonly unknown[];
+  readonly jsonSchema: Readonly<Record<string, unknown>>;
+  parse(input: never): {
+    readonly ok: true;
+    readonly value: unknown;
+  } | {
+    readonly ok: false;
+    readonly issues: readonly ValidationIssue[];
+  };
+  run(db: never, query: never, extra?: never): PromiseLike<unknown>;
+}
+/** What hooks and action handlers receive. */
+interface ResourceContext<DbT = unknown> {
+  /** The repositories, bound to the caller (RLS applies). */
+  readonly db: DbT;
+  readonly table: string;
+  /** The HTTP request, when the call came from one. */
+  readonly request: Request | undefined;
+  /** The verified request context: actor, tenant and claims. */
+  readonly context: RequestContext;
+}
+type HookResult<T> = Result<T> | PromiseLike<Result<T>>;
+/** The target of an item operation or action. `row` is set when a permission check fetched it. */
+interface ResourceTarget<R> {
+  readonly id?: unknown;
+  readonly data?: unknown;
+  readonly query?: unknown;
+  readonly row?: R;
+}
+/** A list response: the page's rows plus its paging fields. */
+interface ResourcePage<R> {
+  readonly items: readonly R[];
+  readonly [field: string]: unknown;
+}
+/**
+ * Business logic around the repository. Every hook returns a `Result`; an
+ * error `Result` ends the request with that error, and a throw becomes an
+ * `unexpected` error. Hooks run after the authorizer.
+ */
+interface ResourceHooks<M extends AnyModels, T extends TableKey<M>, DbT = unknown> {
+  /** Runs before every operation and action; an error denies it. */
+  authorize?(ctx: ResourceContext<DbT>, operation: ResourceOperation | (string & {}), target: ResourceTarget<Row<M, T>>): HookResult<unknown>;
+  /** Returns the values to insert. */
+  beforeCreate?(ctx: ResourceContext<DbT>, data: Insert<M, T>): HookResult<Insert<M, T>>;
+  /** Returns the values to update. */
+  beforeUpdate?(ctx: ResourceContext<DbT>, data: Update<M, T>, target: ResourceTarget<Row<M, T>>): HookResult<Update<M, T>>;
+  beforeDelete?(ctx: ResourceContext<DbT>, target: ResourceTarget<Row<M, T>>): HookResult<unknown>;
+  /** Returns the response; describe a changed shape in `output.list`. */
+  afterList?(ctx: ResourceContext<DbT>, page: ResourcePage<Row<M, T>>): HookResult<unknown>;
+  afterGet?(ctx: ResourceContext<DbT>, row: Row<M, T>): HookResult<unknown>;
+  afterCreate?(ctx: ResourceContext<DbT>, row: Row<M, T>): HookResult<unknown>;
+  afterUpdate?(ctx: ResourceContext<DbT>, row: Row<M, T>): HookResult<unknown>;
+}
+/** What an action handler receives besides the context: values already validated. */
+interface ActionArgs<I = unknown, Q = unknown> {
+  /** The parsed key, for item actions (`/{id}/send`). */
+  readonly id: unknown;
+  readonly data: I;
+  readonly query: Q;
+}
+/**
+ * A custom operation (`POST /<table>/{id}/send`). The handler returns a
+ * `Result`, a plain value or a `Response`; a throw becomes an `unexpected`
+ * error.
+ */
+interface ResourceAction<Ref = string, DbT = unknown> extends ResourceActionSpec<Ref> {
+  handler(ctx: ResourceContext<DbT>, args: ActionArgs): unknown;
+}
+type Parsed<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<S> : undefined;
+interface ResourceRouteOptions<M extends AnyModels, T extends TableKey<M>, Ref = string, DbT = unknown> extends Omit<ResourceDescription<Ref>, "list" | "input" | "actions" | "operations" | "pagination" | "maxPageSize"> {
+  /** Defaults to every operation for tables, `list` and `get` for views. */
+  readonly operations?: readonly ResourceOperation[];
+  /** Filters, search and sorts for `list`, from `defineListQuery`. */
+  readonly list?: ResourceList;
+  /** Columns returned by every operation. */
+  readonly select?: SelectArg<M, T>;
+  /** Validates request bodies before they reach the repository. */
+  readonly input?: {
+    readonly create?: StandardSchemaV1<unknown, Insert<M, T>>;
+    readonly update?: StandardSchemaV1<unknown, Update<M, T>>;
+  };
+  /**
+   * Paging of the default list: `offset` (`page` and `size`) or `cursor`
+   * (`after` and `size`, keyset). A `list` query brings its own. Defaults
+   * to `offset`.
+   */
+  readonly pagination?: ResourcePagination;
+  /** Largest page for the default list. Defaults to 200. */
+  readonly maxPageSize?: number;
+  readonly hooks?: ResourceHooks<M, T, DbT>;
+  readonly actions?: Readonly<Record<string, ResourceAction<Ref, DbT>>>;
+}
+interface ResourceInput {
+  /** Primary key value; strings are converted for integer keys. */
+  readonly id?: unknown;
+  /** Body of `create`, `update` and actions. */
+  readonly data?: unknown;
+  /** `list` and action parameters: URL params or typed values. */
+  readonly query?: URLSearchParams | Readonly<Record<string, unknown>>;
+  /** The HTTP request, passed on to hooks and actions. */
+  readonly request?: Request;
+}
+interface ResourceHandler<Ref = string> {
+  readonly table: string;
+  readonly meta: TableMeta;
+  readonly operations: readonly ResourceOperation[];
+  /** Name of the key parameter, or `undefined` for tables without a single-column key. */
+  readonly keyParam: string | undefined;
+  readonly list: ResourceList | undefined;
+  readonly pagination: ResourcePagination;
+  readonly maxPageSize: number;
+  /** What the resource serves; `defineApi` documents the same plan. */
+  readonly plan: ResourcePlan<Ref>;
+  /** Runs one operation as whoever `db` is bound to. Resolves to a `Result`. */
+  execute(db: object, operation: ResourceOperation, input?: ResourceInput): Promise<Result<unknown>>;
+  /** Runs one action by name. Resolves to a `Result`. */
+  action(db: object, name: string, input?: ResourceInput): Promise<Result<unknown>>;
+  /** Serves a collection request (`id` undefined) or an item request. Actions are not routed. */
+  handle(request: Request, db: object, id: string | undefined, options?: RespondOptions): Promise<Response>;
+  /**
+   * Serves the collection (`[]`), an item (`[id]`) or an action path
+   * (`[id, "send"]`), below the resource's own path. A string is split on `/`
+   * and decoded.
+   */
+  serve(request: Request, db: object, subpath: string | readonly string[], options?: RespondOptions): Promise<Response>;
+}
+//#endregion
+export { ResourceHandler as a, ResourceList as c, ResourceContext as i, ResourceRouteOptions as l, Parsed as n, ResourceHooks as o, ResourceAction as r, ResourceInput as s, ActionArgs as t };

package/dist/resources-BVYPnuLo.js

@@ -0,0 +1,56 @@
+import { n as dbError } from "./errors-2M6CKMP4.js";
+import { o as problemResponse } from "./problem-CJvFeGu7.js";
+import { n as actionFits, t as defineResource } from "./resource-DA811u_4.js";
+//#region src/server/resources.ts
+function split(path) {
+	return path.split("/").filter((segment) => segment !== "");
+}
+/** Whether a resource serves this path below it, with some method. */
+function serves(handler, segments) {
+	if (segments.length === 0) return true;
+	if (handler.plan.actions.some((action) => actionFits(action, segments))) return true;
+	return segments.length === 1 && handler.keyParam !== void 0;
+}
+/**
+* Routes `basePath` plus each resource's path (`/<table>` unless `path` is
+* set) to its handler. Shared by the edge and Next.js resource routers.
+*/
+function resourceRouter(betterSupabase, map, options = {}) {
+	const base = split(options.basePath ?? "");
+	const routes = [];
+	for (const [table, resource] of Object.entries(map)) {
+		if (!resource) continue;
+		const handler = defineResource(betterSupabase, table, resource === true ? {} : resource, options.authorizer);
+		routes.push({
+			prefix: split(handler.plan.description.path ?? `/${table}`),
+			handler
+		});
+	}
+	routes.sort((a, b) => b.prefix.length - a.prefix.length);
+	return {
+		handlers: routes.map((route) => route.handler),
+		match(request) {
+			const { pathname } = new URL(request.url);
+			const notFound = () => problemResponse(dbError("not_found", `No route for ${pathname}`), { instance: pathname });
+			const raw = split(pathname);
+			if (!base.every((segment, index) => raw[index] === segment)) return notFound();
+			const rest = raw.slice(base.length);
+			const route = routes.find(({ prefix }) => prefix.length <= rest.length && prefix.every((segment, index) => rest[index] === segment));
+			if (!route) return notFound();
+			let segments;
+			try {
+				segments = rest.slice(route.prefix.length).map((segment) => decodeURIComponent(segment));
+			} catch {
+				return problemResponse(dbError("invalid_input", `Malformed id in ${pathname}`), { instance: pathname });
+			}
+			if (!serves(route.handler, segments)) return notFound();
+			return {
+				handler: route.handler,
+				segments,
+				instance: pathname
+			};
+		}
+	};
+}
+//#endregion
+export { resourceRouter as t };

package/dist/resources-DZSk8tXJ.d.ts

@@ -0,0 +1,7 @@
+import { L as TableKey, a as AnyModels } from "./types-CoE5Zwy4.js";
+import { l as ResourceRouteOptions } from "./resource-types-CqB6GWGT.js";
+//#region src/server/resources.d.ts
+/** Resources by table name; `true` serves a table with the defaults. */
+type ResourceMap<M extends AnyModels, Ref = string, DbT = unknown> = { readonly [T in TableKey<M>]?: ResourceRouteOptions<M, T, Ref, DbT> | true; };
+//#endregion
+export { ResourceMap as t };

package/dist/{respond-DprrgyXX.d.ts → respond-Cw-zanCm.d.ts}

@@ -1,6 +1,6 @@
-import { b as DbError } from "./result-D7y2fT87.js";
-import { r as AuthState } from "./resolve-ChTYeTEl.js";
-import { t as Aal } from "./mfa-Daak8ukG.js";
+import { b as DbError } from "./result-BchM1XZn.js";
+import { r as AuthState } from "./resolve-MxXVWyhd.js";
+import { t as Aal } from "./mfa-SZc9YYyb.js";
 //#region src/server/refresh.d.ts
 /** A router or browser prefetch, by its request headers. */
 declare function isPrefetch(request: Request): boolean;

package/dist/{respond-BUgsXNgk.js → respond-volM3ByS.js}

@@ -1,8 +1,8 @@
-import { n as dbError, o as isDbError, r as dbErrorOf } from "./errors-B11Duf73.js";
-import { s as toDbError } from "./result-DzUbqgdW.js";
-import { a as problemResponse } from "./problem-BreOl8b8.js";
+import { n as dbError, o as isDbError, r as dbErrorOf } from "./errors-2M6CKMP4.js";
+import { s as toDbError } from "./result-DEqHCMKP.js";
+import { o as problemResponse } from "./problem-CJvFeGu7.js";
 import { a as actorOf, o as delegationOf } from "./impersonation-DcqaTBHx.js";
-import { a as checkAal, t as isAnonymousUser } from "./view-BeFcRV6G.js";
+import { a as checkAal, t as isAnonymousUser } from "./view-D5ryq3gz.js";
 import { n as jsonResponse } from "./json-CEnpTHlZ.js";
 //#region src/server/respond.ts
 /**

package/dist/{result-D7y2fT87.d.ts → result-BchM1XZn.d.ts}

@@ -10,11 +10,17 @@ interface DbErrorKinds {
   /**
    * `required`: the assurance level the route needs, when a second factor is
    * missing. `scopes`: the OAuth scopes the route needs, when a delegated
-   * token lacks one (`INSUFFICIENT_SCOPE`).
+   * token lacks one (`INSUFFICIENT_SCOPE`). `permission`: the key an
+   * `Authorizer` denied. `approval`: the pending approval when the answer is
+   * `APPROVAL_REQUIRED`.
    */
   forbidden: {
     required?: "aal1" | "aal2";
     scopes?: readonly string[];
+    permission?: string;
+    approval?: {
+      readonly id: string;
+    };
   };
   conflict: {
     constraint?: string;

package/dist/{result-DzUbqgdW.js → result-DEqHCMKP.js}

@@ -1,5 +1,5 @@
 import { t as DbException } from "./db-exception-CnWcYPxL.js";
-import { n as dbError, r as dbErrorOf } from "./errors-B11Duf73.js";
+import { n as dbError, r as dbErrorOf } from "./errors-2M6CKMP4.js";
 //#region src/core/result.ts
 const throwMappers = /* @__PURE__ */ new WeakMap();
 function inherit(from, next) {

package/dist/server/index.d.ts

@@ -1,26 +1,30 @@
-import { b as DbError } from "../result-D7y2fT87.js";
-import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
-import { m as RequestContext } from "../plugin-FGY8UhYm.js";
+import { b as DbError } from "../result-BchM1XZn.js";
+import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-CoE5Zwy4.js";
+import { t as SqlClient } from "../executor-ngjKL_Pe.js";
+import { m as RequestContext } from "../plugin-CPK2HsbY.js";
 import { _ as writeSession, a as CookieWrite, c as StoredSession, h as sessionCookieName, n as CookieOptions, p as readSession, r as CookieRecord, t as AUTH_CACHE_HEADERS } from "../session-ChiXDZdZ.js";
-import { a as ResolveAuthOptions, c as clientIp, i as InvalidReason, l as resolveAuth, n as AuthResolver, o as ResolvedState, r as AuthState, s as authContext, t as AuthResolution } from "../resolve-ChTYeTEl.js";
-import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DD8LZFjc.js";
-import { B as DbStats, b as Db, t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { A as supportSessions, B as SupportSession, C as ActiveSupport, D as SupportPolicy, E as SupportOptions, F as supportCookieValue, H as SupportStartInput, I as SqlSupportStoreOptions, L as SupportCallerClaims, M as SupportCookieOptions, N as clearSupportCookie, O as SupportSessions, P as supportCookie, R as SupportEndedBy, S as deleteAccount, T as SupportAuthorizeInput, U as sqlSupportStore, V as SupportSessionStore, W as supportClaims, _ as RequestIdOptions, a as ServerDbOptions, b as DeleteAccountOptions, c as createServer, d as LastSignIn, f as SuspendAccountOptions, g as suspendAccount, h as lastSignIns, i as ServerContext, j as SUPPORT_COOKIE, k as SupportStartRequest, l as extendServer, m as endSessions, n as ContextOptions, o as ServerOptions, p as SuspendAccountResult, r as ForContextOptions, s as TENANT_HEADER, t as BetterServer, u as EndSessionsResult, v as PRIMARY_COOKIE, w as SupportApi, x as DeleteAccountResult, y as ReplicaState, z as SupportListFilter } from "../server-Bh0EVSwU.js";
-import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-Daak8ukG.js";
+import { a as ResolveAuthOptions, c as resolveAuth, i as InvalidReason, n as AuthResolver, o as ResolvedState, r as AuthState, s as clientIp, t as AuthResolution } from "../resolve-MxXVWyhd.js";
+import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-TvGdxO1t.js";
+import { a as AuthorizationSubject, c as defineAuthorizer, i as AuthorizationResource, n as AuthorizationOutcome, o as Authorizer, r as AuthorizationRequest, s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
+import { i as ResourcePagination } from "../resource--vTrBe6I.js";
+import { t as StorageApi } from "../storage-api-CB7Zl1Ci.js";
+import { Wt as DbStats, _ as Db, t as BetterSupabase } from "../define-DmcfoNXB.js";
+import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-SZc9YYyb.js";
+import { A as SUPPORT_COOKIE, B as SupportSessionStore, C as SupportAuthorizeInput, D as SupportSessions, E as SupportPolicy, F as SqlSupportStoreOptions, G as LiteDriver, H as sqlSupportStore, I as SupportCallerClaims, L as SupportEndedBy, M as clearSupportCookie, N as supportCookie, O as SupportStartRequest, P as supportCookieValue, R as SupportListFilter, S as SupportApi, T as SupportOptions, U as supportClaims, V as SupportStartInput, W as RequestIdOptions, _ as ReplicaState, a as ServerDbOptions, b as deleteAccount, c as TENANT_HEADER, d as SuspendAccountOptions, f as SuspendAccountResult, g as PRIMARY_COOKIE, h as suspendAccount, i as ServerContext, j as SupportCookieOptions, k as supportSessions, l as EndSessionsResult, m as lastSignIns, n as ContextOptions, o as ServerKeys, p as endSessions, r as ForContextOptions, s as ServerOptions, t as BetterServer, u as LastSignIn, v as DeleteAccountOptions, w as SupportExpireRouteOptions, x as ActiveSupport, y as DeleteAccountResult, z as SupportSession } from "../server-types-CrAmZ8jv.js";
 import { n as SessionActor, r as SessionDelegation, t as ActClaim } from "../actor-CQTlc1Hh.js";
-import { n as toSession, t as AuthSession } from "../view-CF7ihnkg.js";
-import { a as SessionEntryConfig, c as withGuard, i as withBetterSupabase, l as ServerCore, n as BetterSupabaseContributions, o as withSession, r as BetterSupabaseEntry, s as GuardEntryConfig, t as BetterSupabaseConfig, u as serverCore } from "../composite--yqry7uW.js";
-import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-DprrgyXX.js";
-import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-CkNzZUqv.js";
-import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-IPS5xi9q.js";
-import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-Cx-LnIQP.js";
-import { n as supportOf, t as SupportView } from "../support-view-CVOJJLpc.js";
-import { a as sessionStatus, c as refreshSession, i as clearSessionCookies, n as SessionStatus, r as SessionStatusOptions, s as RefreshOutcome, t as ClearSessionCookiesOptions } from "../ended-XjeGQ5XW.js";
+import { n as toSession, t as AuthSession } from "../view-TpXEUcVN.js";
+import { a as SessionEntryConfig, c as withGuard, i as withBetterSupabase, l as ServerCore, n as BetterSupabaseContributions, o as withSession, r as BetterSupabaseEntry, s as GuardEntryConfig, t as BetterSupabaseConfig, u as serverCore } from "../composite-CWAJTRBF.js";
+import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-Cw-zanCm.js";
+import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-W99LCPBS.js";
+import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-CqB6GWGT.js";
+import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-BO9LjtWG.js";
+import { n as supportOf, t as SupportView } from "../support-view-scqMgtOo.js";
+import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-CcvcRqEd.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware, SingleKeyEntry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
 import { PostgresApi } from "@supabase/server/middleware/postgres";
-//#region src/blocks/csv.d.ts
+//#region src/core/csv.d.ts
 interface CsvOptions {
   /**
    * The columns in order. Defaults to every key of the rows, in the order
@@ -62,6 +66,19 @@ export declare function csvResponse(rows: readonly Readonly<Record<string, unkno
 export declare const SERVER_EVENT_SOURCE = "/better-supabase/server";
 type AccountEventType = "account.suspended" | "account.unsuspended" | "account.deleted" | "account.sessions_ended";
 //#endregion
+//#region src/server/server.d.ts
+/**
+ * A framework adapter's server: `server` plus the adapter's own methods,
+ * without reading the lazy `env` getter. `extra` can't replace a
+ * `BetterServer` method.
+ */
+export declare function extendServer<R extends object>(server: object, extra: Omit<R, ServerKeys>): R;
+/**
+ * Server-side entry point for APIs, jobs, MCP servers and framework
+ * adapters. Holds the secrets; `betterSupabase` stays isomorphic.
+ */
+export declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
+//#endregion
 //#region src/server/adapter.d.ts
 interface HandleOptions extends MiddlewareOptions {
   /** Include error messages in problem responses. Defaults to `NODE_ENV === 'development'`. */
@@ -85,6 +102,8 @@ interface HandleOptions extends MiddlewareOptions {
 }
 /** Hands event sink sends still running to `waitUntil`; a no-op without either. */
 export declare function flushEvents(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown>, "events">, waitUntil: ((promise: Promise<unknown>) => void) | undefined): void;
+/** Runs `run`, then hands pending event sink sends to `waitUntil` even when it throws. */
+export declare function withFlush<T>(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown>, "events">, waitUntil: ((promise: Promise<unknown>) => void) | undefined, run: () => Promise<T> | T): Promise<T>;
 /** The 500 for an error a handler threw; the message only when `expose` is set. */
 export declare function unexpectedResponse(cause: unknown, options: {
   readonly instance?: string;
@@ -109,6 +128,37 @@ export declare function handle<M extends AnyModels, F extends AnyFunctions, E, C
  */
 export declare function resolveToken<C, P>(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown, C, P>, "resolve">, token: string | null | undefined): Promise<AuthState<C, P>>;
 //#endregion
+//#region src/server/support-storage.d.ts
+interface SupportStorageOptions {
+  /** The service-role `supabase.storage` that serves what the target may read. */
+  readonly admin: StorageApi;
+  /** Runs as the target, such as `postgres.asUser(support.claims)`, so RLS on `storage.objects` decides. */
+  readonly sql: SqlClient;
+  /** Whether the session is read-only. Defaults to true. */
+  readonly readOnly?: boolean;
+}
+/**
+ * Storage for a support session, with the same `from(bucket)` file API as
+ * `supabase.storage`, so `bucket.connect()` and the blocks take it.
+ *
+ * Storage policies read `auth.uid()` from the request's token, and there is
+ * no token for the target, so reads go through Postgres as the target.
+ * `exists`, `info`, `list` and `listV2` run entirely there: the listings
+ * call the invoker-rights `storage.search` functions storage-api calls, so
+ * RLS filters each page as it would for the target's own request.
+ * `download` and the signed URLs first check there that the target may see
+ * the object, then the service client serves it. A hidden object answers
+ * like a missing one. `getPublicUrl` is built without a check, as it is
+ * built without a request.
+ *
+ * Writes resolve to a `403` error: `SUPPORT_READ_ONLY` in a read-only
+ * session and `SUPPORT_STORAGE_WRITES` in a writable one. The service client
+ * would store the object with no owner, and Storage never sees the session's
+ * `act` claim, so the write could be neither attributed to the target nor
+ * audited as the admin's.
+ */
+export declare function supportStorage(options: SupportStorageOptions): StorageApi;
+//#endregion
 //#region src/server/entries/upstream.d.ts
 /** The `withSupabase` context keys `withBetterDb` and `withBetterPostgres` read. */
 interface SupabaseAuthContext {
@@ -156,7 +206,7 @@ export declare function withBetterPostgres<M extends AnyModels, D, F extends Any
  */
 export declare function withBlock<const Key extends string, In extends object, Service>(key: Key, create: (ctx: In) => Service): SingleKeyEntry<Key, In, Service>;
 //#endregion
-//#region src/server/entries/claims.d.ts
+//#region src/auth/claims.d.ts
 /** `jwtClaims` as `withSupabase` contributes it: the verified token's payload, or `null`. */
 export declare function jwtClaimsOf<C>(auth: AuthState<C>): (JWTClaims & C) | null;
 /** `userClaims` as `withSupabase` contributes it, or `null` without a user. */
@@ -192,6 +242,18 @@ export declare function checkSession(sql: SessionLookup, auth: {
   readonly kind: string;
 }): Promise<DbError | undefined>;
 //#endregion
+//#region src/server/resource.d.ts
+/**
+ * Operations over one table, matching the paths and responses of the API
+ * model: `GET/POST /<table>`, `GET/PATCH/DELETE /<table>/{id}` and each
+ * action's path. Shared by the HTTP adapters and the MCP table tools.
+ *
+ * With permissions, the authorizer decides before the repository runs:
+ * `get`, `update` and `delete` fetch the row first (under RLS) and pass it
+ * as the resource's properties, and `list` keeps only the rows it grants.
+ */
+export declare function defineResource<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>, Ref = string, DbT = unknown>(betterSupabase: BetterSupabase<M, D, F, E>, table: T, options?: ResourceRouteOptions<M, T, NoInfer<Ref>, DbT>, authorizer?: Authorizer<Ref>): ResourceHandler<Ref>;
+//#endregion
 //#region src/server/entries/timing.d.ts
 /** The header `withDbStats` sets: `calls;waves;ms`, what `expectDbBudget` reads. */
 export declare const DB_CALLS_HEADER = "x-bs-db-calls";
@@ -225,4 +287,4 @@ export declare function withDbStats(options?: {
   };
 }, () => DbStats>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizeOptions, type AuthorizedContext, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, aalOf, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, createServer, defineResource, deleteAccount, endSessions, extendServer, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, type Aal, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type AmrEntry, type AnyAuthorizer, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PermissionRef, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, aalOf, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, defineAuthorizer, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };

package/dist/server/index.js

@@ -1,21 +1,23 @@
-import { n as dbError } from "../errors-B11Duf73.js";
-import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-BreOl8b8.js";
+import { n as dbError } from "../errors-2M6CKMP4.js";
+import { i as isProblem, n as PROBLEM_TYPE_BASE, o as problemResponse, r as fromProblem, s as toProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-CJvFeGu7.js";
 import { i as userContext, r as impersonatorOf } from "../impersonation-DcqaTBHx.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { n as toCsv, t as csvColumns } from "../csv-DCK-PT1n.js";
-import { n as postgresExecutor } from "../executor-De1Of3m3.js";
-import { C as serverCore, D as suspendAccount, E as lastSignIns, O as deleteAccount, T as endSessions, _ as withSession, a as unexpectedResponse, b as shouldCheckSession, c as extendServer, d as clearSupportCookie, f as supportCookie, i as resolveToken, m as supportCookieValue, n as flushEvents, o as TENANT_HEADER, r as handle, s as createServer, u as SUPPORT_COOKIE, v as isPrefetch, w as SERVER_EVENT_SOURCE, x as shouldRefresh, y as refreshFor } from "../adapter-iKgjHVPx.js";
+import { n as toCsv, t as csvColumns } from "../csv-BZnHA1Py.js";
+import { n as postgresExecutor } from "../executor-B_Hfobee.js";
+import { D as lastSignIns, E as endSessions, O as suspendAccount, S as shouldRefresh, T as SERVER_EVENT_SOURCE, a as unexpectedResponse, b as refreshFor, c as extendServer, d as clearSupportCookie, f as supportCookie, h as TENANT_HEADER, i as resolveToken, k as deleteAccount, l as supportStorage, m as supportCookieValue, n as flushEvents, o as withFlush, r as handle, s as createServer, u as SUPPORT_COOKIE, v as withSession, w as serverCore, x as shouldCheckSession, y as isPrefetch } from "../adapter-CN45ibbV.js";
 import { n as PRIMARY_COOKIE } from "../replicas-CwrYp5Zj.js";
-import { _ as writeSession, a as refreshSession, c as AUTH_CACHE_HEADERS, h as sessionCookieName, i as resolveAuth, n as clientIp, o as clearSessionCookies, p as readSession, s as sessionStatus, t as authContext } from "../resolve-tJZY3FEa.js";
-import { a as checkAal, i as amrOf, n as toSession, r as aalOf } from "../view-BeFcRV6G.js";
-import { a as respond, i as isResult, o as settle, r as guard } from "../respond-BUgsXNgk.js";
-import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-ig_K4PvS.js";
-import { n as jwtClaimsOf, r as userClaimsOf, t as authModeOf } from "../claims-DDBQT6BK.js";
-import { n as withGuard, t as withBetterSupabase } from "../composite-DXVUibdi.js";
-import { t as defineResource } from "../resource-BsvzCMlX.js";
+import { t as authContext } from "../context-nPDvQ-Zl.js";
+import { a as clearSessionCookies, f as readSession, g as writeSession, i as refreshSession, m as sessionCookieName, o as sessionStatus, r as resolveAuth, s as AUTH_CACHE_HEADERS, t as clientIp } from "../resolve-Bvgf3ut_.js";
+import { a as checkAal, i as amrOf, n as toSession, r as aalOf } from "../view-D5ryq3gz.js";
+import { a as respond, i as isResult, o as settle, r as guard } from "../respond-volM3ByS.js";
+import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-D1pFFouF.js";
+import { n as jwtClaimsOf, r as userClaimsOf, t as authModeOf } from "../claims-0KZVT804.js";
+import { n as withGuard, t as withBetterSupabase } from "../composite-zTe0TCqj.js";
+import { r as defineAuthorizer } from "../authorizer-ayxUDXXP.js";
+import { t as defineResource } from "../resource-DA811u_4.js";
 import { i as withServerTiming, n as parseDbStats, r as withDbStats, t as DB_CALLS_HEADER } from "../timing-CyTQPubY.js";
 import { n as tagCache, r as tagFor, t as cacheTagsOf } from "../tags-B99_U9Pp.js";
-import { a as rolesAt, r as hasRole } from "../kit-Fm-Fv7q5.js";
+import { a as rolesAt, r as hasRole } from "../kit-BhHr9T9v.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/server/csv.ts
 function disposition(filename) {
@@ -142,4 +144,4 @@ async function checkSession(sql, auth) {
 	return row?.active === true ? void 0 : revoked;
 }
 //#endregion
-export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, amrOf, authContext, authModeOf, cacheTagsOf, checkAal, checkSession, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, csvColumns, csvResponse, defineResource, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, jwtClaimsOf, lastSignIns, parseDbStats, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, resolveToken, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withGuard, withServerTiming, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, amrOf, authContext, authModeOf, cacheTagsOf, checkAal, checkSession, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, csvColumns, csvResponse, defineAuthorizer, defineResource, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, jwtClaimsOf, lastSignIns, parseDbStats, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, resolveToken, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, supportStorage, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withFlush, withGuard, withServerTiming, withSession, writeSession };