better-supabase 0.7.1 → 0.9.0

package/dist/server/index.d.ts

@@ -1,47 +1,35 @@
-import { b as DbError } from "../result-D7y2fT87.js";
-import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
-import { m as RequestContext } from "../plugin-FGY8UhYm.js";
-import { _ as writeSession, a as CookieWrite, c as StoredSession, h as sessionCookieName, n as CookieOptions, p as readSession, r as CookieRecord, t as AUTH_CACHE_HEADERS } from "../session-ChiXDZdZ.js";
-import { a as ResolveAuthOptions, c as clientIp, i as InvalidReason, l as resolveAuth, n as AuthResolver, o as ResolvedState, r as AuthState, s as authContext, t as AuthResolution } from "../resolve-ChTYeTEl.js";
-import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DD8LZFjc.js";
-import { B as DbStats, b as Db, t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { A as supportSessions, B as SupportSession, C as ActiveSupport, D as SupportPolicy, E as SupportOptions, F as supportCookieValue, H as SupportStartInput, I as SqlSupportStoreOptions, L as SupportCallerClaims, M as SupportCookieOptions, N as clearSupportCookie, O as SupportSessions, P as supportCookie, R as SupportEndedBy, S as deleteAccount, T as SupportAuthorizeInput, U as sqlSupportStore, V as SupportSessionStore, W as supportClaims, _ as RequestIdOptions, a as ServerDbOptions, b as DeleteAccountOptions, c as createServer, d as LastSignIn, f as SuspendAccountOptions, g as suspendAccount, h as lastSignIns, i as ServerContext, j as SUPPORT_COOKIE, k as SupportStartRequest, l as extendServer, m as endSessions, n as ContextOptions, o as ServerOptions, p as SuspendAccountResult, r as ForContextOptions, s as TENANT_HEADER, t as BetterServer, u as EndSessionsResult, v as PRIMARY_COOKIE, w as SupportApi, x as DeleteAccountResult, y as ReplicaState, z as SupportListFilter } from "../server-Bh0EVSwU.js";
-import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-Daak8ukG.js";
-import { n as SessionActor, r as SessionDelegation, t as ActClaim } from "../actor-CQTlc1Hh.js";
-import { n as toSession, t as AuthSession } from "../view-CF7ihnkg.js";
-import { a as SessionEntryConfig, c as withGuard, i as withBetterSupabase, l as ServerCore, n as BetterSupabaseContributions, o as withSession, r as BetterSupabaseEntry, s as GuardEntryConfig, t as BetterSupabaseConfig, u as serverCore } from "../composite--yqry7uW.js";
-import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-DprrgyXX.js";
-import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-CkNzZUqv.js";
-import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-IPS5xi9q.js";
-import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-Cx-LnIQP.js";
-import { n as supportOf, t as SupportView } from "../support-view-CVOJJLpc.js";
-import { a as sessionStatus, c as refreshSession, i as clearSessionCookies, n as SessionStatus, r as SessionStatusOptions, s as RefreshOutcome, t as ClearSessionCookiesOptions } from "../ended-XjeGQ5XW.js";
+import { b as DbError, f as Result } from "../result-Cj3yWhjH.js";
+import { a as AnyModels, i as AnyFunctions, z as TableKey } from "../types-YfwpIE-d.js";
+import { lt as SupportEventData, wt as Events } from "../events-CTreRrgP.js";
+import { m as RequestContext } from "../plugin-CDLJRFFg.js";
+import { E as writeSession, S as readSession, a as ResolveAuthOptions, c as resolveAuth, d as CookieRecord, g as StoredSession, i as InvalidReason, l as AUTH_CACHE_HEADERS, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as clientIp, t as AuthResolution, u as CookieOptions, w as sessionCookieName } from "../resolve-w9EpHzuM.js";
+import { n as SqlClient } from "../executor-BBHgjUJu.js";
+import { a as SessionActor, c as agentClaims, i as IDENTITY_SCOPES, l as delegationOf, n as ActorOutcome, o as SessionDelegation, r as AgentActOptions, s as actorOf, t as ActClaim } from "../actor-BAhb-d1S.js";
+import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-CEjyhV5T.js";
+import { a as AuthorizationSubject, c as defineAuthorizer, i as AuthorizationResource, n as AuthorizationOutcome, o as Authorizer, r as AuthorizationRequest, s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
+import { i as ResourcePagination } from "../resource-B4ka8dDH.js";
+import { t as StorageApi } from "../storage-api-Cx-1iWBd.js";
+import { Wt as DbStats, _ as Db, t as BetterSupabase } from "../define-DxHHbNEb.js";
+import { n as Impersonator, r as impersonatorOf, t as ImpersonationOptions } from "../impersonation-D5chOkrO.js";
+import { _ as SupportAuthorize, a as AutomationHooks, b as TicketSubject, c as ChatActionHook, d as IdentityRef, f as IdentityTarget, g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, l as DelegationPermissions, m as Subscriber, n as Approver, o as AutomationRef, p as PrincipalByIdentity, r as ApproverOf, s as ChatAction, t as ApprovalRequestRef, u as DelegationRef, v as SupportAuthorizeInput, x as defineAuthorizationHooks, y as SupportDecision } from "../authorization-hooks-DkmrnDX7.js";
+import { A as SupportApprovalQuery, B as sqlSupportStore, C as supportSessions, D as supportCookie, E as clearSupportCookie, F as SupportRequest, G as LiteDriver, H as RequestIdOptions, I as SupportRequestInput, J as deleteAccount, K as DeleteAccountOptions, L as SupportSession, M as SupportCallerClaims, N as SupportEndedBy, O as supportCookieValue, P as SupportListFilter, R as SupportSessionStore, S as SupportStartRequest, T as SupportCookieOptions, U as PRIMARY_COOKIE, V as supportClaims, W as ReplicaState, _ as SupportApi, a as ServerDbOptions, b as SupportPolicy, c as TENANT_HEADER, d as SuspendAccountOptions, f as SuspendAccountResult, g as ActiveSupport, h as suspendAccount, i as ServerContext, j as SupportApprover, k as SqlSupportStoreOptions, l as EndSessionsResult, m as lastSignIns, n as ContextOptions, o as ServerKeys, p as endSessions, q as DeleteAccountResult, r as ForContextOptions, s as ServerOptions, t as BetterServer, u as LastSignIn, v as SupportExpireRouteOptions, w as SUPPORT_COOKIE, x as SupportSessions, y as SupportOptions, z as SupportStartInput } from "../server-types-OohhIQb2.js";
+import { a as checkAal, i as amrOf, n as AmrEntry, r as aalOf, t as Aal } from "../mfa-DtflCXEt.js";
+import { n as toSession, t as AuthSession } from "../view-Dv0A949a.js";
+import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-DiWHtYrO.js";
+import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-C7I8kLK_.js";
+import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-djtGy6bz.js";
+import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-D5S7KNFe.js";
+import { n as subjectReaders, t as SubjectReadersOptions } from "../subject-readers-fxP5wu0s.js";
+import { i as toCsv, n as csvColumns, t as CsvOptions } from "../csv-D3eKxV1T.js";
+import { i as JwsAlgorithm, n as Jwks, r as JwksOfOptions } from "../jws-35a8VhFV.js";
+import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-D2vEQVXI.js";
+import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-Dw8vKkcI.js";
+import { n as supportOf, t as SupportView } from "../support-view-BbcZR7Io.js";
+import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-nIdGCHxk.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware, SingleKeyEntry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
 import { PostgresApi } from "@supabase/server/middleware/postgres";
-//#region src/blocks/csv.d.ts
-interface CsvOptions {
-  /**
-   * The columns in order. Defaults to every key of the rows, in the order
-   * they first appear.
-   */
-  readonly columns?: readonly string[];
-  /**
-   * Prefixes a text cell that starts with `=`, `+`, `-`, `@`, a tab or a
-   * carriage return with `'`, so a spreadsheet shows it instead of running
-   * it as a formula (CSV injection). Default true.
-   */
-  readonly escapeFormulas?: boolean;
-}
-/** The columns of `rows`: every key, in the order it first appears. */
-export declare function csvColumns(rows: readonly Readonly<Record<string, unknown>>[]): string[];
-/**
- * RFC 4180 CSV with a header row and CRLF line ends. Objects and arrays are
- * written as JSON, null and undefined as empty cells.
- */
-export declare function toCsv(rows: readonly Readonly<Record<string, unknown>>[], options?: CsvOptions): string;
-//#endregion
 //#region src/server/csv.d.ts
 interface CsvResponseOptions extends CsvOptions {
   /** The download name, such as `invoices.csv`. */
@@ -62,6 +50,19 @@ export declare function csvResponse(rows: readonly Readonly<Record<string, unkno
 export declare const SERVER_EVENT_SOURCE = "/better-supabase/server";
 type AccountEventType = "account.suspended" | "account.unsuspended" | "account.deleted" | "account.sessions_ended";
 //#endregion
+//#region src/server/server.d.ts
+/**
+ * A framework adapter's server: `server` plus the adapter's own methods,
+ * without reading the lazy `env` getter. `extra` can't replace a
+ * `BetterServer` method.
+ */
+export declare function extendServer<R extends object>(server: object, extra: Omit<R, ServerKeys>): R;
+/**
+ * Server-side entry point for APIs, jobs, MCP servers and framework
+ * adapters. Holds the secrets; `betterSupabase` stays isomorphic.
+ */
+export declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
+//#endregion
 //#region src/server/adapter.d.ts
 interface HandleOptions extends MiddlewareOptions {
   /** Include error messages in problem responses. Defaults to `NODE_ENV === 'development'`. */
@@ -85,6 +86,8 @@ interface HandleOptions extends MiddlewareOptions {
 }
 /** Hands event sink sends still running to `waitUntil`; a no-op without either. */
 export declare function flushEvents(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown>, "events">, waitUntil: ((promise: Promise<unknown>) => void) | undefined): void;
+/** Runs `run`, then hands pending event sink sends to `waitUntil` even when it throws. */
+export declare function withFlush<T>(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown>, "events">, waitUntil: ((promise: Promise<unknown>) => void) | undefined, run: () => Promise<T> | T): Promise<T>;
 /** The 500 for an error a handler threw; the message only when `expose` is set. */
 export declare function unexpectedResponse(cause: unknown, options: {
   readonly instance?: string;
@@ -109,6 +112,55 @@ export declare function handle<M extends AnyModels, F extends AnyFunctions, E, C
  */
 export declare function resolveToken<C, P>(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown, C, P>, "resolve">, token: string | null | undefined): Promise<AuthState<C, P>>;
 //#endregion
+//#region src/blocks/support-sessions/events.d.ts
+/** The events of the `support-sessions` block: type to data. */
+type SupportSessionsEvents = {
+  readonly "support.started": SupportEventData;
+  readonly "support.ended": SupportEventData;
+  readonly "support.denied": SupportEventData;
+};
+/** The `support-sessions` block's event types, for its manifest and `onBlockEvent`. */
+export declare const supportSessionsEvents: Events<SupportSessionsEvents>;
+//#endregion
+//#region src/server/support-storage.d.ts
+interface SupportStorageOptions {
+  /** The service-role `supabase.storage` that serves what the target may read. */
+  readonly admin: StorageApi;
+  /** Runs as the target, such as `postgres.asUser(support.claims)`, so RLS on `storage.objects` decides. Writes need its `transaction`. */
+  readonly sql: SqlClient;
+  /** Runs as the connection-string role, such as `postgres.admin`. Writes need it to make the target the owner of what they store. */
+  readonly adminSql?: SqlClient;
+  /** The session the writes are recorded under. Writes need it. */
+  readonly session?: Pick<SupportSession, "id" | "adminId" | "targetUserId">;
+  /** Whether the session is read-only. Defaults to true. */
+  readonly readOnly?: boolean;
+}
+/**
+ * Storage for a support session, with the same `from(bucket)` file API as
+ * `supabase.storage`, so `bucket.connect()` and the blocks take it.
+ *
+ * Storage policies read `auth.uid()` from the request's token, and there is
+ * no token for the target, so reads go through Postgres as the target.
+ * `exists`, `info`, `list` and `listV2` run entirely there: the listings
+ * call the invoker-rights `storage.search` functions storage-api calls, so
+ * RLS filters each page as it would for the target's own request.
+ * `download` and the signed URLs first check there that the target may see
+ * the object, then the service client serves it. A hidden object answers
+ * like a missing one. `getPublicUrl` is built without a check, as it is
+ * built without a request.
+ *
+ * In a writable session, `upload`, `update`, `remove`, `copy` and `move`
+ * first run the row change Storage would make as the target, inside a
+ * savepoint that is rolled back, so the policies on `storage.objects`
+ * decide as for the target's own request. Then the service client writes,
+ * the admin connection makes the target the owner of the stored object,
+ * and its `user_metadata` records the session id and the admin's id. A
+ * refused dry run resolves to Storage's `403`. Signed uploads resolve to a
+ * `403` `SUPPORT_STORAGE_WRITES` error, and every write in a read-only
+ * session to a `403` `SUPPORT_READ_ONLY` error.
+ */
+export declare function supportStorage(options: SupportStorageOptions): StorageApi;
+//#endregion
 //#region src/server/entries/upstream.d.ts
 /** The `withSupabase` context keys `withBetterDb` and `withBetterPostgres` read. */
 interface SupabaseAuthContext {
@@ -149,14 +201,14 @@ export declare function withBetterPostgres<M extends AnyModels, D, F extends Any
  *
  * ```ts
  * pipeline(
- *   [withBetterSupabase(bs), withPostgresAdminClient(), withBlock('jobs', (ctx) => createJobs(ctx.postgresAdmin, queues))],
+ *   [withBetterSupabase(bs), withPostgresAdminClient(), withBlock('jobs', (ctx) => createJobs({ sql: ctx.postgresAdmin, queues }))],
  *   (req, ctx) => ctx.jobs.drainRoute({ secret, handlers })(req),
  * )
  * ```
  */
 export declare function withBlock<const Key extends string, In extends object, Service>(key: Key, create: (ctx: In) => Service): SingleKeyEntry<Key, In, Service>;
 //#endregion
-//#region src/server/entries/claims.d.ts
+//#region src/auth/claims.d.ts
 /** `jwtClaims` as `withSupabase` contributes it: the verified token's payload, or `null`. */
 export declare function jwtClaimsOf<C>(auth: AuthState<C>): (JWTClaims & C) | null;
 /** `userClaims` as `withSupabase` contributes it, or `null` without a user. */
@@ -169,6 +221,75 @@ export declare function userClaimsOf(auth: AuthState): UserClaims | null;
  */
 export declare function authModeOf(auth: AuthState): AuthMode;
 //#endregion
+//#region src/core/jwks-cache.d.ts
+/** Where a key set comes from: inline, a URL fetched and cached, or a loader. */
+type JwksInput = Jwks | URL | (() => Promise<Jwks>);
+interface JwksSourceOptions extends JwksOfOptions {
+  /** How long a fetched key set is used before it is fetched again. Default: 300. */
+  readonly cacheSeconds?: number;
+  /** The least time between two fetches for an unknown `kid`. Default: 30. */
+  readonly refetchSeconds?: number;
+  readonly fetch?: typeof fetch;
+  /** Epoch milliseconds. */
+  readonly now?: () => number;
+}
+//#endregion
+//#region src/auth/access-token.d.ts
+/**
+ * Checks whether an access token was revoked, by its `jti` or by the grant it
+ * was issued under. `createOAuthServer` from `better-supabase/blocks/oauth-server`
+ * has this shape.
+ */
+interface AccessTokenRevocation {
+  isRevoked(jti: string, grantId: string | undefined): PromiseLike<Result<boolean>>;
+}
+interface AccessTokenResolverOptions {
+  /** The authorization server's keys: inline, a JWKS URL (cached), or a loader. */
+  readonly jwks: JwksInput;
+  /** The `iss` the tokens must carry, compared exactly. */
+  readonly issuer: string | readonly string[];
+  /** This resource server's identifier; the token's `aud` must contain it. */
+  readonly audience: string | readonly string[];
+  /** The `alg` values accepted. Default: `RS256`, `PS256`, `ES256` and `EdDSA`. */
+  readonly algorithms?: readonly JwsAlgorithm[];
+  /** Seconds of clock skew allowed on `exp`, `nbf` and `iat`. Default: 30. */
+  readonly clockSkew?: number;
+  /**
+   * The Postgres role queries run as, which the token's `role` must match
+   * when it has one. Default: `authenticated`.
+   */
+  readonly role?: string;
+  /** Checked on every request after the signature; a failure answers 401. */
+  readonly revocation?: AccessTokenRevocation;
+  /** The claim with the grant id `revocation` receives. Default: `grant_id`. */
+  readonly grantClaim?: string;
+  /**
+   * Extra claims for a verified token, such as a tenant read from a custom
+   * claim. Claims the token carries keep their values.
+   */
+  readonly claims?: (payload: Readonly<Record<string, unknown>>) => Readonly<Record<string, unknown>>;
+  /** How the JWKS is cached when `jwks` is a URL or a loader. */
+  readonly cache?: Pick<JwksSourceOptions, "cacheSeconds" | "refetchSeconds">;
+  readonly fetch?: typeof fetch;
+  /** Epoch milliseconds. */
+  readonly now?: () => number;
+}
+/**
+ * Resolves an OAuth 2.0 access token in the JWT format of RFC 9068, issued
+ * by an authorization server the app trusts, to a `user` auth state with
+ * `source: "oauth"`. Its claims keep `sub`, `client_id` and `scope`, so
+ * queries run as the user under RLS and the access functions narrow the
+ * token to the permissions its scopes map to.
+ *
+ * Only `Authorization: Bearer` tokens with the `typ` header `at+jwt` are
+ * claimed; others fall through to the next resolver and the Supabase token
+ * check. A claimed token that fails a check answers 401, never anon.
+ *
+ * `ctx.supabase` forwards the token to PostgREST, which accepts it only
+ * when the issuer is registered as Supabase third-party auth.
+ */
+export declare function accessTokenResolver(options: AccessTokenResolverOptions): AuthResolver;
+//#endregion
 //#region src/auth/revocation.d.ts
 /** A client that can read `auth.sessions`, such as `createPostgres().admin`. */
 interface SessionLookup {
@@ -192,6 +313,53 @@ export declare function checkSession(sql: SessionLookup, auth: {
   readonly kind: string;
 }): Promise<DbError | undefined>;
 //#endregion
+//#region src/core/ratelimit-headers.d.ts
+/**
+ * The `RateLimit` and `RateLimit-Policy` response fields of
+ * draft-ietf-httpapi-ratelimit-headers (`SPEC_PINS.ratelimitHeaders`), as
+ * RFC 9651 Structured Fields Lists.
+ */
+/** One quota policy in `RateLimit-Policy`. */
+interface RateLimitPolicy {
+  /** Printable ASCII; the `RateLimit` item names the policy with it. */
+  readonly name: string;
+  /** The quota: requests (or `unit`) allowed per window. */
+  readonly quota: number;
+  /** The window in whole seconds, greater than zero. */
+  readonly window?: number;
+  readonly unit?: "requests" | "content-bytes" | "concurrent-requests";
+}
+/** The quota left under one policy, for `RateLimit`. */
+interface RateLimitState {
+  readonly policy: string;
+  readonly remaining: number;
+  /** Seconds until the quota is restored. */
+  readonly reset?: number;
+}
+/** Whether `name` can be a policy name: printable ASCII only (RFC 9651 § 3.3.3). */
+export declare function isRateLimitPolicyName(name: string): boolean;
+/** The `RateLimit-Policy` value for `policies`. */
+export declare function rateLimitPolicyHeader(policies: readonly RateLimitPolicy[]): string;
+/** The `RateLimit` value for `states`. */
+export declare function rateLimitHeader(states: readonly RateLimitState[]): string;
+/**
+ * Whole seconds in a period of `count unit` (`1 minute`, `30 seconds`,
+ * `2 hours`) or a number of seconds; `undefined` for any other interval.
+ */
+export declare function periodSeconds(period: number | string): number | undefined;
+//#endregion
+//#region src/server/resource.d.ts
+/**
+ * Operations over one table, matching the paths and responses of the API
+ * model: `GET/POST /<table>`, `GET/PATCH/DELETE /<table>/{id}` and each
+ * action's path. Shared by the HTTP adapters and the MCP table tools.
+ *
+ * With permissions, the authorizer decides before the repository runs:
+ * `get`, `update` and `delete` fetch the row first (under RLS) and pass it
+ * as the resource's properties, and `list` keeps only the rows it grants.
+ */
+export declare function defineResource<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>, Ref = string, DbT = unknown>(betterSupabase: BetterSupabase<M, D, F, E>, table: T, options?: ResourceRouteOptions<M, T, NoInfer<Ref>, DbT>, authorizer?: Authorizer<Ref>): ResourceHandler<Ref>;
+//#endregion
 //#region src/server/entries/timing.d.ts
 /** The header `withDbStats` sets: `calls;waves;ms`, what `expectDbBudget` reads. */
 export declare const DB_CALLS_HEADER = "x-bs-db-calls";
@@ -225,4 +393,4 @@ export declare function withDbStats(options?: {
   };
 }, () => DbStats>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizeOptions, type AuthorizedContext, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, aalOf, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, createServer, defineResource, deleteAccount, endSessions, extendServer, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, type Aal, type AccessTokenResolverOptions, type AccessTokenRevocation, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type ActorOutcome, type AgentActOptions, type AmrEntry, type AnyAuthorizer, type ApprovalRequestRef, type Approver, type ApproverOf, type AuthKind, type AuthOutageHook, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationHooks, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type AutomationHooks, type AutomationRef, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ChatAction, type ChatActionHook, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DelegationPermissions, type DelegationRef, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, IDENTITY_SCOPES, type IdentityRef, type IdentityTarget, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PermissionRef, type PrincipalByIdentity, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RateLimitPolicy, type RateLimitState, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SubjectReadersOptions, type Subscriber, type SubscriberEvent, type SubscriberPolicy, type SupabaseAuthContext, type SupportApi, type SupportApprovalQuery, type SupportApprover, type SupportAuthorize, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportDecision, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportRequest, type SupportRequestInput, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportSessionsEvents, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, type TicketSubject, aalOf, actorOf, agentClaims, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, csvColumns, defineAuthorizationHooks, defineAuthorizer, delegationOf, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, subjectReaders, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };