better-supabase 0.8.0 → 0.10.0

package/dist/resolve-CAR9oaKW.js

@@ -0,0 +1,869 @@
+import { n as dbError } from "./errors-8i6tSICm.js";
+import { t as consoleLogger } from "./logger-glM28NVN.js";
+import { n as decodeJwtPayload, r as fromBase64, t as base64ToText } from "./base64-BmeCBgGo.js";
+import { a as invalidActorError, n as actorOf } from "./actor-KHDOKGb1.js";
+import { DEFAULT_COOKIE_OPTIONS, createChunks, isChunkLike, parseCookieHeader, serializeCookieHeader, stringFromBase64URL, stringToBase64URL } from "@supabase/ssr";
+import { extractCredentials, verifyCredentials } from "@supabase/server/core";
+//#region src/auth/session.ts
+const DEFAULT_SESSION_ENCODING = "user-and-tokens";
+const BASE64_PREFIX = "base64-";
+/** Headers that keep responses carrying session cookies out of shared caches. */
+const AUTH_CACHE_HEADERS = {
+	"Cache-Control": "private, no-cache, no-store, must-revalidate, max-age=0",
+	Expires: "0",
+	Pragma: "no-cache"
+};
+/** `sb-<first label of the hostname>-auth-token`, the supabase-js default. */
+function sessionCookieName(url) {
+	let name = cookieNames.get(url);
+	if (name === void 0) {
+		name = `sb-${new URL(url).hostname.split(".")[0] ?? ""}-auth-token`;
+		if (cookieNames.size < 16) cookieNames.set(url, name);
+	}
+	return name;
+}
+/** Project URLs come from configuration, so a handful of entries suffice. */
+const cookieNames = /* @__PURE__ */ new Map();
+function parseCookies(header) {
+	return header ? parseCookieHeader(header) : [];
+}
+function serializeCookie(write) {
+	return serializeCookieHeader(write.name, write.value, write.options);
+}
+/** Cookie values by name, per parsed cookie list: one request reads its session more than once. */
+const cookieMaps = /* @__PURE__ */ new WeakMap();
+function byNameOf(cookies) {
+	let byName = cookieMaps.get(cookies);
+	if (!byName) {
+		byName = new Map(cookies.map((cookie) => [cookie.name, cookie.value]));
+		cookieMaps.set(cookies, byName);
+	}
+	return byName;
+}
+function parseSession(raw) {
+	try {
+		const json = raw.startsWith(BASE64_PREFIX) ? stringFromBase64URL(raw.slice(7)) : raw;
+		const parsed = JSON.parse(json);
+		return isStoredSession(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+const readParts = /* @__PURE__ */ new WeakMap();
+/**
+* The whole cookie, else the `.0`, `.1`, ... chunks. When the joined chunks
+* don't parse (a stale `.2` left by a longer session), the longest prefix
+* that parses wins, so one leftover chunk never signs the user out.
+*/
+function readSessionParts(cookies, name) {
+	let memo = readParts.get(cookies);
+	const known = memo?.get(name);
+	if (known) return known;
+	const byName = byNameOf(cookies);
+	let result = {
+		session: null,
+		used: []
+	};
+	const whole = byName.get(name);
+	if (whole) result = {
+		session: parseSession(whole),
+		used: [name]
+	};
+	else {
+		const parts = [];
+		for (let index = 0;; index++) {
+			const part = byName.get(`${name}.${index}`);
+			if (!part) break;
+			parts.push(part);
+		}
+		for (let length = parts.length; length > 0; length--) {
+			const session = parseSession(parts.slice(0, length).join(""));
+			if (session) {
+				result = {
+					session,
+					used: Array.from({ length }, (_, index) => `${name}.${index}`)
+				};
+				break;
+			}
+		}
+	}
+	if (!memo) {
+		memo = /* @__PURE__ */ new Map();
+		readParts.set(cookies, memo);
+	}
+	memo.set(name, result);
+	return result;
+}
+function isStoredSession(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const session = value;
+	return typeof session["access_token"] === "string" && typeof session["refresh_token"] === "string";
+}
+/**
+* Reads the session written by `@supabase/ssr` (plain or `base64-`, whole or
+* chunked, `user-and-tokens` or `tokens-only`). Trailing chunks a shorter
+* session no longer uses are ignored; chunks that never form a session read
+* as no session.
+*/
+function readSession(cookies, name) {
+	return readSessionParts(cookies, name).session;
+}
+/**
+* `Max-Age=0` writes for the session's chunk-like cookies that the readable
+* session doesn't use: a leftover `.2` after a shorter rewrite, chunks next
+* to a whole cookie, or chunks past a gap. Empty when no session reads.
+*/
+function pruneSessionChunks(cookies, name, options = {}) {
+	const { session, used } = readSessionParts(cookies, name);
+	if (!session) return [];
+	const kept = new Set(used);
+	const base = {
+		...DEFAULT_COOKIE_OPTIONS,
+		...options
+	};
+	return cookies.filter((cookie) => isChunkLike(cookie.name, name) && !kept.has(cookie.name)).map((cookie) => ({
+		name: cookie.name,
+		value: "",
+		options: {
+			...base,
+			maxAge: 0
+		}
+	}));
+}
+/** The encoding a stored session was written with: `tokens-only` without a `user`. */
+function sessionEncoding(session) {
+	return session.user === void 0 || session.user === null ? "tokens-only" : "user-and-tokens";
+}
+function encoded(session, encode) {
+	switch (encode) {
+		case "user-and-tokens": return JSON.stringify(session);
+		case "tokens-only": {
+			const { user: _user, ...tokens } = session;
+			return JSON.stringify(tokens);
+		}
+		default: return encode;
+	}
+}
+/**
+* Cookie writes that store `session` (or clear it with `null`) exactly like
+* `@supabase/ssr` with the same `encode`, and expire chunks the new value no
+* longer uses.
+*/
+function writeSession(existing, name, session, options = {}, { encode = DEFAULT_SESSION_ENCODING } = {}) {
+	const base = {
+		...DEFAULT_COOKIE_OPTIONS,
+		...options
+	};
+	const chunks = session ? createChunks(name, BASE64_PREFIX + stringToBase64URL(encoded(session, encode))) : [];
+	const kept = new Set(chunks.map((chunk) => chunk.name));
+	return [...existing.filter((cookie) => isChunkLike(cookie.name, name) && !kept.has(cookie.name)).map((cookie) => ({
+		name: cookie.name,
+		value: "",
+		options: {
+			...base,
+			maxAge: 0
+		}
+	})), ...chunks.map((chunk) => ({
+		name: chunk.name,
+		value: chunk.value,
+		options: base
+	}))];
+}
+/**
+* `Max-Age=0` writes for every chunk of the session cookie at each of
+* `scopes`, like `clearAuthCookiesAtScopes` from `@supabase/ssr`. Use it once
+* the cookie `domain` or `path` changed, for the scopes earlier deploys
+* wrote: browsers ignore writes for scopes the host doesn't own, but a scope
+* equal to the current one clears the live session.
+*/
+function clearSessionAtScopes(existing, name, scopes) {
+	if (scopes.length === 0) return [];
+	const chunks = existing.map((cookie) => cookie.name).filter((cookie) => isChunkLike(cookie, name));
+	return scopes.flatMap((scope) => {
+		const options = {
+			...DEFAULT_COOKIE_OPTIONS,
+			...scope.domain === void 0 ? {} : { domain: scope.domain },
+			...scope.path === void 0 ? {} : { path: scope.path },
+			maxAge: 0
+		};
+		return chunks.map((chunk) => ({
+			name: chunk,
+			value: "",
+			options
+		}));
+	});
+}
+/** Applies cookie writes to a cookie list, as the next request would see it. */
+function applyCookieWrites(cookies, writes) {
+	const next = new Map(cookies.map((cookie) => [cookie.name, cookie.value]));
+	for (const write of writes) if (write.options.maxAge === 0) next.delete(write.name);
+	else next.set(write.name, write.value);
+	return [...next].map(([name, value]) => ({
+		name,
+		value
+	}));
+}
+//#endregion
+//#region src/auth/ended.ts
+const DEFAULT_TIMEOUT_MS$1 = 5e3;
+function accessTokenOf(request, options) {
+	const bearer = extractCredentials(request).token;
+	if (bearer) return bearer;
+	return readSession(parseCookies(request.headers.get("cookie")), options.cookieName ?? sessionCookieName(options.url))?.access_token;
+}
+async function sessionStatus(input, options) {
+	const token = typeof input === "string" ? input : accessTokenOf(input, options);
+	if (!token) return "unknown";
+	const exp = decodeJwtPayload(token)?.["exp"];
+	if (typeof exp === "number" && exp * 1e3 <= (options.now ?? Date.now)()) return "unknown";
+	const doFetch = options.fetch ?? fetch;
+	try {
+		const response = await doFetch(`${options.url}/auth/v1/user`, {
+			headers: {
+				apikey: options.publishableKey,
+				authorization: `Bearer ${token}`
+			},
+			signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS$1)
+		});
+		if (response.status === 401 || response.status === 403) return (await response.json().catch(() => null))?.["error_code"] === "user_banned" ? "banned" : "ended";
+		await response.body?.cancel();
+		return response.ok ? "active" : "unknown";
+	} catch {
+		return "unknown";
+	}
+}
+function clearSessionCookies(request, response, options) {
+	const writes = writeSession(parseCookies(request.headers.get("cookie")), options.cookieName ?? sessionCookieName(options.url), null, options.cookie);
+	if (writes.length === 0) return response;
+	for (const write of writes) response.headers.append("set-cookie", serializeCookie(write));
+	for (const [key, value] of Object.entries(AUTH_CACHE_HEADERS)) response.headers.set(key, value);
+	return response;
+}
+//#endregion
+//#region src/auth/hs256.ts
+const encoder = /* @__PURE__ */ new TextEncoder();
+/** The most HMAC keys kept at once; the oldest goes first. */
+const KEYS_SIZE = 64;
+const keys = /* @__PURE__ */ new Map();
+function keyFor(secret) {
+	let key = keys.get(secret);
+	if (!key) {
+		key = crypto.subtle.importKey("raw", encoder.encode(secret), {
+			name: "HMAC",
+			hash: "SHA-256"
+		}, false, ["verify"]);
+		keys.set(secret, key);
+		if (keys.size > KEYS_SIZE) {
+			const oldest = keys.keys().next();
+			if (!oldest.done) keys.delete(oldest.value);
+		}
+	}
+	return key;
+}
+function parseJson(part) {
+	try {
+		const parsed = JSON.parse(base64ToText(part));
+		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Whether the token is HS256 without a `kid`, the shape Supabase Lite (and
+* legacy shared-secret projects) issue.
+*/
+function isSharedSecretToken(token) {
+	const part = token.split(".", 1)[0];
+	const header = part ? parseJson(part) : void 0;
+	return header?.["alg"] === "HS256" && header["kid"] === void 0;
+}
+function fail(message) {
+	return {
+		ok: false,
+		code: "INVALID_JWT",
+		message
+	};
+}
+function matches(claim, expected) {
+	const wanted = typeof expected === "string" ? [expected] : expected;
+	return (Array.isArray(claim) ? claim : [claim]).some((value) => typeof value === "string" && wanted.includes(value));
+}
+/**
+* Verifies an HS256 user token against a shared secret with WebCrypto:
+* the signature, `exp`, `nbf`, and `aud` and `iss` when they are given.
+*/
+async function verifyHs256(token, secret, options) {
+	const parts = token.split(".");
+	const [encodedHeader, encodedPayload, encodedSignature] = parts;
+	if (parts.length !== 3 || !encodedHeader || !encodedPayload || encodedSignature === void 0) return fail("The token is not a JWT");
+	if (parseJson(encodedHeader)?.["alg"] !== "HS256") return fail("The token is not signed with HS256");
+	let signature;
+	try {
+		signature = fromBase64(encodedSignature);
+	} catch {
+		return fail("The token signature is not base64url");
+	}
+	if (!await crypto.subtle.verify("HMAC", await keyFor(secret), signature, encoder.encode(`${encodedHeader}.${encodedPayload}`))) return fail("The token signature does not match the JWT secret");
+	const payload = parseJson(encodedPayload);
+	if (!payload) return fail("The token payload is not a JSON object");
+	const { exp, nbf, sub } = payload;
+	if (typeof exp === "number" && exp <= options.now) return fail("The token has expired");
+	if (typeof nbf === "number" && nbf > options.now) return fail("The token is not valid yet");
+	if (options.audience !== void 0 && !matches(payload["aud"], options.audience)) return fail("The token audience does not match");
+	if (options.issuer !== void 0 && !matches(payload["iss"], options.issuer)) return fail("The token issuer does not match");
+	if (typeof sub !== "string") return fail("The token has no sub claim, so it identifies no user");
+	const claims = payload;
+	return {
+		ok: true,
+		claims,
+		user: {
+			id: sub,
+			...typeof claims.role === "string" ? { role: claims.role } : {},
+			...typeof claims.email === "string" ? { email: claims.email } : {},
+			...claims.app_metadata ? { appMetadata: claims.app_metadata } : {},
+			...claims.user_metadata ? { userMetadata: claims.user_metadata } : {}
+		}
+	};
+}
+//#endregion
+//#region src/auth/refresh.ts
+/**
+* How long a finished refresh is reused for requests still carrying the old
+* refresh token (parallel page loads, prefetches). Matches the default
+* refresh-token reuse interval of Supabase Auth.
+*/
+const REUSE_MS = 1e4;
+const DEFAULT_TIMEOUT_MS = 5e3;
+/** Finished refreshes kept for reuse; a burst of sign-ins can't grow it past this. */
+const RECENT_MAX = 1e3;
+const inflight = /* @__PURE__ */ new Map();
+const recent = /* @__PURE__ */ new Map();
+function shared(outcome) {
+	return outcome.ok ? {
+		...outcome,
+		shared: true
+	} : outcome;
+}
+function prune(now) {
+	for (const [token, entry] of recent) {
+		if (entry.until > now) return;
+		recent.delete(token);
+	}
+}
+async function request(refreshToken, options, now) {
+	const doFetch = options.fetch ?? fetch;
+	const signal = AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+	let response;
+	try {
+		response = await doFetch(`${options.url}/auth/v1/token?grant_type=refresh_token`, {
+			method: "POST",
+			headers: {
+				apikey: options.forwardedFor?.secretKey ?? options.publishableKey,
+				"content-type": "application/json",
+				...options.forwardedFor ? { "sb-forwarded-for": options.forwardedFor.ip } : {}
+			},
+			body: JSON.stringify({ refresh_token: refreshToken }),
+			signal
+		});
+	} catch (cause) {
+		return {
+			ok: false,
+			reason: "network",
+			cause: signal.aborted ? "timeout" : "fetch",
+			message: cause instanceof Error ? cause.message : "fetch failed"
+		};
+	}
+	const body = await response.json().catch(() => null);
+	if (signal.aborted) return {
+		ok: false,
+		reason: "network",
+		cause: "timeout",
+		message: "refresh timed out"
+	};
+	if (!response.ok || !body || typeof body["access_token"] !== "string" || typeof body["refresh_token"] !== "string") {
+		const message = typeof body?.["msg"] === "string" ? body["msg"] : typeof body?.["error_description"] === "string" ? body["error_description"] : `Refresh failed with ${String(response.status)}`;
+		const outage = response.status >= 500 || response.status === 429;
+		return {
+			ok: false,
+			reason: outage ? "network" : "rejected",
+			...outage ? { cause: "status" } : {},
+			status: response.status,
+			...typeof body?.["error_code"] === "string" ? { code: body["error_code"] } : {},
+			message
+		};
+	}
+	const expiresIn = typeof body["expires_in"] === "number" ? body["expires_in"] : void 0;
+	return {
+		ok: true,
+		session: {
+			...body,
+			access_token: body["access_token"],
+			refresh_token: body["refresh_token"],
+			...typeof body["expires_at"] !== "number" && expiresIn !== void 0 ? { expires_at: Math.floor(now / 1e3) + expiresIn } : {}
+		}
+	};
+}
+/**
+* Exchanges a refresh token for a new session. Concurrent calls with the same
+* token share one request, and a successful result is reused for a short
+* window so parallel requests carrying the old cookie converge on one session.
+*/
+function refreshSession(refreshToken, options) {
+	const clock = options.now ?? Date.now;
+	const now = clock();
+	prune(now);
+	const key = `${options.url}\n${refreshToken}`;
+	const cached = recent.get(key);
+	if (cached) return Promise.resolve(shared(cached.outcome));
+	const pending = inflight.get(key);
+	if (pending) return pending.then(shared);
+	const promise = request(refreshToken, options, now).then((outcome) => {
+		if (outcome.ok || outcome.reason === "rejected") {
+			recent.delete(key);
+			recent.set(key, {
+				outcome,
+				until: clock() + REUSE_MS
+			});
+			if (recent.size > RECENT_MAX) {
+				const oldest = recent.keys().next();
+				if (!oldest.done) recent.delete(oldest.value);
+			}
+		}
+		return outcome;
+	}).finally(() => {
+		inflight.delete(key);
+	});
+	inflight.set(key, promise);
+	return promise;
+}
+//#endregion
+//#region src/auth/resolve.ts
+function expiryOf(session) {
+	if (typeof session.expires_at === "number") return session.expires_at;
+	const exp = decodeJwtPayload(session.access_token)?.["exp"];
+	return typeof exp === "number" ? exp : void 0;
+}
+function serverEnv(options) {
+	const { env } = options;
+	return {
+		url: env.url,
+		publishableKeys: { default: env.publishableKey },
+		secretKeys: env.secretKeys ?? (env.secretKey ? { default: env.secretKey } : {}),
+		jwks: options.jwks ?? env.jwks ?? env.jwksUrl
+	};
+}
+const MEMO_SIZE = 256;
+const memoByUrl = /* @__PURE__ */ new Map();
+let memoByJwks = /* @__PURE__ */ new WeakMap();
+/** The most JWT secrets remembered at once; the oldest goes first. */
+const SECRET_IDS_SIZE = 64;
+/** A number per JWT secret, so memo keys tell secrets apart. Bounded, and never reuses a number. */
+const secretIds = /* @__PURE__ */ new Map();
+let nextSecretId = 1;
+function secretId(secret) {
+	if (secret === void 0) return null;
+	let id = secretIds.get(secret);
+	if (id === void 0) {
+		id = nextSecretId++;
+		secretIds.set(secret, id);
+		if (secretIds.size > SECRET_IDS_SIZE) {
+			const oldest = secretIds.keys().next();
+			if (!oldest.done) secretIds.delete(oldest.value);
+		}
+	}
+	return id;
+}
+/**
+* Tokens that already verified, until they expire. Every private-cache scope
+* and island resolves the same token again; this skips the signature check.
+* A hit skips the audience and issuer checks too, so both are part of the key.
+*/
+function memoFor(options) {
+	const jwks = options.jwks ?? options.env.jwks;
+	const inline = jwks && typeof jwks === "object" && !(jwks instanceof URL);
+	const key = JSON.stringify([
+		inline ? null : String(jwks ?? options.env.jwksUrl),
+		options.env.url,
+		options.audience ?? null,
+		options.issuer ?? null,
+		secretId(options.jwtSecret)
+	]);
+	if (inline) {
+		let byKey = memoByJwks.get(jwks);
+		if (!byKey) memoByJwks.set(jwks, byKey = /* @__PURE__ */ new Map());
+		let memo = byKey.get(key);
+		if (!memo) byKey.set(key, memo = /* @__PURE__ */ new Map());
+		return memo;
+	}
+	let memo = memoByUrl.get(key);
+	if (!memo) memoByUrl.set(key, memo = /* @__PURE__ */ new Map());
+	return memo;
+}
+function remembered(memo, token, now) {
+	const hit = memo.get(token);
+	if (!hit) return;
+	memo.delete(token);
+	if (hit.expiresAt === null || hit.expiresAt <= now) return;
+	memo.set(token, hit);
+	return hit;
+}
+const NO_SCHEMA = {};
+const checkedByMemo = /* @__PURE__ */ new WeakMap();
+/**
+* Tokens that already passed (or failed) the claims and `userMetadata`
+* schemas, per verification memo and schema pair, so a memo hit skips
+* validation too.
+*/
+function checkedFor(memo, options) {
+	const claims = options.claims ?? NO_SCHEMA;
+	const metadata = options.userMetadata ?? NO_SCHEMA;
+	let byClaims = checkedByMemo.get(memo);
+	if (!byClaims) checkedByMemo.set(memo, byClaims = /* @__PURE__ */ new WeakMap());
+	let byMetadata = byClaims.get(claims);
+	if (!byMetadata) byClaims.set(claims, byMetadata = /* @__PURE__ */ new WeakMap());
+	let checked = byMetadata.get(metadata);
+	if (!checked) byMetadata.set(metadata, checked = /* @__PURE__ */ new Map());
+	return checked;
+}
+function withoutSource(state) {
+	if (state.kind !== "user") return state;
+	const { source: _source, ...rest } = state;
+	return rest;
+}
+function remember(memo, token, user, expiresAt) {
+	if (expiresAt === null) return;
+	memo.set(token, user);
+	if (memo.size > MEMO_SIZE) memo.delete(memo.keys().next().value);
+}
+async function verify(credentials, modes, options, source) {
+	const token = modes.length === 1 && modes[0] === "user" && credentials.token;
+	const memo = token ? memoFor(options) : void 0;
+	if (token && memo) {
+		const hit = remembered(memo, token, Math.floor((options.now ?? Date.now)() / 1e3));
+		if (hit) {
+			const checked = checkedFor(memo, options);
+			const known = checked.get(token);
+			if (known) return known.kind === "user" ? {
+				...known,
+				source
+			} : known;
+			const state = await checkUser({
+				...hit,
+				source
+			}, options);
+			remember(checked, token, withoutSource(state), hit.expiresAt);
+			return state;
+		}
+	}
+	const state = await verifyOnce(credentials, modes, options, source);
+	if (token && memo && state.kind === "user") remember(memo, token, {
+		kind: "user",
+		token: state.token,
+		claims: state.claims,
+		user: state.user,
+		expiresAt: state.expiresAt
+	}, state.expiresAt);
+	const checked = await checkUser(state, options);
+	if (token && memo && state.kind === "user") remember(checkedFor(memo, options), token, withoutSource(checked), state.expiresAt);
+	return checked;
+}
+/** Validates a user's claims against `options.claims`, keeping every JWT claim. */
+async function checkClaims(state, options) {
+	if (state.kind !== "user") return state;
+	if (!actorOf(state.claims).ok) return {
+		kind: "invalid",
+		reason: "actor",
+		error: invalidActorError()
+	};
+	if (!options.claims) return state;
+	let outcome = options.claims["~standard"].validate(state.claims);
+	if (outcome instanceof Promise) outcome = await outcome;
+	if (outcome.issues) {
+		const issues = outcome.issues.map((issue) => {
+			const path = issue.path?.map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join(".");
+			return path ? `${path}: ${issue.message}` : issue.message;
+		}).join("; ");
+		return {
+			kind: "invalid",
+			reason: "claims",
+			error: dbError("unauthorized", `The token claims are invalid (${issues})`, { code: "CLAIMS_INVALID" })
+		};
+	}
+	const extra = outcome.value;
+	return typeof extra === "object" && extra !== null ? {
+		...state,
+		claims: {
+			...state.claims,
+			...extra
+		}
+	} : state;
+}
+const warnedMetadata = /* @__PURE__ */ new WeakSet();
+/** Claims first, then `user_metadata`, whose failure never invalidates the session. */
+async function checkUser(state, options) {
+	const checked = await checkClaims(state, options);
+	const schema = options.userMetadata;
+	if (checked.kind !== "user" || !schema) return checked;
+	const { profile: _untrusted, ...user } = checked;
+	let outcome = schema["~standard"].validate(checked.user.userMetadata ?? checked.claims.user_metadata ?? {});
+	if (outcome instanceof Promise) outcome = await outcome;
+	if (!outcome.issues) return {
+		...user,
+		profile: outcome.value
+	};
+	if (!warnedMetadata.has(schema)) {
+		warnedMetadata.add(schema);
+		(options.logger ?? consoleLogger).warn("user_metadata does not match betterSupabase.userMetadata(schema); session.profile is undefined", { paths: outcome.issues.map((issue) => issue.path?.map((segment) => typeof segment === "object" ? String(segment.key) : String(segment)).join(".") ?? "") });
+	}
+	return user;
+}
+/** A token whose `kid` matches no key: verifying it loads the JWKS and fails. */
+const PREFETCH_TOKEN = `${base64url(JSON.stringify({
+	alg: "ES256",
+	kid: "better-supabase-prefetch",
+	typ: "JWT"
+}))}.e30.AA`;
+function base64url(text) {
+	return btoa(text).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+/**
+* Loads the remote JWKS into the verifier's cache so the first request
+* doesn't wait for it. Never throws; a failure leaves the first request to
+* fetch it as before.
+*/
+function prefetchJwks(options) {
+	if (options.jwks !== void 0 || options.env.jwks !== void 0) return Promise.resolve();
+	return verifyCredentials({
+		token: PREFETCH_TOKEN,
+		apikey: null
+	}, {
+		auth: ["user"],
+		env: serverEnv(options)
+	}).then(() => {}, () => {});
+}
+async function verifyOnce(credentials, modes, options, source) {
+	const token = credentials.token;
+	if (options.jwtSecret !== void 0 && token && modes.length === 1 && modes[0] === "user" && isSharedSecretToken(token)) {
+		const verified = await verifyHs256(token, options.jwtSecret, {
+			now: Math.floor((options.now ?? Date.now)() / 1e3),
+			...options.audience === void 0 ? {} : { audience: options.audience },
+			...options.issuer === void 0 ? {} : { issuer: options.issuer }
+		});
+		if (!verified.ok) return {
+			kind: "invalid",
+			reason: "token",
+			error: dbError("unauthorized", verified.message, { code: verified.code })
+		};
+		return {
+			kind: "user",
+			token,
+			claims: verified.claims,
+			user: verified.user,
+			source,
+			expiresAt: typeof verified.claims.exp === "number" ? verified.claims.exp : null
+		};
+	}
+	const { data, error } = await verifyCredentials(credentials, {
+		auth: modes,
+		env: serverEnv(options),
+		...options.audience === void 0 ? {} : { audience: options.audience },
+		...options.issuer === void 0 ? {} : { issuer: options.issuer }
+	});
+	if (error) {
+		const kind = error.code === "JWKS_FETCH_FAILED" ? "network" : error.status >= 500 ? "unexpected" : "unauthorized";
+		return {
+			kind: "invalid",
+			reason: "token",
+			error: dbError(kind, error.message, { code: error.code })
+		};
+	}
+	if (data.authMode === "secret") return {
+		kind: "service",
+		keyName: data.keyName ?? "default"
+	};
+	if (data.authMode === "user" && data.token && data.jwtClaims && data.userClaims) return {
+		kind: "user",
+		token: data.token,
+		claims: data.jwtClaims,
+		user: data.userClaims,
+		source,
+		expiresAt: typeof data.jwtClaims.exp === "number" ? data.jwtClaims.exp : null
+	};
+	return {
+		kind: "anon",
+		reason: "none"
+	};
+}
+function resolution(auth, cookies, writes = [], ended, outage) {
+	const headers = writes.length > 0 ? AUTH_CACHE_HEADERS : {};
+	let requestCookies;
+	return {
+		auth,
+		...ended ? {
+			sessionEnded: true,
+			sessionEndedReason: ended
+		} : {},
+		...outage ? { outage } : {},
+		cookies: writes,
+		headers,
+		/** Parsed on first read: bearer requests rarely need their cookies. */
+		get requestCookies() {
+			requestCookies ??= writes.length > 0 ? applyCookieWrites(cookies(), writes) : cookies();
+			return requestCookies;
+		},
+		apply(response) {
+			if (writes.length === 0) return response;
+			let target = response;
+			try {
+				for (const write of writes) target.headers.append("set-cookie", serializeCookie(write));
+			} catch {
+				target = new Response(response.body, response);
+				for (const write of writes) target.headers.append("set-cookie", serializeCookie(write));
+			}
+			for (const [name, value] of Object.entries(headers)) target.headers.set(name, value);
+			return target;
+		}
+	};
+}
+const IP = /^[0-9a-f:.]+$/i;
+/**
+* The last `x-forwarded-for` hop, the one your own edge appended. Hops to its
+* left come from the client and can be forged. Behind more than one proxy,
+* pass your own reader to `clientIp`.
+*/
+function clientIp(request) {
+	const last = request.headers.get("x-forwarded-for")?.split(",").at(-1)?.trim();
+	return last && IP.test(last) ? last : void 0;
+}
+/**
+* Resolves who is calling: custom resolvers, then `Authorization: Bearer`
+* (APIs, MCP, mobile), then the `@supabase/ssr` session cookie (browsers).
+*
+* A valid token costs no network call: it is verified locally against the
+* cached JWKS. An expiring cookie session is refreshed only when `refresh` is
+* set, through a single-flight request, and only then are cookies written.
+*/
+async function resolveAuth(request, options) {
+	let parsed;
+	const cookies = () => parsed ??= parseCookies(request.headers.get("cookie"));
+	for (const resolver of options.resolvers ?? []) {
+		const state = await resolver.resolve(request);
+		if (!state) continue;
+		return resolution(state.kind === "invalid" ? {
+			kind: "invalid",
+			reason: state.reason ?? "token",
+			error: state.error
+		} : await checkUser(state, options), cookies);
+	}
+	const credentials = extractCredentials(request);
+	if (credentials.token) return resolution(await verify({
+		token: credentials.token,
+		apikey: null
+	}, ["user"], options, "bearer"), cookies);
+	if (options.secret && credentials.apikey?.startsWith("sb_secret_")) return resolution(await verify({
+		token: null,
+		apikey: credentials.apikey
+	}, options.secret === true ? ["secret"] : options.secret.map((name) => `secret:${name}`), options, "bearer"), cookies);
+	if (options.cookies === false) return resolution({
+		kind: "anon",
+		reason: "none"
+	}, cookies);
+	const name = options.cookie?.name ?? sessionCookieName(options.env.url);
+	const encoding = options.cookie?.encode === void 0 ? {} : { encode: options.cookie.encode };
+	const session = readSession(cookies(), name);
+	if (!session) {
+		const stale = cookies().some((cookie) => cookie.name === name || cookie.name.startsWith(`${name}.`));
+		const writes = stale && options.refresh ? writeSession(cookies(), name, null, options.cookie?.options, encoding) : [];
+		return resolution({
+			kind: "anon",
+			reason: stale ? "signed_out" : "none"
+		}, cookies, writes);
+	}
+	const pruned = options.refresh && options.pruneChunks !== false ? pruneSessionChunks(cookies(), name, options.cookie?.options) : [];
+	const now = Math.floor((options.now ?? Date.now)() / 1e3);
+	const expiry = expiryOf(session);
+	const leeway = options.refresh ? options.leeway ?? 60 : 0;
+	const fresh = expiry !== void 0 && expiry - leeway > now;
+	if (fresh) {
+		const state = await verify({
+			token: session.access_token,
+			apikey: null
+		}, ["user"], options, "cookie");
+		const status = state.kind === "user" && options.checkSession ? await sessionStatus(state.token, {
+			url: options.env.url,
+			publishableKey: options.env.publishableKey,
+			...options.fetch ? { fetch: options.fetch } : {},
+			...options.refreshTimeoutMs === void 0 ? {} : { timeoutMs: options.refreshTimeoutMs },
+			...options.now ? { now: options.now } : {}
+		}) : void 0;
+		if (status === "ended" || status === "banned") return resolution({
+			kind: "anon",
+			reason: "signed_out"
+		}, cookies, options.refresh ? writeSession(cookies(), name, null, options.cookie?.options, encoding) : [], status);
+		if (state.kind !== "invalid" || state.reason !== "token" || state.error.kind === "network") return resolution(state, cookies, pruned);
+		if (!options.refresh) return resolution({
+			kind: "anon",
+			reason: "signed_out"
+		}, cookies);
+	} else if (!options.refresh) return resolution({
+		kind: "anon",
+		reason: "expired"
+	}, cookies);
+	const secretKey = options.env.secretKey;
+	const ip = secretKey && options.clientIp !== false ? (options.clientIp ?? clientIp)(request) : void 0;
+	const started = performance.now();
+	const outcome = await refreshSession(session.refresh_token, {
+		url: options.env.url,
+		publishableKey: options.env.publishableKey,
+		...secretKey && ip ? { forwardedFor: {
+			ip,
+			secretKey
+		} } : {},
+		...options.fetch ? { fetch: options.fetch } : {},
+		...options.now ? { now: options.now } : {},
+		...options.refreshTimeoutMs === void 0 ? {} : { timeoutMs: options.refreshTimeoutMs }
+	});
+	const durationMs = performance.now() - started;
+	options.onRefresh?.({
+		ok: outcome.ok,
+		shared: outcome.ok && outcome.shared === true,
+		durationMs,
+		...outcome.ok ? {} : {
+			reason: outcome.reason,
+			...outcome.status === void 0 ? {} : { status: outcome.status },
+			...outcome.code === void 0 ? {} : { code: outcome.code }
+		}
+	});
+	if (!outcome.ok) {
+		if (outcome.reason === "network") {
+			const outage = (kept) => ({
+				cause: outcome.cause === "timeout" ? "timeout" : outcome.cause === "status" ? "status" : "network",
+				...outcome.status === void 0 ? {} : { status: outcome.status },
+				kept,
+				durationMs
+			});
+			if (!fresh && expiry !== void 0 && expiry > now) {
+				const state = await verify({
+					token: session.access_token,
+					apikey: null
+				}, ["user"], options, "cookie");
+				if (state.kind !== "invalid") return resolution(state, cookies, pruned, void 0, outage(true));
+			}
+			return resolution({
+				kind: "anon",
+				reason: "refresh_failed"
+			}, cookies, pruned, void 0, outage(false));
+		}
+		return resolution({
+			kind: "anon",
+			reason: "signed_out"
+		}, cookies, writeSession(cookies(), name, null, options.cookie?.options, encoding), outcome.code === "user_banned" ? "banned" : void 0);
+	}
+	const writes = writeSession(cookies(), name, outcome.session, options.cookie?.options, encoding);
+	return resolution(await verify({
+		token: outcome.session.access_token,
+		apikey: null
+	}, ["user"], options, "cookie"), cookies, writes);
+}
+//#endregion
+export { writeSession as _, clearSessionCookies as a, DEFAULT_SESSION_ENCODING as c, parseCookies as d, pruneSessionChunks as f, sessionEncoding as g, sessionCookieName as h, refreshSession as i, applyCookieWrites as l, serializeCookie as m, prefetchJwks as n, sessionStatus as o, readSession as p, resolveAuth as r, AUTH_CACHE_HEADERS as s, clientIp as t, clearSessionAtScopes as u };