better-supabase 0.8.0 → 0.9.0

package/dist/server/index.d.ts

@@ -1,51 +1,35 @@
-import { b as DbError } from "../result-BchM1XZn.js";
-import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-CoE5Zwy4.js";
-import { t as SqlClient } from "../executor-ngjKL_Pe.js";
-import { m as RequestContext } from "../plugin-CPK2HsbY.js";
-import { _ as writeSession, a as CookieWrite, c as StoredSession, h as sessionCookieName, n as CookieOptions, p as readSession, r as CookieRecord, t as AUTH_CACHE_HEADERS } from "../session-ChiXDZdZ.js";
-import { a as ResolveAuthOptions, c as resolveAuth, i as InvalidReason, n as AuthResolver, o as ResolvedState, r as AuthState, s as clientIp, t as AuthResolution } from "../resolve-MxXVWyhd.js";
-import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-TvGdxO1t.js";
+import { b as DbError, f as Result } from "../result-Cj3yWhjH.js";
+import { a as AnyModels, i as AnyFunctions, z as TableKey } from "../types-YfwpIE-d.js";
+import { lt as SupportEventData, wt as Events } from "../events-CTreRrgP.js";
+import { m as RequestContext } from "../plugin-CDLJRFFg.js";
+import { E as writeSession, S as readSession, a as ResolveAuthOptions, c as resolveAuth, d as CookieRecord, g as StoredSession, i as InvalidReason, l as AUTH_CACHE_HEADERS, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as clientIp, t as AuthResolution, u as CookieOptions, w as sessionCookieName } from "../resolve-w9EpHzuM.js";
+import { n as SqlClient } from "../executor-BBHgjUJu.js";
+import { a as SessionActor, c as agentClaims, i as IDENTITY_SCOPES, l as delegationOf, n as ActorOutcome, o as SessionDelegation, r as AgentActOptions, s as actorOf, t as ActClaim } from "../actor-BAhb-d1S.js";
+import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-CEjyhV5T.js";
 import { a as AuthorizationSubject, c as defineAuthorizer, i as AuthorizationResource, n as AuthorizationOutcome, o as Authorizer, r as AuthorizationRequest, s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
-import { i as ResourcePagination } from "../resource--vTrBe6I.js";
-import { t as StorageApi } from "../storage-api-CB7Zl1Ci.js";
-import { Wt as DbStats, _ as Db, t as BetterSupabase } from "../define-DmcfoNXB.js";
-import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-SZc9YYyb.js";
-import { A as SUPPORT_COOKIE, B as SupportSessionStore, C as SupportAuthorizeInput, D as SupportSessions, E as SupportPolicy, F as SqlSupportStoreOptions, G as LiteDriver, H as sqlSupportStore, I as SupportCallerClaims, L as SupportEndedBy, M as clearSupportCookie, N as supportCookie, O as SupportStartRequest, P as supportCookieValue, R as SupportListFilter, S as SupportApi, T as SupportOptions, U as supportClaims, V as SupportStartInput, W as RequestIdOptions, _ as ReplicaState, a as ServerDbOptions, b as deleteAccount, c as TENANT_HEADER, d as SuspendAccountOptions, f as SuspendAccountResult, g as PRIMARY_COOKIE, h as suspendAccount, i as ServerContext, j as SupportCookieOptions, k as supportSessions, l as EndSessionsResult, m as lastSignIns, n as ContextOptions, o as ServerKeys, p as endSessions, r as ForContextOptions, s as ServerOptions, t as BetterServer, u as LastSignIn, v as DeleteAccountOptions, w as SupportExpireRouteOptions, x as ActiveSupport, y as DeleteAccountResult, z as SupportSession } from "../server-types-CrAmZ8jv.js";
-import { n as SessionActor, r as SessionDelegation, t as ActClaim } from "../actor-CQTlc1Hh.js";
-import { n as toSession, t as AuthSession } from "../view-TpXEUcVN.js";
-import { a as SessionEntryConfig, c as withGuard, i as withBetterSupabase, l as ServerCore, n as BetterSupabaseContributions, o as withSession, r as BetterSupabaseEntry, s as GuardEntryConfig, t as BetterSupabaseConfig, u as serverCore } from "../composite-CWAJTRBF.js";
-import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-Cw-zanCm.js";
-import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-W99LCPBS.js";
-import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-CqB6GWGT.js";
-import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-BO9LjtWG.js";
-import { n as supportOf, t as SupportView } from "../support-view-scqMgtOo.js";
-import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-CcvcRqEd.js";
+import { i as ResourcePagination } from "../resource-B4ka8dDH.js";
+import { t as StorageApi } from "../storage-api-Cx-1iWBd.js";
+import { Wt as DbStats, _ as Db, t as BetterSupabase } from "../define-DxHHbNEb.js";
+import { n as Impersonator, r as impersonatorOf, t as ImpersonationOptions } from "../impersonation-D5chOkrO.js";
+import { _ as SupportAuthorize, a as AutomationHooks, b as TicketSubject, c as ChatActionHook, d as IdentityRef, f as IdentityTarget, g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, l as DelegationPermissions, m as Subscriber, n as Approver, o as AutomationRef, p as PrincipalByIdentity, r as ApproverOf, s as ChatAction, t as ApprovalRequestRef, u as DelegationRef, v as SupportAuthorizeInput, x as defineAuthorizationHooks, y as SupportDecision } from "../authorization-hooks-DkmrnDX7.js";
+import { A as SupportApprovalQuery, B as sqlSupportStore, C as supportSessions, D as supportCookie, E as clearSupportCookie, F as SupportRequest, G as LiteDriver, H as RequestIdOptions, I as SupportRequestInput, J as deleteAccount, K as DeleteAccountOptions, L as SupportSession, M as SupportCallerClaims, N as SupportEndedBy, O as supportCookieValue, P as SupportListFilter, R as SupportSessionStore, S as SupportStartRequest, T as SupportCookieOptions, U as PRIMARY_COOKIE, V as supportClaims, W as ReplicaState, _ as SupportApi, a as ServerDbOptions, b as SupportPolicy, c as TENANT_HEADER, d as SuspendAccountOptions, f as SuspendAccountResult, g as ActiveSupport, h as suspendAccount, i as ServerContext, j as SupportApprover, k as SqlSupportStoreOptions, l as EndSessionsResult, m as lastSignIns, n as ContextOptions, o as ServerKeys, p as endSessions, q as DeleteAccountResult, r as ForContextOptions, s as ServerOptions, t as BetterServer, u as LastSignIn, v as SupportExpireRouteOptions, w as SUPPORT_COOKIE, x as SupportSessions, y as SupportOptions, z as SupportStartInput } from "../server-types-OohhIQb2.js";
+import { a as checkAal, i as amrOf, n as AmrEntry, r as aalOf, t as Aal } from "../mfa-DtflCXEt.js";
+import { n as toSession, t as AuthSession } from "../view-Dv0A949a.js";
+import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-DiWHtYrO.js";
+import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-C7I8kLK_.js";
+import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-djtGy6bz.js";
+import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-D5S7KNFe.js";
+import { n as subjectReaders, t as SubjectReadersOptions } from "../subject-readers-fxP5wu0s.js";
+import { i as toCsv, n as csvColumns, t as CsvOptions } from "../csv-D3eKxV1T.js";
+import { i as JwsAlgorithm, n as Jwks, r as JwksOfOptions } from "../jws-35a8VhFV.js";
+import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-D2vEQVXI.js";
+import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-Dw8vKkcI.js";
+import { n as supportOf, t as SupportView } from "../support-view-BbcZR7Io.js";
+import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-nIdGCHxk.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware, SingleKeyEntry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
 import { PostgresApi } from "@supabase/server/middleware/postgres";
-//#region src/core/csv.d.ts
-interface CsvOptions {
-  /**
-   * The columns in order. Defaults to every key of the rows, in the order
-   * they first appear.
-   */
-  readonly columns?: readonly string[];
-  /**
-   * Prefixes a text cell that starts with `=`, `+`, `-`, `@`, a tab or a
-   * carriage return with `'`, so a spreadsheet shows it instead of running
-   * it as a formula (CSV injection). Default true.
-   */
-  readonly escapeFormulas?: boolean;
-}
-/** The columns of `rows`: every key, in the order it first appears. */
-export declare function csvColumns(rows: readonly Readonly<Record<string, unknown>>[]): string[];
-/**
- * RFC 4180 CSV with a header row and CRLF line ends. Objects and arrays are
- * written as JSON, null and undefined as empty cells.
- */
-export declare function toCsv(rows: readonly Readonly<Record<string, unknown>>[], options?: CsvOptions): string;
-//#endregion
 //#region src/server/csv.d.ts
 interface CsvResponseOptions extends CsvOptions {
   /** The download name, such as `invoices.csv`. */
@@ -128,12 +112,26 @@ export declare function handle<M extends AnyModels, F extends AnyFunctions, E, C
  */
 export declare function resolveToken<C, P>(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown, C, P>, "resolve">, token: string | null | undefined): Promise<AuthState<C, P>>;
 //#endregion
+//#region src/blocks/support-sessions/events.d.ts
+/** The events of the `support-sessions` block: type to data. */
+type SupportSessionsEvents = {
+  readonly "support.started": SupportEventData;
+  readonly "support.ended": SupportEventData;
+  readonly "support.denied": SupportEventData;
+};
+/** The `support-sessions` block's event types, for its manifest and `onBlockEvent`. */
+export declare const supportSessionsEvents: Events<SupportSessionsEvents>;
+//#endregion
 //#region src/server/support-storage.d.ts
 interface SupportStorageOptions {
   /** The service-role `supabase.storage` that serves what the target may read. */
   readonly admin: StorageApi;
-  /** Runs as the target, such as `postgres.asUser(support.claims)`, so RLS on `storage.objects` decides. */
+  /** Runs as the target, such as `postgres.asUser(support.claims)`, so RLS on `storage.objects` decides. Writes need its `transaction`. */
   readonly sql: SqlClient;
+  /** Runs as the connection-string role, such as `postgres.admin`. Writes need it to make the target the owner of what they store. */
+  readonly adminSql?: SqlClient;
+  /** The session the writes are recorded under. Writes need it. */
+  readonly session?: Pick<SupportSession, "id" | "adminId" | "targetUserId">;
   /** Whether the session is read-only. Defaults to true. */
   readonly readOnly?: boolean;
 }
@@ -151,11 +149,15 @@ interface SupportStorageOptions {
  * like a missing one. `getPublicUrl` is built without a check, as it is
  * built without a request.
  *
- * Writes resolve to a `403` error: `SUPPORT_READ_ONLY` in a read-only
- * session and `SUPPORT_STORAGE_WRITES` in a writable one. The service client
- * would store the object with no owner, and Storage never sees the session's
- * `act` claim, so the write could be neither attributed to the target nor
- * audited as the admin's.
+ * In a writable session, `upload`, `update`, `remove`, `copy` and `move`
+ * first run the row change Storage would make as the target, inside a
+ * savepoint that is rolled back, so the policies on `storage.objects`
+ * decide as for the target's own request. Then the service client writes,
+ * the admin connection makes the target the owner of the stored object,
+ * and its `user_metadata` records the session id and the admin's id. A
+ * refused dry run resolves to Storage's `403`. Signed uploads resolve to a
+ * `403` `SUPPORT_STORAGE_WRITES` error, and every write in a read-only
+ * session to a `403` `SUPPORT_READ_ONLY` error.
  */
 export declare function supportStorage(options: SupportStorageOptions): StorageApi;
 //#endregion
@@ -199,7 +201,7 @@ export declare function withBetterPostgres<M extends AnyModels, D, F extends Any
  *
  * ```ts
  * pipeline(
- *   [withBetterSupabase(bs), withPostgresAdminClient(), withBlock('jobs', (ctx) => createJobs(ctx.postgresAdmin, queues))],
+ *   [withBetterSupabase(bs), withPostgresAdminClient(), withBlock('jobs', (ctx) => createJobs({ sql: ctx.postgresAdmin, queues }))],
  *   (req, ctx) => ctx.jobs.drainRoute({ secret, handlers })(req),
  * )
  * ```
@@ -219,6 +221,75 @@ export declare function userClaimsOf(auth: AuthState): UserClaims | null;
  */
 export declare function authModeOf(auth: AuthState): AuthMode;
 //#endregion
+//#region src/core/jwks-cache.d.ts
+/** Where a key set comes from: inline, a URL fetched and cached, or a loader. */
+type JwksInput = Jwks | URL | (() => Promise<Jwks>);
+interface JwksSourceOptions extends JwksOfOptions {
+  /** How long a fetched key set is used before it is fetched again. Default: 300. */
+  readonly cacheSeconds?: number;
+  /** The least time between two fetches for an unknown `kid`. Default: 30. */
+  readonly refetchSeconds?: number;
+  readonly fetch?: typeof fetch;
+  /** Epoch milliseconds. */
+  readonly now?: () => number;
+}
+//#endregion
+//#region src/auth/access-token.d.ts
+/**
+ * Checks whether an access token was revoked, by its `jti` or by the grant it
+ * was issued under. `createOAuthServer` from `better-supabase/blocks/oauth-server`
+ * has this shape.
+ */
+interface AccessTokenRevocation {
+  isRevoked(jti: string, grantId: string | undefined): PromiseLike<Result<boolean>>;
+}
+interface AccessTokenResolverOptions {
+  /** The authorization server's keys: inline, a JWKS URL (cached), or a loader. */
+  readonly jwks: JwksInput;
+  /** The `iss` the tokens must carry, compared exactly. */
+  readonly issuer: string | readonly string[];
+  /** This resource server's identifier; the token's `aud` must contain it. */
+  readonly audience: string | readonly string[];
+  /** The `alg` values accepted. Default: `RS256`, `PS256`, `ES256` and `EdDSA`. */
+  readonly algorithms?: readonly JwsAlgorithm[];
+  /** Seconds of clock skew allowed on `exp`, `nbf` and `iat`. Default: 30. */
+  readonly clockSkew?: number;
+  /**
+   * The Postgres role queries run as, which the token's `role` must match
+   * when it has one. Default: `authenticated`.
+   */
+  readonly role?: string;
+  /** Checked on every request after the signature; a failure answers 401. */
+  readonly revocation?: AccessTokenRevocation;
+  /** The claim with the grant id `revocation` receives. Default: `grant_id`. */
+  readonly grantClaim?: string;
+  /**
+   * Extra claims for a verified token, such as a tenant read from a custom
+   * claim. Claims the token carries keep their values.
+   */
+  readonly claims?: (payload: Readonly<Record<string, unknown>>) => Readonly<Record<string, unknown>>;
+  /** How the JWKS is cached when `jwks` is a URL or a loader. */
+  readonly cache?: Pick<JwksSourceOptions, "cacheSeconds" | "refetchSeconds">;
+  readonly fetch?: typeof fetch;
+  /** Epoch milliseconds. */
+  readonly now?: () => number;
+}
+/**
+ * Resolves an OAuth 2.0 access token in the JWT format of RFC 9068, issued
+ * by an authorization server the app trusts, to a `user` auth state with
+ * `source: "oauth"`. Its claims keep `sub`, `client_id` and `scope`, so
+ * queries run as the user under RLS and the access functions narrow the
+ * token to the permissions its scopes map to.
+ *
+ * Only `Authorization: Bearer` tokens with the `typ` header `at+jwt` are
+ * claimed; others fall through to the next resolver and the Supabase token
+ * check. A claimed token that fails a check answers 401, never anon.
+ *
+ * `ctx.supabase` forwards the token to PostgREST, which accepts it only
+ * when the issuer is registered as Supabase third-party auth.
+ */
+export declare function accessTokenResolver(options: AccessTokenResolverOptions): AuthResolver;
+//#endregion
 //#region src/auth/revocation.d.ts
 /** A client that can read `auth.sessions`, such as `createPostgres().admin`. */
 interface SessionLookup {
@@ -242,6 +313,41 @@ export declare function checkSession(sql: SessionLookup, auth: {
   readonly kind: string;
 }): Promise<DbError | undefined>;
 //#endregion
+//#region src/core/ratelimit-headers.d.ts
+/**
+ * The `RateLimit` and `RateLimit-Policy` response fields of
+ * draft-ietf-httpapi-ratelimit-headers (`SPEC_PINS.ratelimitHeaders`), as
+ * RFC 9651 Structured Fields Lists.
+ */
+/** One quota policy in `RateLimit-Policy`. */
+interface RateLimitPolicy {
+  /** Printable ASCII; the `RateLimit` item names the policy with it. */
+  readonly name: string;
+  /** The quota: requests (or `unit`) allowed per window. */
+  readonly quota: number;
+  /** The window in whole seconds, greater than zero. */
+  readonly window?: number;
+  readonly unit?: "requests" | "content-bytes" | "concurrent-requests";
+}
+/** The quota left under one policy, for `RateLimit`. */
+interface RateLimitState {
+  readonly policy: string;
+  readonly remaining: number;
+  /** Seconds until the quota is restored. */
+  readonly reset?: number;
+}
+/** Whether `name` can be a policy name: printable ASCII only (RFC 9651 § 3.3.3). */
+export declare function isRateLimitPolicyName(name: string): boolean;
+/** The `RateLimit-Policy` value for `policies`. */
+export declare function rateLimitPolicyHeader(policies: readonly RateLimitPolicy[]): string;
+/** The `RateLimit` value for `states`. */
+export declare function rateLimitHeader(states: readonly RateLimitState[]): string;
+/**
+ * Whole seconds in a period of `count unit` (`1 minute`, `30 seconds`,
+ * `2 hours`) or a number of seconds; `undefined` for any other interval.
+ */
+export declare function periodSeconds(period: number | string): number | undefined;
+//#endregion
 //#region src/server/resource.d.ts
 /**
  * Operations over one table, matching the paths and responses of the API
@@ -287,4 +393,4 @@ export declare function withDbStats(options?: {
   };
 }, () => DbStats>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type AmrEntry, type AnyAuthorizer, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PermissionRef, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, aalOf, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, defineAuthorizer, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, type Aal, type AccessTokenResolverOptions, type AccessTokenRevocation, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type ActorOutcome, type AgentActOptions, type AmrEntry, type AnyAuthorizer, type ApprovalRequestRef, type Approver, type ApproverOf, type AuthKind, type AuthOutageHook, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationHooks, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type AutomationHooks, type AutomationRef, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ChatAction, type ChatActionHook, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DelegationPermissions, type DelegationRef, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, IDENTITY_SCOPES, type IdentityRef, type IdentityTarget, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PermissionRef, type PrincipalByIdentity, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RateLimitPolicy, type RateLimitState, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SubjectReadersOptions, type Subscriber, type SubscriberEvent, type SubscriberPolicy, type SupabaseAuthContext, type SupportApi, type SupportApprovalQuery, type SupportApprover, type SupportAuthorize, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportDecision, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportRequest, type SupportRequestInput, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportSessionsEvents, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, type TicketSubject, aalOf, actorOf, agentClaims, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, csvColumns, defineAuthorizationHooks, defineAuthorizer, delegationOf, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, subjectReaders, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };

package/dist/server/index.js

@@ -1,23 +1,31 @@
-import { n as dbError } from "../errors-2M6CKMP4.js";
-import { i as isProblem, n as PROBLEM_TYPE_BASE, o as problemResponse, r as fromProblem, s as toProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-CJvFeGu7.js";
-import { i as userContext, r as impersonatorOf } from "../impersonation-DcqaTBHx.js";
+import { n as dbError } from "../errors-8i6tSICm.js";
+import { a as ok, r as err } from "../result-BlgnMB0H.js";
+import { n as isRecord } from "../guards-6F2bCtQR.js";
+import { t as base64ToText } from "../base64-BmeCBgGo.js";
+import { c as toProblem, i as isProblem, n as PROBLEM_TYPE_BASE, o as problemResponse, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-pIiL3WbE.js";
+import { i as delegationOf, n as actorOf, r as agentClaims, t as IDENTITY_SCOPES } from "../actor-KHDOKGb1.js";
+import { i as userContext, r as impersonatorOf } from "../impersonation-CDeCzZP6.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { n as toCsv, t as csvColumns } from "../csv-BZnHA1Py.js";
-import { n as postgresExecutor } from "../executor-B_Hfobee.js";
-import { D as lastSignIns, E as endSessions, O as suspendAccount, S as shouldRefresh, T as SERVER_EVENT_SOURCE, a as unexpectedResponse, b as refreshFor, c as extendServer, d as clearSupportCookie, f as supportCookie, h as TENANT_HEADER, i as resolveToken, k as deleteAccount, l as supportStorage, m as supportCookieValue, n as flushEvents, o as withFlush, r as handle, s as createServer, u as SUPPORT_COOKIE, v as withSession, w as serverCore, x as shouldCheckSession, y as isPrefetch } from "../adapter-CN45ibbV.js";
-import { n as PRIMARY_COOKIE } from "../replicas-CwrYp5Zj.js";
-import { t as authContext } from "../context-nPDvQ-Zl.js";
-import { a as clearSessionCookies, f as readSession, g as writeSession, i as refreshSession, m as sessionCookieName, o as sessionStatus, r as resolveAuth, s as AUTH_CACHE_HEADERS, t as clientIp } from "../resolve-Bvgf3ut_.js";
-import { a as checkAal, i as amrOf, n as toSession, r as aalOf } from "../view-D5ryq3gz.js";
-import { a as respond, i as isResult, o as settle, r as guard } from "../respond-volM3ByS.js";
-import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-D1pFFouF.js";
+import { r as toCsv, t as csvColumns } from "../csv-CVfXqaAu.js";
+import { A as suspendAccount, C as shouldRefresh, D as SERVER_EVENT_SOURCE, E as defineAuthorizationHooks, O as endSessions, S as shouldCheckSession, T as serverCore, a as unexpectedResponse, b as isPrefetch, c as extendServer, d as clearSupportCookie, f as supportCookie, h as TENANT_HEADER, i as resolveToken, j as deleteAccount, k as lastSignIns, l as supportStorage, m as supportCookieValue, n as flushEvents, o as withFlush, r as handle, s as createServer, u as SUPPORT_COOKIE, x as refreshFor, y as withSession } from "../adapter-CEjmtazZ.js";
+import { n as PRIMARY_COOKIE } from "../replicas-BvIL4_jL.js";
+import { t as authContext } from "../context-BDDgjoxz.js";
+import { _ as writeSession, a as clearSessionCookies, h as sessionCookieName, i as refreshSession, o as sessionStatus, p as readSession, r as resolveAuth, s as AUTH_CACHE_HEADERS, t as clientIp } from "../resolve-CAR9oaKW.js";
+import { a as checkAal, i as amrOf, n as toSession, r as aalOf } from "../view-DZ63nqwt.js";
+import { a as respond, i as isResult, o as settle, r as guard } from "../respond-DdhZ9Wbn.js";
+import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-BsKkvA92.js";
+import { n as event, t as defineEvents } from "../event-map-Dy2vKHai.js";
+import { t as subjectReaders } from "../subject-readers-DiePmaYP.js";
+import { t as postgresExecutor } from "../executor-D1kYY5BA.js";
 import { n as jwtClaimsOf, r as userClaimsOf, t as authModeOf } from "../claims-0KZVT804.js";
-import { n as withGuard, t as withBetterSupabase } from "../composite-zTe0TCqj.js";
-import { r as defineAuthorizer } from "../authorizer-ayxUDXXP.js";
-import { t as defineResource } from "../resource-DA811u_4.js";
-import { i as withServerTiming, n as parseDbStats, r as withDbStats, t as DB_CALLS_HEADER } from "../timing-CyTQPubY.js";
+import { n as withGuard, t as withBetterSupabase } from "../composite-M6zPs1Xm.js";
+import { a as jwksOf, c as verifyCompact, t as JwsError } from "../jws-milwSg7E.js";
+import { i as rateLimitPolicyHeader, n as periodSeconds, r as rateLimitHeader, t as isRateLimitPolicyName } from "../ratelimit-headers-Bsxx0Tj2.js";
+import { r as defineAuthorizer } from "../authorizer-DH7DjkL3.js";
+import { t as defineResource } from "../resource-C8r5xGqY.js";
+import { i as withServerTiming, n as parseDbStats, r as withDbStats, t as DB_CALLS_HEADER } from "../timing-BMCWgpdZ.js";
 import { n as tagCache, r as tagFor, t as cacheTagsOf } from "../tags-B99_U9Pp.js";
-import { a as rolesAt, r as hasRole } from "../kit-BhHr9T9v.js";
+import { a as rolesAt, r as hasRole } from "../kit-MUK34-ZG.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/server/csv.ts
 function disposition(filename) {
@@ -40,6 +48,14 @@ function csvResponse(rows, options) {
 	return response;
 }
 //#endregion
+//#region src/blocks/support-sessions/events.ts
+/** The `support-sessions` block's event types, for its manifest and `onBlockEvent`. */
+const supportSessionsEvents = defineEvents({
+	"support.started": event(),
+	"support.ended": event(),
+	"support.denied": event()
+});
+//#endregion
 //#region src/server/entries/upstream.ts
 /** Repository context from a `@supabase/server` context. */
 function contextFromSupabase(ctx) {
@@ -108,7 +124,7 @@ function withBetterPostgres(betterSupabase) {
 *
 * ```ts
 * pipeline(
-*   [withBetterSupabase(bs), withPostgresAdminClient(), withBlock('jobs', (ctx) => createJobs(ctx.postgresAdmin, queues))],
+*   [withBetterSupabase(bs), withPostgresAdminClient(), withBlock('jobs', (ctx) => createJobs({ sql: ctx.postgresAdmin, queues }))],
 *   (req, ctx) => ctx.jobs.drainRoute({ secret, handlers })(req),
 * )
 * ```
@@ -120,6 +136,265 @@ function withBlock(key, create) {
 	})();
 }
 //#endregion
+//#region src/core/jwks-cache.ts
+/** The most bytes read from a JWKS response. */
+const MAX_JWKS_BYTES = 262144;
+/**
+* A cached key set. A URL is fetched on first use and again after
+* `cacheSeconds`; a refresh for an unknown `kid` refetches at most once per
+* `refetchSeconds`, so a stream of forged `kid`s can't hammer the issuer.
+* Concurrent callers share one fetch.
+*/
+function jwksSource(input, options = {}) {
+	const parse = (value) => jwksOf(value, options.rsa === void 0 ? {} : { rsa: options.rsa });
+	if (!(input instanceof URL) && typeof input !== "function") {
+		const keys = parse(input);
+		return () => Promise.resolve(ok(keys));
+	}
+	const now = options.now ?? Date.now;
+	const cacheMs = (options.cacheSeconds ?? 300) * 1e3;
+	const refetchMs = (options.refetchSeconds ?? 30) * 1e3;
+	let cached;
+	let pending;
+	const load = async () => {
+		if (typeof input === "function") return ok(parse(await input()));
+		const response = await (options.fetch ?? fetch)(input, { headers: { accept: "application/jwk-set+json, application/json" } });
+		if (!response.ok) return err(dbError("network", `The JWKS answered ${response.status}`, { code: "JWKS_FETCH_FAILED" }));
+		const text = await response.text();
+		if (text.length > MAX_JWKS_BYTES) return err(dbError("network", "The JWKS response is too large", { code: "JWKS_FETCH_FAILED" }));
+		return ok(parse(JSON.parse(text)));
+	};
+	return async (refresh) => {
+		const age = cached ? now() - cached.at : Number.POSITIVE_INFINITY;
+		if (cached && age < (refresh ? refetchMs : cacheMs)) return ok(cached.keys);
+		pending ??= load().catch((cause) => err(dbError("network", `The JWKS could not be loaded: ${cause instanceof Error ? cause.message : String(cause)}`, { code: "JWKS_FETCH_FAILED" }))).then((result) => {
+			if (result.ok) cached = {
+				keys: result.data,
+				at: now()
+			};
+			return result;
+		}).finally(() => {
+			pending = void 0;
+		});
+		const result = await pending;
+		return !result.ok && cached ? ok(cached.keys) : result;
+	};
+}
+//#endregion
+//#region src/auth/access-token.ts
+const RESERVED = /* @__PURE__ */ new Set([
+	"iss",
+	"sub",
+	"aud",
+	"exp",
+	"iat",
+	"jti",
+	"client_id",
+	"scope",
+	"role"
+]);
+const TYPES = /* @__PURE__ */ new Set(["at+jwt", "application/at+jwt"]);
+const BEARER = /^Bearer\s+([\w.~+/-]+=*)\s*$/i;
+const MEMO_SIZE = 256;
+function headerOf(token) {
+	const part = token.split(".", 1)[0];
+	if (!part || token.split(".").length !== 3) return;
+	try {
+		const value = JSON.parse(base64ToText(part));
+		return isRecord(value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+/** Whether the token says it is an RFC 9068 access token (`typ: at+jwt`). */
+function isAccessTokenJwt(token) {
+	const typ = headerOf(token)?.["typ"];
+	return typeof typ === "string" && TYPES.has(typ.toLowerCase());
+}
+function invalid(code, message) {
+	return {
+		kind: "invalid",
+		reason: "token",
+		error: dbError("unauthorized", message, { code })
+	};
+}
+function listOf(value) {
+	return typeof value === "string" ? [value] : value;
+}
+function text(value) {
+	return typeof value === "string" && value !== "" ? value : void 0;
+}
+/** RFC 9068 section 4: the claims a resource server checks. */
+function checkClaims(payload, options, now) {
+	const fail = (code, message) => ({
+		ok: false,
+		state: invalid(code, message)
+	});
+	const skew = options.clockSkew ?? 30;
+	const { exp, nbf, iat } = payload;
+	if (!listOf(options.issuer).includes(String(payload["iss"]))) return fail("ACCESS_TOKEN_ISSUER", "The access token issuer is not trusted");
+	const aud = payload["aud"];
+	const audiences = Array.isArray(aud) ? aud : [aud];
+	if (!listOf(options.audience).some((wanted) => audiences.includes(wanted))) return fail("ACCESS_TOKEN_AUDIENCE", "The access token is not for this resource server");
+	if (typeof exp !== "number") return fail("ACCESS_TOKEN_INVALID", "The access token has no exp claim");
+	if (exp + skew <= now) return fail("ACCESS_TOKEN_EXPIRED", "The access token has expired");
+	if (typeof nbf === "number" && nbf - skew > now) return fail("ACCESS_TOKEN_INVALID", "The access token is not valid yet");
+	if (typeof iat !== "number" || iat - skew > now) return fail("ACCESS_TOKEN_INVALID", "The access token has no iat claim, or one in the future");
+	for (const claim of [
+		"sub",
+		"client_id",
+		"jti"
+	]) if (text(payload[claim]) === void 0) return fail("ACCESS_TOKEN_INVALID", `The access token has no ${claim} claim`);
+	const scope = payload["scope"];
+	if (scope !== void 0 && typeof scope !== "string") return fail("ACCESS_TOKEN_INVALID", "The access token scope is not a string");
+	const role = options.role ?? "authenticated";
+	if (payload["role"] !== void 0 && payload["role"] !== role) return fail("ACCESS_TOKEN_ROLE", `The access token role must be ${role} when it is set`);
+	if (payload["cnf"] !== void 0) return fail("ACCESS_TOKEN_BOUND", "Sender-constrained access tokens (cnf) are not accepted as bearer tokens");
+	return {
+		ok: true,
+		payload
+	};
+}
+function verifiedOf(payload, options) {
+	const extra = Object.entries(options.claims?.(payload) ?? {}).filter(([name]) => !RESERVED.has(name));
+	const role = options.role ?? "authenticated";
+	const sub = String(payload["sub"]);
+	const claims = {
+		...Object.fromEntries(extra),
+		...payload,
+		role
+	};
+	return {
+		claims,
+		user: {
+			id: sub,
+			role,
+			...typeof claims.email === "string" ? { email: claims.email } : {}
+		},
+		expiresAt: Number(payload["exp"]),
+		jti: String(payload["jti"]),
+		grantId: text(payload[options.grantClaim ?? "grant_id"])
+	};
+}
+function bearerOf(request) {
+	return BEARER.exec(request.headers.get("authorization") ?? "")?.[1];
+}
+function revocationError(error) {
+	return {
+		kind: "invalid",
+		reason: "token",
+		error: dbError(error.kind === "network" ? "network" : "unexpected", `The revocation list could not be checked: ${error.message}`, { code: "ACCESS_TOKEN_REVOCATION_UNAVAILABLE" })
+	};
+}
+/**
+* Resolves an OAuth 2.0 access token in the JWT format of RFC 9068, issued
+* by an authorization server the app trusts, to a `user` auth state with
+* `source: "oauth"`. Its claims keep `sub`, `client_id` and `scope`, so
+* queries run as the user under RLS and the access functions narrow the
+* token to the permissions its scopes map to.
+*
+* Only `Authorization: Bearer` tokens with the `typ` header `at+jwt` are
+* claimed; others fall through to the next resolver and the Supabase token
+* check. A claimed token that fails a check answers 401, never anon.
+*
+* `ctx.supabase` forwards the token to PostgREST, which accepts it only
+* when the issuer is registered as Supabase third-party auth.
+*/
+function accessTokenResolver(options) {
+	if (listOf(options.issuer).length === 0) throw new TypeError("accessTokenResolver: issuer is required");
+	if (listOf(options.audience).length === 0) throw new TypeError("accessTokenResolver: audience is required");
+	const algorithms = options.algorithms ?? [
+		"RS256",
+		"PS256",
+		"ES256",
+		"EdDSA"
+	];
+	const rsa = algorithms.some((alg) => alg === "RS256" || alg === "PS256");
+	const keys = jwksSource(options.jwks, {
+		rsa,
+		...options.cache,
+		...options.fetch ? { fetch: options.fetch } : {},
+		...options.now ? { now: options.now } : {}
+	});
+	const memo = /* @__PURE__ */ new Map();
+	const seconds = () => Math.floor((options.now ?? Date.now)() / 1e3);
+	const verify = async (token) => {
+		const now = seconds();
+		const hit = memo.get(token);
+		if (hit) {
+			memo.delete(token);
+			if (hit.expiresAt + (options.clockSkew ?? 30) > now) {
+				memo.set(token, hit);
+				return {
+					ok: true,
+					verified: hit
+				};
+			}
+		}
+		let payload;
+		for (const refresh of [false, true]) {
+			const set = await keys(refresh);
+			if (!set.ok) return {
+				ok: false,
+				state: {
+					kind: "invalid",
+					reason: "token",
+					error: set.error
+				}
+			};
+			try {
+				({payload} = await verifyCompact(token, set.data, { algorithms }));
+				break;
+			} catch (cause) {
+				if (!(cause instanceof JwsError)) throw cause;
+				if (cause.code !== "JWS_KEY" || refresh) return {
+					ok: false,
+					state: invalid("ACCESS_TOKEN_INVALID", cause.message)
+				};
+			}
+		}
+		if (payload === void 0) return {
+			ok: false,
+			state: invalid("ACCESS_TOKEN_INVALID", "No key verifies the access token")
+		};
+		const checked = checkClaims(payload, options, now);
+		if (!checked.ok) return checked;
+		const verified = verifiedOf(checked.payload, options);
+		memo.set(token, verified);
+		if (memo.size > MEMO_SIZE) memo.delete(memo.keys().next().value);
+		return {
+			ok: true,
+			verified
+		};
+	};
+	return {
+		name: "oauth-access-token",
+		async resolve(request) {
+			const token = bearerOf(request);
+			if (token === void 0 || !isAccessTokenJwt(token)) return;
+			const outcome = await verify(token);
+			if (!outcome.ok) return outcome.state;
+			const { verified } = outcome;
+			if (options.revocation) {
+				const revoked = await options.revocation.isRevoked(verified.jti, verified.grantId);
+				if (!revoked.ok) return revocationError(revoked.error);
+				if (revoked.data) {
+					memo.delete(token);
+					return invalid("ACCESS_TOKEN_REVOKED", "The access token was revoked");
+				}
+			}
+			return {
+				kind: "user",
+				token,
+				claims: verified.claims,
+				user: verified.user,
+				source: "oauth",
+				expiresAt: verified.expiresAt
+			};
+		}
+	};
+}
+//#endregion
 //#region src/auth/revocation.ts
 const UUID = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
 const ACTIVE = `select exists (
@@ -136,7 +411,7 @@ const ACTIVE = `select exists (
 * by default. Non-user callers pass: `guard` decides about them.
 */
 async function checkSession(sql, auth) {
-	if (auth.kind !== "user" || !("claims" in auth)) return void 0;
+	if (auth.kind !== "user" || !("claims" in auth)) return;
 	const { sub, session_id: sessionId } = auth.claims;
 	const revoked = dbError("unauthorized", "This session has ended", { code: "SESSION_REVOKED" });
 	if (typeof sessionId !== "string" || typeof sub !== "string" || !UUID.test(sessionId) || !UUID.test(sub)) return revoked;
@@ -144,4 +419,4 @@ async function checkSession(sql, auth) {
 	return row?.active === true ? void 0 : revoked;
 }
 //#endregion
-export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, amrOf, authContext, authModeOf, cacheTagsOf, checkAal, checkSession, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, csvColumns, csvResponse, defineAuthorizer, defineResource, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, jwtClaimsOf, lastSignIns, parseDbStats, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, resolveToken, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, supportStorage, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withFlush, withGuard, withServerTiming, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, IDENTITY_SCOPES, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, accessTokenResolver, actorOf, agentClaims, amrOf, authContext, authModeOf, cacheTagsOf, checkAal, checkSession, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, csvColumns, csvResponse, defineAuthorizationHooks, defineAuthorizer, defineResource, delegationOf, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonatorOf, isPrefetch, isProblem, isRateLimitPolicyName, isResult, jwtClaimsOf, lastSignIns, parseDbStats, periodSeconds, problemResponse, rateLimitHeader, rateLimitPolicyHeader, readSession, refreshFor, refreshSession, resolveAuth, resolveToken, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, subjectReaders, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, supportSessionsEvents, supportStorage, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withFlush, withGuard, withServerTiming, withSession, writeSession };