better-supabase 0.8.0 → 0.9.0

package/dist/sql-DJrXG-3Z.js

@@ -0,0 +1,422 @@
+import { t as MAX_AFFECTED_MARKER } from "./errors-8i6tSICm.js";
+import { n as invalidRequest } from "./build-Cx08LOT7.js";
+import { t as lookupOf } from "./lookup-BaP5bI27.js";
+import { n as simplifyOrFalse } from "./simplify-DDO0j0LI.js";
+import { n as whereClause, t as integer } from "./shared-DbO3Dfms.js";
+//#region src/compile/sql.ts
+/** Supabase's default `max_rows`, which PostgREST uses for `count=estimated`. */
+const DEFAULT_ESTIMATED_COUNT_THRESHOLD = 1e3;
+const MAX_PARAMS = 65535;
+const MAX_PAIRS = 50;
+function quoteIdent(name) {
+	return `"${name.replaceAll("\"", "\"\"")}"`;
+}
+function tableRef(table) {
+	return `${quoteIdent(table.schema)}.${quoteIdent(table.name)}`;
+}
+function dbColumn(table, app) {
+	const meta = table.columns[app];
+	if (!meta) invalidRequest(`Unknown column "${app}" on "${table.key}"`, table.key);
+	return meta.db;
+}
+function columnType(table, db) {
+	return lookupOf(table).byDb.get(db)?.[1].type;
+}
+function jsonText(value) {
+	return value === null || value === void 0 ? value : JSON.stringify(value);
+}
+function columnValue(table, db, value) {
+	const meta = lookupOf(table).byDb.get(db)?.[1];
+	if (!meta?.json) return value;
+	if (meta.array && Array.isArray(value)) return value.map(jsonText);
+	return jsonText(value);
+}
+function comparedValue(table, condition) {
+	const { value } = condition;
+	if (condition.path || typeof value !== "object" || value === null) return value;
+	const meta = lookupOf(table).byDb.get(condition.column)?.[1];
+	return meta?.json && !meta.array ? JSON.stringify(value) : value;
+}
+/**
+* `a > x or (a = x and b > y) or ...` as `(a, b) > (x, y)`, which an index
+* on `(a, b)` serves. Both forms give the same result under SQL's
+* three-valued logic, nulls included.
+*/
+function rowComparison(condition) {
+	const steps = [];
+	for (const [index, item] of condition.items.entries()) {
+		const terms = index === 0 ? [item] : item.kind === "and" ? item.items : [];
+		if (terms.length !== index + 1) return null;
+		const step = terms[index];
+		if (step.kind !== "column" || step.path || step.op !== "gt" && step.op !== "lt") return null;
+		for (const [at, term] of terms.slice(0, index).entries()) {
+			const prev = steps[at];
+			if (term.kind !== "column" || term.op !== "eq" || term.column !== prev.column || !Object.is(term.value, prev.value)) return null;
+		}
+		steps.push(step);
+	}
+	const op = steps[0]?.op;
+	if (op !== "gt" && op !== "lt") return null;
+	if (steps.length < 2 || steps.some((step) => step.op !== op)) return null;
+	return {
+		columns: steps.map((step) => step.column),
+		op,
+		values: steps.map((step) => step.value)
+	};
+}
+var SqlCompiler = class {
+	params = [];
+	#aliases = 0;
+	alias() {
+		const alias = `t${this.#aliases}`;
+		this.#aliases += 1;
+		return alias;
+	}
+	param(value, cast) {
+		this.params.push(value);
+		return cast ? `$${this.params.length}::${cast}` : `$${this.params.length}`;
+	}
+	column(alias, name) {
+		return `${alias}.${quoteIdent(name)}`;
+	}
+	condition(condition, table, alias) {
+		switch (condition.kind) {
+			case "and":
+			case "or": {
+				if (condition.items.length === 0) return condition.kind === "and" ? "true" : "false";
+				const row = condition.kind === "or" ? rowComparison(condition) : null;
+				if (row) {
+					const columns = row.columns.map((name) => this.column(alias, name));
+					const values = row.values.map((value) => this.param(value));
+					return `(${columns.join(", ")}) ${row.op === "gt" ? ">" : "<"} (${values.join(", ")})`;
+				}
+				const joiner = condition.kind === "and" ? " and " : " or ";
+				return `(${condition.items.map((item) => this.condition(item, table, alias)).join(joiner)})`;
+			}
+			case "not": return `not ${this.condition(condition.item, table, alias)}`;
+			case "column": return this.columnCondition(condition, table, alias);
+			case "relation": {
+				const target = this.alias();
+				const join = this.join(condition.relation, table, alias, condition.target, target);
+				const where = condition.quantifier === "every" && condition.where ? `not ${this.condition(condition.where, condition.target, target)}` : condition.where ? this.condition(condition.where, condition.target, target) : void 0;
+				const body = `select 1 from ${tableRef(condition.target)} as ${target} where ${join}${where ? ` and ${where}` : ""}`;
+				return condition.quantifier === "some" ? `exists (${body})` : `not exists (${body})`;
+			}
+			default: return condition;
+		}
+	}
+	columnCondition(condition, table, alias) {
+		const column = condition.path ? `(${this.column(alias, condition.column)} #>> ${this.param(condition.path, "text[]")})` : this.column(alias, condition.column);
+		const { value } = condition;
+		switch (condition.op) {
+			case "eq": return `${column} = ${this.param(comparedValue(table, condition))}`;
+			case "neq": return `${column} <> ${this.param(comparedValue(table, condition))}`;
+			case "gt": return `${column} > ${this.param(comparedValue(table, condition))}`;
+			case "gte": return `${column} >= ${this.param(comparedValue(table, condition))}`;
+			case "lt": return `${column} < ${this.param(comparedValue(table, condition))}`;
+			case "lte": return `${column} <= ${this.param(comparedValue(table, condition))}`;
+			case "like": return `${column} like ${this.param(value)}`;
+			case "ilike": return `${column} ilike ${this.param(value)}`;
+			case "match": return `${column} ~ ${this.param(value)}`;
+			case "imatch": return `${column} ~* ${this.param(value)}`;
+			case "in":
+				if (!Array.isArray(value)) invalidRequest("\"in\" needs an array");
+				return `${column} = any(${this.param(value)})`;
+			case "is":
+				if (value === null) return `${column} is null`;
+				if (value === true) return `${column} is true`;
+				if (value === false) return `${column} is false`;
+				return invalidRequest("\"is\" needs null, true or false");
+			case "contains":
+			case "containedBy":
+			case "overlaps": {
+				const operator = condition.op === "contains" ? "@>" : condition.op === "containedBy" ? "<@" : "&&";
+				return Array.isArray(value) && !condition.json ? `${column} ${operator} ${this.param(value)}` : `${column} ${operator} ${this.param(JSON.stringify(value), "jsonb")}`;
+			}
+			case "fts": {
+				const config = condition.config ? `${this.param(condition.config, "regconfig")}, ` : "";
+				const query = `websearch_to_tsquery(${config}${this.param(value)})`;
+				return `${columnType(table, condition.column) === "tsvector" ? column : `to_tsvector(${config}${column})`} @@ ${query}`;
+			}
+			default: return condition.op;
+		}
+	}
+	join(relation, source, sourceAlias, target, targetAlias) {
+		if (relation.columns.length !== relation.references.length) invalidRequest(`Relation to "${target.key}" has mismatched columns`);
+		return relation.columns.map((column, index) => {
+			const reference = relation.references[index];
+			if (reference === void 0) invalidRequest(`Relation to "${target.key}" has mismatched columns`);
+			return `${this.column(targetAlias, dbColumn(target, reference))} = ${this.column(sourceAlias, dbColumn(source, column))}`;
+		}).join(" and ");
+	}
+	orderBy(terms, alias, table) {
+		return terms.map((term) => {
+			const nulls = term.nulls ? ` nulls ${term.nulls}` : "";
+			return `${this.sortKey(term, alias, table)} ${term.direction}${nulls}`;
+		}).join(", ");
+	}
+	/**
+	* A column, an aggregate of the group, or the column of a to-one
+	* relation's row as a scalar subquery.
+	*/
+	sortKey(term, alias, table) {
+		if (term.aggregate === "count") return "count(*)";
+		if (term.aggregate) return `${term.aggregate}(${this.column(alias, term.column)})`;
+		const { relation } = term;
+		if (!relation) return this.column(alias, term.column);
+		if (!table) invalidRequest("A relation sort needs the root table");
+		const target = this.alias();
+		const join = this.join(relation.relation, table, alias, relation.target, target);
+		return `(select ${this.column(target, term.column)} from ${tableRef(relation.target)} as ${target} where ${join} limit 1)`;
+	}
+	/** `json_build_object('alias', t0."col", ...)` for a selection. */
+	rowExpression(selection, table, alias) {
+		const pairs = selection.columns.map((entry) => `'${entry.alias.replaceAll("'", "''")}', ${this.column(alias, entry.column)}${entry.cast ? `::${entry.cast}` : ""}`);
+		if (selection.aggregate) {
+			if (selection.aggregate.count) pairs.push(`'_count', count(*)`);
+			for (const measure of selection.aggregate.measures) pairs.push(`'${measure.key.replaceAll("'", "''")}', ${measure.fn}(${this.column(alias, measure.column)})${measure.cast ? `::${measure.cast}` : ""}`);
+		}
+		for (const include of selection.includes) pairs.push(`'${include.alias.replaceAll("'", "''")}', ${this.include(include, table, alias)}`);
+		if (pairs.length <= MAX_PAIRS) return `json_build_object(${pairs.join(", ")})`;
+		const chunks = [];
+		for (let index = 0; index < pairs.length; index += MAX_PAIRS) chunks.push(`jsonb_build_object(${pairs.slice(index, index + MAX_PAIRS).join(", ")})`);
+		return `(${chunks.join(" || ")})::json`;
+	}
+	/** Conditions an include adds to its parent: `required` includes need a match. */
+	requiredIncludes(selection, table, alias) {
+		return selection.includes.filter((include) => include.required).map((include) => {
+			const target = this.alias();
+			const where = this.includeWhere(include, table, alias, target);
+			return `exists (select 1 from ${tableRef(include.target)} as ${target} where ${where})`;
+		});
+	}
+	includeWhere(include, parent, parentAlias, alias) {
+		const parts = [this.join(include.relation, parent, parentAlias, include.target, alias)];
+		const simple = simplifyOrFalse(include.where);
+		if (simple.never) parts.push("false");
+		else if (simple.condition) parts.push(this.condition(simple.condition, include.target, alias));
+		parts.push(...this.requiredIncludes(include.selection, include.target, alias));
+		return parts.join(" and ");
+	}
+	include(include, parent, parentAlias) {
+		const alias = this.alias();
+		const where = this.includeWhere(include, parent, parentAlias, alias);
+		const from = `from ${tableRef(include.target)} as ${alias} where ${where}`;
+		if (include.count !== void 0) return `(select count(*) ${from})`;
+		const row = this.rowExpression(include.selection, include.target, alias);
+		if (include.selection.aggregate) return `(select ${row} ${from})`;
+		if (include.relation.kind === "one") return `(select ${row} ${from} limit 1)`;
+		const order = include.orderBy.length > 0 ? this.orderBy(include.orderBy, alias) : void 0;
+		const limit = include.limit === void 0 ? "" : ` limit ${integer(include.limit)}`;
+		return `(select coalesce(json_agg(s.r order by s.o), '[]'::json) from (${`select ${row} as r, ${`row_number() over (${order ? `order by ${order}` : ""})`} as o ${from}${order ? ` order by ${order}` : ""}${limit}`}) as s)`;
+	}
+};
+function insertColumns(op) {
+	const columns = /* @__PURE__ */ new Set();
+	for (const row of op.rows) for (const key of Object.keys(row)) columns.add(key);
+	return [...columns];
+}
+function returningRows(compiler, op, alias) {
+	return op.returning ? ` returning ${compiler.rowExpression(op.returning, op.table, alias)} as row` : " returning 1";
+}
+function estimatedThreshold(options) {
+	const threshold = options.estimatedCountThreshold ?? DEFAULT_ESTIMATED_COUNT_THRESHOLD;
+	if (!Number.isSafeInteger(threshold) || threshold < 0) invalidRequest(`"estimatedCountThreshold" must be a non-negative integer, got ${threshold}`);
+	return threshold;
+}
+/**
+* The count queries for a mode. `exact` counts every row; `planned` asks the
+* planner; `estimated` counts up to the threshold and asks the planner past
+* it, the way PostgREST does. Counts are `bigint`, which the executor
+* decodes.
+*/
+function countPlan(mode, from, params, threshold) {
+	switch (mode) {
+		case void 0: return { count: void 0 };
+		case "exact": return { count: {
+			text: `select count(*)::bigint as count ${from}`,
+			params: [...params]
+		} };
+		case "planned": return {
+			count: void 0,
+			plannedCount: {
+				text: `explain (format json) select 1 ${from}`,
+				params: [...params]
+			}
+		};
+		case "estimated": return {
+			count: {
+				text: `select count(*)::bigint as count from (select 1 ${from} limit ${threshold + 1}) as c`,
+				params: [...params]
+			},
+			plannedCount: {
+				text: `explain (format json) select 1 ${from}`,
+				params: [...params]
+			},
+			countThreshold: threshold
+		};
+		default: return mode;
+	}
+}
+/** Compiles an operation to parameterized SQL. Rows come back as json. */
+function compileSql(op, options = {}) {
+	const compiler = new SqlCompiler();
+	const alias = compiler.alias();
+	const source = op.kind === "select" ? op.source : void 0;
+	const from = source ? `${quoteIdent(source.schema)}.${quoteIdent(source.name)}(${Object.entries(source.args).map(([name, value]) => `${quoteIdent(name)} => ${compiler.param(value)}`).join(", ")}) as ${alias}` : `${tableRef(op.table)} as ${alias}`;
+	switch (op.kind) {
+		case "select": {
+			const simple = simplifyOrFalse(op.where);
+			if (simple.never) return {
+				rows: void 0,
+				count: void 0,
+				never: true
+			};
+			const where = simple.condition ? compiler.condition(simple.condition, op.table, alias) : void 0;
+			const required = compiler.requiredIncludes(op.selection, op.table, alias);
+			const filter = whereClause([where, ...required]);
+			const counting = countPlan(op.head ? op.count ?? "exact" : op.count, `from ${from}${filter}`, compiler.params, estimatedThreshold(options));
+			if (op.head) return {
+				rows: void 0,
+				never: false,
+				...counting
+			};
+			return {
+				rows: {
+					text: `select ${compiler.rowExpression(op.selection, op.table, alias)} as row from ${from}${filter}${op.selection.aggregate && op.selection.columns.length > 0 ? ` group by ${op.selection.columns.map((entry) => compiler.column(alias, entry.column)).join(", ")}` : ""}${op.orderBy.length > 0 ? ` order by ${compiler.orderBy(op.orderBy, alias, op.table)}` : ""}${op.limit === void 0 ? "" : ` limit ${integer(op.limit)}`}${op.offset === void 0 ? "" : ` offset ${integer(op.offset)}`}`,
+					params: compiler.params
+				},
+				never: false,
+				...counting
+			};
+		}
+		case "insert": {
+			if (op.rows.length === 0) return {
+				rows: void 0,
+				count: void 0,
+				never: true
+			};
+			const columns = insertColumns(op);
+			const perChunk = Math.floor(MAX_PARAMS / Math.max(columns.length, 1));
+			if (op.rows.length <= perChunk) return insertPlan(compiler, from, alias, op, columns);
+			const [first, ...rest] = chunk(op.rows, perChunk).map((rows) => {
+				const own = new SqlCompiler();
+				const ownAlias = own.alias();
+				return insertPlan(own, `${tableRef(op.table)} as ${ownAlias}`, ownAlias, {
+					...op,
+					rows
+				}, columns);
+			});
+			return {
+				...first,
+				chunks: rest
+			};
+		}
+		case "update": {
+			const simple = simplifyOrFalse(op.where);
+			if (simple.never) return {
+				rows: void 0,
+				count: void 0,
+				never: true
+			};
+			const entries = Object.entries(op.set);
+			if (entries.length === 0) invalidRequest(`Update on "${op.table.key}" sets no columns`);
+			const set = entries.map(([column, value]) => `${quoteIdent(column)} = ${compiler.param(columnValue(op.table, column, value))}`).join(", ");
+			const where = simple.condition ? compiler.condition(simple.condition, op.table, alias) : void 0;
+			return mutation(`update ${from} set ${set}${whereClause([where])}${returningRows(compiler, op, alias)}`, op.returning !== void 0, compiler.params, maxAffectedOf(op));
+		}
+		case "delete": {
+			const simple = simplifyOrFalse(op.where);
+			if (simple.never) return {
+				rows: void 0,
+				count: void 0,
+				never: true
+			};
+			const where = simple.condition ? compiler.condition(simple.condition, op.table, alias) : void 0;
+			return mutation(`delete from ${from}${whereClause([where])}${returningRows(compiler, op, alias)}`, op.returning !== void 0, compiler.params, maxAffectedOf(op));
+		}
+		default: return op;
+	}
+}
+function chunk(items, size) {
+	const out = [];
+	for (let start = 0; start < items.length; start += size) out.push(items.slice(start, start + size));
+	return out;
+}
+function insertPlan(compiler, from, alias, op, columns) {
+	let body;
+	if (columns.length === 0) {
+		if (op.rows.length > 1) invalidRequest("Cannot insert several rows without columns");
+		body = "default values";
+	} else {
+		const values = op.rows.map((row) => `(${columns.map((column) => column in row ? compiler.param(columnValue(op.table, column, row[column])) : op.defaultToNull ? "null" : "default").join(", ")})`);
+		body = `(${columns.map(quoteIdent).join(", ")}) values ${values.join(", ")}`;
+	}
+	let conflict = "";
+	if (op.onConflict) {
+		const target = `(${op.onConflict.columns.map(quoteIdent).join(", ")})`;
+		const updates = columns.map((column) => `${quoteIdent(column)} = excluded.${quoteIdent(column)}`);
+		conflict = op.onConflict.action === "ignore" || updates.length === 0 ? ` on conflict ${target} do nothing` : ` on conflict ${target} do update set ${updates.join(", ")}${tenantGuard(op, alias)}`;
+	}
+	return mutation(`insert into ${from} ${body}${conflict}${returningRows(compiler, op, alias)}`, op.returning !== void 0, compiler.params);
+}
+/** An upsert never updates a row that belongs to another tenant. */
+function tenantGuard(op, alias) {
+	const app = op.table.flags.tenant;
+	const column = app === void 0 ? void 0 : op.table.columns[app]?.db;
+	if (column === void 0) return "";
+	return ` where ${alias}.${quoteIdent(column)} = excluded.${quoteIdent(column)}`;
+}
+function maxAffectedOf(op) {
+	if (op.maxAffected === void 0) return;
+	if (!Number.isInteger(op.maxAffected) || op.maxAffected < 0) invalidRequest(`"maxAffected" must be a non-negative integer, got ${op.maxAffected}`, op.table.key);
+	return op.maxAffected;
+}
+/**
+* The statement's row count, or a cast error naming it when it is above
+* `max`. The cast depends on `count(*)`, so the planner can't fold it into
+* an error for every call; the failed statement rolls its writes back. A
+* query returning rows must use the count (`where c.n >= 0`), or Postgres
+* drops the unused column and never runs the check.
+*/
+function guardedCount(max) {
+	return `case when count(*) > ${max} then ('${MAX_AFFECTED_MARKER}:' || count(*))::bigint else count(*)::bigint end`;
+}
+function mutation(statement, returning, params, maxAffected) {
+	if (maxAffected !== void 0) {
+		const guard = guardedCount(maxAffected);
+		return returning ? {
+			rows: {
+				text: `with m as (${statement}), c as (select ${guard} as n from m) select m.row from m cross join c where c.n >= 0`,
+				params
+			},
+			count: void 0,
+			never: false
+		} : {
+			rows: void 0,
+			count: {
+				text: `with m as (${statement}) select ${guard} as count from m`,
+				params
+			},
+			never: false
+		};
+	}
+	if (returning) return {
+		rows: {
+			text: statement,
+			params
+		},
+		count: void 0,
+		never: false
+	};
+	return {
+		rows: void 0,
+		count: {
+			text: `with m as (${statement}) select count(*)::bigint as count from m`,
+			params
+		},
+		never: false
+	};
+}
+//#endregion
+export { quoteIdent as n, compileSql as t };

package/dist/sso-BDva_-4y.js

@@ -0,0 +1,217 @@
+import { n as dbError } from "./errors-8i6tSICm.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-BlgnMB0H.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { C as optionalText, D as recordOf, F as stringsOf, I as textOf, R as toInstant, S as optionalInstant, f as errorText, k as recordsOf, n as applyTemporal, o as blockCall } from "./block-helpers-CfG_MvDR.js";
+import { r as withBlockHooks } from "./block-hooks-BsXncUlZ.js";
+//#region src/blocks/sso/sso.ts
+function recordOfDomain(value) {
+	const row = recordOf(value, "organization_domains.record");
+	return {
+		type: "TXT",
+		name: textOf(row["name"]),
+		value: textOf(row["value"])
+	};
+}
+function domainOf(value) {
+	const row = recordOf(value, "organization_domains");
+	return {
+		id: textOf(row["id"]),
+		organizationId: textOf(row["organization_id"]),
+		domain: textOf(row["domain"]),
+		verifiedAt: optionalInstant(row["verified_at"]),
+		autoJoinRole: optionalText(row["auto_join_role"]),
+		enforceSso: row["enforce_sso"] === true,
+		createdBy: optionalText(row["created_by"]),
+		createdAt: toInstant(textOf(row["created_at"])),
+		record: recordOfDomain(row["record"])
+	};
+}
+function providerOf(value) {
+	const row = recordOf(value, "organization_sso_providers");
+	return {
+		id: textOf(row["id"]),
+		organizationId: textOf(row["organization_id"]),
+		type: "saml",
+		metadataUrl: optionalText(row["metadata_url"]),
+		domains: stringsOf(row["domains"]),
+		createdAt: toInstant(textOf(row["created_at"]))
+	};
+}
+function ssoDomainOf(value) {
+	if (!isRecord(value)) return;
+	return {
+		domain: textOf(value["domain"]),
+		organizationId: textOf(value["organizationId"]),
+		providerId: textOf(value["providerId"]),
+		enforceSso: value["enforceSso"] === true
+	};
+}
+/** Organization domains and SSO lookups as the caller. */
+function createSso(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	return withBlockHooks({
+		addDomain: (organizationId, domain) => call("add_organization_domain", {
+			tenant: organizationId,
+			domain
+		}, domainOf),
+		domains: (organizationId) => call("list_organization_domains", { tenant: organizationId }, (value) => recordsOf(value, "list_organization_domains").map(domainOf)),
+		updateDomain: (domainId, settings) => call("organization_domain", { id: domainId }, (value) => isRecord(value) ? domainOf(value) : void 0).andThen(async (current) => current === void 0 ? err(dbError("not_found", "No domain you manage has this id", { hint: "SSO_DOMAIN_NOT_FOUND" })) : call("update_organization_domain", {
+			id: domainId,
+			auto_join_role: settings.autoJoinRole === void 0 ? current.autoJoinRole ?? null : settings.autoJoinRole,
+			enforce_sso: settings.enforceSso ?? current.enforceSso
+		}, domainOf)),
+		removeDomain: (domainId) => call("remove_organization_domain", { id: domainId }, (value) => value === true),
+		providers: (organizationId) => call("list_sso_providers", { tenant: organizationId }, (value) => recordsOf(value, "list_sso_providers").map(providerOf)),
+		domainFor: (email) => call("sso_domain_for", { email }, ssoDomainOf)
+	}, options.hooks, {
+		block: "sso",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+const NXDOMAIN = 3;
+const TXT = 16;
+/** TXT lookups over DNS-over-HTTPS (the `application/dns-json` API). */
+function dohResolver(options = {}) {
+	const endpoint = options.endpoint ?? "https://cloudflare-dns.com/dns-query";
+	const fetcher = options.fetch ?? fetch;
+	return async (name, signal) => {
+		const url = new URL(endpoint);
+		url.searchParams.set("name", name);
+		url.searchParams.set("type", "TXT");
+		const response = await fetcher(url, {
+			headers: { accept: "application/dns-json" },
+			...signal ? { signal } : {}
+		});
+		if (!response.ok) throw new Error(`DNS lookup of ${name} failed with ${response.status}`);
+		const body = await response.json();
+		if (!isRecord(body)) throw new Error(`DNS lookup of ${name} returned no JSON`);
+		if (body["Status"] === NXDOMAIN) return [];
+		if (body["Status"] !== 0) throw new Error(`DNS lookup of ${name} failed with status ${String(body["Status"])}`);
+		return (Array.isArray(body["Answer"]) ? body["Answer"] : []).filter((answer) => isRecord(answer) && answer["type"] === TXT).map((answer) => txtValue(textOf(isRecord(answer) ? answer["data"] : "")));
+	};
+}
+/** `"abc" "def"` (one record split into strings) gives `abcdef`. */
+function txtValue(data) {
+	const parts = [...data.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((match) => (match[1] ?? "").replaceAll(/\\(.)/g, "$1"));
+	return parts.length === 0 ? data : parts.join("");
+}
+function authStatusError(status, message) {
+	if (status === 400 || status === 422) return dbError("invalid_input", message);
+	if (status === 401) return dbError("unauthorized", message);
+	if (status === 403) return dbError("forbidden", message);
+	if (status === 404) return dbError("not_found", message);
+	if (status === 409) return dbError("conflict", message);
+	if (status === 429) return dbError("rate_limited", message);
+	return dbError("network", message);
+}
+/** Domain verification and SAML providers with a service-role client. */
+function createSsoAdmin(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const resolver = options.resolver ?? dohResolver();
+	const auth = (method, path, body) => AsyncResult.from(async () => {
+		const admin = options.auth;
+		if (!admin) return err(dbError("invalid_request", "Pass auth to createSsoAdmin to manage SAML providers"));
+		const fetcher = admin.fetch ?? fetch;
+		let response;
+		try {
+			response = await fetcher(`${admin.url.replace(/\/+$/, "")}/auth/v1/admin/sso/providers${path}`, {
+				method,
+				headers: {
+					apikey: admin.secretKey,
+					authorization: `Bearer ${admin.secretKey}`,
+					"content-type": "application/json"
+				},
+				...body === void 0 ? {} : { body: JSON.stringify(body) }
+			});
+		} catch (cause) {
+			return err(dbError("network", errorText(cause)));
+		}
+		const text = await response.text();
+		let json;
+		try {
+			json = text.length > 0 ? JSON.parse(text) : {};
+		} catch {
+			json = {};
+		}
+		if (!response.ok) {
+			const message = isRecord(json) ? optionalText(json["msg"]) ?? optionalText(json["message"]) ?? optionalText(json["error_description"]) : void 0;
+			return err(authStatusError(response.status, message ?? `Supabase Auth answered ${response.status}`));
+		}
+		return ok(isRecord(json) ? json : {});
+	});
+	const providerBody = (input) => ({
+		type: "saml",
+		...input.metadataUrl === void 0 ? {} : { metadata_url: input.metadataUrl },
+		...input.metadataXml === void 0 ? {} : { metadata_xml: input.metadataXml },
+		...input.domains === void 0 ? {} : { domains: [...input.domains] },
+		...input.attributeMapping === void 0 ? {} : { attribute_mapping: input.attributeMapping },
+		...input.nameIdFormat === void 0 ? {} : { name_id_format: input.nameIdFormat }
+	});
+	const register = (organizationId, providerId, domains, metadataUrl, actor) => call("register_sso_provider", {
+		tenant: organizationId,
+		provider: providerId,
+		domains,
+		metadata_url: metadataUrl ?? null,
+		actor: actor.actorId ?? null
+	}, providerOf);
+	const providerFor = (providerId, actor) => call("sso_provider", {
+		provider: providerId,
+		actor: actor.actorId ?? null
+	}, (value) => isRecord(value) ? providerOf(value) : void 0);
+	const missing = () => err(dbError("not_found", "No SSO provider has this id", { hint: "SSO_PROVIDER_NOT_FOUND" }));
+	const path = (providerId) => `/${encodeURIComponent(providerId)}`;
+	return {
+		verifyDomain: (domainId, request = {}) => call("organization_domain", { id: domainId }, (value) => isRecord(value) ? domainOf(value) : void 0).andThen(async (found) => {
+			if (found === void 0) return err(dbError("not_found", "No domain has this id", { hint: "SSO_DOMAIN_NOT_FOUND" }));
+			if (found.verifiedAt === void 0) {
+				let values;
+				try {
+					values = await resolver(found.record.name, request.signal);
+				} catch (cause) {
+					return err(dbError("network", errorText(cause)));
+				}
+				if (!values.includes(found.record.value)) return err(dbError("invalid_request", `No TXT record ${found.record.name} with the verification value yet`, { hint: "SSO_DOMAIN_RECORD_MISSING" }));
+			}
+			return call("verify_organization_domain", {
+				id: domainId,
+				actor: request.actorId ?? null
+			}, domainOf);
+		}),
+		addSamlProvider: (organizationId, input, actor = {}) => call("check_sso_provider", {
+			tenant: organizationId,
+			domains: input.domains,
+			actor: actor.actorId ?? null
+		}, () => void 0).andThen(() => auth("POST", "", providerBody(input))).andThen(async (created) => {
+			const providerId = textOf(created["id"]);
+			const recorded = await register(organizationId, providerId, input.domains, input.metadataUrl, actor);
+			if (!recorded.ok) await auth("DELETE", path(providerId));
+			return recorded;
+		}),
+		updateSamlProvider: (providerId, input, actor = {}) => providerFor(providerId, actor).andThen(async (found) => {
+			if (found === void 0) return missing();
+			const checked = await call("check_sso_provider", {
+				tenant: found.organizationId,
+				domains: input.domains,
+				actor: actor.actorId ?? null
+			}, () => void 0);
+			if (!checked.ok) return checked;
+			const updated = await auth("PUT", path(providerId), providerBody(input));
+			if (!updated.ok) return updated;
+			const metadataUrl = input.metadataXml === void 0 ? input.metadataUrl ?? found.metadataUrl : void 0;
+			return register(found.organizationId, providerId, input.domains, metadataUrl, actor);
+		}),
+		removeSamlProvider: (providerId, actor = {}) => providerFor(providerId, actor).andThen(async (found) => {
+			if (found === void 0) return ok(void 0);
+			const deleted = await auth("DELETE", path(providerId));
+			if (!deleted.ok && deleted.error.kind !== "not_found") return deleted;
+			return call("unregister_sso_provider", {
+				provider: providerId,
+				actor: actor.actorId ?? null
+			}, () => found);
+		})
+	};
+}
+//#endregion
+export { createSsoAdmin as n, dohResolver as r, createSso as t };