better-supabase 0.8.0 → 0.9.0

package/dist/stripe-D04h-QBT.d.ts

@@ -1,136 +0,0 @@
-//#region src/blocks/stripe.d.ts
-/**
- * The part of the Stripe SDK (`stripe`, an optional peer) the billing and
- * usage blocks call, typed structurally so the blocks never import it.
- */
-interface StripeClient {
-  readonly customers: {
-    create(params: {
-      readonly email?: string;
-      readonly name?: string;
-      readonly metadata?: Readonly<Record<string, string>>;
-    }, options?: {
-      readonly idempotencyKey?: string;
-    }): Promise<{
-      readonly id: string;
-    }>;
-    /** Used by `billing.updateCustomer`. */
-    update?(id: string, params: Readonly<Record<string, unknown>>): Promise<{
-      readonly id: string;
-    }>;
-    /** Used by `billing.taxIds`. */
-    listTaxIds?(id: string, params?: {
-      readonly limit?: number;
-    }): Promise<{
-      readonly data: readonly StripeTaxId[];
-    }>;
-    /** Used by `billing.addTaxId`. */
-    createTaxId?(id: string, params: {
-      readonly type: string;
-      readonly value: string;
-    }): Promise<StripeTaxId>;
-    /** Used by `billing.removeTaxId`. */
-    deleteTaxId?(id: string, taxId: string): Promise<{
-      readonly id: string;
-      readonly deleted?: boolean;
-    }>;
-  };
-  readonly checkout: {
-    readonly sessions: {
-      create(params: Readonly<Record<string, unknown>>, options?: {
-        readonly idempotencyKey?: string;
-      }): Promise<{
-        readonly id: string;
-        readonly url: string | null;
-      }>;
-    };
-  };
-  readonly billingPortal: {
-    readonly sessions: {
-      create(params: {
-        readonly customer: string;
-        readonly return_url?: string;
-      }): Promise<{
-        readonly id: string;
-        readonly url: string;
-      }>;
-    };
-  };
-  readonly subscriptionItems: {
-    update(id: string, params: {
-      readonly quantity: number;
-      readonly proration_behavior?: string;
-    }, options?: {
-      readonly idempotencyKey?: string;
-    }): Promise<{
-      readonly id: string;
-      readonly quantity?: number | null;
-    }>;
-  };
-  readonly subscriptions: {
-    cancel(id: string): Promise<{
-      readonly id: string;
-    }>;
-    /** Used by `billing.changePlan` and `billing.cancelAtPeriodEnd`. */
-    update?(id: string, params: Readonly<Record<string, unknown>>, options?: {
-      readonly idempotencyKey?: string;
-    }): Promise<{
-      readonly id: string;
-    }>;
-  };
-  /** Used by `billing.voidInvoice` and `billing.markInvoiceUncollectible`. */
-  readonly invoices?: {
-    voidInvoice(id: string): Promise<{
-      readonly id: string;
-      readonly status?: string | null;
-    }>;
-    markUncollectible(id: string): Promise<{
-      readonly id: string;
-      readonly status?: string | null;
-    }>;
-  };
-  readonly billing: {
-    readonly meterEvents: {
-      create(params: {
-        readonly event_name: string;
-        readonly payload: Readonly<Record<string, string>>;
-        readonly identifier?: string;
-        readonly timestamp?: number;
-      }, options?: {
-        readonly idempotencyKey?: string;
-      }): Promise<unknown>;
-    };
-  };
-  readonly webhooks: {
-    constructEventAsync(payload: string, header: string, secret: string): Promise<{
-      readonly id: string;
-      readonly type: string;
-      readonly data: {
-        readonly object: unknown;
-      };
-    }>;
-  };
-}
-/** A customer tax id as Stripe returns it (`eu_vat`, `DE123456789`). */
-interface StripeTaxId {
-  readonly id: string;
-  readonly type: string;
-  readonly value: string;
-  readonly country?: string | null;
-  readonly verification?: {
-    readonly status?: string | null;
-  } | null;
-  readonly created?: number | null;
-}
-/**
- * A Stripe client, the secret key to create one from the `stripe` package,
- * or a function that returns a client. The function runs on every Stripe
- * call, so it can create the client lazily, pick a per-request or per-tenant
- * client (Stripe Connect), or read a rotated key; cache inside it when needed.
- */
-type StripeSource = StripeClient | {
-  readonly secretKey: string;
-  readonly apiVersion?: string;
-} | (() => StripeClient | Promise<StripeClient>);
-//#endregion
-export { StripeSource as n, StripeTaxId as r, StripeClient as t };

package/dist/stripe-v-Y2lmop.js

@@ -1,32 +0,0 @@
-import { t as importOptionalPeer } from "./optional-peer-D1pi-skw.js";
-//#region src/blocks/stripe.ts
-const isModule = (value) => typeof value === "object" && value !== null && "default" in value && typeof value.default === "function" && "createFetchHttpClient" in value.default;
-/**
-* Loads `stripe` on first use. The specifier is a variable so bundlers leave
-* the optional peer out of apps that pass their own client; a missing
-* install returns `undefined` and the caller explains how to add it.
-*/
-const loadStripeModule = () => importOptionalPeer("stripe");
-/**
-* The client `source` names: itself, or one created with Stripe's fetch HTTP
-* client so it runs on every WinterTC runtime.
-*/
-async function stripeClient(source, load = loadStripeModule) {
-	if (typeof source === "function") return source();
-	if (!("secretKey" in source)) return source;
-	const loaded = await load();
-	if (!isModule(loaded)) throw new TypeError("The billing and usage blocks need the stripe package: pnpm add stripe, or pass a Stripe client as `stripe`");
-	const Stripe = loaded.default;
-	return new Stripe(source.secretKey, {
-		httpClient: Stripe.createFetchHttpClient(),
-		...source.apiVersion === void 0 ? {} : { apiVersion: source.apiVersion }
-	});
-}
-/** Resolves the client once, on first use; a function source runs on every use. */
-function lazyStripe(source) {
-	if (typeof source === "function") return async () => source();
-	let client;
-	return () => client ??= stripeClient(source);
-}
-//#endregion
-export { lazyStripe as t };

package/dist/supabase-mcp-Cpn5A4i-.js

@@ -1,28 +0,0 @@
-import { t as importOptionalPeer } from "./optional-peer-D1pi-skw.js";
-//#region src/core/supabase-mcp.ts
-const INSTALL = "Supabase's MCP server needs @supabase/mcp-server-supabase: pnpm add @supabase/mcp-server-supabase";
-const isRecord = (value) => typeof value === "object" && value !== null;
-function isServerModule(value) {
-	return isRecord(value) && "createToolSchemas" in value && "createSupabaseMcpHandler" in value && typeof value["createToolSchemas"] === "function" && typeof value["createSupabaseMcpHandler"] === "function";
-}
-function isPlatformModule(value) {
-	return isRecord(value) && "createSupabaseApiPlatform" in value && typeof value["createSupabaseApiPlatform"] === "function";
-}
-/**
-* Loads `@supabase/mcp-server-supabase` on first use. The specifiers are
-* variables so bundlers leave the optional peer out of apps that don't call
-* Supabase's MCP server; a missing install throws how to add it.
-*/
-async function loadSupabaseMcp() {
-	const loaded = await importOptionalPeer("@supabase/mcp-server-supabase");
-	if (!isServerModule(loaded)) throw new TypeError(INSTALL);
-	return loaded;
-}
-/** Loads the Management API platform of `@supabase/mcp-server-supabase`. */
-async function loadSupabaseMcpPlatform() {
-	const loaded = await importOptionalPeer("@supabase/mcp-server-supabase/platform/api");
-	if (!isPlatformModule(loaded)) throw new TypeError(INSTALL);
-	return loaded;
-}
-//#endregion
-export { loadSupabaseMcp as n, loadSupabaseMcpPlatform as r, isRecord as t };

package/dist/support-D1pFFouF.js

@@ -1,350 +0,0 @@
-import { c as mapDbError, n as dbError } from "./errors-2M6CKMP4.js";
-import { t as temporal } from "./temporal-required-BtynQtM-.js";
-import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-DEqHCMKP.js";
-import { n as validate } from "./standard-DkzZUneg.js";
-import { o as problemResponse } from "./problem-CJvFeGu7.js";
-import { t as fromPgError } from "./executor-B_Hfobee.js";
-import { d as clearSupportCookie, f as supportCookie, m as supportCookieValue } from "./adapter-CN45ibbV.js";
-import { i as sqlIdent } from "./template-lPVh-EwW.js";
-import { a as emitBlockEvent } from "./block-events-DTxU5tfr.js";
-import { t as cronRoute } from "./cron-route-D2AN9SA1.js";
-import { t as boundedTtlCache } from "./ttl-cache-XzZ-Q2eX.js";
-//#region src/auth/support.ts
-/**
-* A session from the jsonb the `support-sessions` functions return, with
-* `namespace` (else the provided or global Temporal) for its time values.
-*/
-function supportSessionFromRow(row, namespace) {
-	const Instant = (namespace ?? temporal()).Instant;
-	const instant = (value) => Instant.from(value);
-	return {
-		id: row.id,
-		adminId: row.admin_id,
-		targetUserId: row.target_user_id,
-		reason: row.reason,
-		readOnly: row.read_only ?? true,
-		...row.tenant === null ? {} : { tenant: String(row.tenant) },
-		startedAt: instant(row.started_at),
-		expiresAt: instant(row.expires_at),
-		...row.ended_at === null ? {} : { endedAt: instant(row.ended_at) },
-		...row.ended_by === null ? {} : { endedBy: row.ended_by },
-		metadata: row.metadata ?? {}
-	};
-}
-/**
-* Support sessions in the `support-sessions` SQL module. `start` runs
-* as the admin, so the module's `is_platform()` gate applies; the reads run
-* on the admin connection.
-*/
-function sqlSupportStore(postgres, options = {}) {
-	const fn = (name) => `${sqlIdent(options.schema ?? "better_supabase")}.${sqlIdent(name)}`;
-	const as = (claims) => claims ? postgres.asUser(claims) : postgres.admin;
-	const one = async (client, text, params) => {
-		const [row] = await client.queryRaw(text, params);
-		return row?.session ?? null;
-	};
-	return {
-		apiVersion: 1,
-		name: "sql",
-		async start(input) {
-			const row = await one(postgres.asUser(input.adminClaims), `select ${fn("start_support_session")}($1, $2, $3::interval, $4, $5, $6, $7) as session`, [
-				input.targetUserId,
-				input.reason,
-				`${String(input.ttlSeconds)} seconds`,
-				input.readOnly,
-				JSON.stringify(input.metadata),
-				input.tenant ?? null,
-				input.adminId
-			]);
-			if (!row) throw new Error("start_support_session returned no session");
-			return supportSessionFromRow(row, options.temporal);
-		},
-		async get(sessionId, adminId, claims) {
-			const row = await one(as(claims), `select ${fn("active_support_session")}($1, $2) as session`, [sessionId, adminId]);
-			return row ? supportSessionFromRow(row, options.temporal) : void 0;
-		},
-		async end(sessionId, endedBy, claims) {
-			const [row] = await as(claims).queryRaw(`select ${fn("end_support_session")}($1, $2) as ended`, [sessionId, endedBy]);
-			return row?.ended === true;
-		},
-		async list(filter = {}, claims) {
-			return (await as(claims).queryRaw(`select session from ${fn("list_support_sessions")}($1, $2, $3, $4) as session`, [
-				filter.adminId ?? null,
-				filter.targetUserId ?? null,
-				filter.active ?? null,
-				filter.limit ?? 50
-			])).map((row) => supportSessionFromRow(row.session, options.temporal));
-		},
-		async expire() {
-			return (await postgres.admin.queryRaw(`select session from ${fn("expire_support_sessions")}() as session`)).map((row) => supportSessionFromRow(row.session, options.temporal));
-		},
-		withTemporal: (namespace) => options.temporal === void 0 ? sqlSupportStore(postgres, {
-			...options,
-			temporal: namespace
-		}) : sqlSupportStore(postgres, options),
-		async claims(targetUserId) {
-			const [row] = await postgres.admin.queryRaw(`select ${fn("support_target_claims")}($1) as claims`, [targetUserId]);
-			return row?.claims ?? {};
-		}
-	};
-}
-/**
-* The claims a support session runs with: the target's, plus `act` naming
-* the admin, the reason and the session (the audit module records all three),
-* marked `kind: "support"` so `actorOf` never reads it as an OAuth client.
-* `role` falls back to `authenticated`; the admin's claims never leak in.
-*/
-function supportClaims(session, target) {
-	const role = target["role"];
-	return {
-		...target,
-		sub: session.targetUserId,
-		role: typeof role === "string" && role !== "" ? role : "authenticated",
-		act: {
-			kind: "support",
-			sub: session.adminId,
-			reason: session.reason,
-			session_id: session.id,
-			read_only: session.readOnly
-		}
-	};
-}
-//#endregion
-//#region src/server/support.ts
-/** How long a support target's claims are reused; a role change applies within it. */
-const CLAIMS_TTL_MS = 6e4;
-const CLAIMS_CACHE_SIZE = 1e3;
-const denied = (message, code) => dbError("forbidden", message, { code });
-const invalid = (message, code) => dbError("invalid_request", message, { code });
-function storeError(cause) {
-	const raw = fromPgError(cause);
-	return raw ? mapDbError(raw) : toDbError(cause);
-}
-/**
-* Support sessions for `createServer(betterSupabase, { support })`. Apps that
-* never import it don't bundle the support code.
-*/
-function supportSessions(options) {
-	return {
-		options,
-		create: (events, claimsSchema, temporal) => createSupport(options, events, claimsSchema, temporal)
-	};
-}
-function createSupport(options, events, claimsSchema, temporal) {
-	const store = temporal !== void 0 && options.store.withTemporal ? options.store.withTemporal(temporal) : options.store;
-	const policy = options.policy ?? {};
-	const ttl = policy.ttl ?? 1800;
-	const maxTtl = policy.maxTtl ?? 14400;
-	const cookieName = options.cookie?.name;
-	const emit = (type, data) => {
-		emitBlockEvent(events, type, data, {
-			actorId: data.adminId,
-			...data.sessionId ? { subject: `support_sessions/${data.sessionId}` } : {}
-		});
-	};
-	const targetClaims = async (store, targetUserId) => {
-		if (options.claims) return options.claims(targetUserId);
-		if (store.claims) return store.claims(targetUserId);
-		return { role: "authenticated" };
-	};
-	/** Target claims per support session; the session itself is loaded every time, so revoking stays immediate. */
-	const claimsCache = boundedTtlCache({ max: CLAIMS_CACHE_SIZE });
-	const cachedTargetClaims = async (session) => {
-		const cached = claimsCache.get(session.id);
-		if (cached) return cached;
-		const claims = await targetClaims(store, session.targetUserId);
-		claimsCache.set(session.id, claims, Math.min(session.expiresAt.epochMilliseconds, Date.now() + CLAIMS_TTL_MS));
-		return claims;
-	};
-	const checkPolicy = (admin, request, reason, seconds) => {
-		if (admin.claims["act"] !== void 0) return denied("An impersonated session cannot start a support session", "SUPPORT_NESTED");
-		if (request.targetUserId === admin.user.id) return invalid("An admin cannot start a support session as themselves", "SUPPORT_SELF");
-		if ((policy.requireReason ?? true) && reason === "") return invalid("A reason is required", "SUPPORT_REASON_REQUIRED");
-		if (!Number.isFinite(seconds) || seconds <= 0 || seconds > maxTtl) return invalid(`ttl must be between 1 and ${String(maxTtl)} seconds`, "SUPPORT_TTL");
-	};
-	const authorized = async (input) => {
-		if (!options.authorize) return true;
-		try {
-			return await options.authorize(input);
-		} catch {
-			return false;
-		}
-	};
-	const expire = () => AsyncResult.from(async () => {
-		if (!store.expire) return err(dbError("unsupported", `The "${store.name}" support session store has no expire()`, { code: "SUPPORT_EXPIRE_UNSUPPORTED" }));
-		let expired;
-		try {
-			expired = await store.expire();
-		} catch (cause) {
-			return err(storeError(cause));
-		}
-		for (const session of expired) emit("support.ended", {
-			sessionId: session.id,
-			adminId: session.adminId,
-			targetUserId: session.targetUserId,
-			reason: session.reason,
-			endedBy: "expired",
-			...session.tenant === void 0 ? {} : { organizationId: session.tenant }
-		});
-		return ok(expired);
-	});
-	return {
-		expire,
-		expireRoute: (routeOptions) => cronRoute({
-			name: "expire",
-			secret: routeOptions.secret,
-			problem: routeOptions.problem
-		}, async (_request, instance) => {
-			const result = await expire();
-			return result.ok ? Response.json({ expired: result.data.length }) : problemResponse(result.error, {
-				instance,
-				format: routeOptions.problem
-			});
-		}),
-		start(admin, request) {
-			return AsyncResult.from(async () => {
-				if (admin.kind !== "user") return err(dbError("unauthorized", "Sign in to start a support session"));
-				const reason = request.reason?.trim() ?? "";
-				const seconds = request.ttl ?? ttl;
-				const readOnly = policy.readOnly === "default" ? request.readOnly ?? true : true;
-				const deny = (error, denial) => {
-					emit("support.denied", {
-						adminId: admin.user.id,
-						targetUserId: request.targetUserId,
-						...reason ? { reason } : {},
-						denial
-					});
-					return err(error);
-				};
-				const violation = checkPolicy(admin, request, reason, seconds);
-				if (violation) return deny(violation, "policy");
-				const input = {
-					admin,
-					targetUserId: request.targetUserId,
-					reason,
-					readOnly,
-					...request.tenant === void 0 ? {} : { tenant: request.tenant },
-					metadata: request.metadata ?? {}
-				};
-				if (!await authorized(input)) return deny(denied("Not allowed to start a support session", "SUPPORT_FORBIDDEN"), "authorize");
-				let session;
-				try {
-					session = await store.start({
-						adminId: admin.user.id,
-						adminClaims: admin.claims,
-						targetUserId: request.targetUserId,
-						reason,
-						ttlSeconds: seconds,
-						readOnly,
-						...request.tenant === void 0 ? {} : { tenant: request.tenant },
-						metadata: request.metadata ?? {}
-					});
-				} catch (cause) {
-					const error = storeError(cause);
-					return deny(error, error.code === "42501" ? "permission" : "store");
-				}
-				emit("support.started", {
-					sessionId: session.id,
-					adminId: session.adminId,
-					targetUserId: session.targetUserId,
-					reason: session.reason,
-					readOnly: session.readOnly,
-					expiresAt: session.expiresAt
-				});
-				return ok({
-					session,
-					cookie: supportCookie(session, options.cookie)
-				});
-			});
-		},
-		stop(admin, sessionId) {
-			return AsyncResult.from(async () => {
-				const cookie = clearSupportCookie(options.cookie);
-				if (admin.kind !== "user") return err(dbError("unauthorized", "Sign in to stop a support session"));
-				try {
-					const session = await store.get(sessionId, admin.user.id, admin.claims);
-					if (!session) return ok({
-						ended: false,
-						cookie
-					});
-					const ended = await store.end(sessionId, "admin", admin.claims);
-					if (ended) emit("support.ended", {
-						sessionId,
-						adminId: session.adminId,
-						targetUserId: session.targetUserId,
-						endedBy: "admin"
-					});
-					return ok({
-						ended,
-						cookie
-					});
-				} catch (cause) {
-					return err(storeError(cause));
-				}
-			});
-		},
-		revoke(caller, sessionId) {
-			return AsyncResult.from(async () => {
-				if (caller.kind !== "user") return err(dbError("unauthorized", "Sign in to revoke a support session"));
-				try {
-					return ok(await store.end(sessionId, "revoked", caller.claims));
-				} catch (cause) {
-					return err(storeError(cause));
-				}
-			});
-		},
-		async current(request, auth) {
-			if (auth.kind !== "user") return;
-			if (auth.claims["act"] !== void 0) return;
-			const id = supportCookieValue(request.headers.get("cookie"), cookieName);
-			if (!id) return;
-			let session;
-			let claims;
-			try {
-				session = await store.get(id, auth.user.id, auth.claims);
-				if (!session || session.expiresAt.epochMilliseconds <= Date.now()) return;
-				if (policy.readOnly !== "default" && !session.readOnly) session = {
-					...session,
-					readOnly: true
-				};
-				claims = supportClaims(session, await cachedTargetClaims(session));
-			} catch (cause) {
-				events.logger.warn("Could not load the support session", { cause });
-				return;
-			}
-			if (claimsSchema) {
-				const checked = await validate(claimsSchema, claims, "claims");
-				if (!checked.ok) {
-					events.logger.warn("The support target's claims fail the claims schema", { sessionId: session.id });
-					return;
-				}
-				if (typeof checked.data === "object" && checked.data !== null) claims = {
-					...claims,
-					...checked.data
-				};
-			}
-			return {
-				session,
-				admin: {
-					id: auth.user.id,
-					...auth.user.email ? { email: auth.user.email } : {}
-				},
-				claims
-			};
-		},
-		list(caller, filter) {
-			return AsyncResult.from(async () => {
-				if (caller.kind !== "user") return err(dbError("unauthorized", "Sign in to list support sessions"));
-				try {
-					return ok(await store.list(filter, caller.claims));
-				} catch (cause) {
-					return err(storeError(cause));
-				}
-			});
-		},
-		sessionIdOf: (request) => supportCookieValue(request.headers.get("cookie"), cookieName),
-		clearCookie: () => clearSupportCookie(options.cookie)
-	};
-}
-//#endregion
-export { sqlSupportStore as n, supportClaims as r, supportSessions as t };

package/dist/support-view-scqMgtOo.d.ts

@@ -1,17 +0,0 @@
-import { t as AuthSession } from "./view-TpXEUcVN.js";
-//#region src/auth/support-view.d.ts
-/** A running support session as the target's view shows it, for a banner. */
-interface SupportView {
-  readonly sessionId: string;
-  /** The admin viewing the app. */
-  readonly adminId: string;
-  readonly targetUserId: string;
-  readonly reason?: string;
-  readonly readOnly: boolean;
-  /** Seconds since epoch. */
-  readonly expiresAt: number | null;
-}
-/** The support session behind `session`, or `undefined` outside one. */
-declare function supportOf(session: AuthSession): SupportView | undefined;
-//#endregion
-export { supportOf as n, SupportView as t };