{"version":3,"file":"runtime.mjs","names":["packageJson.version","extensionContractJson"],"sources":["../src/runtime/descriptor.ts","../src/runtime/supabase-runtime.ts","../src/runtime/supabase.ts","../src/exports/runtime.ts"],"sourcesContent":["import type { SqlRuntimeExtensionDescriptor } from '@prisma-next/sql-runtime';\nimport packageJson from '../../package.json' with { type: 'json' };\n\n/**\n * Tells the runtime that the Supabase pack's runtime component is available.\n *\n * When a contract declares the Supabase pack, the runtime checks that a\n * matching descriptor has been registered. Without this, loading a Supabase\n * contract errors with \"pack runtime component missing\". The `supabase()`\n * factory registers this descriptor automatically — app code never needs to\n * reference it directly.\n */\nexport const supabaseRuntimeDescriptor: SqlRuntimeExtensionDescriptor<'postgres'> = {\n  kind: 'extension' as const,\n  id: 'supabase',\n  version: packageJson.version,\n  familyId: 'sql' as const,\n  targetId: 'postgres' as const,\n  codecs: () => [],\n  create() {\n    return {\n      familyId: 'sql' as const,\n      targetId: 'postgres' as const,\n    };\n  },\n};\n","import type { Contract } from '@prisma-next/contract/types';\nimport type { RuntimeExecuteOptions } from '@prisma-next/framework-components/runtime';\nimport { AsyncIterableResult } from '@prisma-next/framework-components/runtime';\nimport { type PostgresRuntime, PostgresRuntimeImpl } from '@prisma-next/postgres/runtime';\nimport type { SqlStorage } from '@prisma-next/sql-contract/types';\nimport type { SqlExecutionPlan, SqlQueryPlan } from '@prisma-next/sql-relational-core/plan';\nimport type {\n  PreparedStatement,\n  PreparedStatementImpl,\n  RuntimeConnection,\n  RuntimeTransaction,\n} from '@prisma-next/sql-runtime';\nimport { blindCast } from '@prisma-next/utils/casts';\nimport type { SupabaseRole } from '../contract/roles';\n\nexport interface SupabaseRuntime extends PostgresRuntime {}\n\nexport interface SupabaseRoleBinding {\n  readonly role: SupabaseRole;\n  readonly claims?: Record<string, unknown>;\n}\n\n/**\n * A connection with a Supabase role already bound via session-scoped set_config.\n * Implements `RuntimeConnection` so it plugs into ORM scope machinery and `withTransaction`.\n */\nexport interface RoleSession extends RuntimeConnection {}\n\nexport class SupabaseRuntimeImpl<\n  TContract extends Contract<SqlStorage> = Contract<SqlStorage>,\n> extends PostgresRuntimeImpl<TContract> {\n  /**\n   * Opens a raw connection and applies role + JWT claims via session-scoped set_config.\n   * On bind failure, destroys the connection before rethrowing — no leaked connections.\n   * Not on the `SupabaseRuntime` interface; consumed by the facade, not by app code.\n   */\n  async openRoleSession(binding: SupabaseRoleBinding): Promise<RoleSession> {\n    const conn = await this.acquireRawConnection();\n\n    try {\n      await conn.query('SELECT set_config($1, $2, false)', ['role', binding.role]);\n      await conn.query('SELECT set_config($1, $2, false)', [\n        'request.jwt.claims',\n        JSON.stringify(binding.claims ?? {}),\n      ]);\n    } catch (err) {\n      await conn.destroy(err).catch(() => undefined);\n      throw err;\n    }\n\n    const self = this;\n\n    const session: RoleSession = {\n      execute<Row>(\n        plan: (SqlExecutionPlan<unknown> | SqlQueryPlan<unknown>) & { readonly _row?: Row },\n        options?: RuntimeExecuteOptions,\n      ): AsyncIterableResult<Row> {\n        return self.executeAgainstQueryable<Row>(plan, conn, { ...options, scope: 'connection' });\n      },\n\n      executePrepared<Params, Row>(\n        ps: PreparedStatement<Params, Row>,\n        params: Params,\n        options?: RuntimeExecuteOptions,\n      ): AsyncIterableResult<Row> {\n        return self.executePreparedAgainstQueryable(\n          blindCast<\n            PreparedStatementImpl<Params, Row>,\n            'PreparedStatement is PreparedStatementImpl; the impl class is the only concrete form'\n          >(ps),\n          blindCast<\n            Record<string, unknown>,\n            'params are structurally Record<string, unknown> at runtime'\n          >(params),\n          conn,\n          { ...options, scope: 'connection' },\n        );\n      },\n\n      async transaction(): Promise<RuntimeTransaction> {\n        const tx = await conn.beginTransaction();\n        return {\n          async commit(): Promise<void> {\n            await tx.commit();\n          },\n          async rollback(): Promise<void> {\n            await tx.rollback();\n          },\n          execute<Row>(\n            plan: (SqlExecutionPlan<unknown> | SqlQueryPlan<unknown>) & { readonly _row?: Row },\n            options?: RuntimeExecuteOptions,\n          ): AsyncIterableResult<Row> {\n            return self.executeAgainstQueryable<Row>(plan, tx, {\n              ...options,\n              scope: 'transaction',\n            });\n          },\n          executePrepared<Params, Row>(\n            ps: PreparedStatement<Params, Row>,\n            params: Params,\n            options?: RuntimeExecuteOptions,\n          ): AsyncIterableResult<Row> {\n            return self.executePreparedAgainstQueryable(\n              blindCast<\n                PreparedStatementImpl<Params, Row>,\n                'PreparedStatement is PreparedStatementImpl; the impl class is the only concrete form'\n              >(ps),\n              blindCast<\n                Record<string, unknown>,\n                'params are structurally Record<string, unknown> at runtime'\n              >(params),\n              tx,\n              { ...options, scope: 'transaction' },\n            );\n          },\n        };\n      },\n\n      /**\n       * Resets all session-local config then releases the connection back to the pool.\n       * If RESET ALL fails, destroys the connection instead — pool-poisoning guarantee.\n       */\n      async release(): Promise<void> {\n        try {\n          await conn.query('RESET ALL');\n          await conn.release();\n        } catch (resetError) {\n          await conn.destroy(resetError).catch(() => undefined);\n        }\n      },\n\n      async destroy(reason?: unknown): Promise<void> {\n        await conn.destroy(reason);\n      },\n    };\n\n    return session;\n  }\n\n  /**\n   * Opens a role session, executes the plan, then releases after the stream drains.\n   * On mid-stream error, destroys the session instead of releasing.\n   */\n  executeWithRole<Row>(\n    plan: SqlExecutionPlan<Row> | SqlQueryPlan<Row>,\n    binding: SupabaseRoleBinding,\n    options?: RuntimeExecuteOptions,\n  ): AsyncIterableResult<Row> {\n    const self = this;\n\n    const generator = async function* (): AsyncGenerator<Row, void, unknown> {\n      const session = await self.openRoleSession(binding);\n      let errored = false;\n      try {\n        for await (const row of session.execute(plan, options)) {\n          yield row;\n        }\n      } catch (err) {\n        errored = true;\n        await session.destroy(err).catch(() => undefined);\n        throw err;\n      } finally {\n        if (!errored) {\n          await session.release();\n        }\n      }\n    };\n\n    return new AsyncIterableResult(generator());\n  }\n}\n","import postgresAdapter from '@prisma-next/adapter-postgres/runtime';\nimport type { Contract } from '@prisma-next/contract/types';\nimport postgresDriver from '@prisma-next/driver-postgres/runtime';\nimport { instantiateExecutionStack } from '@prisma-next/framework-components/execution';\nimport type {\n  AsyncIterableResult,\n  RuntimeExecuteOptions,\n} from '@prisma-next/framework-components/runtime';\nimport {\n  buildNamespacedNativeEnums,\n  isPgPool,\n  type NamespacedNativeEnums,\n} from '@prisma-next/postgres/runtime';\nimport { sql } from '@prisma-next/sql-builder/runtime';\nimport type { Db } from '@prisma-next/sql-builder/types';\nimport type { SqlStorage } from '@prisma-next/sql-contract/types';\nimport { orm } from '@prisma-next/sql-orm-client';\nimport type { RawSqlTag } from '@prisma-next/sql-relational-core/expression';\nimport { createRawSql } from '@prisma-next/sql-relational-core/expression';\nimport type { SqlExecutionPlan, SqlQueryPlan } from '@prisma-next/sql-relational-core/plan';\nimport type {\n  ExecutionContext,\n  SqlExecutionStackWithDriver,\n  SqlMiddleware,\n  SqlRuntimeExtensionDescriptor,\n  TransactionContext,\n  VerifyMarkerOption,\n} from '@prisma-next/sql-runtime';\nimport {\n  createExecutionContext,\n  createSqlExecutionStack,\n  withTransaction,\n} from '@prisma-next/sql-runtime';\nimport postgresTarget, { PostgresContractSerializer } from '@prisma-next/target-postgres/runtime';\nimport { blindCast } from '@prisma-next/utils/casts';\nimport { ifDefined } from '@prisma-next/utils/defined';\nimport { createRemoteJWKSet, decodeProtectedHeader, type JWTVerifyResult, jwtVerify } from 'jose';\nimport type { Client } from 'pg';\nimport { Pool } from 'pg';\nimport extensionContractJson from '../contract/contract.json' with { type: 'json' };\nimport { isSupabaseRole, SUPABASE_JWT_ROLE_CLAIM, SupabaseRole } from '../contract/roles';\nimport { supabaseRuntimeDescriptor } from './descriptor';\nimport type { SupabaseExtensionContract } from './ext-contract-type';\nimport type { SupabaseRoleBinding, SupabaseRuntime } from './supabase-runtime';\nimport { SupabaseRuntimeImpl } from './supabase-runtime';\n\nexport type SupabaseTargetId = 'postgres';\n\ntype OrmClient<TContract extends Contract<SqlStorage>> = ReturnType<typeof orm<TContract>>;\n\nexport class SupabaseConfigError extends Error {\n  override readonly name = 'SupabaseConfigError';\n}\n\nexport class InvalidJwtError extends Error {\n  override readonly name = 'InvalidJwtError';\n  readonly reason: string;\n  constructor(reason: string) {\n    super(`Invalid JWT: ${reason}`);\n    this.reason = reason;\n  }\n}\n\ntype KeyMaterial =\n  | { readonly kind: 'secret'; readonly key: Uint8Array }\n  | { readonly kind: 'jwks'; readonly keyset: ReturnType<typeof createRemoteJWKSet> };\n\nexport interface RoleBoundDb<TContract extends Contract<SqlStorage>> {\n  readonly sql: Db<TContract>;\n  readonly orm: OrmClient<TContract>;\n  readonly raw: RawSqlTag;\n  execute<Row>(\n    plan: (SqlExecutionPlan<Row> | SqlQueryPlan<Row>) & { readonly _row?: Row },\n    options?: RuntimeExecuteOptions,\n  ): AsyncIterableResult<Row>;\n  transaction<R>(fn: (tx: TransactionContext) => PromiseLike<R>): Promise<R>;\n}\n\n/**\n * Query surface for the Supabase-internal contract (`auth`, `storage`). Exposed\n * as a separate secondary root — never merged into the app contract — and only\n * reachable through `service_role`, the one role with grants on those schemas\n * over a direct Postgres connection.\n *\n * Deliberately omits `transaction` (which {@link RoleBoundDb} has): the primary\n * app root and this secondary root are served by separate runtimes that do not\n * share one pinned connection, so a transaction spanning both is out of scope for v1.\n */\nexport interface SupabaseInternalDb {\n  readonly sql: Db<SupabaseExtensionContract>;\n  readonly orm: OrmClient<SupabaseExtensionContract>;\n  readonly nativeEnums: NamespacedNativeEnums<SupabaseExtensionContract>;\n  execute<Row>(\n    plan: (SqlExecutionPlan<Row> | SqlQueryPlan<Row>) & { readonly _row?: Row },\n    options?: RuntimeExecuteOptions,\n  ): AsyncIterableResult<Row>;\n}\n\n/**\n * The `service_role` db: the app-contract role-bound surface (its `.sql` / `.orm`\n * are app-only, exactly like `asUser` / `asAnon`), plus a `.supabase` secondary\n * root for the Supabase-internal namespaces.\n */\nexport type ServiceRoleDb<TContract extends Contract<SqlStorage>> = RoleBoundDb<TContract> & {\n  readonly supabase: SupabaseInternalDb;\n};\n\nexport interface SupabaseDb<TContract extends Contract<SqlStorage>> {\n  readonly context: ExecutionContext<TContract>;\n  readonly stack: SqlExecutionStackWithDriver<SupabaseTargetId>;\n  asUser(jwt: string): Promise<RoleBoundDb<TContract>>;\n  asAnon(): RoleBoundDb<TContract>;\n  asServiceRole(): ServiceRoleDb<TContract>;\n  close(): Promise<void>;\n  [Symbol.asyncDispose](): Promise<void>;\n}\n\nexport interface SupabaseOptionsBase {\n  readonly extensions?: readonly SqlRuntimeExtensionDescriptor<SupabaseTargetId>[];\n  readonly middleware?: readonly SqlMiddleware[];\n  readonly verifyMarker?: VerifyMarkerOption;\n  readonly poolOptions?: {\n    readonly connectionTimeoutMillis?: number;\n    readonly idleTimeoutMillis?: number;\n  };\n}\n\nexport interface SupabaseBindingOptions {\n  readonly url?: string;\n  readonly pg?: Pool | Client;\n}\n\ntype JwtSecretOption = {\n  readonly jwtSecret: string;\n  readonly jwksUrl?: never;\n};\n\ntype JwksUrlOption = {\n  readonly jwksUrl: string;\n  readonly jwtSecret?: never;\n};\n\nexport type SupabaseOptionsWithContract<TContract extends Contract<SqlStorage>> =\n  SupabaseBindingOptions &\n    SupabaseOptionsBase &\n    (JwtSecretOption | JwksUrlOption) & {\n      readonly contract: TContract;\n      readonly contractJson?: never;\n    };\n\nexport type SupabaseOptionsWithContractJson<TContract extends Contract<SqlStorage>> =\n  SupabaseBindingOptions &\n    SupabaseOptionsBase &\n    (JwtSecretOption | JwksUrlOption) & {\n      readonly contractJson: unknown;\n      readonly contract?: never;\n      readonly _contract?: TContract;\n    };\n\nexport type SupabaseOptions<TContract extends Contract<SqlStorage>> =\n  | SupabaseOptionsWithContract<TContract>\n  | SupabaseOptionsWithContractJson<TContract>;\n\nfunction hasContractJson<TContract extends Contract<SqlStorage>>(\n  options: SupabaseOptions<TContract>,\n): options is SupabaseOptionsWithContractJson<TContract> {\n  return 'contractJson' in options;\n}\n\nconst contractSerializer = new PostgresContractSerializer();\n\nfunction resolveContract<TContract extends Contract<SqlStorage>>(\n  options: SupabaseOptions<TContract>,\n): TContract {\n  const contractJson = hasContractJson(options)\n    ? options.contractJson\n    : contractSerializer.serializeContract(options.contract);\n  return blindCast<\n    TContract,\n    'contractSerializer.deserializeContract returns a validated TContract'\n  >(contractSerializer.deserializeContract(contractJson));\n}\n\nfunction resolveKeyMaterial<TContract extends Contract<SqlStorage>>(\n  options: SupabaseOptions<TContract>,\n): KeyMaterial {\n  const jwtSecret = 'jwtSecret' in options ? options.jwtSecret : undefined;\n  const jwksUrl = 'jwksUrl' in options ? options.jwksUrl : undefined;\n\n  if (jwtSecret !== undefined && jwksUrl !== undefined) {\n    throw new SupabaseConfigError('Provide either jwtSecret or jwksUrl, not both');\n  }\n  if (jwtSecret === undefined && jwksUrl === undefined) {\n    throw new SupabaseConfigError('Either jwtSecret or jwksUrl is required');\n  }\n\n  if (jwtSecret !== undefined) {\n    return { kind: 'secret', key: new TextEncoder().encode(jwtSecret) };\n  }\n\n  if (jwksUrl !== undefined) {\n    return { kind: 'jwks', keyset: createRemoteJWKSet(new URL(jwksUrl)) };\n  }\n\n  throw new SupabaseConfigError('Either jwtSecret or jwksUrl is required');\n}\n\n/**\n * Pre-verification check that the token's signing algorithm can possibly\n * match the configured key material. Without it the mismatch surfaces as a\n * jose internal (\"Key for the ES256 algorithm must be one of type\n * CryptoKey... Received an instance of Uint8Array\") that never names the\n * actual problem: current Supabase projects sign ES256 via JWKS by default,\n * while `supabase status` still prints a JWT_SECRET that only fits legacy\n * HS256 projects. Returns `undefined` when the pairing is plausible or the\n * header is unreadable (jwtVerify then produces the canonical error).\n */\nfunction algKeyMismatchReason(jwt: string, kind: KeyMaterial['kind']): string | undefined {\n  let alg: string | undefined;\n  try {\n    alg = decodeProtectedHeader(jwt).alg;\n  } catch {\n    return undefined;\n  }\n  if (alg === undefined) return undefined;\n  const asymmetric = /^(?:ES|RS|PS)\\d{3}$/.test(alg) || alg === 'EdDSA' || alg === 'Ed25519';\n  if (kind === 'secret' && asymmetric) {\n    return (\n      `token is signed with ${alg} but this client is configured with jwtSecret (HS256). ` +\n      'Current Supabase projects sign with asymmetric keys by default — configure ' +\n      'jwksUrl (https://<project>/auth/v1/.well-known/jwks.json) instead of jwtSecret.'\n    );\n  }\n  if (kind === 'jwks' && alg.startsWith('HS')) {\n    return (\n      `token is signed with ${alg} (a symmetric algorithm) but this client is configured ` +\n      'with jwksUrl. A legacy HS256 Supabase project needs jwtSecret (the JWT_SECRET from ' +\n      '`supabase status`) instead of jwksUrl.'\n    );\n  }\n  return undefined;\n}\n\nfunction toPool<TContract extends Contract<SqlStorage>>(\n  options: SupabaseOptions<TContract>,\n): { pool: Pool; owned: boolean } | undefined {\n  if (options.pg !== undefined && isPgPool(options.pg)) {\n    return { pool: options.pg, owned: false };\n  }\n  if (typeof options.url === 'string') {\n    return {\n      pool: new Pool({\n        connectionString: options.url,\n        connectionTimeoutMillis: options.poolOptions?.connectionTimeoutMillis ?? 20_000,\n        idleTimeoutMillis: options.poolOptions?.idleTimeoutMillis ?? 30_000,\n      }),\n      owned: true,\n    };\n  }\n  return undefined;\n}\n\nfunction withSupabaseDescriptor(\n  extensions: readonly SqlRuntimeExtensionDescriptor<SupabaseTargetId>[] | undefined,\n): readonly SqlRuntimeExtensionDescriptor<SupabaseTargetId>[] {\n  const packs = extensions ?? [];\n  return packs.some((pack) => pack.id === supabaseRuntimeDescriptor.id)\n    ? packs\n    : [...packs, supabaseRuntimeDescriptor];\n}\n\n/**\n * Deserializes the Supabase extension's own emitted contract into a runtime\n * contract: namespaces hydrate into `PostgresSchema` instances (with\n * `qualifyTable`), and `typeRef` columns (`Timestamptz`, `Uuid`) resolve\n * through the codec registry. Exposed only via `service_role`'s `.supabase`\n * secondary root — never merged into the app contract.\n */\nfunction buildExtensionContract(): SupabaseExtensionContract {\n  return blindCast<\n    SupabaseExtensionContract,\n    'deserializeContract hydrates JSON namespaces into PostgresSchema instances with qualifyTable'\n  >(contractSerializer.deserializeContract(extensionContractJson));\n}\n\nexport default async function supabase<TContract extends Contract<SqlStorage>>(\n  options: SupabaseOptionsWithContract<TContract>,\n): Promise<SupabaseDb<TContract>>;\nexport default async function supabase<TContract extends Contract<SqlStorage>>(\n  options: SupabaseOptionsWithContractJson<TContract>,\n): Promise<SupabaseDb<TContract>>;\nexport default async function supabase<TContract extends Contract<SqlStorage>>(\n  options: SupabaseOptions<TContract>,\n): Promise<SupabaseDb<TContract>> {\n  const keyMaterial = resolveKeyMaterial(options);\n  const contract = resolveContract(options);\n\n  const stack = createSqlExecutionStack({\n    target: postgresTarget,\n    adapter: postgresAdapter,\n    driver: postgresDriver,\n    extensionPacks: withSupabaseDescriptor(options.extensions),\n  });\n\n  const context = createExecutionContext({ contract, stack });\n  const rawCodecInferer = stack.adapter.rawCodecInferer;\n  const rawSqlTag: RawSqlTag = createRawSql(rawCodecInferer);\n\n  const poolEntry = toPool(options);\n  let closed = false;\n\n  const stackInstance = instantiateExecutionStack(stack);\n  const driverDescriptor = stack.driver;\n  if (!driverDescriptor) {\n    throw new Error('Driver descriptor missing from execution stack');\n  }\n  const driver = driverDescriptor.create({ cursor: { disabled: true } });\n\n  if (poolEntry) {\n    await driver.connect({ kind: 'pgPool', pool: poolEntry.pool });\n  }\n\n  const runtime: SupabaseRuntime & SupabaseRuntimeImpl<TContract> = new SupabaseRuntimeImpl({\n    context,\n    adapter: stackInstance.adapter,\n    driver,\n    ...ifDefined('verifyMarker', options.verifyMarker),\n    ...ifDefined('middleware', options.middleware),\n  });\n\n  async function verifyJwt(jwt: string): Promise<JWTVerifyResult> {\n    const mismatch = algKeyMismatchReason(jwt, keyMaterial.kind);\n    if (mismatch !== undefined) {\n      throw new InvalidJwtError(mismatch);\n    }\n    try {\n      if (keyMaterial.kind === 'secret') {\n        return await jwtVerify(jwt, keyMaterial.key);\n      }\n      return await jwtVerify(jwt, keyMaterial.keyset);\n    } catch (err) {\n      const reason = err instanceof Error ? err.message : String(err);\n      throw new InvalidJwtError(reason);\n    }\n  }\n\n  function buildRoleBoundDbWithContext<C extends Contract<SqlStorage>>(\n    binding: SupabaseRoleBinding,\n    roleContext: ExecutionContext<C>,\n    roleRuntime: SupabaseRuntime & SupabaseRuntimeImpl<C>,\n  ): RoleBoundDb<C> {\n    const roleSql: Db<C> = sql<C>({ context: roleContext, rawCodecInferer });\n    const roleOrm: OrmClient<C> = orm({\n      runtime: {\n        execute(plan) {\n          return roleRuntime.executeWithRole(plan, binding);\n        },\n        connection: () => roleRuntime.openRoleSession(binding),\n      },\n      context: roleContext,\n    });\n\n    return {\n      sql: roleSql,\n      orm: roleOrm,\n      raw: rawSqlTag,\n      execute<Row>(\n        plan: (SqlExecutionPlan<Row> | SqlQueryPlan<Row>) & { readonly _row?: Row },\n        execOptions?: RuntimeExecuteOptions,\n      ): AsyncIterableResult<Row> {\n        return roleRuntime.executeWithRole<Row>(plan, binding, execOptions);\n      },\n      transaction<R>(fn: (tx: TransactionContext) => PromiseLike<R>): Promise<R> {\n        return withTransaction({ connection: () => roleRuntime.openRoleSession(binding) }, fn);\n      },\n    };\n  }\n\n  function buildRoleBoundDb(binding: SupabaseRoleBinding): RoleBoundDb<TContract> {\n    return buildRoleBoundDbWithContext(binding, context, runtime);\n  }\n\n  const serviceRoleBinding: SupabaseRoleBinding = {\n    role: SupabaseRole.members.ServiceRole,\n    claims: {},\n  };\n\n  // The Supabase-internal contract (auth/storage) as a separate secondary root.\n  // It is contract-bound: a plan built against it carries the extension's\n  // storageHash, so it must run on a runtime bound to the extension contract —\n  // the app runtime would reject it (PLAN.HASH_MISMATCH). This runtime shares\n  // the same driver (one pool, no second connection) and disables marker\n  // verification: the extension contract is external and owns no app-space\n  // marker, so its hashes must not be checked against the DB marker.\n  const extContract = buildExtensionContract();\n  const extContext = createExecutionContext({ contract: extContract, stack });\n  const extRuntime: SupabaseRuntime & SupabaseRuntimeImpl<SupabaseExtensionContract> =\n    new SupabaseRuntimeImpl({\n      context: extContext,\n      adapter: stackInstance.adapter,\n      driver,\n      verifyMarker: false,\n      ...ifDefined('middleware', options.middleware),\n    });\n\n  const extNativeEnums = blindCast<\n    NamespacedNativeEnums<SupabaseExtensionContract>,\n    'buildNamespacedNativeEnums returns the namespace-keyed accessor map this contract types'\n  >(Object.freeze(buildNamespacedNativeEnums(extContract.storage)));\n\n  const supabaseInternal: SupabaseInternalDb = {\n    sql: sql<SupabaseExtensionContract>({ context: extContext, rawCodecInferer }),\n    orm: orm({\n      runtime: {\n        execute(plan) {\n          return extRuntime.executeWithRole(plan, serviceRoleBinding);\n        },\n        connection: () => extRuntime.openRoleSession(serviceRoleBinding),\n      },\n      context: extContext,\n    }),\n    nativeEnums: extNativeEnums,\n    execute<Row>(\n      plan: (SqlExecutionPlan<Row> | SqlQueryPlan<Row>) & { readonly _row?: Row },\n      execOptions?: RuntimeExecuteOptions,\n    ): AsyncIterableResult<Row> {\n      return extRuntime.executeWithRole<Row>(plan, serviceRoleBinding, execOptions);\n    },\n  };\n\n  async function closeDb(): Promise<void> {\n    if (closed) return;\n    closed = true;\n    await runtime.close();\n    if (poolEntry?.owned) {\n      await poolEntry.pool.end().catch(() => undefined);\n    }\n  }\n\n  return {\n    context,\n    stack,\n\n    async asUser(jwt: string): Promise<RoleBoundDb<TContract>> {\n      const { payload } = await verifyJwt(jwt);\n      const rawRole = payload[SUPABASE_JWT_ROLE_CLAIM];\n      const roleStr = typeof rawRole === 'string' ? rawRole : SupabaseRole.members.Authenticated;\n      const role: SupabaseRoleBinding['role'] = isSupabaseRole(roleStr)\n        ? roleStr\n        : SupabaseRole.members.Authenticated;\n      const binding: SupabaseRoleBinding = { role, claims: payload };\n      return buildRoleBoundDb(binding);\n    },\n\n    asAnon(): RoleBoundDb<TContract> {\n      return buildRoleBoundDb({ role: SupabaseRole.members.Anon, claims: {} });\n    },\n\n    asServiceRole(): ServiceRoleDb<TContract> {\n      const roleBound = buildRoleBoundDbWithContext(serviceRoleBinding, context, runtime);\n      return { ...roleBound, supabase: supabaseInternal };\n    },\n\n    close: closeDb,\n    [Symbol.asyncDispose]: closeDb,\n  };\n}\n","import { supabaseRuntimeDescriptor } from '../runtime/descriptor';\n\nexport default supabaseRuntimeDescriptor;\n\nexport type { SupabaseExtensionContract } from '../runtime/ext-contract-type';\nexport type {\n  RoleBoundDb,\n  ServiceRoleDb,\n  SupabaseDb,\n  SupabaseInternalDb,\n  SupabaseOptions,\n  SupabaseOptionsWithContract,\n  SupabaseOptionsWithContractJson,\n  SupabaseTargetId,\n} from '../runtime/supabase';\nexport { default as supabase, InvalidJwtError, SupabaseConfigError } from '../runtime/supabase';\nexport type {\n  RoleSession,\n  SupabaseRoleBinding,\n  SupabaseRuntime,\n} from '../runtime/supabase-runtime';\nexport { SupabaseRuntimeImpl } from '../runtime/supabase-runtime';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAYA,MAAa,4BAAuE;CAClF,MAAM;CACN,IAAI;CACKA;CACT,UAAU;CACV,UAAU;CACV,cAAc,CAAC;CACf,SAAS;EACP,OAAO;GACL,UAAU;GACV,UAAU;EACZ;CACF;AACF;;;ACGA,IAAa,sBAAb,cAEU,oBAA+B;;;;;;CAMvC,MAAM,gBAAgB,SAAoD;EACxE,MAAM,OAAO,MAAM,KAAK,qBAAqB;EAE7C,IAAI;GACF,MAAM,KAAK,MAAM,oCAAoC,CAAC,QAAQ,QAAQ,IAAI,CAAC;GAC3E,MAAM,KAAK,MAAM,oCAAoC,CACnD,sBACA,KAAK,UAAU,QAAQ,UAAU,CAAC,CAAC,CACrC,CAAC;EACH,SAAS,KAAK;GACZ,MAAM,KAAK,QAAQ,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;GAC7C,MAAM;EACR;EAEA,MAAM,OAAO;EAsFb,OAAO;GAnFL,QACE,MACA,SAC0B;IAC1B,OAAO,KAAK,wBAA6B,MAAM,MAAM;KAAE,GAAG;KAAS,OAAO;IAAa,CAAC;GAC1F;GAEA,gBACE,IACA,QACA,SAC0B;IAC1B,OAAO,KAAK,gCACV,UAGE,EAAE,GACJ,UAGE,MAAM,GACR,MACA;KAAE,GAAG;KAAS,OAAO;IAAa,CACpC;GACF;GAEA,MAAM,cAA2C;IAC/C,MAAM,KAAK,MAAM,KAAK,iBAAiB;IACvC,OAAO;KACL,MAAM,SAAwB;MAC5B,MAAM,GAAG,OAAO;KAClB;KACA,MAAM,WAA0B;MAC9B,MAAM,GAAG,SAAS;KACpB;KACA,QACE,MACA,SAC0B;MAC1B,OAAO,KAAK,wBAA6B,MAAM,IAAI;OACjD,GAAG;OACH,OAAO;MACT,CAAC;KACH;KACA,gBACE,IACA,QACA,SAC0B;MAC1B,OAAO,KAAK,gCACV,UAGE,EAAE,GACJ,UAGE,MAAM,GACR,IACA;OAAE,GAAG;OAAS,OAAO;MAAc,CACrC;KACF;IACF;GACF;;;;;GAMA,MAAM,UAAyB;IAC7B,IAAI;KACF,MAAM,KAAK,MAAM,WAAW;KAC5B,MAAM,KAAK,QAAQ;IACrB,SAAS,YAAY;KACnB,MAAM,KAAK,QAAQ,UAAU,CAAC,CAAC,YAAY,KAAA,CAAS;IACtD;GACF;GAEA,MAAM,QAAQ,QAAiC;IAC7C,MAAM,KAAK,QAAQ,MAAM;GAC3B;EAGW;CACf;;;;;CAMA,gBACE,MACA,SACA,SAC0B;EAC1B,MAAM,OAAO;EAEb,MAAM,YAAY,mBAAuD;GACvE,MAAM,UAAU,MAAM,KAAK,gBAAgB,OAAO;GAClD,IAAI,UAAU;GACd,IAAI;IACF,WAAW,MAAM,OAAO,QAAQ,QAAQ,MAAM,OAAO,GACnD,MAAM;GAEV,SAAS,KAAK;IACZ,UAAU;IACV,MAAM,QAAQ,QAAQ,GAAG,CAAC,CAAC,YAAY,KAAA,CAAS;IAChD,MAAM;GACR,UAAU;IACR,IAAI,CAAC,SACH,MAAM,QAAQ,QAAQ;GAE1B;EACF;EAEA,OAAO,IAAI,oBAAoB,UAAU,CAAC;CAC5C;AACF;;;ACxHA,IAAa,sBAAb,cAAyC,MAAM;CAC7C,OAAyB;AAC3B;AAEA,IAAa,kBAAb,cAAqC,MAAM;CACzC,OAAyB;CACzB;CACA,YAAY,QAAgB;EAC1B,MAAM,gBAAgB,QAAQ;EAC9B,KAAK,SAAS;CAChB;AACF;AAsGA,SAAS,gBACP,SACuD;CACvD,OAAO,kBAAkB;AAC3B;AAEA,MAAM,qBAAqB,IAAI,2BAA2B;AAE1D,SAAS,gBACP,SACW;CACX,MAAM,eAAe,gBAAgB,OAAO,IACxC,QAAQ,eACR,mBAAmB,kBAAkB,QAAQ,QAAQ;CACzD,OAAO,UAGL,mBAAmB,oBAAoB,YAAY,CAAC;AACxD;AAEA,SAAS,mBACP,SACa;CACb,MAAM,YAAY,eAAe,UAAU,QAAQ,YAAY,KAAA;CAC/D,MAAM,UAAU,aAAa,UAAU,QAAQ,UAAU,KAAA;CAEzD,IAAI,cAAc,KAAA,KAAa,YAAY,KAAA,GACzC,MAAM,IAAI,oBAAoB,+CAA+C;CAE/E,IAAI,cAAc,KAAA,KAAa,YAAY,KAAA,GACzC,MAAM,IAAI,oBAAoB,yCAAyC;CAGzE,IAAI,cAAc,KAAA,GAChB,OAAO;EAAE,MAAM;EAAU,KAAK,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS;CAAE;CAGpE,IAAI,YAAY,KAAA,GACd,OAAO;EAAE,MAAM;EAAQ,QAAQ,mBAAmB,IAAI,IAAI,OAAO,CAAC;CAAE;CAGtE,MAAM,IAAI,oBAAoB,yCAAyC;AACzE;;;;;;;;;;;AAYA,SAAS,qBAAqB,KAAa,MAA+C;CACxF,IAAI;CACJ,IAAI;EACF,MAAM,sBAAsB,GAAG,CAAC,CAAC;CACnC,QAAQ;EACN;CACF;CACA,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAC9B,MAAM,aAAa,sBAAsB,KAAK,GAAG,KAAK,QAAQ,WAAW,QAAQ;CACjF,IAAI,SAAS,YAAY,YACvB,OACE,wBAAwB,IAAI;CAKhC,IAAI,SAAS,UAAU,IAAI,WAAW,IAAI,GACxC,OACE,wBAAwB,IAAI;AAMlC;AAEA,SAAS,OACP,SAC4C;CAC5C,IAAI,QAAQ,OAAO,KAAA,KAAa,SAAS,QAAQ,EAAE,GACjD,OAAO;EAAE,MAAM,QAAQ;EAAI,OAAO;CAAM;CAE1C,IAAI,OAAO,QAAQ,QAAQ,UACzB,OAAO;EACL,MAAM,IAAI,KAAK;GACb,kBAAkB,QAAQ;GAC1B,yBAAyB,QAAQ,aAAa,2BAA2B;GACzE,mBAAmB,QAAQ,aAAa,qBAAqB;EAC/D,CAAC;EACD,OAAO;CACT;AAGJ;AAEA,SAAS,uBACP,YAC4D;CAC5D,MAAM,QAAQ,cAAc,CAAC;CAC7B,OAAO,MAAM,MAAM,SAAS,KAAK,OAAO,0BAA0B,EAAE,IAChE,QACA,CAAC,GAAG,OAAO,yBAAyB;AAC1C;;;;;;;;AASA,SAAS,yBAAoD;CAC3D,OAAO,UAGL,mBAAmB,oBAAoBC,gBAAqB,CAAC;AACjE;AAQA,eAA8B,SAC5B,SACgC;CAChC,MAAM,cAAc,mBAAmB,OAAO;CAC9C,MAAM,WAAW,gBAAgB,OAAO;CAExC,MAAM,QAAQ,wBAAwB;EACpC,QAAQ;EACR,SAAS;EACT,QAAQ;EACR,gBAAgB,uBAAuB,QAAQ,UAAU;CAC3D,CAAC;CAED,MAAM,UAAU,uBAAuB;EAAE;EAAU;CAAM,CAAC;CAC1D,MAAM,kBAAkB,MAAM,QAAQ;CACtC,MAAM,YAAuB,aAAa,eAAe;CAEzD,MAAM,YAAY,OAAO,OAAO;CAChC,IAAI,SAAS;CAEb,MAAM,gBAAgB,0BAA0B,KAAK;CACrD,MAAM,mBAAmB,MAAM;CAC/B,IAAI,CAAC,kBACH,MAAM,IAAI,MAAM,gDAAgD;CAElE,MAAM,SAAS,iBAAiB,OAAO,EAAE,QAAQ,EAAE,UAAU,KAAK,EAAE,CAAC;CAErE,IAAI,WACF,MAAM,OAAO,QAAQ;EAAE,MAAM;EAAU,MAAM,UAAU;CAAK,CAAC;CAG/D,MAAM,UAA4D,IAAI,oBAAoB;EACxF;EACA,SAAS,cAAc;EACvB;EACA,GAAG,UAAU,gBAAgB,QAAQ,YAAY;EACjD,GAAG,UAAU,cAAc,QAAQ,UAAU;CAC/C,CAAC;CAED,eAAe,UAAU,KAAuC;EAC9D,MAAM,WAAW,qBAAqB,KAAK,YAAY,IAAI;EAC3D,IAAI,aAAa,KAAA,GACf,MAAM,IAAI,gBAAgB,QAAQ;EAEpC,IAAI;GACF,IAAI,YAAY,SAAS,UACvB,OAAO,MAAM,UAAU,KAAK,YAAY,GAAG;GAE7C,OAAO,MAAM,UAAU,KAAK,YAAY,MAAM;EAChD,SAAS,KAAK;GAEZ,MAAM,IAAI,gBADK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAC9B;EAClC;CACF;CAEA,SAAS,4BACP,SACA,aACA,aACgB;EAYhB,OAAO;GACL,KAZqB,IAAO;IAAE,SAAS;IAAa;GAAgB,CAYzD;GACX,KAZ4B,IAAI;IAChC,SAAS;KACP,QAAQ,MAAM;MACZ,OAAO,YAAY,gBAAgB,MAAM,OAAO;KAClD;KACA,kBAAkB,YAAY,gBAAgB,OAAO;IACvD;IACA,SAAS;GACX,CAIa;GACX,KAAK;GACL,QACE,MACA,aAC0B;IAC1B,OAAO,YAAY,gBAAqB,MAAM,SAAS,WAAW;GACpE;GACA,YAAe,IAA4D;IACzE,OAAO,gBAAgB,EAAE,kBAAkB,YAAY,gBAAgB,OAAO,EAAE,GAAG,EAAE;GACvF;EACF;CACF;CAEA,SAAS,iBAAiB,SAAsD;EAC9E,OAAO,4BAA4B,SAAS,SAAS,OAAO;CAC9D;CAEA,MAAM,qBAA0C;EAC9C,MAAM,aAAa,QAAQ;EAC3B,QAAQ,CAAC;CACX;CASA,MAAM,cAAc,uBAAuB;CAC3C,MAAM,aAAa,uBAAuB;EAAE,UAAU;EAAa;CAAM,CAAC;CAC1E,MAAM,aACJ,IAAI,oBAAoB;EACtB,SAAS;EACT,SAAS,cAAc;EACvB;EACA,cAAc;EACd,GAAG,UAAU,cAAc,QAAQ,UAAU;CAC/C,CAAC;CAEH,MAAM,iBAAiB,UAGrB,OAAO,OAAO,2BAA2B,YAAY,OAAO,CAAC,CAAC;CAEhE,MAAM,mBAAuC;EAC3C,KAAK,IAA+B;GAAE,SAAS;GAAY;EAAgB,CAAC;EAC5E,KAAK,IAAI;GACP,SAAS;IACP,QAAQ,MAAM;KACZ,OAAO,WAAW,gBAAgB,MAAM,kBAAkB;IAC5D;IACA,kBAAkB,WAAW,gBAAgB,kBAAkB;GACjE;GACA,SAAS;EACX,CAAC;EACD,aAAa;EACb,QACE,MACA,aAC0B;GAC1B,OAAO,WAAW,gBAAqB,MAAM,oBAAoB,WAAW;EAC9E;CACF;CAEA,eAAe,UAAyB;EACtC,IAAI,QAAQ;EACZ,SAAS;EACT,MAAM,QAAQ,MAAM;EACpB,IAAI,WAAW,OACb,MAAM,UAAU,KAAK,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;CAEpD;CAEA,OAAO;EACL;EACA;EAEA,MAAM,OAAO,KAA8C;GACzD,MAAM,EAAE,YAAY,MAAM,UAAU,GAAG;GACvC,MAAM,UAAU,QAAQ;GACxB,MAAM,UAAU,OAAO,YAAY,WAAW,UAAU,aAAa,QAAQ;GAK7E,OAAO,iBAAiB;IADe,MAHG,eAAe,OAAO,IAC5D,UACA,aAAa,QAAQ;IACoB,QAAQ;GACvB,CAAC;EACjC;EAEA,SAAiC;GAC/B,OAAO,iBAAiB;IAAE,MAAM,aAAa,QAAQ;IAAM,QAAQ,CAAC;GAAE,CAAC;EACzE;EAEA,gBAA0C;GAExC,OAAO;IAAE,GADS,4BAA4B,oBAAoB,SAAS,OACvD;IAAG,UAAU;GAAiB;EACpD;EAEA,OAAO;GACN,OAAO,eAAe;CACzB;AACF;;;AChdA,IAAA,kBAAe"}