@managemint-solutions/sdk 0.23.0 → 0.24.0

package/README.md

@@ -241,32 +241,35 @@ import { configureSupabaseUserClient } from '@managemint-solutions/sdk/nest';
 configureSupabaseUserClient({ onAuditError: (error) => Sentry.captureException(error) });
 ```
 
-Consumers writing tables the SDK has no resource for (the api's admin-client modules) use the same
-helper over their own client, so they carry no audit code either:
+Service-role work with no caller (webhooks, the queue worker, provisioning) goes through the
+service client's organization scope, which supplies the audit actor — `mms_id: null` for system
+work — and hands out audited tables for anything the SDK has no resource for:
 
 ```ts
-import { AuditResource, auditedTable } from '@managemint-solutions/sdk';
+import { createSupabaseServiceClient } from '@managemint-solutions/sdk';
 import { AuditTrailAction, AuditTrailEntityType } from '@managemint-solutions/entities/audit-trail/enum';
 
-const actor = { mms_id: authUser.mms_id, organization_id: authUser.organization_id }; // mms_id: null for system jobs
-const audit = new AuditResource(adminClient, actor, onAuditError);
-const users = auditedTable(adminClient, actor, audit, {
-  table: 'users',
-  entityType: AuditTrailEntityType.USER,
-});
+const service = createSupabaseServiceClient({ url, serviceRoleKey, onAuditError });
+const scope = service.forOrganization(organizationId, actorMmsId); // actorMmsId: null for system jobs
+
+await scope.paymentMethod.set({ paystack_customer_code: 'CUS_x' });   // service-role-only resource
+const users = scope.table({ table: 'users', entityType: AuditTrailEntityType.USER });
 
-const row = await users.insert({ ...payload, organization_id: actor.organization_id });
+const row = await users.insert({ ...payload, organization_id: organizationId });
 await users.update(userId, { name: 'Ada' });                              // records UPDATE
 await users.update(userId, (before) => ({ active: !before.active }));     // payload from the pre-read
 await users.transition(userId, AuditTrailAction.DELETE, { deleted: true }); // records the given action
 const deleted = await users.remove(userId);                              // hard delete; returns the old row
 ```
 
+Cross-tenant lookups — the organization behind a Paystack code, a ledger row by id, every
+organization with a Paystack customer — hang off `service` itself, because a webhook or cron does
+not know its tenant until it looks one up.
+
 `update` / `transition` / `remove` pre-read the flat row (by `mms_id`, and by `organization_id`
 unless `scopeByOrganization: false` — the `organizations` table is its own tenant), so a missing
 row surfaces as the usual 406. The write itself still throws `SupabaseClientError` on failure;
-only the audit insert is swallowed. `diffChanges(before, after)` and
-`snapshotChanges(row, 'new' | 'old')` are exported as pure functions if you need them directly.
+only the audit insert is swallowed.
 
 Only what goes through the SDK/API is logged — a raw PostgREST write or a dashboard edit is not.
 
@@ -286,7 +289,7 @@ const auth = createSupabaseAuthClient({
 
 const { access_token, refresh_token } = await auth.signIn({ email, password });
 await auth.refreshSession({ refresh_token });
-await auth.signOut();
+await auth.signOut(access_token); // revokes that session's refresh token on the server
 
 // The redirect URL is passed in; the SDK reads no environment variables.
 await auth.sendPasswordResetEmail({ email }, `${process.env.FRONTEND_URL}/reset-password`);
@@ -296,9 +299,12 @@ await auth.resetPassword({ password, access_token, refresh_token });
 ```
 
 `signIn` also stamps `users.last_logged_in` for the user who just signed in, on a throwaway
-client carrying the fresh access token; a failed stamp never fails the login. `signOut` is a
-no-op server-side — the client holds no session — and is kept for parity with the api endpoint
-it replaces. `auth.supabase` is the raw `@supabase/supabase-js` client.
+client carrying the fresh access token; a failed stamp never fails the login. `signOut` takes the
+caller's access token because this client holds no session of its own: GoTrue's logout endpoint
+authenticates with the token itself, and the `local` scope ends that device's session only. Build
+one of these per request — supabase-js keeps the session `signIn`, `verifyOtp` and `setSession`
+produce in the client's memory, so a shared instance would leak sessions between callers.
+`auth.supabase` is the raw `@supabase/supabase-js` client.
 
 ```ts
 import { SupabasePublicClient } from '@managemint-solutions/sdk/nest';
@@ -313,6 +319,33 @@ export class AuthController {
 }
 ```
 
+## Billing and invoices
+
+Billing is split by who may write. On the caller's client, `supabase.billing` and
+`supabase.invoices` are **read** resources over the ledger and the invoices table, scoped by RLS
+to the caller's organization; every write to the ledger is service-role only and lives on the
+service client's organization scope (`scope.billing`, `scope.invoices`, `scope.paymentMethod`).
+
+```ts
+import type { InvoiceEntity, InvoiceSummary } from '@managemint-solutions/entities/billing/invoices';
+import type { MmsList } from '@managemint-solutions/entities/common';
+
+// Paginated, newest first; `status_in` is a CSV of BillingTransactionStatus values.
+const page: MmsList<InvoiceSummary> = await supabase.invoices.list({ page: 1, page_size: 25 });
+const invoice: InvoiceEntity | null = await supabase.invoices.byId(invoiceId); // null when not ours
+
+// Service side, when a ledger row is written:
+const next = (await scope.invoices.maxNumber()) + 1;      // per-organization sequence
+await scope.invoices.create(row);                          // unique (organization_id, invoice_number)
+await scope.invoices.syncStatus(transactionId, { status, paid_at });
+const references = await scope.billing.paystackReferences(); // what the reconcile diffs against
+```
+
+Invoice numbers are assigned by the writer as `max + 1` and arbitrated by the unique index: a
+`23505` on insert means a concurrent writer took the number, and the caller retries once with
+the next one. The document itself (HTML/PDF) is rendered by the api from the row; the SDK stores
+and reads rows only.
+
 ## Pricebooks
 
 The price catalog (`pricebooks`, `pricebook_modules`, `billing_modules`) is readable by `anon`
@@ -338,11 +371,14 @@ row joined with its `billing_modules` catalog entry). Exactly one pricebook is a
 
 Every error the SDK throws is a `SupabaseClientError` carrying the HTTP `status` to respond
 with and the client-facing body, `toResponse()` → `{ error, message }`. Postgrest/Postgres
-errors are translated by `mapPostgrestError` (Postgrest code → status, RLS permission and
-module denials → readable messages), Storage errors by `mapStorageError` (the storage error's
-own HTTP status, or 500 when it has none), Supabase Auth errors by `mapAuthError` (same rule,
-`Authentication Error`); JWT problems are `401 Authentication Error`. Consumers
-return these as-is instead of mapping database errors themselves.
+errors are mapped by code: `PGRST*` codes to their documented statuses, an RLS or grant denial
+(`42501`) to **403**, a unique or foreign-key violation (`23505`, `23503`) to **409**, a not-null,
+check or malformed-literal failure (`23502`, `23514`, `22P02`) to **400**, anything else 500 —
+the message is always Postgrest's own. Storage errors carry the storage error's own HTTP status
+(500 when it has none); Supabase Auth errors likewise, as `Authentication Error`; a rejected or
+missing JWT is `401 Authentication Error`. Consumers return these as-is instead of mapping
+database errors themselves, and `error.code` keeps the raw Postgres code for the few callers
+that branch on one (the invoice-number retry on `23505`).
 
 ## NestJS
 

package/dist/additional-details/dto.js

@@ -141,4 +141,3 @@ __decorate([
     (0, class_validator_1.IsBoolean)({ message: 'Invalid copyable value' }),
     __metadata("design:type", Boolean)
 ], UpdateAdditionalDetailsDto.prototype, "copyable", void 0);
-//# sourceMappingURL=dto.js.map

package/dist/additional-details/index.js

@@ -96,4 +96,3 @@ class AdditionalDetailsResource {
     }
 }
 exports.AdditionalDetailsResource = AdditionalDetailsResource;
-//# sourceMappingURL=index.js.map

package/dist/additional-details/values.js

@@ -34,4 +34,3 @@ exports.castValueByType = castValueByType;
  */
 const serializeValue = (value) => value instanceof Date ? value.toISOString() : String(value);
 exports.serializeValue = serializeValue;
-//# sourceMappingURL=values.js.map

package/dist/audit/dto.js

@@ -94,4 +94,3 @@ __decorate([
     (0, class_validator_1.IsUUID)(['4', '7'], { message: 'Entity ID must be a valid UUID' }),
     __metadata("design:type", Object)
 ], GetAuditTrailDto.prototype, "entity_id", void 0);
-//# sourceMappingURL=dto.js.map

package/dist/audit/index.js

@@ -340,4 +340,3 @@ const auditedTable = (supabase, actor, audit, options) => {
     };
 };
 exports.auditedTable = auditedTable;
-//# sourceMappingURL=index.js.map

package/dist/auth-client/dto.js

@@ -69,4 +69,3 @@ __decorate([
     (0, class_validator_1.IsString)({ message: 'Refresh token is required' }),
     __metadata("design:type", String)
 ], ResetPasswordDto.prototype, "refresh_token", void 0);
-//# sourceMappingURL=dto.js.map

package/dist/auth-client/index.d.ts

@@ -20,6 +20,13 @@ export declare class SupabaseAuthClient {
     constructor(config: SupabaseAuthClientConfig);
     signIn(input: loginDto): Promise<LoginResponse>;
     refreshSession(input: ExchangeRefreshTokenDto): Promise<ExchangeTokenResponse>;
+    /**
+     * Revokes the session behind `accessToken`, so its refresh token stops working at once.
+     * GoTrue's logout endpoint authenticates with the token itself, which is why this session-less
+     * publishable-key client is enough; `local` ends this device's session and leaves the user's
+     * other sessions alone.
+     */
+    signOut(accessToken: string): Promise<void>;
     /** `redirectTo` is passed in — the SDK reads no environment variables. */
     sendPasswordResetEmail(input: SendPasswordResetEmailDto, redirectTo: string): Promise<void>;
     exchangeRecoveryToken(input: ExchangeTokenHashDto): Promise<ExchangeTokenResponse>;

package/dist/auth-client/index.js

@@ -63,6 +63,17 @@ class SupabaseAuthClient {
             throw noSession('Token exchange failed: No session data returned');
         return toTokens(data.session);
     }
+    /**
+     * Revokes the session behind `accessToken`, so its refresh token stops working at once.
+     * GoTrue's logout endpoint authenticates with the token itself, which is why this session-less
+     * publishable-key client is enough; `local` ends this device's session and leaves the user's
+     * other sessions alone.
+     */
+    async signOut(accessToken) {
+        const { error } = await this.supabase.auth.admin.signOut(accessToken, 'local');
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
+    }
     /** `redirectTo` is passed in — the SDK reads no environment variables. */
     async sendPasswordResetEmail(input, redirectTo) {
         const { error } = await this.supabase.auth.resetPasswordForEmail(input.email, { redirectTo });
@@ -121,4 +132,3 @@ class SupabaseAuthClient {
 exports.SupabaseAuthClient = SupabaseAuthClient;
 const createSupabaseAuthClient = (config) => new SupabaseAuthClient(config);
 exports.createSupabaseAuthClient = createSupabaseAuthClient;
-//# sourceMappingURL=index.js.map

package/dist/auth.js

@@ -73,4 +73,3 @@ const verifyAccessToken = async ({ url, key, accessToken, client = (0, exports.c
     };
 };
 exports.verifyAccessToken = verifyAccessToken;
-//# sourceMappingURL=auth.js.map

package/dist/billing/dto.js

@@ -72,4 +72,3 @@ __decorate([
     (0, class_validator_1.IsUUID)('4', { message: 'An idempotency key is required and must be a v4 uuid' }),
     __metadata("design:type", String)
 ], PurchaseModuleDto.prototype, "idempotency_key", void 0);
-//# sourceMappingURL=dto.js.map

package/dist/billing/index.js

@@ -126,4 +126,3 @@ class BillingResource extends BillingReadsResource {
     }
 }
 exports.BillingResource = BillingResource;
-//# sourceMappingURL=index.js.map

package/dist/billing/invoices/dto.d.ts

@@ -1,7 +1,7 @@
-import type { GetInvoicesDto as GetInvoicesDtoType } from '@managemint-solutions/entities/billing/invoices/dto';
+import type { GetInvoicesDto as GetInvoicesDtoType, InvoiceIdDto as InvoiceIdDtoType } from '@managemint-solutions/entities/billing/invoices/dto';
 import { BillingTransactionStatus } from '@managemint-solutions/entities/billing/enum';
 /** GET /billing/invoices/:invoiceId. v7: `invoices.mms_id` defaults from `uuidv7()`. */
-export declare class InvoiceIdDto {
+export declare class InvoiceIdDto implements InvoiceIdDtoType {
     readonly invoiceId: string;
 }
 export declare class GetInvoicesQueryDto implements Omit<GetInvoicesDtoType, 'status_in'> {

package/dist/billing/invoices/dto.js

@@ -54,4 +54,3 @@ __decorate([
     (0, class_validator_1.IsEnum)(enum_1.BillingTransactionStatus, { each: true, message: 'Invalid invoice status filter' }),
     __metadata("design:type", Object)
 ], GetInvoicesQueryDto.prototype, "status_in", void 0);
-//# sourceMappingURL=dto.js.map

package/dist/billing/invoices/index.js

@@ -129,4 +129,3 @@ class InvoicesResource extends InvoicesReadsResource {
     }
 }
 exports.InvoicesResource = InvoicesResource;
-//# sourceMappingURL=index.js.map

package/dist/client.js

@@ -62,4 +62,3 @@ class SupabaseClient {
 exports.SupabaseClient = SupabaseClient;
 const createSupabaseClient = (config) => new SupabaseClient(config);
 exports.createSupabaseClient = createSupabaseClient;
-//# sourceMappingURL=client.js.map

package/dist/clients/dto.js

@@ -178,4 +178,3 @@ __decorate([
     (0, class_validator_1.Min)(0, { message: 'Contracted hours must be at least 0' }),
     __metadata("design:type", Object)
 ], UpdateClientDto.prototype, "contracted_hours", void 0);
-//# sourceMappingURL=dto.js.map

package/dist/clients/index.js

@@ -164,4 +164,3 @@ class ClientsResource {
     }
 }
 exports.ClientsResource = ClientsResource;
-//# sourceMappingURL=index.js.map

package/dist/errors.js

@@ -61,11 +61,17 @@ const POSTGREST_CODE_TO_HTTP_STATUS = {
     PGRST302: 401,
     // Group X - Internal
     PGRSTX00: 500,
-    // Not PGRST* codes: an RLS denial, and the bare HTTP statuses PostgREST reports for some
-    // failures.
-    42501: 401,
-    404: 404,
-    400: 400,
+    // Postgres codes PostgREST passes through. An RLS or grant denial is a 403: the caller is
+    // authenticated, just not allowed - a 401 here sent the portal into a refresh-and-retry loop.
+    42501: 403,
+    // Integrity violations: the unique-index and foreign-key races are conflicts the caller (or
+    // a retry) can resolve; a not-null or check failure is a bad request.
+    23505: 409,
+    23503: 409,
+    23502: 400,
+    23514: 400,
+    // Malformed literal, e.g. a non-uuid where a uuid column is filtered.
+    '22P02': 400,
 };
 /**
  * Converts a raw Postgrest error into the SupabaseClientError the SDK throws. The message is
@@ -100,4 +106,3 @@ const mapAuthError = (error) => new SupabaseClientError({
     message: error.message,
 }, { cause: error });
 exports.mapAuthError = mapAuthError;
-//# sourceMappingURL=errors.js.map

package/dist/index.d.ts

@@ -1,52 +1,35 @@
 export { SupabaseClient, createSupabaseClient } from './client';
 export type { SupabaseClientConfig, TypedSupabaseClient } from './client';
-export { verifyAccessToken } from './auth';
 export type { AuthContext, VerifiedAuth, VerifiedOrganization, VerifyAccessTokenConfig, } from './auth';
 export { SupabaseAuthClient, createSupabaseAuthClient } from './auth-client';
 export type { SupabaseAuthClientConfig } from './auth-client';
 export { ExchangeRefreshTokenDto, ExchangeTokenHashDto, ResetPasswordDto, SendPasswordResetEmailDto, SignInDto, } from './auth-client';
-export { SupabaseServiceClient, SupabaseOrganizationScope, createSupabaseServiceClient, } from './service-client';
-export type { SupabaseServiceClientConfig } from './service-client';
+export { SupabaseServiceClient, createSupabaseServiceClient } from './service-client';
+export type { SupabaseOrganizationScope, SupabaseServiceClientConfig } from './service-client';
 export { SupabaseClientError } from './errors';
 export type { SupabaseClientErrorInit } from './errors';
 export { IsNullable } from './validators';
-export { AuditResource } from './audit';
 export type { AuditActor, AuditChanges, AuditEntry, AuditErrorHandler, AuditGuard, AuditRow, AuditedTable, AuditedTableOptions, } from './audit';
 export { GetAuditTrailDto } from './audit';
-export { BillingReadsResource, BillingResource } from './billing';
 export { CancelSubscriptionDto, InitialPaymentDto, PurchaseModuleDto, ReinstateSubscriptionDto, } from './billing';
-export { InvoicesReadsResource, InvoicesResource } from './billing/invoices';
 export { GetInvoicesQueryDto, InvoiceIdDto } from './billing/invoices';
-export { StatusesResource } from './statuses';
 export { AddStatusDto, GetStatusesDto, StatusIdDto, UpdateStatusDto } from './statuses';
-export { AdditionalDetailsResource } from './additional-details';
 export { AddAdditionalDetailsDto, AdditionalDetailsIdDto, GetAdditionalDetailsDto, IsAdditionalDetailsValueByType, UpdateAdditionalDetailsDto, } from './additional-details';
-export { NotesResource } from './notes';
 export { AddNoteDto, GetNotesDto, NoteIdDto } from './notes';
-export { NotificationsResource, NotificationsOutboxResource } from './notifications';
 export type { CreateNotificationInput, CreatedNotification, NotificationContentRow, OrganizationTableFactory, QueuedNotification, } from './notifications';
 export { GetNotificationsDto, NotificationIdDto } from './notifications';
-export { OrganizationInvitesResource } from './organization-invites';
 export type { OrganizationInvite } from './organization-invites';
-export { OrganizationPaymentMethodsResource } from './organization-payment-methods';
 export type { OrganizationPaymentMethod, PaymentMethodLookupColumn, } from './organization-payment-methods';
-export { OrganizationsResource, OrganizationSignupResource } from './organizations';
 export type { CreateOrganizationRow, OrganizationRow } from './organizations';
 export { CreateOrganizationDto, UpdateOrganizationDto } from './organizations';
 export { PermissionsResource } from './permissions';
 export type { PermissionFlags } from './permissions';
 export { UpdatePermissionsDto } from './permissions';
-export { UsersResource } from './users';
 export type { UserRow } from './users';
 export { AddUserDto, GetUsersQueryDto, UpdateMyProfileDto, UpdateUserDto, UserIdDto, } from './users';
-export { WebhookEventsResource } from './webhook-events';
 export type { ClaimOutcome, WebhookEventRow, WebhookEventsTable } from './webhook-events';
-export { SupportingFilesResource } from './supporting-files';
 export { GetSupportingFilesDto, SupportingFileIdDto } from './supporting-files';
-export { ClientsResource } from './clients';
 export { ClientIdDto, CreateClientDto, GetClientsDto, UpdateClientDto } from './clients';
-export { ProjectsResource } from './projects';
 export { CreateProjectDto, GetProjectsDto, ProjectIdDto, UpdateProjectDto } from './projects';
-export { TasksResource } from './tasks';
 export { CreateTaskDto, GetTasksDto, TaskIdDto, UpdateTaskDto } from './tasks';
-export { PricebooksResource, monthlyTotalMinor } from './pricebooks';
+export { monthlyTotalMinor } from './pricebooks';

package/dist/index.js

@@ -2,14 +2,16 @@
 // The package's public surface, spelled out. Anything not listed here is the SDK's own plumbing —
 // the audit diff, the row helpers, the select-string fragments, the error mappers — and stays
 // reachable only from inside. The `./nest` entrypoint is listed separately, in src/nest/index.ts.
+//
+// Resources are reached through the three clients (`supabase.tasks`, `scope.invoices`, ...), so
+// their classes are not exported: a consumer never constructs one, and every export is a contract
+// to keep. The row and input types they produce and accept are exported for annotations.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OrganizationSignupResource = exports.OrganizationsResource = exports.OrganizationPaymentMethodsResource = exports.OrganizationInvitesResource = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NotificationsOutboxResource = exports.NotificationsResource = exports.NoteIdDto = exports.GetNotesDto = exports.AddNoteDto = exports.NotesResource = exports.UpdateAdditionalDetailsDto = exports.IsAdditionalDetailsValueByType = exports.GetAdditionalDetailsDto = exports.AdditionalDetailsIdDto = exports.AddAdditionalDetailsDto = exports.AdditionalDetailsResource = exports.UpdateStatusDto = exports.StatusIdDto = exports.GetStatusesDto = exports.AddStatusDto = exports.StatusesResource = exports.InvoiceIdDto = exports.GetInvoicesQueryDto = exports.InvoicesResource = exports.InvoicesReadsResource = exports.ReinstateSubscriptionDto = exports.PurchaseModuleDto = exports.InitialPaymentDto = exports.CancelSubscriptionDto = exports.BillingResource = exports.BillingReadsResource = exports.GetAuditTrailDto = exports.AuditResource = exports.IsNullable = exports.SupabaseClientError = exports.createSupabaseServiceClient = exports.SupabaseOrganizationScope = exports.SupabaseServiceClient = exports.SignInDto = exports.SendPasswordResetEmailDto = exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.ExchangeRefreshTokenDto = exports.createSupabaseAuthClient = exports.SupabaseAuthClient = exports.verifyAccessToken = exports.createSupabaseClient = exports.SupabaseClient = void 0;
-exports.monthlyTotalMinor = exports.PricebooksResource = exports.UpdateTaskDto = exports.TaskIdDto = exports.GetTasksDto = exports.CreateTaskDto = exports.TasksResource = exports.UpdateProjectDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.ProjectsResource = exports.UpdateClientDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.ClientsResource = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.SupportingFilesResource = exports.WebhookEventsResource = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UsersResource = exports.UpdatePermissionsDto = exports.PermissionsResource = exports.UpdateOrganizationDto = exports.CreateOrganizationDto = void 0;
+exports.CreateProjectDto = exports.UpdateClientDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UpdatePermissionsDto = exports.PermissionsResource = exports.UpdateOrganizationDto = exports.CreateOrganizationDto = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NoteIdDto = exports.GetNotesDto = exports.AddNoteDto = exports.UpdateAdditionalDetailsDto = exports.IsAdditionalDetailsValueByType = exports.GetAdditionalDetailsDto = exports.AdditionalDetailsIdDto = exports.AddAdditionalDetailsDto = exports.UpdateStatusDto = exports.StatusIdDto = exports.GetStatusesDto = exports.AddStatusDto = exports.InvoiceIdDto = exports.GetInvoicesQueryDto = exports.ReinstateSubscriptionDto = exports.PurchaseModuleDto = exports.InitialPaymentDto = exports.CancelSubscriptionDto = exports.GetAuditTrailDto = exports.IsNullable = exports.SupabaseClientError = exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.SignInDto = exports.SendPasswordResetEmailDto = exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.ExchangeRefreshTokenDto = exports.createSupabaseAuthClient = exports.SupabaseAuthClient = exports.createSupabaseClient = exports.SupabaseClient = void 0;
+exports.monthlyTotalMinor = exports.UpdateTaskDto = exports.TaskIdDto = exports.GetTasksDto = exports.CreateTaskDto = exports.UpdateProjectDto = exports.ProjectIdDto = exports.GetProjectsDto = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "SupabaseClient", { enumerable: true, get: function () { return client_1.SupabaseClient; } });
 Object.defineProperty(exports, "createSupabaseClient", { enumerable: true, get: function () { return client_1.createSupabaseClient; } });
-var auth_1 = require("./auth");
-Object.defineProperty(exports, "verifyAccessToken", { enumerable: true, get: function () { return auth_1.verifyAccessToken; } });
 var auth_client_1 = require("./auth-client");
 Object.defineProperty(exports, "SupabaseAuthClient", { enumerable: true, get: function () { return auth_client_1.SupabaseAuthClient; } });
 Object.defineProperty(exports, "createSupabaseAuthClient", { enumerable: true, get: function () { return auth_client_1.createSupabaseAuthClient; } });
@@ -21,108 +23,71 @@ Object.defineProperty(exports, "SendPasswordResetEmailDto", { enumerable: true,
 Object.defineProperty(exports, "SignInDto", { enumerable: true, get: function () { return auth_client_2.SignInDto; } });
 var service_client_1 = require("./service-client");
 Object.defineProperty(exports, "SupabaseServiceClient", { enumerable: true, get: function () { return service_client_1.SupabaseServiceClient; } });
-Object.defineProperty(exports, "SupabaseOrganizationScope", { enumerable: true, get: function () { return service_client_1.SupabaseOrganizationScope; } });
 Object.defineProperty(exports, "createSupabaseServiceClient", { enumerable: true, get: function () { return service_client_1.createSupabaseServiceClient; } });
 var errors_1 = require("./errors");
 Object.defineProperty(exports, "SupabaseClientError", { enumerable: true, get: function () { return errors_1.SupabaseClientError; } });
 var validators_1 = require("./validators");
 Object.defineProperty(exports, "IsNullable", { enumerable: true, get: function () { return validators_1.IsNullable; } });
 var audit_1 = require("./audit");
-Object.defineProperty(exports, "AuditResource", { enumerable: true, get: function () { return audit_1.AuditResource; } });
-var audit_2 = require("./audit");
-Object.defineProperty(exports, "GetAuditTrailDto", { enumerable: true, get: function () { return audit_2.GetAuditTrailDto; } });
+Object.defineProperty(exports, "GetAuditTrailDto", { enumerable: true, get: function () { return audit_1.GetAuditTrailDto; } });
 var billing_1 = require("./billing");
-Object.defineProperty(exports, "BillingReadsResource", { enumerable: true, get: function () { return billing_1.BillingReadsResource; } });
-Object.defineProperty(exports, "BillingResource", { enumerable: true, get: function () { return billing_1.BillingResource; } });
-var billing_2 = require("./billing");
-Object.defineProperty(exports, "CancelSubscriptionDto", { enumerable: true, get: function () { return billing_2.CancelSubscriptionDto; } });
-Object.defineProperty(exports, "InitialPaymentDto", { enumerable: true, get: function () { return billing_2.InitialPaymentDto; } });
-Object.defineProperty(exports, "PurchaseModuleDto", { enumerable: true, get: function () { return billing_2.PurchaseModuleDto; } });
-Object.defineProperty(exports, "ReinstateSubscriptionDto", { enumerable: true, get: function () { return billing_2.ReinstateSubscriptionDto; } });
+Object.defineProperty(exports, "CancelSubscriptionDto", { enumerable: true, get: function () { return billing_1.CancelSubscriptionDto; } });
+Object.defineProperty(exports, "InitialPaymentDto", { enumerable: true, get: function () { return billing_1.InitialPaymentDto; } });
+Object.defineProperty(exports, "PurchaseModuleDto", { enumerable: true, get: function () { return billing_1.PurchaseModuleDto; } });
+Object.defineProperty(exports, "ReinstateSubscriptionDto", { enumerable: true, get: function () { return billing_1.ReinstateSubscriptionDto; } });
 var invoices_1 = require("./billing/invoices");
-Object.defineProperty(exports, "InvoicesReadsResource", { enumerable: true, get: function () { return invoices_1.InvoicesReadsResource; } });
-Object.defineProperty(exports, "InvoicesResource", { enumerable: true, get: function () { return invoices_1.InvoicesResource; } });
-var invoices_2 = require("./billing/invoices");
-Object.defineProperty(exports, "GetInvoicesQueryDto", { enumerable: true, get: function () { return invoices_2.GetInvoicesQueryDto; } });
-Object.defineProperty(exports, "InvoiceIdDto", { enumerable: true, get: function () { return invoices_2.InvoiceIdDto; } });
+Object.defineProperty(exports, "GetInvoicesQueryDto", { enumerable: true, get: function () { return invoices_1.GetInvoicesQueryDto; } });
+Object.defineProperty(exports, "InvoiceIdDto", { enumerable: true, get: function () { return invoices_1.InvoiceIdDto; } });
 var statuses_1 = require("./statuses");
-Object.defineProperty(exports, "StatusesResource", { enumerable: true, get: function () { return statuses_1.StatusesResource; } });
-var statuses_2 = require("./statuses");
-Object.defineProperty(exports, "AddStatusDto", { enumerable: true, get: function () { return statuses_2.AddStatusDto; } });
-Object.defineProperty(exports, "GetStatusesDto", { enumerable: true, get: function () { return statuses_2.GetStatusesDto; } });
-Object.defineProperty(exports, "StatusIdDto", { enumerable: true, get: function () { return statuses_2.StatusIdDto; } });
-Object.defineProperty(exports, "UpdateStatusDto", { enumerable: true, get: function () { return statuses_2.UpdateStatusDto; } });
+Object.defineProperty(exports, "AddStatusDto", { enumerable: true, get: function () { return statuses_1.AddStatusDto; } });
+Object.defineProperty(exports, "GetStatusesDto", { enumerable: true, get: function () { return statuses_1.GetStatusesDto; } });
+Object.defineProperty(exports, "StatusIdDto", { enumerable: true, get: function () { return statuses_1.StatusIdDto; } });
+Object.defineProperty(exports, "UpdateStatusDto", { enumerable: true, get: function () { return statuses_1.UpdateStatusDto; } });
 var additional_details_1 = require("./additional-details");
-Object.defineProperty(exports, "AdditionalDetailsResource", { enumerable: true, get: function () { return additional_details_1.AdditionalDetailsResource; } });
-var additional_details_2 = require("./additional-details");
-Object.defineProperty(exports, "AddAdditionalDetailsDto", { enumerable: true, get: function () { return additional_details_2.AddAdditionalDetailsDto; } });
-Object.defineProperty(exports, "AdditionalDetailsIdDto", { enumerable: true, get: function () { return additional_details_2.AdditionalDetailsIdDto; } });
-Object.defineProperty(exports, "GetAdditionalDetailsDto", { enumerable: true, get: function () { return additional_details_2.GetAdditionalDetailsDto; } });
-Object.defineProperty(exports, "IsAdditionalDetailsValueByType", { enumerable: true, get: function () { return additional_details_2.IsAdditionalDetailsValueByType; } });
-Object.defineProperty(exports, "UpdateAdditionalDetailsDto", { enumerable: true, get: function () { return additional_details_2.UpdateAdditionalDetailsDto; } });
+Object.defineProperty(exports, "AddAdditionalDetailsDto", { enumerable: true, get: function () { return additional_details_1.AddAdditionalDetailsDto; } });
+Object.defineProperty(exports, "AdditionalDetailsIdDto", { enumerable: true, get: function () { return additional_details_1.AdditionalDetailsIdDto; } });
+Object.defineProperty(exports, "GetAdditionalDetailsDto", { enumerable: true, get: function () { return additional_details_1.GetAdditionalDetailsDto; } });
+Object.defineProperty(exports, "IsAdditionalDetailsValueByType", { enumerable: true, get: function () { return additional_details_1.IsAdditionalDetailsValueByType; } });
+Object.defineProperty(exports, "UpdateAdditionalDetailsDto", { enumerable: true, get: function () { return additional_details_1.UpdateAdditionalDetailsDto; } });
 var notes_1 = require("./notes");
-Object.defineProperty(exports, "NotesResource", { enumerable: true, get: function () { return notes_1.NotesResource; } });
-var notes_2 = require("./notes");
-Object.defineProperty(exports, "AddNoteDto", { enumerable: true, get: function () { return notes_2.AddNoteDto; } });
-Object.defineProperty(exports, "GetNotesDto", { enumerable: true, get: function () { return notes_2.GetNotesDto; } });
-Object.defineProperty(exports, "NoteIdDto", { enumerable: true, get: function () { return notes_2.NoteIdDto; } });
+Object.defineProperty(exports, "AddNoteDto", { enumerable: true, get: function () { return notes_1.AddNoteDto; } });
+Object.defineProperty(exports, "GetNotesDto", { enumerable: true, get: function () { return notes_1.GetNotesDto; } });
+Object.defineProperty(exports, "NoteIdDto", { enumerable: true, get: function () { return notes_1.NoteIdDto; } });
 var notifications_1 = require("./notifications");
-Object.defineProperty(exports, "NotificationsResource", { enumerable: true, get: function () { return notifications_1.NotificationsResource; } });
-Object.defineProperty(exports, "NotificationsOutboxResource", { enumerable: true, get: function () { return notifications_1.NotificationsOutboxResource; } });
-var notifications_2 = require("./notifications");
-Object.defineProperty(exports, "GetNotificationsDto", { enumerable: true, get: function () { return notifications_2.GetNotificationsDto; } });
-Object.defineProperty(exports, "NotificationIdDto", { enumerable: true, get: function () { return notifications_2.NotificationIdDto; } });
-var organization_invites_1 = require("./organization-invites");
-Object.defineProperty(exports, "OrganizationInvitesResource", { enumerable: true, get: function () { return organization_invites_1.OrganizationInvitesResource; } });
-var organization_payment_methods_1 = require("./organization-payment-methods");
-Object.defineProperty(exports, "OrganizationPaymentMethodsResource", { enumerable: true, get: function () { return organization_payment_methods_1.OrganizationPaymentMethodsResource; } });
+Object.defineProperty(exports, "GetNotificationsDto", { enumerable: true, get: function () { return notifications_1.GetNotificationsDto; } });
+Object.defineProperty(exports, "NotificationIdDto", { enumerable: true, get: function () { return notifications_1.NotificationIdDto; } });
 var organizations_1 = require("./organizations");
-Object.defineProperty(exports, "OrganizationsResource", { enumerable: true, get: function () { return organizations_1.OrganizationsResource; } });
-Object.defineProperty(exports, "OrganizationSignupResource", { enumerable: true, get: function () { return organizations_1.OrganizationSignupResource; } });
-var organizations_2 = require("./organizations");
-Object.defineProperty(exports, "CreateOrganizationDto", { enumerable: true, get: function () { return organizations_2.CreateOrganizationDto; } });
-Object.defineProperty(exports, "UpdateOrganizationDto", { enumerable: true, get: function () { return organizations_2.UpdateOrganizationDto; } });
+Object.defineProperty(exports, "CreateOrganizationDto", { enumerable: true, get: function () { return organizations_1.CreateOrganizationDto; } });
+Object.defineProperty(exports, "UpdateOrganizationDto", { enumerable: true, get: function () { return organizations_1.UpdateOrganizationDto; } });
+// The one resource class still exported: the api's permissions guard spec drives a real
+// PermissionsResource over a stubbed client.
 var permissions_1 = require("./permissions");
 Object.defineProperty(exports, "PermissionsResource", { enumerable: true, get: function () { return permissions_1.PermissionsResource; } });
 var permissions_2 = require("./permissions");
 Object.defineProperty(exports, "UpdatePermissionsDto", { enumerable: true, get: function () { return permissions_2.UpdatePermissionsDto; } });
 var users_1 = require("./users");
-Object.defineProperty(exports, "UsersResource", { enumerable: true, get: function () { return users_1.UsersResource; } });
-var users_2 = require("./users");
-Object.defineProperty(exports, "AddUserDto", { enumerable: true, get: function () { return users_2.AddUserDto; } });
-Object.defineProperty(exports, "GetUsersQueryDto", { enumerable: true, get: function () { return users_2.GetUsersQueryDto; } });
-Object.defineProperty(exports, "UpdateMyProfileDto", { enumerable: true, get: function () { return users_2.UpdateMyProfileDto; } });
-Object.defineProperty(exports, "UpdateUserDto", { enumerable: true, get: function () { return users_2.UpdateUserDto; } });
-Object.defineProperty(exports, "UserIdDto", { enumerable: true, get: function () { return users_2.UserIdDto; } });
-var webhook_events_1 = require("./webhook-events");
-Object.defineProperty(exports, "WebhookEventsResource", { enumerable: true, get: function () { return webhook_events_1.WebhookEventsResource; } });
+Object.defineProperty(exports, "AddUserDto", { enumerable: true, get: function () { return users_1.AddUserDto; } });
+Object.defineProperty(exports, "GetUsersQueryDto", { enumerable: true, get: function () { return users_1.GetUsersQueryDto; } });
+Object.defineProperty(exports, "UpdateMyProfileDto", { enumerable: true, get: function () { return users_1.UpdateMyProfileDto; } });
+Object.defineProperty(exports, "UpdateUserDto", { enumerable: true, get: function () { return users_1.UpdateUserDto; } });
+Object.defineProperty(exports, "UserIdDto", { enumerable: true, get: function () { return users_1.UserIdDto; } });
 var supporting_files_1 = require("./supporting-files");
-Object.defineProperty(exports, "SupportingFilesResource", { enumerable: true, get: function () { return supporting_files_1.SupportingFilesResource; } });
-var supporting_files_2 = require("./supporting-files");
-Object.defineProperty(exports, "GetSupportingFilesDto", { enumerable: true, get: function () { return supporting_files_2.GetSupportingFilesDto; } });
-Object.defineProperty(exports, "SupportingFileIdDto", { enumerable: true, get: function () { return supporting_files_2.SupportingFileIdDto; } });
+Object.defineProperty(exports, "GetSupportingFilesDto", { enumerable: true, get: function () { return supporting_files_1.GetSupportingFilesDto; } });
+Object.defineProperty(exports, "SupportingFileIdDto", { enumerable: true, get: function () { return supporting_files_1.SupportingFileIdDto; } });
 var clients_1 = require("./clients");
-Object.defineProperty(exports, "ClientsResource", { enumerable: true, get: function () { return clients_1.ClientsResource; } });
-var clients_2 = require("./clients");
-Object.defineProperty(exports, "ClientIdDto", { enumerable: true, get: function () { return clients_2.ClientIdDto; } });
-Object.defineProperty(exports, "CreateClientDto", { enumerable: true, get: function () { return clients_2.CreateClientDto; } });
-Object.defineProperty(exports, "GetClientsDto", { enumerable: true, get: function () { return clients_2.GetClientsDto; } });
-Object.defineProperty(exports, "UpdateClientDto", { enumerable: true, get: function () { return clients_2.UpdateClientDto; } });
+Object.defineProperty(exports, "ClientIdDto", { enumerable: true, get: function () { return clients_1.ClientIdDto; } });
+Object.defineProperty(exports, "CreateClientDto", { enumerable: true, get: function () { return clients_1.CreateClientDto; } });
+Object.defineProperty(exports, "GetClientsDto", { enumerable: true, get: function () { return clients_1.GetClientsDto; } });
+Object.defineProperty(exports, "UpdateClientDto", { enumerable: true, get: function () { return clients_1.UpdateClientDto; } });
 var projects_1 = require("./projects");
-Object.defineProperty(exports, "ProjectsResource", { enumerable: true, get: function () { return projects_1.ProjectsResource; } });
-var projects_2 = require("./projects");
-Object.defineProperty(exports, "CreateProjectDto", { enumerable: true, get: function () { return projects_2.CreateProjectDto; } });
-Object.defineProperty(exports, "GetProjectsDto", { enumerable: true, get: function () { return projects_2.GetProjectsDto; } });
-Object.defineProperty(exports, "ProjectIdDto", { enumerable: true, get: function () { return projects_2.ProjectIdDto; } });
-Object.defineProperty(exports, "UpdateProjectDto", { enumerable: true, get: function () { return projects_2.UpdateProjectDto; } });
+Object.defineProperty(exports, "CreateProjectDto", { enumerable: true, get: function () { return projects_1.CreateProjectDto; } });
+Object.defineProperty(exports, "GetProjectsDto", { enumerable: true, get: function () { return projects_1.GetProjectsDto; } });
+Object.defineProperty(exports, "ProjectIdDto", { enumerable: true, get: function () { return projects_1.ProjectIdDto; } });
+Object.defineProperty(exports, "UpdateProjectDto", { enumerable: true, get: function () { return projects_1.UpdateProjectDto; } });
 var tasks_1 = require("./tasks");
-Object.defineProperty(exports, "TasksResource", { enumerable: true, get: function () { return tasks_1.TasksResource; } });
-var tasks_2 = require("./tasks");
-Object.defineProperty(exports, "CreateTaskDto", { enumerable: true, get: function () { return tasks_2.CreateTaskDto; } });
-Object.defineProperty(exports, "GetTasksDto", { enumerable: true, get: function () { return tasks_2.GetTasksDto; } });
-Object.defineProperty(exports, "TaskIdDto", { enumerable: true, get: function () { return tasks_2.TaskIdDto; } });
-Object.defineProperty(exports, "UpdateTaskDto", { enumerable: true, get: function () { return tasks_2.UpdateTaskDto; } });
+Object.defineProperty(exports, "CreateTaskDto", { enumerable: true, get: function () { return tasks_1.CreateTaskDto; } });
+Object.defineProperty(exports, "GetTasksDto", { enumerable: true, get: function () { return tasks_1.GetTasksDto; } });
+Object.defineProperty(exports, "TaskIdDto", { enumerable: true, get: function () { return tasks_1.TaskIdDto; } });
+Object.defineProperty(exports, "UpdateTaskDto", { enumerable: true, get: function () { return tasks_1.UpdateTaskDto; } });
 var pricebooks_1 = require("./pricebooks");
-Object.defineProperty(exports, "PricebooksResource", { enumerable: true, get: function () { return pricebooks_1.PricebooksResource; } });
 Object.defineProperty(exports, "monthlyTotalMinor", { enumerable: true, get: function () { return pricebooks_1.monthlyTotalMinor; } });
-//# sourceMappingURL=index.js.map

package/dist/nest/index.d.ts

@@ -55,5 +55,10 @@ export declare const createSupabaseServiceClientFromEnv: (options?: SupabaseUser
 /**
  * A `SupabaseAuthClient` for routes a logged-out caller hits (sign-in, refresh, password
  * reset) — built from the publishable key alone, with no bearer token involved.
+ *
+ * Deliberately a fresh client per request, not a module-level singleton: supabase-js keeps the
+ * session `signIn`, `verifyOtp` and `setSession` produce in the client's own memory, so one
+ * shared instance would let concurrent sign-in and reset-password requests read each other's
+ * sessions. The construction is cheap (no network) and the isolation is the point.
  */
 export declare const SupabasePublicClient: (...dataOrPipes: any[]) => ParameterDecorator;

package/dist/nest/index.js

@@ -114,9 +114,13 @@ exports.createSupabaseServiceClientFromEnv = createSupabaseServiceClientFromEnv;
 /**
  * A `SupabaseAuthClient` for routes a logged-out caller hits (sign-in, refresh, password
  * reset) — built from the publishable key alone, with no bearer token involved.
+ *
+ * Deliberately a fresh client per request, not a module-level singleton: supabase-js keeps the
+ * session `signIn`, `verifyOtp` and `setSession` produce in the client's own memory, so one
+ * shared instance would let concurrent sign-in and reset-password requests read each other's
+ * sessions. The construction is cheap (no network) and the isolation is the point.
  */
 exports.SupabasePublicClient = (0, common_1.createParamDecorator)(() => (0, auth_client_1.createSupabaseAuthClient)({
     url: getEnvOrThrow('SUPABASE_URL'),
     key: getEnvOrThrow('SUPABASE_PUBLISHABLE_KEY'),
 }));
-//# sourceMappingURL=index.js.map

package/dist/notes/dto.js

@@ -45,4 +45,3 @@ __decorate([
     (0, class_validator_1.MaxLength)(255, { message: 'Content cannot exceed 255 characters' }),
     __metadata("design:type", String)
 ], AddNoteDto.prototype, "content", void 0);
-//# sourceMappingURL=dto.js.map

package/dist/notes/index.js

@@ -82,4 +82,3 @@ class NotesResource {
     }
 }
 exports.NotesResource = NotesResource;
-//# sourceMappingURL=index.js.map

package/dist/notifications/dto.js

@@ -60,4 +60,3 @@ __decorate([
     (0, class_validator_1.IsBoolean)({ message: 'Unread only must be a boolean' }),
     __metadata("design:type", Boolean)
 ], GetNotificationsDto.prototype, "unread", void 0);
-//# sourceMappingURL=dto.js.map

package/dist/notifications/index.js

@@ -354,4 +354,3 @@ class NotificationsOutboxResource {
     }
 }
 exports.NotificationsOutboxResource = NotificationsOutboxResource;
-//# sourceMappingURL=index.js.map