@managemint-solutions/sdk 0.38.0 → 0.38.1

package/dist/client.d.ts

@@ -24,20 +24,20 @@ export type SupabaseClientConfig = {
     accessToken: string;
     /**
      * Who the request runs as. The caller must already have **verified** the token this came from
-     * (`verifyAccessToken`) — the client trusts this outright and scopes every query to it.
+     * (`verifyAccessToken`) - the client trusts this outright and scopes every query to it.
      */
     auth: AuthContext;
     /** Where a failed audit insert is reported. Defaults to `console.error`. */
     onAuditError?: AuditErrorHandler;
     /**
-     * A raw client already built for this url/key/token — what `verifyAccessToken` was handed, so
+     * A raw client already built for this url/key/token - what `verifyAccessToken` was handed, so
      * one request builds one supabase-js client. Defaults to building its own.
      */
     client?: TypedSupabaseClient;
 };
 /**
  * The caller's data client: every query carries their bearer token, so RLS decides what they
- * may see. It performs no authentication of its own — build it from a `VerifiedAuth`, never from
+ * may see. It performs no authentication of its own - build it from a `VerifiedAuth`, never from
  * a token you have only decoded.
  */
 export declare class SupabaseClient {

package/dist/client.js

@@ -21,7 +21,7 @@ const tasks_1 = require("./tasks");
 const users_1 = require("./users");
 /**
  * The caller's data client: every query carries their bearer token, so RLS decides what they
- * may see. It performs no authentication of its own — build it from a `VerifiedAuth`, never from
+ * may see. It performs no authentication of its own - build it from a `VerifiedAuth`, never from
  * a token you have only decoded.
  */
 class SupabaseClient {

package/dist/clients/index.d.ts

@@ -17,6 +17,6 @@ export declare class ClientsResource {
     archive(clientId: string): Promise<ClientEntity>;
     unarchive(clientId: string): Promise<ClientEntity>;
     restore(clientId: string): Promise<ClientEntity>;
-    /** Soft delete — the row stays, flagged `deleted`, and `restore()` brings it back. */
+    /** Soft delete - the row stays, flagged `deleted`, and `restore()` brings it back. */
     remove(clientId: string): Promise<void>;
 }

package/dist/clients/index.js

@@ -164,7 +164,7 @@ class ClientsResource {
         await this.table.transition(clientId, enum_1.AuditTrailAction.RESTORE, (0, transforms_1.restoredPatch)(this.auth.mms_id));
         return this.getById(clientId);
     }
-    /** Soft delete — the row stays, flagged `deleted`, and `restore()` brings it back. */
+    /** Soft delete - the row stays, flagged `deleted`, and `restore()` brings it back. */
     async remove(clientId) {
         await this.table.transition(clientId, enum_1.AuditTrailAction.DELETE, (0, transforms_1.deletedPatch)(this.auth.mms_id));
     }

package/dist/configs/dto.js

@@ -16,7 +16,7 @@ const class_transformer_1 = require("class-transformer");
 // wire contract cannot drift.
 /**
  * Whitespace on either side of a pasted value is not part of the answer. Trimming here rather
- * than in the api means the length rules below measure what will actually be stored — a name of
+ * than in the api means the length rules below measure what will actually be stored - a name of
  * three spaces is empty, not three characters long.
  */
 const Trim = () => (0, class_transformer_1.Transform)(({ value }) => (typeof value === 'string' ? value.trim() : value), {
@@ -25,11 +25,11 @@ const Trim = () => (0, class_transformer_1.Transform)(({ value }) => (typeof val
 class CreateConfigDto {
     name;
     description;
-    // This DTO is the only place the object shape is enforced — the column has no CHECK by
+    // This DTO is the only place the object shape is enforced - the column has no CHECK by
     // design, so a config may hold whatever keys the row's author named. class-validator's
     // isObject rejects arrays and scalars, which is exactly the line: one JSON object, nothing
     // else. `@ValidateIf` rather than `@IsOptional` because the latter skips an explicit null
-    // too, and null is not a config value — an omitted `value` becomes `{}` at the insert.
+    // too, and null is not a config value - an omitted `value` becomes `{}` at the insert.
     value;
 }
 exports.CreateConfigDto = CreateConfigDto;

package/dist/configs/index.d.ts

@@ -3,7 +3,7 @@ import type { CreateConfigDto as CreateConfigDtoType, UpdateConfigDto as UpdateC
 import type { TypedSupabaseClient } from '../client';
 export * from './dto';
 /**
- * Global named JSON configs. Every signed-in caller may read (the READ policy is `true` — there
+ * Global named JSON configs. Every signed-in caller may read (the READ policy is `true` - there
  * is no tenant on the row), so this hangs off the user client and the service client alike;
  * only the service role may write, and a write on the user client fails at the database.
  * Not audited: Studio is the other writer, and nothing would see its edits anyway.
@@ -15,10 +15,10 @@ export declare class ConfigsResource {
     getByName(name: string): Promise<ConfigEntity>;
     getById(configId: string): Promise<ConfigEntity>;
     create(input: CreateConfigDtoType): Promise<ConfigEntity>;
-    /** `value` replaces the whole object — it is not merged. */
+    /** `value` replaces the whole object - it is not merged. */
     update(name: string, patch: UpdateConfigDtoType): Promise<ConfigEntity>;
     /**
-     * Hard delete — there is nothing to soft-delete into and nothing references a config row.
+     * Hard delete - there is nothing to soft-delete into and nothing references a config row.
      * Service role only, like every write here; a call on the user client fails at the database.
      */
     remove(name: string): Promise<void>;

package/dist/configs/index.js

@@ -22,7 +22,7 @@ __exportStar(require("./dto"), exports);
 // supabase/migrations). `id` never leaves SQL.
 const CONFIG_SELECT = 'mms_id, created_at, updated_at, name, description, value';
 /**
- * Global named JSON configs. Every signed-in caller may read (the READ policy is `true` — there
+ * Global named JSON configs. Every signed-in caller may read (the READ policy is `true` - there
  * is no tenant on the row), so this hangs off the user client and the service client alike;
  * only the service role may write, and a write on the user client fails at the database.
  * Not audited: Studio is the other writer, and nothing would see its edits anyway.
@@ -76,7 +76,7 @@ class ConfigsResource {
             throw (0, errors_1.mapPostgrestError)(error);
         return data;
     }
-    /** `value` replaces the whole object — it is not merged. */
+    /** `value` replaces the whole object - it is not merged. */
     async update(name, patch) {
         const { data, error } = await this.supabase
             .from('configs')
@@ -89,7 +89,7 @@ class ConfigsResource {
         return data;
     }
     /**
-     * Hard delete — there is nothing to soft-delete into and nothing references a config row.
+     * Hard delete - there is nothing to soft-delete into and nothing references a config row.
      * Service role only, like every write here; a call on the user client fails at the database.
      */
     async remove(name) {

package/dist/errors.d.ts

@@ -28,7 +28,7 @@ export declare class SupabaseClientError extends Error {
 }
 /**
  * Converts a raw Postgrest error into the SupabaseClientError the SDK throws. The message is
- * Postgrest's own — RLS denials say what the policy said, and nothing rewrites it.
+ * Postgrest's own - RLS denials say what the policy said, and nothing rewrites it.
  */
 export declare const mapPostgrestError: (error: PostgrestError) => SupabaseClientError;
 /**
@@ -38,7 +38,7 @@ export declare const mapPostgrestError: (error: PostgrestError) => SupabaseClien
  */
 export declare const mapStorageError: (error: StorageError, message?: string) => SupabaseClientError;
 /**
- * Converts a Supabase Auth (GoTrue) error into the SupabaseClientError the SDK throws — the
+ * Converts a Supabase Auth (GoTrue) error into the SupabaseClientError the SDK throws - the
  * SDK-side equivalent of the api's `throwAuthErrorResponse`. `AuthError.status` is the HTTP
  * status GoTrue answered with; network/unknown failures carry none, hence the 500 fallback.
  */

package/dist/errors.js

@@ -75,7 +75,7 @@ const POSTGREST_CODE_TO_HTTP_STATUS = {
 };
 /**
  * Converts a raw Postgrest error into the SupabaseClientError the SDK throws. The message is
- * Postgrest's own — RLS denials say what the policy said, and nothing rewrites it.
+ * Postgrest's own - RLS denials say what the policy said, and nothing rewrites it.
  */
 const mapPostgrestError = (error) => new SupabaseClientError({
     status: POSTGREST_CODE_TO_HTTP_STATUS[error.code] || 500,
@@ -96,7 +96,7 @@ const mapStorageError = (error, message = error.message) => new SupabaseClientEr
 }, { cause: error });
 exports.mapStorageError = mapStorageError;
 /**
- * Converts a Supabase Auth (GoTrue) error into the SupabaseClientError the SDK throws — the
+ * Converts a Supabase Auth (GoTrue) error into the SupabaseClientError the SDK throws - the
  * SDK-side equivalent of the api's `throwAuthErrorResponse`. `AuthError.status` is the HTTP
  * status GoTrue answered with; network/unknown failures carry none, hence the 500 fallback.
  */

package/dist/feature-requests/dto.js

@@ -17,7 +17,7 @@ const validators_1 = require("../validators");
 // wire contract cannot drift.
 /**
  * Whitespace on either side of a pasted value is not part of the answer. Trimming here rather
- * than in the api means the length rules below measure what will actually be stored — a name of
+ * than in the api means the length rules below measure what will actually be stored - a name of
  * three spaces is empty, not three characters long.
  */
 const Trim = () => (0, class_transformer_1.Transform)(({ value }) => (typeof value === 'string' ? value.trim() : value), {

package/dist/feature-requests/index.d.ts

@@ -9,13 +9,13 @@ export type CreateFeatureRequestRow = {
     requester_email: string;
     source: FeatureRequestSource;
 };
-/** All the insert hands back — the id the endpoint answers with. */
+/** All the insert hands back - the id the endpoint answers with. */
 export type CreatedFeatureRequest = {
     mms_id: string;
 };
 /**
  * The `feature_requests` table: "I need something" submissions from the marketing website's
- * roadmap page. There is no reader here by design — the rows are read in Supabase Studio, and
+ * roadmap page. There is no reader here by design - the rows are read in Supabase Studio, and
  * nothing renders a visitor's words back to anyone.
  *
  * Service-role only, like `organization_invites`: the table has RLS enabled with no policies and
@@ -25,7 +25,7 @@ export type CreatedFeatureRequest = {
  * No organization: a feature request belongs to nobody's tenant, which is why the resource hangs
  * off the client itself rather than off `forOrganization`.
  *
- * Not audited — `audit_logs` rows carry an organization and an actor, and this write has neither.
+ * Not audited - `audit_logs` rows carry an organization and an actor, and this write has neither.
  */
 export declare class FeatureRequestsResource {
     private readonly supabase;

package/dist/feature-requests/index.js

@@ -19,7 +19,7 @@ const errors_1 = require("../errors");
 __exportStar(require("./dto"), exports);
 /**
  * The `feature_requests` table: "I need something" submissions from the marketing website's
- * roadmap page. There is no reader here by design — the rows are read in Supabase Studio, and
+ * roadmap page. There is no reader here by design - the rows are read in Supabase Studio, and
  * nothing renders a visitor's words back to anyone.
  *
  * Service-role only, like `organization_invites`: the table has RLS enabled with no policies and
@@ -29,7 +29,7 @@ __exportStar(require("./dto"), exports);
  * No organization: a feature request belongs to nobody's tenant, which is why the resource hangs
  * off the client itself rather than off `forOrganization`.
  *
- * Not audited — `audit_logs` rows carry an organization and an actor, and this write has neither.
+ * Not audited - `audit_logs` rows carry an organization and an actor, and this write has neither.
  */
 class FeatureRequestsResource {
     supabase;

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
-// The package's public surface, spelled out. Anything not listed here is the SDK's own plumbing —
-// the audit diff, the row helpers, the select-string fragments, the error mappers — and stays
+// The package's public surface, spelled out. Anything not listed here is the SDK's own plumbing -
+// the audit diff, the row helpers, the select-string fragments, the error mappers - and stays
 // reachable only from inside. The `./nest` entrypoint is listed separately, in src/nest/index.ts.
 //
 // Resources are reached through the three clients (`supabase.tasks`, `scope.invoices`, ...), so

package/dist/nest/index.d.ts

@@ -12,7 +12,7 @@ import { type SupabaseServiceClient } from '../service-client';
  */
 export declare const toHttpException: (error: SupabaseClientError) => HttpException;
 export type SupabaseUserClientOptions = {
-    /** Where a failed audit insert is reported — e.g. `(error) => Sentry.captureException(error)`. */
+    /** Where a failed audit insert is reported - e.g. `(error) => Sentry.captureException(error)`. */
     onAuditError?: AuditErrorHandler;
 };
 /**
@@ -25,12 +25,12 @@ export type SupabaseRequestContext = {
     client: SupabaseClient;
     auth: VerifiedAuth;
 };
-/** Where on the request the context is stored — `request[SUPABASE_REQUEST_KEY]`. */
+/** Where on the request the context is stored - `request[SUPABASE_REQUEST_KEY]`. */
 export declare const SUPABASE_REQUEST_KEY = "supabase";
 /**
  * Verifies the bearer token on `request`, builds the caller's client from it and stores both on
  * the request. This is the one place a token is authenticated, so it belongs in the api's auth
- * guard — a param decorator cannot be async and must not be where identity is established.
+ * guard - a param decorator cannot be async and must not be where identity is established.
  *
  * Idempotent: a second call hands back the context the first one attached.
  */
@@ -43,7 +43,7 @@ export declare const getSupabaseRequestContext: (request: Request) => SupabaseRe
 /** The caller's data client, from the context the auth guard attached. */
 export declare const SupabaseUserClient: (...dataOrPipes: unknown[]) => ParameterDecorator;
 /**
- * A `SupabaseServiceClient` from the ambient env — the SDK-side replacement for the api's
+ * A `SupabaseServiceClient` from the ambient env - the SDK-side replacement for the api's
  * `createSupabaseAdminClient()`.
  *
  * Deliberately a factory rather than a param decorator: a service client carries no per-request
@@ -54,7 +54,7 @@ export declare const SupabaseUserClient: (...dataOrPipes: unknown[]) => Paramete
 export declare const createSupabaseServiceClientFromEnv: (options?: SupabaseUserClientOptions) => SupabaseServiceClient;
 /**
  * A `SupabaseAuthClient` for routes a logged-out caller hits (sign-in, refresh, password
- * reset) — built from the publishable key alone, with no bearer token involved.
+ * reset) - built from the publishable key alone, with no bearer token involved.
  *
  * Deliberately a fresh client per request, not a module-level singleton: supabase-js keeps the
  * session `signIn`, `verifyOtp` and `setSession` produce in the client's own memory, so one

package/dist/nest/index.js

@@ -39,12 +39,12 @@ const configureSupabaseUserClient = (options) => {
     userClientOptions = options;
 };
 exports.configureSupabaseUserClient = configureSupabaseUserClient;
-/** Where on the request the context is stored — `request[SUPABASE_REQUEST_KEY]`. */
+/** Where on the request the context is stored - `request[SUPABASE_REQUEST_KEY]`. */
 exports.SUPABASE_REQUEST_KEY = 'supabase';
 /**
  * Verifies the bearer token on `request`, builds the caller's client from it and stores both on
  * the request. This is the one place a token is authenticated, so it belongs in the api's auth
- * guard — a param decorator cannot be async and must not be where identity is established.
+ * guard - a param decorator cannot be async and must not be where identity is established.
  *
  * Idempotent: a second call hands back the context the first one attached.
  */
@@ -97,7 +97,7 @@ exports.getSupabaseRequestContext = getSupabaseRequestContext;
 /** The caller's data client, from the context the auth guard attached. */
 exports.SupabaseUserClient = (0, common_1.createParamDecorator)((_, ctx) => (0, exports.getSupabaseRequestContext)(ctx.switchToHttp().getRequest()).client);
 /**
- * A `SupabaseServiceClient` from the ambient env — the SDK-side replacement for the api's
+ * A `SupabaseServiceClient` from the ambient env - the SDK-side replacement for the api's
  * `createSupabaseAdminClient()`.
  *
  * Deliberately a factory rather than a param decorator: a service client carries no per-request
@@ -113,7 +113,7 @@ const createSupabaseServiceClientFromEnv = (options = {}) => (0, service_client_
 exports.createSupabaseServiceClientFromEnv = createSupabaseServiceClientFromEnv;
 /**
  * A `SupabaseAuthClient` for routes a logged-out caller hits (sign-in, refresh, password
- * reset) — built from the publishable key alone, with no bearer token involved.
+ * reset) - built from the publishable key alone, with no bearer token involved.
  *
  * Deliberately a fresh client per request, not a module-level singleton: supabase-js keeps the
  * session `signIn`, `verifyOtp` and `setSession` produce in the client's own memory, so one

package/dist/notifications/index.d.ts

@@ -47,7 +47,7 @@ export type NotificationContentRow = {
 };
 /**
  * The recipient's own inbox. Every method is scoped to the caller by `recipient_id`, matching
- * the RLS policies (`auth.uid() = recipient_id`) rather than by organization — a notification
+ * the RLS policies (`auth.uid() = recipient_id`) rather than by organization - a notification
  * belongs to a person, not a tenant.
  */
 export declare class NotificationsResource {
@@ -62,7 +62,7 @@ export declare class NotificationsResource {
     markRead(notificationId: string): Promise<void>;
     /**
      * Deliberately one statement and unaudited. It is a bulk update with no single row to key on,
-     * so auditing it would mean a select-then-loop and one audit row per unread notification —
+     * so auditing it would mean a select-then-loop and one audit row per unread notification -
      * for the reader's own UI state, not an entity change.
      */
     markAllRead(): Promise<void>;
@@ -72,7 +72,7 @@ export declare class NotificationsResource {
      * `rendered_content`.
      */
     contentRow(notificationId: string): Promise<NotificationContentRow>;
-    /** Soft delete — the outbox row stays, flagged `deleted`, so the send record survives. */
+    /** Soft delete - the outbox row stays, flagged `deleted`, so the send record survives. */
     remove(notificationId: string): Promise<void>;
 }
 /** How the outbox reaches an audited table once it knows which organization a row belongs to. */
@@ -83,7 +83,7 @@ export type OrganizationTableFactory = (organizationId: string) => AuditedTable;
  * `rendered_content`.
  *
  * Writes are audited against the row's own organization. Auth mail (signup confirmation,
- * password recovery) has none — it precedes any tenant — and `audit_logs.organization_id` is
+ * password recovery) has none - it precedes any tenant - and `audit_logs.organization_id` is
  * not nullable, so those rows are written unaudited. Their lifecycle columns are the record.
  */
 export declare class NotificationsOutboxResource {
@@ -102,15 +102,15 @@ export declare class NotificationsOutboxResource {
      * Stamps a delivery rollup on first occurrence only. A provider that reports `delivered`
      * twice must not move the timestamp, so the guard is the column still being null.
      *
-     * Only the rollup columns are ever touched here — `status` belongs to the send lifecycle,
+     * Only the rollup columns are ever touched here - `status` belongs to the send lifecycle,
      * not to what the provider reports afterwards.
      */
     stampRollup(notification: Pick<NotificationContentRow, 'mms_id' | 'organization_id'>, column: 'delivered_at' | 'delivery_failure_reason', value: string): Promise<void>;
-    /** The worker's load. Returns null when the row is gone rather than throwing — see `processQueuedNotification`. */
+    /** The worker's load. Returns null when the row is gone rather than throwing - see `processQueuedNotification`. */
     loadForDelivery(notificationId: string): Promise<QueuedNotification | null>;
     /**
      * Stamps a successful send. Guarded on `sent_at is null` so a duplicate delivery of the same
-     * queue message changes nothing instead of double-stamping — the email has already gone.
+     * queue message changes nothing instead of double-stamping - the email has already gone.
      */
     stampSent(notification: QueuedNotification, patch: {
         providerMessageId: string | null;
@@ -124,7 +124,7 @@ export declare class NotificationsOutboxResource {
         failureReason: string;
         terminal: boolean;
     }): Promise<void>;
-    /** Retires a row nothing can rescue — an unknown template, no address, an unsupported channel. */
+    /** Retires a row nothing can rescue - an unknown template, no address, an unsupported channel. */
     stampFailed(notification: QueuedNotification, patch: {
         attempts: number;
         at: string;

package/dist/notifications/index.js

@@ -91,7 +91,7 @@ const NOTIFICATIONS_TABLE = {
 };
 /**
  * The recipient's own inbox. Every method is scoped to the caller by `recipient_id`, matching
- * the RLS policies (`auth.uid() = recipient_id`) rather than by organization — a notification
+ * the RLS policies (`auth.uid() = recipient_id`) rather than by organization - a notification
  * belongs to a person, not a tenant.
  */
 class NotificationsResource {
@@ -157,7 +157,7 @@ class NotificationsResource {
     }
     /**
      * Deliberately one statement and unaudited. It is a bulk update with no single row to key on,
-     * so auditing it would mean a select-then-loop and one audit row per unread notification —
+     * so auditing it would mean a select-then-loop and one audit row per unread notification -
      * for the reader's own UI state, not an entity change.
      */
     async markAllRead() {
@@ -187,7 +187,7 @@ class NotificationsResource {
             throw (0, errors_1.mapPostgrestError)(error);
         return data;
     }
-    /** Soft delete — the outbox row stays, flagged `deleted`, so the send record survives. */
+    /** Soft delete - the outbox row stays, flagged `deleted`, so the send record survives. */
     async remove(notificationId) {
         await this.table.transition(notificationId, enum_2.AuditTrailAction.DELETE, {
             deleted: true,
@@ -202,7 +202,7 @@ exports.NotificationsResource = NotificationsResource;
  * `rendered_content`.
  *
  * Writes are audited against the row's own organization. Auth mail (signup confirmation,
- * password recovery) has none — it precedes any tenant — and `audit_logs.organization_id` is
+ * password recovery) has none - it precedes any tenant - and `audit_logs.organization_id` is
  * not nullable, so those rows are written unaudited. Their lifecycle columns are the record.
  */
 class NotificationsOutboxResource {
@@ -257,7 +257,7 @@ class NotificationsOutboxResource {
      * Stamps a delivery rollup on first occurrence only. A provider that reports `delivered`
      * twice must not move the timestamp, so the guard is the column still being null.
      *
-     * Only the rollup columns are ever touched here — `status` belongs to the send lifecycle,
+     * Only the rollup columns are ever touched here - `status` belongs to the send lifecycle,
      * not to what the provider reports afterwards.
      */
     async stampRollup(notification, column, value) {
@@ -274,7 +274,7 @@ class NotificationsOutboxResource {
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
     }
-    /** The worker's load. Returns null when the row is gone rather than throwing — see `processQueuedNotification`. */
+    /** The worker's load. Returns null when the row is gone rather than throwing - see `processQueuedNotification`. */
     async loadForDelivery(notificationId) {
         const { data, error } = await this.supabase
             .from('notifications')
@@ -287,7 +287,7 @@ class NotificationsOutboxResource {
     }
     /**
      * Stamps a successful send. Guarded on `sent_at is null` so a duplicate delivery of the same
-     * queue message changes nothing instead of double-stamping — the email has already gone.
+     * queue message changes nothing instead of double-stamping - the email has already gone.
      */
     async stampSent(notification, patch) {
         const payload = {
@@ -328,7 +328,7 @@ class NotificationsOutboxResource {
         }
         await this.rawUpdate(notification.mms_id, payload);
     }
-    /** Retires a row nothing can rescue — an unknown template, no address, an unsupported channel. */
+    /** Retires a row nothing can rescue - an unknown template, no address, an unsupported channel. */
     async stampFailed(notification, patch) {
         await this.stampAttempt(notification, { ...patch, terminal: true });
     }

package/dist/organization-invites/index.d.ts

@@ -1,20 +1,20 @@
 import type { AuditActor } from '../audit';
 import type { TypedSupabaseClient } from '../client';
-/** The row an invite hands back — the id to send with the sign-up link, and when it lapses. */
+/** The row an invite hands back - the id to send with the sign-up link, and when it lapses. */
 export type OrganizationInvite = {
     mms_id: string;
     expires_at: string;
 };
 /**
  * The `organization_invites` table: the record that says a given address is allowed to sign up
- * into a given organization. The `on_auth_user_created` trigger reads it — it requires an
+ * into a given organization. The `on_auth_user_created` trigger reads it - it requires an
  * unconsumed, unexpired invite matching the new auth user's email and takes the new user's
  * `organization_id` from it, so tenancy is never taken from anything the sign-up supplied.
  *
  * Service-role only: the table carries no `authenticated` grants, so this lives on the service
  * client and never on a caller's client.
  *
- * Not audited — there is no `AuditTrailEntityType` for an invite, so these writes leave no
+ * Not audited - there is no `AuditTrailEntityType` for an invite, so these writes leave no
  * `audit_logs` row. Add one to the entities package before making it audited.
  */
 export declare class OrganizationInvitesResource {

package/dist/organization-invites/index.js

@@ -6,14 +6,14 @@ const errors_1 = require("../errors");
 const DEFAULT_TTL_MINUTES = 60;
 /**
  * The `organization_invites` table: the record that says a given address is allowed to sign up
- * into a given organization. The `on_auth_user_created` trigger reads it — it requires an
+ * into a given organization. The `on_auth_user_created` trigger reads it - it requires an
  * unconsumed, unexpired invite matching the new auth user's email and takes the new user's
  * `organization_id` from it, so tenancy is never taken from anything the sign-up supplied.
  *
  * Service-role only: the table carries no `authenticated` grants, so this lives on the service
  * client and never on a caller's client.
  *
- * Not audited — there is no `AuditTrailEntityType` for an invite, so these writes leave no
+ * Not audited - there is no `AuditTrailEntityType` for an invite, so these writes leave no
  * `audit_logs` row. Add one to the entities package before making it audited.
  */
 class OrganizationInvitesResource {

package/dist/organization-payment-methods/index.d.ts

@@ -25,12 +25,12 @@ export type PaymentMethodLookupColumn = 'paystack_customer_code' | 'paystack_sub
 /**
  * The `organization_payment_methods` table: the organization's Paystack identity in one row
  * beside the `organizations` row, rather than as columns on it. The organizations READ policy
- * hands the whole row to every member of the tenant, and nothing here is a member's business —
+ * hands the whole row to every member of the tenant, and nothing here is a member's business -
  * the customer, plan and subscription codes are the provider's identifiers and the authorization
- * code and email token are credentials — so the table carries no `authenticated` grant and no
+ * code and email token are credentials - so the table carries no `authenticated` grant and no
  * policy. Only the service role can reach it.
  *
- * Service-role only, like the invites — this lives on the organization scope of the service
+ * Service-role only, like the invites - this lives on the organization scope of the service
  * client and never on a caller's client. Writes are audited against the organization (the row
  * has no identity of its own), and the audit diff redacts every `paystack_*` column, so the trail
  * records that a value changed and never what it changed to.

package/dist/organization-payment-methods/index.js

@@ -27,12 +27,12 @@ const EMPTY = {
 /**
  * The `organization_payment_methods` table: the organization's Paystack identity in one row
  * beside the `organizations` row, rather than as columns on it. The organizations READ policy
- * hands the whole row to every member of the tenant, and nothing here is a member's business —
+ * hands the whole row to every member of the tenant, and nothing here is a member's business -
  * the customer, plan and subscription codes are the provider's identifiers and the authorization
- * code and email token are credentials — so the table carries no `authenticated` grant and no
+ * code and email token are credentials - so the table carries no `authenticated` grant and no
  * policy. Only the service role can reach it.
  *
- * Service-role only, like the invites — this lives on the organization scope of the service
+ * Service-role only, like the invites - this lives on the organization scope of the service
  * client and never on a caller's client. Writes are audited against the organization (the row
  * has no identity of its own), and the audit diff redacts every `paystack_*` column, so the trail
  * records that a value changed and never what it changed to.

package/dist/organizations/index.d.ts

@@ -12,7 +12,7 @@ export type CreateOrganizationRow = Record<string, unknown>;
 /**
  * The caller's own organization. Every method takes the id explicitly rather than reading it
  * off the auth context, because the signup and webhook paths operate on an organization that
- * is not the caller's — there is no caller at all.
+ * is not the caller's - there is no caller at all.
  */
 export declare class OrganizationsResource {
     private readonly supabase;
@@ -24,22 +24,22 @@ export declare class OrganizationsResource {
     get(): Promise<OrganizationRow>;
     /**
      * The whole row, unprojected. Billing reads a different handful of columns for each of its
-     * flows — provisioning, a module purchase, a seat charge — and they are all single-row
+     * flows - provisioning, a module purchase, a seat charge - and they are all single-row
      * lookups by primary key, so one read serves them all rather than a select string each.
      */
     getRowById(organizationId: string): Promise<OrganizationRow>;
     /**
-     * A status move that only lands while the organization is still in `expectedFrom` — the
+     * A status move that only lands while the organization is still in `expectedFrom` - the
      * compare-and-set that stops two concurrent webhooks both advancing the subscription.
      * Resolves to null when someone else moved it first.
      */
     moveBillingStatus(organizationId: string, expectedFrom: string, patch: AuditRow): Promise<AuditRow | null>;
     update(organizationId: string, patch: AuditRow): Promise<OrganizationRow>;
-    /** Hard delete — used by the signup rollback. Returns the row as it was. */
+    /** Hard delete - used by the signup rollback. Returns the row as it was. */
     remove(organizationId: string): Promise<AuditRow>;
     /**
-     * Claims a seat atomically. This is the serialization point for concurrent user creation —
-     * two admins adding at once get distinct seat numbers — so it is a function, not a
+     * Claims a seat atomically. This is the serialization point for concurrent user creation -
+     * two admins adding at once get distinct seat numbers - so it is a function, not a
      * read-then-write. The caller decides what to do with the billing status it returns.
      */
     reserveSeat(organizationId: string): Promise<SeatReservation | null>;
@@ -51,7 +51,7 @@ export declare class OrganizationsResource {
     releaseSeat(organizationId: string): Promise<void>;
 }
 /**
- * Signup, on the service client. `organizations` INSERT is `false` for `authenticated` — the
+ * Signup, on the service client. `organizations` INSERT is `false` for `authenticated` - the
  * caller has no account yet, so there is no RLS context to run under.
  */
 export declare class OrganizationSignupResource {

package/dist/organizations/index.js

@@ -75,7 +75,7 @@ const ORGANIZATION_SELECT = `
 /**
  * The caller's own organization. Every method takes the id explicitly rather than reading it
  * off the auth context, because the signup and webhook paths operate on an organization that
- * is not the caller's — there is no caller at all.
+ * is not the caller's - there is no caller at all.
  */
 class OrganizationsResource {
     supabase;
@@ -102,7 +102,7 @@ class OrganizationsResource {
     }
     /**
      * The whole row, unprojected. Billing reads a different handful of columns for each of its
-     * flows — provisioning, a module purchase, a seat charge — and they are all single-row
+     * flows - provisioning, a module purchase, a seat charge - and they are all single-row
      * lookups by primary key, so one read serves them all rather than a select string each.
      */
     async getRowById(organizationId) {
@@ -116,7 +116,7 @@ class OrganizationsResource {
         return (0, audit_1.withoutInternalId)(data);
     }
     /**
-     * A status move that only lands while the organization is still in `expectedFrom` — the
+     * A status move that only lands while the organization is still in `expectedFrom` - the
      * compare-and-set that stops two concurrent webhooks both advancing the subscription.
      * Resolves to null when someone else moved it first.
      */
@@ -131,13 +131,13 @@ class OrganizationsResource {
         });
         return this.getById(organizationId);
     }
-    /** Hard delete — used by the signup rollback. Returns the row as it was. */
+    /** Hard delete - used by the signup rollback. Returns the row as it was. */
     async remove(organizationId) {
         return this.table.remove(organizationId);
     }
     /**
-     * Claims a seat atomically. This is the serialization point for concurrent user creation —
-     * two admins adding at once get distinct seat numbers — so it is a function, not a
+     * Claims a seat atomically. This is the serialization point for concurrent user creation -
+     * two admins adding at once get distinct seat numbers - so it is a function, not a
      * read-then-write. The caller decides what to do with the billing status it returns.
      */
     async reserveSeat(organizationId) {
@@ -165,7 +165,7 @@ class OrganizationsResource {
 }
 exports.OrganizationsResource = OrganizationsResource;
 /**
- * Signup, on the service client. `organizations` INSERT is `false` for `authenticated` — the
+ * Signup, on the service client. `organizations` INSERT is `false` for `authenticated` - the
  * caller has no account yet, so there is no RLS context to run under.
  */
 class OrganizationSignupResource {