better-supabase 0.1.0 → 0.3.0

package/dist/{respond-PoTpy5DT.d.ts → respond-DAkPIdTH.d.ts}

@@ -1,12 +1,12 @@
-import { n as AnyModels, t as AnyFunctions } from "./types-C2fslP1z.js";
-import { p as DbError, t as AsyncResult } from "./result-CTkCZ6JA.js";
-import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "./define-CTfWw-SS.js";
-import { h as RequestContext } from "./plugin-HvGqCurB.js";
+import { n as AnyModels, t as AnyFunctions } from "./types-DONv9SHN.js";
+import { p as DbError, t as AsyncResult } from "./result-c2OYgCV2.js";
+import { I as StatsRecorder, P as DbStats, t as BetterSupabase, y as Db } from "./define-DUbydmJa.js";
+import { h as RequestContext } from "./plugin-DVRB8qNE.js";
 import { t as BetterSupabaseEnv } from "./index-Dy6kuF0P.js";
-import { r as SqlClaims, t as Postgres } from "./pool-BFeqzwQS.js";
-import { o as ImpersonationOptions, t as Aal } from "./mfa-TVia554c.js";
-import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-DW8h9NPm.js";
-import { n as Bucket } from "./index-Nxo3TJcm.js";
+import { o as SqlClaims, r as Postgres } from "./pool-B9qsLyFR.js";
+import { o as ImpersonationOptions, t as Aal } from "./mfa-x3V3vGh-.js";
+import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-BRciX2jK.js";
+import { n as Bucket } from "./index-CTTMS6_1.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 //#region src/server/delete-account.d.ts
 interface DeleteAccountOptions {
@@ -67,9 +67,9 @@ interface ServerOptions {
     readonly pinMs?: number;
   };
 }
-interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown> {
-  readonly auth: AuthState<C>;
-  readonly resolution: AuthResolution<C>;
+interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
+  readonly auth: AuthState<C, P>;
+  readonly resolution: AuthResolution<C, P>;
   /** supabase-js client scoped to the caller (RLS applies). */
   readonly supabase: SupabaseClient;
   /** Repositories over PostgREST as the caller. */
@@ -88,18 +88,18 @@ interface ContextOptions {
   /** Also records this context's calls into a request-wide recorder. */
   readonly stats?: StatsRecorder;
 }
-interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unknown> {
+interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
   readonly env: BetterSupabaseEnv;
   resolve(request: Request, options?: {
     readonly refresh?: boolean;
-  }): Promise<AuthResolution<C>>;
+  }): Promise<AuthResolution<C, P>>;
   /**
    * Resolves auth and binds repositories to the caller. Refreshes an expired
    * cookie session only with `refresh: true`; send `ctx.resolution.apply(response)`.
    */
-  context(request: Request, options?: ContextOptions): Promise<ServerContext<M, F, E, C>>;
+  context(request: Request, options?: ContextOptions): Promise<ServerContext<M, F, E, C, P>>;
   /** The context for an auth state resolved elsewhere (the proxy, a queue message). */
-  contextFor(auth: AuthState<C>, options?: ContextOptions): ServerContext<M, F, E, C>;
+  contextFor(auth: AuthState<C, P>, options?: ContextOptions): ServerContext<M, F, E, C, P>;
   /** A stateless supabase-js client for an auth state, optionally with extra request headers. */
   supabaseFor(auth: AuthState, headers?: Readonly<Record<string, string>>): SupabaseClient;
   /** Repositories for an auth state (e.g. one resolved by the proxy). */
@@ -123,7 +123,7 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
  * Server-side entry point for APIs, jobs, MCP servers and framework
  * adapters. Holds the secrets; `sb` stays isomorphic.
  */
-declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown>(sb: BetterSupabase<M, D, F, E, C>, options?: ServerOptions): BetterServer<M, F, E, C>;
+declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(sb: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
 //#endregion
 //#region src/server/respond.d.ts
 type AuthKind = AuthState["kind"];
@@ -135,9 +135,15 @@ interface GuardOptions {
    * `required: 'aal2'` until the user verifies a second factor.
    */
   readonly aal?: Aal;
+  /**
+   * OAuth scopes a delegated token (an OAuth client or an `act` chain) needs.
+   * A missing one answers 403 with `error="insufficient_scope"`. The user's
+   * own session is not limited by scopes.
+   */
+  readonly scopes?: readonly string[];
 }
 /** `undefined` when `auth` may pass; otherwise the 401/403 error to send. */
-declare function guard(auth: AuthState, allow?: GuardOptions["allow"], aal?: Aal): DbError | undefined;
+declare function guard(auth: AuthState, allow?: GuardOptions["allow"], aal?: Aal, scopes?: readonly string[]): DbError | undefined;
 declare function isResult(value: unknown): value is {
   ok: boolean;
   data: unknown;

package/dist/{result-CTkCZ6JA.d.ts → result-c2OYgCV2.d.ts}

@@ -7,9 +7,14 @@
 interface DbErrorKinds {
   not_found: Record<never, never>;
   unauthorized: Record<never, never>;
-  /** `required`: the assurance level the route needs, when a second factor is missing. */
+  /**
+   * `required`: the assurance level the route needs, when a second factor is
+   * missing. `scopes`: the OAuth scopes the route needs, when a delegated
+   * token lacks one (`INSUFFICIENT_SCOPE`).
+   */
   forbidden: {
     required?: "aal1" | "aal2";
+    scopes?: readonly string[];
   };
   conflict: {
     constraint?: string;
@@ -158,7 +163,7 @@ declare class AsyncResult<T> implements PromiseLike<Result<T>> {
   andThen<U>(fn: (data: T) => PromiseLike<Result<U>>): AsyncResult<U>;
 }
 /** What `toBetterResult` returns: the `status`/`value`/`error` fields every better-result value has. */
-type BetterResultShape<T, E> = {
+type BetterResultValue<T, E> = {
   readonly status: "ok";
   readonly value: T;
 } | {
@@ -182,17 +187,17 @@ interface BetterResultApi<T, E> {
  * const customer = toBetterResult(await db.customers.findById(id), Result, toAppError);
  * ```
  */
-declare function toBetterResult<T, E>(result: Result<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): BetterResultShape<T, E>;
-declare function toBetterResult<T>(result: Result<T>, api: BetterResultApi<T, DbError>): BetterResultShape<T, DbError>;
-declare function toBetterResult<T, E>(result: AsyncResult<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): Promise<BetterResultShape<T, E>>;
-declare function toBetterResult<T>(result: AsyncResult<T>, api: BetterResultApi<T, unknown>): Promise<BetterResultShape<T, unknown>>;
+declare function toBetterResult<T, E>(result: Result<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): BetterResultValue<T, E>;
+declare function toBetterResult<T>(result: Result<T>, api: BetterResultApi<T, DbError>): BetterResultValue<T, DbError>;
+declare function toBetterResult<T, E>(result: AsyncResult<T>, api: BetterResultApi<T, E>, mapError: (error: DbError) => E): Promise<BetterResultValue<T, E>>;
+declare function toBetterResult<T>(result: AsyncResult<T>, api: BetterResultApi<T, unknown>): Promise<BetterResultValue<T, unknown>>;
 /**
  * Converts a better-result value back into a `Result`, by its `status`
  * field, so it works across better-result versions. A `DbError`, or an
  * error whose `cause` is one, is kept; others go through `mapError`
  * (default `toDbError`).
  */
-declare function fromBetterResult<T>(result: BetterResultShape<T, unknown>, mapError?: (error: unknown) => DbError): Result<T>;
+declare function fromBetterResult<T>(result: BetterResultValue<T, unknown>, mapError?: (error: unknown) => DbError): Result<T>;
 declare function toDbError(cause: unknown): DbError;
 //#endregion
-export { isConflict as C, statusOf as D, mapDbError as E, isCheck as S, isForeignKey as T, DbException as _, Ok as a, ValidationIssue as b, err as c, toBetterResult as d, toDbError as f, DbErrorOf as g, DbErrorKinds as h, Err as i, fromBetterResult as l, DbErrorKind as m, BetterResultApi as n, Result as o, DbError as p, BetterResultShape as r, ThrowMapper as s, AsyncResult as t, ok as u, ErrorMapper as v, isDbError as w, dbError as x, RawDbError as y };
+export { isConflict as C, statusOf as D, mapDbError as E, isCheck as S, isForeignKey as T, DbException as _, Ok as a, ValidationIssue as b, err as c, toBetterResult as d, toDbError as f, DbErrorOf as g, DbErrorKinds as h, Err as i, fromBetterResult as l, DbErrorKind as m, BetterResultApi as n, Result as o, DbError as p, BetterResultValue as r, ThrowMapper as s, AsyncResult as t, ok as u, ErrorMapper as v, isDbError as w, dbError as x, RawDbError as y };

package/dist/server/index.d.ts

@@ -1,12 +1,14 @@
-import { n as AnyModels, t as AnyFunctions } from "../types-C2fslP1z.js";
-import { t as BetterSupabase, y as Db } from "../define-CTfWw-SS.js";
-import { h as RequestContext } from "../plugin-HvGqCurB.js";
-import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-TVia554c.js";
-import { _ as readSession, a as ResolveAuthOptions, b as writeSession, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as StoredSession, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, y as sessionCookieName } from "../resolve-DW8h9NPm.js";
-import { _ as DeleteAccountResult, a as guard, c as settle, d as ServerContext, f as ServerOptions, g as DeleteAccountOptions, h as ReplicaState, i as Settled, l as BetterServer, m as PRIMARY_COOKIE, n as GuardOptions, o as isResult, p as createServer, r as RespondOptions, s as respond, t as AuthKind, u as ContextOptions } from "../respond-PoTpy5DT.js";
-import { a as defineResource, i as ResourceRouteOptions, n as ResourceInput, r as ResourceList, t as ResourceHandler } from "../resource-SkPTRJDD.js";
-import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-DlgB0lYl.js";
-import { n as RefreshOutcome, r as refreshSession } from "../index-cEeweTeM.js";
+import { n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { p as DbError } from "../result-c2OYgCV2.js";
+import { t as BetterSupabase, y as Db } from "../define-DUbydmJa.js";
+import { h as RequestContext } from "../plugin-DVRB8qNE.js";
+import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-x3V3vGh-.js";
+import { _ as readSession, a as ResolveAuthOptions, b as writeSession, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as StoredSession, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, y as sessionCookieName } from "../resolve-BRciX2jK.js";
+import { _ as DeleteAccountResult, a as guard, c as settle, d as ServerContext, f as ServerOptions, g as DeleteAccountOptions, h as ReplicaState, i as Settled, l as BetterServer, m as PRIMARY_COOKIE, n as GuardOptions, o as isResult, p as createServer, r as RespondOptions, s as respond, t as AuthKind, u as ContextOptions } from "../respond-DAkPIdTH.js";
+import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-CwVgiI5q.js";
+import { a as ProblemResponseOptions, c as problemResponse, i as ProblemOptions, l as toProblem, n as PROBLEM_TYPE_BASE, o as fromProblem, r as ProblemDetails, s as isProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-Z2RTQjZD.js";
+import { a as SessionDelegation, i as SessionActor, n as toSession, r as ActClaim, t as AuthSession } from "../view-3Po_PVlr.js";
+import { n as RefreshOutcome, r as refreshSession } from "../index-kpgopLNv.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
@@ -39,4 +41,27 @@ export declare function withBetterPostgres<M extends AnyModels, D, F extends Any
   readonly postgres: PostgresApi;
 }, Db<M, F, E, undefined>>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthState, type BetterServer, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type GuardOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourceRouteOptions, type RespondOptions, type ServerContext, type ServerOptions, type Settled, type StoredSession, type SupabaseAuthContext, aalOf, amrOf, authContext, checkAal, clientIp, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, writeSession };
+//#region src/auth/revocation.d.ts
+/** A client that can read `auth.sessions`, such as `createPostgres().admin`. */
+interface SessionLookup {
+  queryRaw<T = Record<string, unknown>>(text: string, params?: unknown[]): Promise<T[]>;
+}
+/**
+ * `undefined` when the user token's session still exists in `auth.sessions`;
+ * otherwise an `unauthorized` error with code `SESSION_REVOKED`. A verified
+ * access token stays valid until it expires, even after sign-out; call this
+ * before sensitive actions (deleting the account, changing the email) to
+ * reject tokens of ended sessions. It costs one query, so nothing calls it
+ * by default. Non-user callers pass: `guard` decides about them.
+ */
+export declare function checkSession(sql: SessionLookup, auth: {
+  readonly kind: "user";
+  readonly claims: {
+    readonly sub?: unknown;
+    readonly session_id?: unknown;
+  };
+} | {
+  readonly kind: string;
+}): Promise<DbError | undefined>;
+//#endregion
+export { AUTH_CACHE_HEADERS, type Aal, type ActClaim, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type BetterServer, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type GuardOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, type ServerContext, type ServerOptions, type SessionActor, type SessionDelegation, type SessionLookup, type Settled, type StoredSession, type SupabaseAuthContext, aalOf, amrOf, authContext, checkAal, clientIp, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, toSession, writeSession };

package/dist/server/index.js

@@ -1,8 +1,10 @@
-import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-DPu6Fh-t.js";
-import { a as settle, i as respond, n as guard, o as createServer, r as isResult, u as PRIMARY_COOKIE } from "../respond-4-dhoV7x.js";
-import { a as clientIp, f as sessionCookieName, g as impersonatorOf, i as authContext, m as refreshSession, n as amrOf, o as resolveAuth, p as writeSession, r as checkAal, s as AUTH_CACHE_HEADERS, t as aalOf, u as readSession } from "../mfa-CpogP66z.js";
-import { n as postgresExecutor } from "../executor-Ceq60hPM.js";
-import { t as defineResource } from "../resource-CYiu6Ygi.js";
+import { n as dbError } from "../errors-Bl3rkOzo.js";
+import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-CGt1ADix.js";
+import { a as settle, i as respond, n as guard, o as createServer, r as isResult, u as PRIMARY_COOKIE } from "../respond-C44EZAJo.js";
+import { a as clientIp, f as sessionCookieName, i as authContext, m as refreshSession, n as amrOf, o as resolveAuth, p as writeSession, r as checkAal, s as AUTH_CACHE_HEADERS, t as aalOf, u as readSession, v as impersonatorOf } from "../mfa-BxoR1RkN.js";
+import { n as postgresExecutor } from "../executor-C57jx2pn.js";
+import { t as toSession } from "../view-wZ-9qIUz.js";
+import { t as defineResource } from "../resource-D30rp0GN.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/server/middleware.ts
 /** Repository context from a `@supabase/server` context. */
@@ -14,8 +16,8 @@ function contextFromSupabase(ctx) {
 				actor: {
 					id: ctx.userClaims.id,
 					kind: "user",
-					...ctx.userClaims.role !== void 0 ? { role: ctx.userClaims.role } : {},
-					...ctx.userClaims.email !== void 0 ? { email: ctx.userClaims.email } : {}
+					...ctx.userClaims.role === void 0 ? {} : { role: ctx.userClaims.role },
+					...ctx.userClaims.email === void 0 ? {} : { email: ctx.userClaims.email }
 				},
 				claims: ctx.jwtClaims ?? {}
 			};
@@ -29,7 +31,10 @@ function contextFromSupabase(ctx) {
 		};
 		case "publishable":
 		case "none": break;
-		default: return ctx.authMode;
+		default: {
+			const unknown = ctx.authMode;
+			throw new TypeError(`contextFromSupabase: unknown auth mode "${String(unknown)}"`);
+		}
 	}
 	return {
 		actor: {
@@ -65,4 +70,28 @@ function withBetterPostgres(sb) {
 	});
 }
 //#endregion
-export { AUTH_CACHE_HEADERS, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, aalOf, amrOf, authContext, checkAal, clientIp, contextFromSupabase, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, withBetterPostgres, withBetterSupabase, writeSession };
+//#region src/auth/revocation.ts
+const UUID = /^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/i;
+const ACTIVE = `select exists (
+  select 1 from auth.sessions s
+  where s.id = $1::uuid and s.user_id = $2::uuid
+    and (s.not_after is null or s.not_after > now())
+) as active`;
+/**
+* `undefined` when the user token's session still exists in `auth.sessions`;
+* otherwise an `unauthorized` error with code `SESSION_REVOKED`. A verified
+* access token stays valid until it expires, even after sign-out; call this
+* before sensitive actions (deleting the account, changing the email) to
+* reject tokens of ended sessions. It costs one query, so nothing calls it
+* by default. Non-user callers pass: `guard` decides about them.
+*/
+async function checkSession(sql, auth) {
+	if (auth.kind !== "user" || !("claims" in auth)) return void 0;
+	const { sub, session_id: sessionId } = auth.claims;
+	const revoked = dbError("unauthorized", "This session has ended", { code: "SESSION_REVOKED" });
+	if (typeof sessionId !== "string" || typeof sub !== "string" || !UUID.test(sessionId) || !UUID.test(sub)) return revoked;
+	const [row] = await sql.queryRaw(ACTIVE, [sessionId, sub]);
+	return row?.active === true ? void 0 : revoked;
+}
+//#endregion
+export { AUTH_CACHE_HEADERS, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, aalOf, amrOf, authContext, checkAal, checkSession, clientIp, contextFromSupabase, createServer, defineResource, fromProblem, guard, impersonatorOf, isProblem, isResult, problemResponse, readSession, refreshSession, resolveAuth, respond, sessionCookieName, settle, toProblem, toSession, withBetterPostgres, withBetterSupabase, writeSession };

package/dist/{simplify-oHiDKRVQ.js → simplify-LakqK1vH.js}

@@ -1,4 +1,6 @@
 import { n as dbError, t as DbException } from "./errors-Bl3rkOzo.js";
+import { i as temporalText } from "./temporal-BwshQk0W.js";
+import { t as temporal } from "./temporal-required-CMxeSVPo.js";
 import { i as or, r as not, t as and } from "./types-6cYK9pbJ.js";
 //#region src/schema/define.ts
 /**
@@ -27,17 +29,19 @@ function relationMeta(meta, table, relation) {
 }
 //#endregion
 //#region src/ir/codec.ts
-/** Wire form of an app value: `Date` to ISO text, `bigint` to decimal text. */
+/** Wire form of an app value: Temporal values to ISO text, `bigint` to decimal text. */
 function encodeValue(value) {
-	if (value instanceof Date) return value.toISOString();
 	if (typeof value === "bigint") return value.toString();
+	const text = temporalText(value);
+	if (text !== void 0) return text;
 	if (Array.isArray(value)) return value.map(encodeValue);
 	return value;
 }
 function decodeScalar(codec, value) {
 	if (value === null || value === void 0) return value;
 	switch (codec) {
-		case "date": return new Date(value);
+		case "instant": return temporal().Instant.from(String(value));
+		case "plainDateTime": return temporal().PlainDateTime.from(String(value));
 		case "bigint": return BigInt(value);
 		case "string": return String(value);
 		default: return codec;
@@ -170,7 +174,7 @@ function writable(meta, mode) {
 }
 /** Escapes LIKE wildcards so user input matches literally. */
 function escapeLike(value) {
-	return value.replace(/[\\%_]/g, (char) => `\\${char}`);
+	return value.replaceAll(/[\\%_]/g, (char) => `\\${char}`);
 }
 var IrBuilder = class {
 	meta;
@@ -236,8 +240,8 @@ var IrBuilder = class {
 			const keys = Object.keys(value);
 			if (keys.length > 0 && keys.every((key) => key === "is" || key === "isNot")) {
 				const items = [];
-				if (value.is !== void 0) items.push(value.is === null ? make("none", null) : make("some", value.is));
-				if (value.isNot !== void 0) items.push(value.isNot === null ? make("some", null) : not(make("some", value.isNot)));
+				if (value["is"] !== void 0) items.push(value["is"] === null ? make("none", null) : make("some", value["is"]));
+				if (value["isNot"] !== void 0) items.push(value["isNot"] === null ? make("some", null) : not(make("some", value["isNot"])));
 				return and(...items) ?? make("some", null);
 			}
 		}
@@ -341,7 +345,7 @@ var IrBuilder = class {
 	* of each group.
 	*/
 	aggregation(table, args) {
-		const groupBy = args.groupBy ?? [];
+		const groupBy = args["groupBy"] ?? [];
 		if (!Array.isArray(groupBy)) invalidRequest(`"groupBy" on "${table.key}" must be an array`, table.key);
 		const columns = groupBy.map((name) => this.selectColumn(table, String(name)));
 		const measures = [];
@@ -350,7 +354,7 @@ var IrBuilder = class {
 			if (value === void 0) continue;
 			for (const alias of this.measured(table, key, value)) measures.push(this.measure(table, fn, alias, `${key}_${alias}`));
 		}
-		const count = args._count === true;
+		const count = args["_count"] === true;
 		if (!count && measures.length === 0) invalidRequest(`aggregate on "${table.key}" needs _count, _sum, _avg, _min or _max`, table.key);
 		return {
 			columns,
@@ -411,13 +415,7 @@ var IrBuilder = class {
 			alias,
 			column
 		};
-		return codec === "date" ? {
-			fn,
-			key,
-			alias,
-			column,
-			codec
-		} : {
+		return {
 			fn,
 			key,
 			alias,
@@ -434,11 +432,7 @@ var IrBuilder = class {
 			alias,
 			column
 		};
-		return codec === "date" ? {
-			alias,
-			column,
-			codec
-		} : {
+		return {
 			alias,
 			column,
 			cast: "text",
@@ -461,7 +455,7 @@ var IrBuilder = class {
 					columns: [],
 					includes: []
 				},
-				where: this.where(target, args.where),
+				where: this.where(target, args["where"]),
 				orderBy: [],
 				limit: void 0,
 				required: false,
@@ -477,11 +471,11 @@ var IrBuilder = class {
 			alias: name,
 			relation,
 			target,
-			selection: this.selection(target, args.select, args.include),
-			where: this.where(target, args.where),
-			orderBy: this.orderBy(target, args.orderBy),
-			limit: typeof args.limit === "number" ? args.limit : void 0,
-			required: args.required === true
+			selection: this.selection(target, args["select"], args["include"]),
+			where: this.where(target, args["where"]),
+			orderBy: this.orderBy(target, args["orderBy"]),
+			limit: typeof args["limit"] === "number" ? args["limit"] : void 0,
+			required: args["required"] === true
 		};
 	}
 	orderBy(table, input) {
@@ -498,8 +492,8 @@ var IrBuilder = class {
 					direction: spec
 				});
 				else if (isPlainObject(spec)) {
-					const direction = spec.direction === "desc" ? "desc" : "asc";
-					const nulls = spec.nulls;
+					const direction = spec["direction"] === "desc" ? "desc" : "asc";
+					const nulls = spec["nulls"];
 					terms.push(nulls === "first" || nulls === "last" ? {
 						column,
 						direction,

package/dist/{spec-pins-t6sPaHvl.js → spec-pins-C3oc-Tdp.js}

@@ -5,7 +5,7 @@
 */
 const SPEC_PINS = {
 	otelSemconv: "1.37.0",
-	mcp: "2025-06-18",
+	mcp: "2026-07-28",
 	openapi: "3.1.1",
 	cloudevents: "1.0.2",
 	standardWebhooks: "1.0.0",

package/dist/{spec-pins-CJPVghHy.d.ts → spec-pins-CqorWDnO.d.ts}

@@ -5,7 +5,7 @@
  */
 declare const SPEC_PINS: {
   readonly otelSemconv: "1.37.0";
-  readonly mcp: "2025-06-18";
+  readonly mcp: "2026-07-28";
   readonly openapi: "3.1.1";
   readonly cloudevents: "1.0.2";
   readonly standardWebhooks: "1.0.0";

package/dist/sql/index.d.ts

@@ -0,0 +1,139 @@
+import { s as ClaimsMeta } from "../types-DONv9SHN.js";
+import { B as ReadSet } from "../define-DUbydmJa.js";
+import { b as ResolvedConfig } from "../config-C1CYcm6o.js";
+import { n as permdockKeys } from "../permdock-sql-DImJULY-.js";
+//#region src/sql/kit.d.ts
+/**
+ * SQL kit modules for `better-supabase sql add`. Every module is idempotent
+ * (`create or replace`, `if not exists`), so re-running it upgrades in place.
+ */
+interface SqlModule {
+  readonly name: string;
+  readonly title: string;
+  readonly description: string;
+  /** Modules this one needs, added along with it. */
+  readonly requires: readonly string[];
+  /** What it needs instead when the layout has `permdock`. */
+  readonly permdockRequires?: readonly string[];
+  /** `schema` files go with your schemas; `test` files go to `supabase/tests`. */
+  readonly target: "schema" | "test";
+  /** The module with the default claim names. */
+  readonly sql: string;
+  /** The module for configured claim names (`config.claims`), when it reads claims. */
+  readonly render?: (claims: ClaimsMeta, layout: KitLayout) => string;
+}
+/** New modules go at the end: the position is part of the file name. */
+export declare const SQL_MODULES: Readonly<Record<string, SqlModule>>;
+/** The modules to install for `names`, dependencies first. Throws on an unknown name. */
+export declare function resolveModules(names: readonly string[], layout?: KitLayout): SqlModule[];
+interface KitFile {
+  readonly module: string;
+  readonly path: string;
+  readonly contents: string;
+}
+interface KitLayout {
+  /** Directory for schema modules. Defaults to `supabase/schemas`. */
+  readonly dir?: string;
+  /** File prefix. Defaults to `900_better_supabase`. */
+  readonly prefix?: string;
+  /** Directory for pgTAP files. Defaults to `supabase/tests`. */
+  readonly testsDir?: string;
+  /** Version stamped into the header. */
+  readonly version?: string;
+  /** `config.realtime.tables`: registered at the end of the `realtime-tables` module. */
+  readonly realtimeTables?: readonly string[];
+  /** Tenant column passed to `track_realtime`; tables without it broadcast unscoped. */
+  readonly tenantColumn?: string;
+  /** Check constraints for the `jsonb-schemas` module. */
+  readonly jsonSchemas?: readonly JsonSchemaCheck[];
+  /** `config.expose`: the grants the `grants` module writes. */
+  readonly grants?: readonly TableGrant[];
+  /** `config.readSets`, compiled: the functions the `read-sets` module writes. */
+  readonly readSets?: readonly {
+    readonly name: string;
+    readonly sql: string;
+  }[];
+  /** `config.entitlements`: where the `entitlements` module finds each tenant's Stripe customer. */
+  readonly entitlements?: EntitlementsSource;
+  /** `config.vectorSearch`: the tables the `vector-search` module writes a search function for. */
+  readonly vectorSearch?: readonly VectorSearchTable[];
+  /** `config.claims`: claim names the modules read and write. */
+  readonly claims?: ClaimsMeta;
+  /** PermDock's helpers and membership sources, from its manifest: `entitlements` reads them instead of `tenant`. */
+  readonly permdock?: KitPermdock;
+}
+/** One PermDock membership source, from the manifest's `memberships`. */
+interface KitMembershipSource {
+  /** `schema.table`. */
+  readonly table: string;
+  readonly userColumn: string;
+  readonly scope: {
+    readonly column: string;
+  } | {
+    readonly value: string;
+  };
+  readonly idColumn: string;
+}
+/** Where PermDock's `member_<scope>_ids` helpers live, and the tables behind them. */
+interface KitPermdock {
+  /** PermDock's `rls.schema`. */
+  readonly schema: string;
+  /** The PermDock scope tenants map to, e.g. `organization`. */
+  readonly scope: string;
+  readonly memberships: readonly KitMembershipSource[];
+}
+/** An embedding column `db.$search` can query. */
+interface VectorSearchTable {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly column: string;
+  readonly distance: "cosine" | "l2" | "inner_product";
+}
+/** The table holding each tenant's Stripe customer id. */
+interface EntitlementsSource {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  /** Column with the Stripe customer id (`cus_...`). */
+  readonly column: string;
+  /** Column with the tenant id. */
+  readonly key: string;
+}
+/** Privileges one Data API role gets on a table or view. */
+interface TableGrant {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly role: "anon" | "authenticated";
+  readonly privileges: readonly ("select" | "insert" | "update" | "delete")[];
+}
+/** A jsonb column and the JSON Schema its values must match. */
+interface JsonSchemaCheck {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  readonly column: string;
+  readonly schema: Readonly<Record<string, unknown>>;
+}
+/** Whether an installed file matches, ignoring the version stamped in its header. */
+export declare function sameKitFile(current: string | undefined, expected: string): boolean;
+/** The files `sql add` writes for these modules. */
+export declare function renderKit(names: readonly string[], layout?: KitLayout): KitFile[];
+//#endregion
+//#region src/sql/layout.d.ts
+/** Where and how `sql add` writes kit files for this config. */
+export declare function kitLayout(config: ResolvedConfig, testsDir?: string, readSets?: KitLayout["readSets"], permdock?: KitPermdock): KitLayout;
+//#endregion
+//#region src/sql/read-sets.d.ts
+/** A read set compiled to the SQL of its function. */
+interface CompiledReadSet {
+  readonly name: string;
+  readonly sql: string;
+}
+/**
+ * The function for a read set: `stable`, `security invoker` (RLS applies to
+ * the caller) and with an empty `search_path`. Parameters are read from the
+ * `p jsonb` argument; nothing is built dynamically.
+ */
+export declare function compileReadSet(set: ReadSet): Promise<CompiledReadSet>;
+/** Compiles every set, sorted by name. Throws on a duplicate name. */
+export declare function compileReadSets(sets: readonly ReadSet[]): Promise<CompiledReadSet[]>;
+//#endregion
+export { type CompiledReadSet, type KitFile, type KitLayout, type KitPermdock, type SqlModule, permdockKeys };