better-supabase 0.1.0 → 0.3.0

package/dist/{types-C2fslP1z.d.ts → types-DONv9SHN.d.ts}

@@ -1,3 +1,4 @@
+/// <reference lib="esnext.temporal" />
 //#region src/schema/types.d.ts
 type Casing = "snake" | "camel";
 /** Runtime metadata for one column. Keyed by the app (cased) column name. */
@@ -27,10 +28,12 @@ interface ColumnMeta {
   readonly storage?: string;
 }
 /**
- * Runtime representation for a column: `date` decodes timestamps to `Date`,
- * `bigint` and `string` read the exact text of `int8`/`numeric` values.
+ * Runtime representation for a column: `instant` decodes `timestamptz` to
+ * `Temporal.Instant`, `plainDateTime` decodes `timestamp` to
+ * `Temporal.PlainDateTime`, and `bigint` and `string` read the exact text of
+ * `int8`/`numeric` values.
  */
-type Codec = "date" | "bigint" | "string";
+type Codec = "instant" | "plainDateTime" | "bigint" | "string";
 interface RelationMeta {
   /** App key of the target table. */
   readonly table: string;
@@ -99,32 +102,85 @@ interface SchemaMeta {
   readonly topics?: Readonly<Record<string, string>>;
   /** Tables that broadcast change signals (`config.realtime.tables`), keyed by app key. */
   readonly realtime?: Readonly<Record<string, RealtimeTableMeta>>;
+  /** Claim names from `config.claims` that differ from the defaults. */
+  readonly claims?: Partial<ClaimsMeta>;
+}
+/** The claim names the SQL kit, codegen and runtime defaults agree on. */
+interface ClaimsMeta {
+  /** Top-level claim holding the active tenant id. Defaults to `tenant_id`. */
+  readonly tenant: string;
+  /** `scope` of the tenant entries in the `memberships` claim. Defaults to `tenant`. */
+  readonly scope: string;
+  /** Claim holding plan features per tenant (`{ [tenantId]: string[] }`). Defaults to `features`. */
+  readonly features: string;
 }
 interface RealtimeTableMeta {
   /** App column whose value scopes the broadcast topic. */
   readonly tenant?: string;
 }
+/**
+ * Storage policies that call PermDock's generated SQL helpers:
+ * `<schema>.permitted_<scope>_ids(key)` for a scope keyed by a path segment,
+ * `<schema>.permdock_has(key)` for `scope: 'global'`. Only for permissions
+ * whose grants have no row conditions beyond the scope.
+ */
+interface PermdockBucketPolicy {
+  readonly permdock: {
+    /** Downloads, signed URLs, renders and metadata reads. */
+    readonly read: string;
+    /** Listing; without it `read` covers listing too. */
+    readonly list?: string;
+    /** Uploads, updates and moves; also deletes unless `delete` is set. */
+    readonly write: string;
+    readonly delete?: string;
+  };
+  /** A PermDock scope such as `organization`, or `global`. */
+  readonly scope: string;
+  /** 1-based path segment holding the scope id. Defaults to the `{orgId}` segment. */
+  readonly segment?: number;
+  /**
+   * Schema of the helpers `permdock rls generate` writes: PermDock's
+   * `rls.schema`. Defaults to `public`.
+   */
+  readonly schema?: string;
+}
+/** A PermDock topic policy: `select` (receive) and `insert` (send) on `realtime.messages`. */
+interface PermdockTopicPolicy {
+  readonly receive: string;
+  /** Lets clients send on the topic with this permission. */
+  readonly send?: string;
+  /** A PermDock scope such as `organization`, or `global`. */
+  readonly scope: string;
+  /** 1-based `:`-separated topic segment holding the scope id. Defaults to the `{orgId}` segment. */
+  readonly segment?: number;
+  readonly schema?: string;
+}
+type BucketPolicyName = "tenant" | "owner" | "public" | "none";
 interface BucketMeta {
   readonly id: string;
   readonly public: boolean;
   readonly path: string;
-  readonly policy?: "tenant" | "owner" | "public" | "none";
+  readonly policy?: BucketPolicyName | PermdockBucketPolicy;
+  /** Claim paths for the tenant policy, when `config.claims.tenant` is not the default. */
+  readonly tenant?: {
+    readonly claim: readonly string[];
+  };
   readonly fileSizeLimit?: string;
   readonly allowedMimeTypes?: readonly string[];
 }
-interface RelationShape {
+interface RelationTypes {
   readonly table: string;
   readonly kind: "one" | "many";
   readonly nullable: boolean;
 }
-interface FlagsShape {
+interface ModelFlags {
   readonly softDelete?: string;
   readonly timestamps?: true;
   readonly tenant?: string;
   readonly actor?: true;
   readonly version?: string;
 }
-interface ModelShape {
+interface ModelTypes {
   readonly Row: object;
   readonly Insert: object;
   readonly Update: object;
@@ -135,17 +191,17 @@ interface ModelShape {
   readonly Checks?: string;
   /** Foreign key constraint names on this table. */
   readonly ForeignKeys?: string;
-  readonly Flags: FlagsShape;
+  readonly Flags: ModelFlags;
 }
 type AnyModels = {
-  readonly [table: string]: ModelShape;
+  readonly [table: string]: ModelTypes;
 };
-type FunctionShape = {
+type FunctionTypes = {
   readonly Args: object;
   readonly Returns: unknown;
 };
 type AnyFunctions = {
-  readonly [name: string]: FunctionShape;
+  readonly [name: string]: FunctionTypes;
 };
 /**
  * Carries the model types next to the runtime metadata. Created by
@@ -192,4 +248,4 @@ type IsUnion<T, U = T> = T extends unknown ? [U] extends [T] ? false : true : ne
 type PrimaryKeyValue<M extends AnyModels, T extends keyof M> = true extends IsUnion<PrimaryKeyColumn<M, T>> ? { readonly [K in PrimaryKeyColumn<M, T>]: Row<M, T>[K]; } : Row<M, T>[PrimaryKeyColumn<M, T>];
 type Simplify<T> = { [K in keyof T]: T[K]; } & {};
 //#endregion
-export { TableMeta as A, Relations as C, Simplify as D, SchemaMeta as E, UniqueKeyName as M, UniqueWhere as N, TableFlags as O, Update as P, RelationShape as S, Schema as T, ModelsOf as _, CheckConstraint as a, RealtimeTableMeta as b, DatabaseOf as c, ForeignKeyConstraint as d, FunctionMeta as f, ModelShape as g, Insert as h, Casing as i, UniqueConstraint as j, TableKey as k, Flags as l, FunctionsOf as m, AnyModels as n, Codec as o, FunctionShape as p, BucketMeta as r, ColumnMeta as s, AnyFunctions as t, FlagsShape as u, PrimaryKeyColumn as v, Row as w, RelationMeta as x, PrimaryKeyValue as y };
+export { SchemaMeta as A, PrimaryKeyValue as C, Relations as D, RelationTypes as E, UniqueConstraint as F, UniqueKeyName as I, UniqueWhere as L, TableFlags as M, TableKey as N, Row as O, TableMeta as P, Update as R, PrimaryKeyColumn as S, RelationMeta as T, ModelFlags as _, Casing as a, PermdockBucketPolicy as b, Codec as c, Flags as d, ForeignKeyConstraint as f, Insert as g, FunctionsOf as h, BucketPolicyName as i, Simplify as j, Schema as k, ColumnMeta as l, FunctionTypes as m, AnyModels as n, CheckConstraint as o, FunctionMeta as p, BucketMeta as r, ClaimsMeta as s, AnyFunctions as t, DatabaseOf as u, ModelTypes as v, RealtimeTableMeta as w, PermdockTopicPolicy as x, ModelsOf as y };

package/dist/{version-Cqq1m3UY.js → version-BfpG2gks.js}

@@ -1,4 +1,4 @@
-//#region src/cli/version.ts
+//#region src/core/version.ts
 const VERSION = "0.0.0";
 //#endregion
 export { VERSION as t };

package/dist/view-3Po_PVlr.d.ts

@@ -0,0 +1,79 @@
+import { p as DbError } from "./result-c2OYgCV2.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-x3V3vGh-.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-BRciX2jK.js";
+import { JWTClaims, UserClaims } from "@supabase/server";
+//#region src/auth/actor.d.ts
+/** One level of an RFC 8693 `act` chain: who acts, and who acted before it. */
+interface ActClaim {
+  readonly sub: string;
+  readonly act?: ActClaim;
+  readonly [claim: string]: unknown;
+}
+/**
+ * The app acting for the user: the outermost `sub` of an RFC 8693 `act`
+ * chain (prior actors stay on `chain`), else the OAuth `client_id` of a
+ * Supabase OAuth server token.
+ */
+interface SessionActor {
+  readonly id: string;
+  readonly kind: "oauth-client";
+  readonly chain?: ActClaim;
+}
+/** What the user delegated to the actor: the token's OAuth `scope`. */
+interface SessionDelegation {
+  readonly scopes: readonly string[];
+  readonly chain?: ActClaim;
+}
+//#endregion
+//#region src/auth/view.d.ts
+/**
+ * The verified caller as plain data: no token, no clients. Safe to return
+ * from a `'use cache: private'` function and to pass to Client Components.
+ */
+type AuthSession<C = unknown, P = unknown> = {
+  readonly kind: "user";
+  readonly user: UserClaims;
+  /**
+   * The verified JWT payload, including custom access token hook claims,
+   * typed and validated by `sb.claims(schema)`.
+   */
+  readonly claims: JWTClaims & C;
+  /** Seconds since epoch, from the token's `exp`. */
+  readonly expiresAt: number | null;
+  /**
+   * `user_metadata` parsed by `sb.userMetadata(schema)`, for display.
+   * Absent without a schema or when the metadata fails it. Users
+   * write this data with `auth.updateUser()`: never base access on it.
+   */
+  readonly profile?: P;
+  /** `aal2` once the user verified a second factor in this session. */
+  readonly aal: Aal;
+  /** How the user signed in (`password`, `totp`, `sso/saml`, ...). */
+  readonly amr: readonly AmrEntry[];
+  /** Set when an admin acts as this user (the `act` claim), for a banner. */
+  readonly impersonator?: Impersonator;
+  /**
+   * The OAuth client or agent acting for the user (`client_id`, or the
+   * outermost `sub` of the `act` chain), as PermDock's `actorOf` reads it.
+   */
+  readonly actor?: SessionActor;
+  /** The scopes the user granted `actor`, plus its `act` chain. Set only with `actor`. */
+  readonly delegation?: SessionDelegation;
+} | {
+  readonly kind: "service";
+  readonly keyName: string;
+} | {
+  readonly kind: "anon";
+  readonly reason: AnonReason;
+} | {
+  readonly kind: "invalid";
+  readonly reason: InvalidReason;
+  readonly error: DbError;
+};
+type AnonReason = Extract<AuthState, {
+  kind: "anon";
+}>["reason"];
+/** Drops the token from an `AuthState`, leaving only serializable fields. */
+declare function toSession<C, P>(auth: AuthState<C, P>): AuthSession<C, P>;
+//#endregion
+export { SessionDelegation as a, SessionActor as i, toSession as n, ActClaim as r, AuthSession as t };

package/dist/{view-B6F9QbG-.js → view-wZ-9qIUz.js}

@@ -1,18 +1,28 @@
-import { g as impersonatorOf, n as amrOf, t as aalOf } from "./mfa-CpogP66z.js";
+import { g as delegationOf, h as actorOf, n as amrOf, t as aalOf, v as impersonatorOf } from "./mfa-BxoR1RkN.js";
 //#region src/auth/view.ts
 /** Drops the token from an `AuthState`, leaving only serializable fields. */
 function toSession(auth) {
 	switch (auth.kind) {
 		case "user": {
 			const impersonator = impersonatorOf(auth.claims);
+			const outcome = actorOf(auth.claims);
+			const actor = outcome.ok ? outcome.actor : void 0;
+			const scopes = actor ? delegationOf(auth.claims)?.scopes : void 0;
+			const delegation = actor && (scopes || actor.chain) ? {
+				scopes: scopes ?? [],
+				...actor.chain ? { chain: actor.chain } : {}
+			} : void 0;
 			return {
 				kind: "user",
 				user: auth.user,
 				claims: auth.claims,
 				expiresAt: auth.expiresAt,
+				...auth.profile === void 0 ? {} : { profile: auth.profile },
 				aal: aalOf(auth.claims),
 				amr: amrOf(auth.claims),
-				...impersonator ? { impersonator } : {}
+				...impersonator ? { impersonator } : {},
+				...actor ? { actor } : {},
+				...delegation ? { delegation } : {}
 			};
 		}
 		case "service": return {

package/dist/webhooks/index.d.ts

@@ -1,19 +1,20 @@
-import { k as TableKey, n as AnyModels, t as AnyFunctions, w as Row } from "../types-C2fslP1z.js";
-import { o as Result } from "../result-CTkCZ6JA.js";
-import { t as BetterSupabase } from "../define-CTfWw-SS.js";
-//#region src/webhooks/index.d.ts
-export interface VerifiedWebhook<T = unknown> {
+/// <reference lib="esnext.temporal" />
+import { N as TableKey, O as Row, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { o as Result } from "../result-c2OYgCV2.js";
+import { t as BetterSupabase } from "../define-DUbydmJa.js";
+//#region src/webhooks/verify.d.ts
+interface VerifiedWebhook<T = unknown> {
   readonly id: string;
-  readonly timestamp: Date;
+  readonly timestamp: Temporal.Instant;
   readonly payload: T;
   readonly body: string;
 }
-export interface VerifyOptions {
+interface VerifyOptions {
   /** Allowed clock skew in seconds. Defaults to 300. */
   readonly tolerance?: number;
-  readonly now?: () => number;
+  readonly now?: () => Temporal.Instant;
 }
-export type WebhookInput = Request | {
+type WebhookInput = Request | {
   readonly headers: Headers | Readonly<Record<string, string>>;
   readonly body: string;
 };
@@ -23,7 +24,7 @@ export declare function timingSafeEqual(a: string, b: string): boolean;
 export declare function signWebhook(secret: string, message: {
   readonly id: string;
   readonly body: string;
-  readonly timestamp?: Date;
+  readonly timestamp?: Temporal.Instant;
 }): Promise<Record<string, string>>;
 /**
  * Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
@@ -41,13 +42,13 @@ interface HookUser {
   readonly user_metadata?: Readonly<Record<string, unknown>>;
   readonly [key: string]: unknown;
 }
-export interface AuthHookError {
+interface AuthHookError {
   readonly error: {
     readonly http_code: number;
     readonly message: string;
   };
 }
-export interface AuthHooks {
+interface AuthHooks {
   custom_access_token: {
     input: {
       readonly user_id: string;
@@ -116,7 +117,7 @@ export interface AuthHooks {
     output: Record<never, never>;
   };
 }
-export type AuthHookKind = keyof AuthHooks;
+type AuthHookKind = keyof AuthHooks;
 /** Rejects a hook with a status and message Supabase Auth passes to the client. */
 export declare function hookError(status: number, message: string): AuthHookError;
 /**
@@ -125,19 +126,19 @@ export declare function hookError(status: number, message: string): AuthHookErro
  *
  * ```ts
  * export const POST = authHook('custom_access_token', env.AUTH_HOOK_SECRET, async ({ claims, user_id }) => ({
- *   claims: { ...claims, org_id: await orgFor(user_id) },
+ *   claims: { ...claims, tenant_id: await orgFor(user_id) },
  * }));
  * ```
  */
 export declare function authHook<K extends AuthHookKind>(_kind: K, secret: string | readonly string[], handler: (payload: AuthHooks[K]["input"], webhook: VerifiedWebhook<AuthHooks[K]["input"]>) => AuthHooks[K]["output"] | AuthHookError | Promise<AuthHooks[K]["output"] | AuthHookError>, options?: VerifyOptions): (request: Request) => Promise<Response>;
-export interface DatabaseWebhookPayload {
+interface DatabaseWebhookPayload {
   readonly type: "INSERT" | "UPDATE" | "DELETE";
   readonly table: string;
   readonly schema: string;
   readonly record: Readonly<Record<string, unknown>> | null;
   readonly old_record: Readonly<Record<string, unknown>> | null;
 }
-export interface DatabaseChange<R> {
+interface DatabaseChange<R> {
   readonly type: "INSERT" | "UPDATE" | "DELETE";
   readonly table: string;
   readonly record: R | null;
@@ -149,4 +150,5 @@ export declare function isDatabaseWebhook(value: unknown): value is DatabaseWebh
  * Returns `null` for other tables or payloads that aren't database webhooks.
  */
 export declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(sb: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
-//#endregion
+//#endregion
+export type { AuthHookError, AuthHookKind, AuthHooks, DatabaseChange, DatabaseWebhookPayload, VerifiedWebhook, VerifyOptions, WebhookInput };

package/dist/webhooks/index.js

@@ -1,2 +1,2 @@
-import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../webhooks-DbMTJJX2.js";
+import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../webhooks-CAIFQSTM.js";
 export { authHook, databaseChange, hookError, isDatabaseWebhook, signWebhook, timingSafeEqual, verifySharedSecret, verifyWebhook };

package/dist/{webhooks-DbMTJJX2.js → webhooks-CAIFQSTM.js}

@@ -1,13 +1,16 @@
 import { n as dbError } from "./errors-Bl3rkOzo.js";
+import { n as nowInstant, r as optionalTemporal } from "./temporal-BwshQk0W.js";
+import { n as temporalMissing } from "./temporal-required-CMxeSVPo.js";
 import { i as ok, n as err } from "./result-DWXatkd6.js";
+import { i as toBase64, r as fromBase64 } from "./base64-CQeB1eSf.js";
 import { s as toApp } from "./shared-_6-uPL7E.js";
-//#region src/webhooks/index.ts
+//#region src/webhooks/verify.ts
 const encoder = new TextEncoder();
 /** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
 function secretBytes(secret) {
 	const raw = secret.replace(/^v1,/, "").replace(/^whsec_/, "");
 	try {
-		return Uint8Array.from(atob(raw), (char) => char.charCodeAt(0));
+		return fromBase64(raw);
 	} catch {
 		throw new TypeError("Webhook secret is not valid base64");
 	}
@@ -17,10 +20,7 @@ async function signature(secret, content) {
 		name: "HMAC",
 		hash: "SHA-256"
 	}, false, ["sign"]);
-	const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(content)));
-	let binary = "";
-	for (const byte of mac) binary += String.fromCharCode(byte);
-	return btoa(binary);
+	return toBase64(new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(content))));
 }
 /** Constant-time string comparison. */
 function timingSafeEqual(a, b) {
@@ -37,7 +37,7 @@ function header(headers, name) {
 const unauthorized = (code, message) => dbError("unauthorized", message, { code });
 /** Headers for a signed Standard Webhooks request. */
 async function signWebhook(secret, message) {
-	const timestamp = String(Math.floor((message.timestamp ?? /* @__PURE__ */ new Date()).getTime() / 1e3));
+	const timestamp = String(Math.floor((message.timestamp ?? nowInstant()).epochMilliseconds / 1e3));
 	return {
 		"webhook-id": message.id,
 		"webhook-timestamp": timestamp,
@@ -58,7 +58,9 @@ async function verifyWebhook(input, secrets, options = {}) {
 	if (!id || !timestamp || !signatures) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing webhook signature headers"));
 	const seconds = Number(timestamp);
 	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
-	const now = (options.now?.() ?? Date.now()) / 1e3;
+	const namespace = optionalTemporal();
+	if (namespace === void 0) return err(temporalMissing());
+	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
 	const tolerance = options.tolerance ?? 300;
 	if (seconds < now - tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_OLD", "Webhook timestamp is too old"));
 	if (seconds > now + tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_NEW", "Webhook timestamp is in the future"));
@@ -73,7 +75,7 @@ async function verifyWebhook(input, secrets, options = {}) {
 	try {
 		return ok({
 			id,
-			timestamp: /* @__PURE__ */ new Date(seconds * 1e3),
+			timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
 			payload: JSON.parse(body),
 			body
 		});
@@ -98,7 +100,7 @@ function hookError(status, message) {
 *
 * ```ts
 * export const POST = authHook('custom_access_token', env.AUTH_HOOK_SECRET, async ({ claims, user_id }) => ({
-*   claims: { ...claims, org_id: await orgFor(user_id) },
+*   claims: { ...claims, tenant_id: await orgFor(user_id) },
 * }));
 * ```
 */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "better-supabase",
-  "version": "0.1.0",
-  "description": "Strongly typed Supabase: generated schema, typed repositories, plugins, auth glue and framework integrations, with a CLI from day one.",
+  "version": "0.3.0",
+  "description": "Strongly typed Supabase: generated schema, typed repositories, plugins, auth glue and framework integrations. The CLI ships as @better-supabase/cli.",
   "keywords": [
     "hono",
     "mcp",
@@ -25,11 +25,7 @@
     "url": "git+https://github.com/ScaleDockHQ/better-supabase.git",
     "directory": "packages/better-supabase"
   },
-  "bin": {
-    "better-supabase": "./bin/better-supabase.js"
-  },
   "files": [
-    "bin",
     "dist",
     "schemas",
     "skills",
@@ -160,14 +156,14 @@
       "types": "./dist/plugins/validation/index.d.ts",
       "default": "./dist/plugins/validation/index.js"
     },
+    "./sql": {
+      "types": "./dist/sql/index.d.ts",
+      "default": "./dist/sql/index.js"
+    },
     "./testing": {
       "types": "./dist/testing/index.d.ts",
       "default": "./dist/testing/index.js"
     },
-    "./cli": {
-      "types": "./dist/cli/index.d.ts",
-      "default": "./dist/cli/index.js"
-    },
     "./schemas/*.json": "./schemas/*.json",
     "./package.json": "./package.json"
   },
@@ -177,50 +173,52 @@
   },
   "dependencies": {
     "@standard-schema/spec": "1.1.0",
-    "@supabase/middleware": "0.6.0",
-    "@supabase/postgrest-typegen": "0.2.2",
-    "@supabase/server": "1.8.1",
+    "@supabase/middleware": "1.0.0",
+    "@supabase/postgrest-typegen": "0.3.1",
+    "@supabase/server": "1.9.0",
     "@supabase/ssr": "0.12.7"
   },
   "devDependencies": {
     "@arethetypeswrong/cli": "0.18.5",
+    "@better-supabase/ox-config": "0.0.0",
     "@better-supabase/typescript-config": "0.0.0",
-    "@effect/platform-node": "4.0.0-rc.117",
     "@opentelemetry/api": "1.9.1",
     "@orpc/server": "2.0.0-beta.40",
-    "@supabase/config": "0.10.0",
     "@supabase/supabase-js": "2.117.2",
     "@tanstack/query-core": "5.104.0",
     "@tanstack/react-query": "5.104.0",
-    "@types/node": "26.6.3",
+    "@types/node": "24.19.0",
     "@types/pg": "8.23.1",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
-    "@vitest/coverage-v8": "5.0.2",
-    "effect": "4.0.0-rc.117",
-    "hono": "4.13.10",
-    "next": "16.3.6",
-    "oxfmt": "0.71.0",
-    "pg": "8.23.0",
+    "@valibot/to-json-schema": "1.8.0",
+    "@vitest/coverage-v8": "5.0.3",
+    "ajv": "8.20.0",
+    "ajv-formats": "3.0.1",
+    "hono": "4.13.12",
+    "next": "16.3.8",
+    "oxlint": "1.86.0",
+    "pg": "8.23.1",
     "publint": "0.3.24",
     "react": "19.3.0",
     "react-dom": "19.3.0",
+    "temporal-polyfill": "1.0.5",
     "tsdown": "0.23.0",
     "typescript": "7.0.2",
     "valibot": "1.5.0",
-    "vitest": "5.0.2",
+    "vitest": "5.0.3",
     "zod": "4.6.5"
   },
   "peerDependencies": {
     "@opentelemetry/api": ">=1.9",
     "@orpc/server": ">=2.0.0-0",
-    "@supabase/config": ">=0.9.0 <0.11",
     "@supabase/supabase-js": "^2.116.0",
     "@tanstack/query-core": "^5",
     "hono": ">=4",
     "next": ">=16",
     "pg": ">=8",
-    "react": "^19"
+    "react": "^19",
+    "temporal-polyfill": ">=1"
   },
   "peerDependenciesMeta": {
     "@opentelemetry/api": {
@@ -229,9 +227,6 @@
     "@orpc/server": {
       "optional": true
     },
-    "@supabase/config": {
-      "optional": true
-    },
     "@tanstack/query-core": {
       "optional": true
     },
@@ -246,16 +241,21 @@
     },
     "react": {
       "optional": true
+    },
+    "temporal-polyfill": {
+      "optional": true
     }
   },
   "engines": {
     "node": ">=24"
   },
   "scripts": {
-    "bench": "node src/next/next.bench.ts",
+    "bench": "node tests/next/next.bench.ts",
     "build": "tsdown",
     "check:publish": "publint && pnpm pack --out pack.tgz && attw --profile esm-only pack.tgz && rm -f pack.tgz",
+    "lint": "oxlint",
     "test": "vitest run --coverage",
-    "typecheck": "tsc --noEmit --checkers 4"
+    "transit": "true",
+    "typecheck": "tsc --noEmit"
   }
 }