better-supabase 0.10.0 → 0.11.0

package/dist/{server-types-fXwJoFjt.d.ts → server-types-BKN_R4Ws.d.ts}

@@ -1,20 +1,20 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult } from "./result-Cj3yWhjH.js";
-import { a as AnyModels, i as AnyFunctions } from "./types-BO8lVTun.js";
-import { o as EventHub } from "./events-CtAHxPal.js";
-import { m as RequestContext } from "./plugin-D5OIaP93.js";
+import { t as AsyncResult } from "./result-BREt7qOh.js";
+import { a as AnyModels, i as AnyFunctions } from "./types-BrpW5ixT.js";
+import { o as EventHub } from "./events-P3raDX2E.js";
+import { m as RequestContext } from "./plugin-D-95Q0w0.js";
 import { t as BetterSupabaseEnv } from "./index-CxmVzT-3.js";
-import { a as ResolveAuthOptions, p as CookieWrite, r as AuthState, t as AuthResolution } from "./resolve-7atr-wWr.js";
-import { r as CredentialProvider } from "./provider-CQ1SrhLa.js";
-import { n as SqlClient } from "./executor-DzJQVTE2.js";
-import { a as ProblemFormat } from "./problem-CEjyhV5T.js";
+import { a as ResolveAuthOptions, p as CookieWrite, r as AuthState, t as AuthResolution } from "./resolve-Bqb8TMTt.js";
+import { r as CredentialProvider } from "./provider-CNs0Jx0I.js";
+import { n as SqlClient } from "./executor-D1hECPGG.js";
+import { a as ProblemFormat } from "./problem-DCDIQiTA.js";
 import { t as AnyAuthorizer } from "./authorizer-eiOjo-3l.js";
-import { i as EventSink } from "./cloud-event-bwsBwVNG.js";
-import { S as Bucket, t as StorageApi } from "./storage-api-B4Ib2Zpo.js";
-import { Kt as StatsRecorder, Wt as DbStats, _ as Db, t as BetterSupabase } from "./define-DXTC706J.js";
+import { i as EventSink } from "./cloud-event-DXkNoI6v.js";
+import { j as StorageApi, n as Bucket } from "./bucket-BBSNDFNH.js";
+import { Kt as StatsRecorder, Wt as DbStats, _ as Db, t as BetterSupabase } from "./define-M_r1d2AT.js";
 import { t as ImpersonationOptions } from "./impersonation-D5chOkrO.js";
-import { _ as SupportAuthorize, b as TicketSubject, i as AuthorizationHooks } from "./authorization-hooks-Do5djkpz.js";
-import { s as SqlClaims, t as BetterPostgres } from "./pool-BBi4mot3.js";
+import { _ as SupportAuthorize, b as TicketSubject, i as AuthorizationHooks } from "./authorization-hooks-mLi894KH.js";
+import { s as SqlClaims, t as BetterPostgres } from "./pool-cM3rpOQr.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/server/delete-account.d.ts
@@ -596,7 +596,7 @@ interface ForContextOptions {
 }
 /** The header `current_tenant_id()` reads over the Data API. */
 declare const TENANT_HEADER = "x-bs-tenant";
-interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
+interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> {
   readonly auth: AuthState<C, P>;
   readonly resolution: AuthResolution<C, P>;
   /**
@@ -605,9 +605,9 @@ interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unkn
    */
   readonly supabase: SupabaseClient;
   /** Repositories over PostgREST as the caller. */
-  readonly db: Db<M, F, E, SupabaseClient>;
+  readonly db: Db<M, F, E, SupabaseClient, B>;
   /** Repositories over direct Postgres as the caller, when `postgres` is configured. */
-  readonly sql: Db<M, F, E, undefined> | undefined;
+  readonly sql: Db<M, F, E, undefined, B> | undefined;
   /** Calls, waves, tables and time for `db` and `sql` together. */
   stats(): DbStats;
   /** Where `db` reads go, when a read URL is configured. */
@@ -659,7 +659,18 @@ interface ContextOptions {
   readonly requestId?: string;
   readonly correlationId?: string;
 }
-interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
+/** The repositories `bs.admin()` returns: a secret-key `Db` with the Auth admin API. */
+type AdminDb<M extends AnyModels, F extends AnyFunctions, E, B = unknown> = Db<M, F, E, SupabaseClient, B> & {
+  /**
+   * `auth.admin` of the secret-key client: create, invite, list, update and
+   * delete users. Request repositories have no such handle, since their
+   * client holds no secret key.
+   */
+  readonly $authAdmin: SupabaseClient["auth"]["admin"];
+};
+/** A server built by `createServer`, `createHono` or `createNext`, handed to another adapter to share. */
+type SharedServer = Pick<BetterServer<AnyModels, AnyFunctions, unknown>, "env" | "events" | "resolve">;
+interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> {
   readonly env: BetterSupabaseEnv;
   /** The definition's events; adapters pass `events.settled()` to `waitUntil`. */
   readonly events: EventHub;
@@ -672,14 +683,14 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
    * Resolves auth and binds repositories to the caller. Refreshes an expired
    * cookie session only with `refresh: true`; send `ctx.apply(response)`.
    */
-  context(request: Request, options?: ContextOptions): Promise<ServerContext<M, F, E, C, P>>;
+  context(request: Request, options?: ContextOptions): Promise<ServerContext<M, F, E, C, P, B>>;
   /**
    * The context for a resolution from `resolve(request)`, so one resolution
    * can back several contexts without verifying the token again.
    */
-  contextFromResolution(resolution: AuthResolution<C, P>, request: Request, options?: Omit<ContextOptions, "refresh">): ServerContext<M, F, E, C, P>;
+  contextFromResolution(resolution: AuthResolution<C, P>, request: Request, options?: Omit<ContextOptions, "refresh">): ServerContext<M, F, E, C, P, B>;
   /** The context for an auth state resolved elsewhere (the proxy, a queue message). */
-  contextFor(auth: AuthState<C, P>, options?: ContextOptions): ServerContext<M, F, E, C, P>;
+  contextFor(auth: AuthState<C, P>, options?: ContextOptions): ServerContext<M, F, E, C, P, B>;
   /** A stateless supabase-js client for an auth state, optionally with extra request headers. */
   supabaseFor(auth: AuthState, headers?: Readonly<Record<string, string>>): SupabaseClient;
   /**
@@ -689,9 +700,16 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
    */
   dbFor(auth: AuthState, context?: RequestContext, options?: {
     readonly support?: ActiveSupport;
-  }): Db<M, F, E, SupabaseClient>;
-  /** Service-role repositories. Bypasses RLS; the actor is `service`. */
-  admin(context?: RequestContext): Db<M, F, E, SupabaseClient>;
+  }): Db<M, F, E, SupabaseClient, B>;
+  /**
+   * Service-role repositories. Bypasses RLS; the actor is `service`. With
+   * `as`, every request carries the `x-bs-actor` header, so the audit log and
+   * `track_actor` columns record that user for writes the secret key makes.
+   * Only a service caller can set it; the database ignores it for anyone else.
+   */
+  admin(context?: RequestContext, options?: {
+    readonly as?: string;
+  }): AdminDb<M, F, E, B>;
   /**
    * Deletes a user: the Auth user, then their objects in `buckets`, then a
    * `mutation` notice for `auth.users`. Needs the secret key. With
@@ -711,7 +729,7 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
    * `impersonation`, the claims carry `act: { kind: "impersonation", sub, reason }`, which
    * the `audit` and `actor` SQL modules record.
    */
-  actingAs(userId: string, claims?: Omit<SqlClaims, "sub" | "act">, impersonation?: ImpersonationOptions): Db<M, F, E, undefined>;
+  actingAs(userId: string, claims?: Omit<SqlClaims, "sub" | "act">, impersonation?: ImpersonationOptions): Db<M, F, E, undefined, B>;
   /**
    * Repositories for the user in a recorded context (`job.context`), with
    * RLS, over direct Postgres: `actingAs` with the context's tenant and
@@ -724,7 +742,7 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
    * or delegation is malformed, or the ticket has no resolver or is
    * refused; it never falls back to the recorded actor or `admin()`.
    */
-  forContext(context: RequestContext, options?: ForContextOptions): AsyncResult<Db<M, F, E, undefined>>;
+  forContext(context: RequestContext, options?: ForContextOptions): AsyncResult<Db<M, F, E, undefined, B>>;
   /** Support sessions; every method fails without `ServerOptions.support`. */
   readonly support: SupportApi;
   /** `options.authorizer`, when the server has one. */
@@ -734,4 +752,4 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
 }
 type ServerKeys = keyof BetterServer<AnyModels, AnyFunctions, unknown>;
 //#endregion
-export { SupportApprovalQuery as A, sqlSupportStore as B, supportSessions as C, supportCookie as D, clearSupportCookie as E, SupportRequest as F, LiteDriver as G, RequestIdOptions as H, SupportRequestInput as I, deleteAccount as J, DeleteAccountOptions as K, SupportSession as L, SupportCallerClaims as M, SupportEndedBy as N, supportCookieValue as O, SupportListFilter as P, SupportSessionStore as R, SupportStartRequest as S, SupportCookieOptions as T, PRIMARY_COOKIE as U, supportClaims as V, ReplicaState as W, SupportApi as _, ServerDbOptions as a, SupportPolicy as b, TENANT_HEADER as c, SuspendAccountOptions as d, SuspendAccountResult as f, ActiveSupport as g, suspendAccount as h, ServerContext as i, SupportApprover as j, SqlSupportStoreOptions as k, EndSessionsResult as l, lastSignIns as m, ContextOptions as n, ServerKeys as o, endSessions as p, DeleteAccountResult as q, ForContextOptions as r, ServerOptions as s, BetterServer as t, LastSignIn as u, SupportExpireRouteOptions as v, SUPPORT_COOKIE as w, SupportSessions as x, SupportOptions as y, SupportStartInput as z };
+export { supportCookieValue as A, SupportSessionStore as B, SupportSessions as C, SupportCookieOptions as D, SUPPORT_COOKIE as E, SupportEndedBy as F, PRIMARY_COOKIE as G, sqlSupportStore as H, SupportListFilter as I, DeleteAccountOptions as J, ReplicaState as K, SupportRequest as L, SupportApprovalQuery as M, SupportApprover as N, clearSupportCookie as O, SupportCallerClaims as P, SupportRequestInput as R, SupportPolicy as S, supportSessions as T, supportClaims as U, SupportStartInput as V, RequestIdOptions as W, deleteAccount as X, DeleteAccountResult as Y, suspendAccount as _, ServerContext as a, SupportExpireRouteOptions as b, ServerOptions as c, EndSessionsResult as d, LastSignIn as f, lastSignIns as g, endSessions as h, ForContextOptions as i, SqlSupportStoreOptions as j, supportCookie as k, SharedServer as l, SuspendAccountResult as m, BetterServer as n, ServerDbOptions as o, SuspendAccountOptions as p, LiteDriver as q, ContextOptions as r, ServerKeys as s, AdminDb as t, TENANT_HEADER as u, ActiveSupport as v, SupportStartRequest as w, SupportOptions as x, SupportApi as y, SupportSession as z };

package/dist/{session-Djo5t4KQ.d.ts → session-CwpfitmI.d.ts}

@@ -1,8 +1,8 @@
-import { a as AnyModels, i as AnyFunctions } from "./types-BO8lVTun.js";
-import { n as AuthOutageEvent, o as EventHub } from "./events-CtAHxPal.js";
-import { f as CookieScope, h as SessionEncoding, r as AuthState, t as AuthResolution } from "./resolve-7atr-wWr.js";
-import { g as ActiveSupport, i as ServerContext, n as ContextOptions } from "./server-types-fXwJoFjt.js";
-import { d as RefreshPolicy } from "./respond-Cdg5ibH5.js";
+import { a as AnyModels, i as AnyFunctions } from "./types-BrpW5ixT.js";
+import { n as AuthOutageEvent, o as EventHub } from "./events-P3raDX2E.js";
+import { f as CookieScope, h as SessionEncoding, r as AuthState, t as AuthResolution } from "./resolve-Bqb8TMTt.js";
+import { a as ServerContext, r as ContextOptions, v as ActiveSupport } from "./server-types-BKN_R4Ws.js";
+import { d as RefreshPolicy } from "./respond-CEBC6KUX.js";
 import { SingleKeyEntry } from "@supabase/middleware";
 //#region src/server/entries/core.d.ts
 /**
@@ -10,7 +10,7 @@ import { SingleKeyEntry } from "@supabase/middleware";
  * request-scoped context builder and the settings behind them. The server
  * registers it once; entries read it with `serverCore(server)`.
  */
-interface ServerCore<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
+interface ServerCore<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> {
   readonly events: EventHub;
   /** How long reads stay on the primary after a write. */
   readonly pinMs: number;
@@ -25,13 +25,13 @@ interface ServerCore<M extends AnyModels, F extends AnyFunctions, E, C = unknown
   /** `ServerOptions.tenant`, or `undefined` without one. */
   tenant(request: Request, auth: AuthState<C, P>): string | undefined | PromiseLike<string | undefined>;
   support(request: Request, auth: AuthState<C, P>): Promise<ActiveSupport | undefined>;
-  context(resolution: AuthResolution<C, P>, request: Request, options: ContextOptions, tenant: string | undefined): ServerContext<M, F, E, C, P>;
+  context(resolution: AuthResolution<C, P>, request: Request, options: ContextOptions, tenant: string | undefined): ServerContext<M, F, E, C, P, B>;
 }
 /** The core of a server built by `createServer` or one of the adapter factories. */
-declare function serverCore<M extends AnyModels, F extends AnyFunctions, E, C, P>(server: {
+declare function serverCore<M extends AnyModels, F extends AnyFunctions, E, C, P, B>(server: {
   readonly events: EventHub;
-  context(request: Request): Promise<ServerContext<M, F, E, C, P>>;
-}): ServerCore<M, F, E, C, P>;
+  context(request: Request): Promise<ServerContext<M, F, E, C, P, B>>;
+}): ServerCore<M, F, E, C, P, B>;
 //#endregion
 //#region src/server/entries/session.d.ts
 interface SessionEntryConfig {
@@ -90,6 +90,6 @@ type AuthOutageHook = (event: AuthOutageEvent, request: Request) => Response | u
  * cookies and the no-store headers, and hands pending event sends to
  * `waitUntil`.
  */
-declare function withSession<M extends AnyModels, F extends AnyFunctions, E, C, P>(core: ServerCore<M, F, E, C, P>, config?: SessionEntryConfig): SingleKeyEntry<"session", Record<never, never>, AuthResolution<C, P>>;
+declare function withSession<M extends AnyModels, F extends AnyFunctions, E, C, P, B>(core: ServerCore<M, F, E, C, P, B>, config?: SessionEntryConfig): SingleKeyEntry<"session", Record<never, never>, AuthResolution<C, P>>;
 //#endregion
 export { serverCore as a, ServerCore as i, SessionEntryConfig as n, withSession as r, AuthOutageHook as t };

package/dist/{settings-DxXfDUmh.js → settings-BiHDFglz.js}

@@ -1,9 +1,9 @@
-import { n as dbError } from "./errors-8i6tSICm.js";
-import { r as err, t as AsyncResult } from "./result-COkvI9t5.js";
+import { n as dbError } from "./errors-BV1SKTVs.js";
+import { r as err, t as AsyncResult } from "./result-DIeYscA3.js";
 import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { n as validate } from "./standard-DZmwmIhV.js";
-import { n as applyTemporal, o as blockCall } from "./block-helpers-BfVCR5Fc.js";
-import { r as withBlockHooks } from "./block-hooks-ByKlh8Qy.js";
+import { n as validate } from "./standard-B1BigegP.js";
+import { n as applyTemporal, o as blockCall } from "./block-helpers-DkVZNDrj.js";
+import { r as withBlockHooks } from "./block-hooks-C22vuIUd.js";
 //#region src/blocks/settings/settings.ts
 /**
 * Declares the app's settings with a Standard Schema per key. Values are

package/dist/{shared-9B02lczf.js → shared-C9zvURqC.js}

@@ -1,4 +1,4 @@
-import { n as invalidRequest } from "./build-6jmaPAgx.js";
+import { n as invalidRequest } from "./build-C-D_vn0U.js";
 //#region src/compile/shared.ts
 /** A row-count or offset value that is safe to inline into SQL text. */
 function integer(value) {

package/dist/{shared-as0EG51f.js → shared-D5Djh43x.js}

@@ -1,5 +1,5 @@
 import { t as DbException } from "./db-exception-CnWcYPxL.js";
-import { n as dbError } from "./errors-8i6tSICm.js";
+import { n as dbError } from "./errors-BV1SKTVs.js";
 //#region src/plugins/shared.ts
 /** Database column name for an app column, or `undefined` if it is unknown. */
 function dbName(table, app) {

package/dist/{sign-in-D0xN6E_l.js → sign-in-z2BaBdps.js}

@@ -1,5 +1,6 @@
+import { t as hasAuthModule } from "./auth-module-DbZv2WrR.js";
 import { t as clearOnUserChange } from "./user-change-XzvgafU4.js";
-import { c as liveKey, d as shownCount, f as startBroadcast, g as specKey, h as sessionUserId, i as countSource, m as startLiveQuery, p as startLiveCount, t as NO_COUNT } from "./client-CvITjt-9.js";
+import { c as liveKey, d as shownCount, f as startBroadcast, g as specKey, h as sessionUserId, i as countSource, m as startLiveQuery, p as startLiveCount, t as NO_COUNT } from "./client-CHR8IBNG.js";
 import { t as ClientContext } from "./context-wDKxSl9x.js";
 import { useSession } from "./react/session.js";
 import { createElement, useContext, useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
@@ -107,6 +108,10 @@ function useBroadcast(topic, values, handlers, options) {
 	]);
 	return status;
 }
+const SIGNED_OUT_CALLER = {
+	status: "signed-out",
+	userId: null
+};
 const NO_AUTH = () => () => void 0;
 /**
 * The user `useBroadcast` subscribes as: the provider's auth snapshot, or
@@ -120,6 +125,7 @@ function useBroadcastAuth(client, supabase) {
 	});
 	useEffect(() => {
 		if (client) return;
+		if (!hasAuthModule(supabase)) return;
 		const { data } = supabase.auth.onAuthStateChange((_event, session) => {
 			setPlain({
 				status: session ? "signed-in" : "signed-out",
@@ -130,10 +136,11 @@ function useBroadcastAuth(client, supabase) {
 			data.subscription.unsubscribe();
 		};
 	}, [client, supabase]);
-	return client ? {
+	if (client) return {
 		status: snapshot.status,
 		userId: snapshot.user?.id ?? null
-	} : plain;
+	};
+	return hasAuthModule(supabase) ? plain : SIGNED_OUT_CALLER;
 }
 /**
 * The spec from the render whose key last changed, so effects keep the

package/dist/{signatures-BMdJ7neI.d.ts → signatures-BXlDXV3D.d.ts}

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { f as Result } from "./result-Cj3yWhjH.js";
+import { f as Result } from "./result-BREt7qOh.js";
 //#region src/core/signatures.d.ts
 interface VerifiedWebhook<T = unknown> {
   readonly id: string;

package/dist/{signatures-C9CGYZS1.js → signatures-CeIoAelK.js}

@@ -1,9 +1,9 @@
-import { n as dbError } from "./errors-8i6tSICm.js";
+import { n as dbError } from "./errors-BV1SKTVs.js";
 import { c as optionalTemporal, s as nowInstant } from "./temporal-CB5Fpo5d.js";
-import { n as temporalMissing } from "./temporal-required-DqRzr7i0.js";
-import { a as ok, r as err } from "./result-COkvI9t5.js";
-import { i as toBase64, r as fromBase64 } from "./base64-BmeCBgGo.js";
-import { r as timingSafeEqual, t as encoder } from "./hmac-DCud0myt.js";
+import { n as temporalMissing } from "./temporal-required-nfZ87U-0.js";
+import { a as ok, r as err } from "./result-DIeYscA3.js";
+import { i as toBase64, r as fromBase64 } from "./base64-D4aqdnDR.js";
+import { r as timingSafeEqual, t as encoder } from "./hmac-BgpThYQW.js";
 //#region src/core/signatures.ts
 /** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
 function secretBytes(secret) {

package/dist/{signers-BjSgNAXP.d.ts → signers-BwKV-9S6.d.ts}

@@ -1,11 +1,11 @@
 /// <reference lib="esnext.temporal" />
-import { f as Result, t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
+import { T as ErrorMapper, f as Result, t as AsyncResult } from "./result-BREt7qOh.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { n as SqlClient } from "./executor-DzJQVTE2.js";
-import { t as BlockTransport } from "./block-transport-NbUJygA7.js";
-import { r as BlockTemporalOptions } from "./block-helpers-7pMBVsE6.js";
-import { n as BlockHooks } from "./block-hooks-C_WaodoA.js";
-import { t as BlockProblemOptions } from "./problem-CEjyhV5T.js";
+import { n as SqlClient } from "./executor-D1hECPGG.js";
+import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
+import { r as BlockTemporalOptions } from "./block-helpers-CjcQM1yA.js";
+import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
+import { t as BlockProblemOptions } from "./problem-DCDIQiTA.js";
 //#region src/blocks/webhooks/incoming-types.d.ts
 /** How a delivery proves it came from the sender. */
 type IncomingVerify = "none" | "standard-webhooks" | "hmac-sha256" | "shared-secret";

package/dist/{signing-keys-Ccr86Y2C.d.ts → signing-keys-v2MRYkDF.d.ts}

@@ -1,8 +1,8 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult } from "./result-Cj3yWhjH.js";
+import { t as AsyncResult } from "./result-BREt7qOh.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { n as BlockOptions } from "./block-helpers-7pMBVsE6.js";
-import { n as BlockHooks } from "./block-hooks-C_WaodoA.js";
+import { n as BlockOptions } from "./block-helpers-CjcQM1yA.js";
+import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
 import { i as JwsAlgorithm, n as Jwks, o as SigningAlgorithm, t as Jwk } from "./jws-35a8VhFV.js";
 //#region src/blocks/signing-keys/signing-keys.d.ts
 interface SigningKeysOptions extends BlockOptions {
@@ -24,6 +24,20 @@ interface SigningKeyOwner {
   readonly type: string;
   readonly id: string;
 }
+/**
+ * The owner of the platform's own keys, for a single authorization server
+ * that signs for every tenant. A key per tenant uses `{ type, id }` of the
+ * tenant instead, such as `{ type: "environment", id: environment.id }`.
+ */
+declare const PLATFORM_OWNER: SigningKeyOwner;
+/**
+ * The `typ` header for a token kind of your own: `jwtType("invite")` is
+ * `vnd.invite+jwt`. Sign with `{ typ }` and verify with `verifyCompact(...,
+ * { typ })` so a token of one kind can't be replayed as another (RFC 8725
+ * section 3.11). Throws a `TypeError` for a name outside lower-case letters,
+ * digits and `-`.
+ */
+declare function jwtType(name: string): string;
 /** What `create` and `rotate` return. The private key never leaves Vault again. */
 interface CreatedSigningKey {
   readonly kid: string;
@@ -45,7 +59,8 @@ interface Signer {
   sign(data: Uint8Array): AsyncResult<Signature>;
   /**
    * A compact JWS over `claims`, with `alg`, `kid` and `typ: "JWT"` in the
-   * header unless `header` sets them. A numeric `exp` keeps the key in the
+   * header unless `header` sets them. A custom `typ` has to be `JWT` or end in
+   * `+jwt` (see `jwtType`); anything else fails with `SIGNING_TYP_INVALID`. A numeric `exp` keeps the key in the
    * JWKS until then (`note_signing_key_exp`), so a rotation can't strand the token.
    */
   signJwt(claims: Readonly<Record<string, unknown>>, header?: Readonly<Record<string, unknown>>): AsyncResult<string>;
@@ -87,4 +102,4 @@ interface SigningKeys {
  */
 declare function createSigningKeys(options: SigningKeysOptions): SigningKeys;
 //#endregion
-export { Signer as a, SigningKeys as c, Signature as i, SigningKeysOptions as l, JwksOptions as n, SignerOptions as o, JwksResponseOptions as r, SigningKeyOwner as s, CreatedSigningKey as t, createSigningKeys as u };
+export { Signature as a, SigningKeyOwner as c, createSigningKeys as d, jwtType as f, PLATFORM_OWNER as i, SigningKeys as l, JwksOptions as n, Signer as o, JwksResponseOptions as r, SignerOptions as s, CreatedSigningKey as t, SigningKeysOptions as u };

package/dist/solid/index.d.ts

@@ -1,11 +1,11 @@
-import { b as DbError } from "../result-Cj3yWhjH.js";
-import { J as TemplateValues } from "../storage-api-B4Ib2Zpo.js";
-import { at as QuerySpec } from "../define-DXTC706J.js";
-import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-Dgs-eSYQ.js";
-import { t as AuthSnapshot } from "../bind-DkaP_0iS.js";
-import { t as AuthSession } from "../view-SuASaomx.js";
-import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-nFnYWvB0.js";
-import { t as SupportView } from "../support-view-CznLe4jq.js";
+import { b as DbError } from "../result-BREt7qOh.js";
+import { O as TemplateValues } from "../bucket-BBSNDFNH.js";
+import { at as QuerySpec } from "../define-M_r1d2AT.js";
+import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-1WTkDnPd.js";
+import { t as AuthSnapshot } from "../bind-CTNKpBM6.js";
+import { t as AuthSession } from "../view-Bf7e07rQ.js";
+import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-DmJICh93.js";
+import { t as SupportView } from "../support-view-IRnDLuGN.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Accessor, JSX } from "solid-js";
 import { QueryClient } from "@tanstack/query-core";

package/dist/solid/index.js

@@ -1,5 +1,5 @@
 import { t as clearOnUserChange } from "../user-change-XzvgafU4.js";
-import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-CvITjt-9.js";
+import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-CHR8IBNG.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
 import { t as fieldErrorsOf } from "../field-errors-DZVRWRkf.js";
 import { n as useContext$1, t as ClientContext } from "../context-B8_p3MXo.js";

package/dist/{solid-controller-CZrt1Tg6.d.ts → solid-controller-Uqi5ef6z.d.ts}

@@ -1,4 +1,4 @@
-import { n as Controller } from "./controller-CCb9tHw_.js";
+import { n as Controller } from "./controller-BBXX1RMw.js";
 import { Accessor } from "solid-js";
 //#region src/blocks/solid-controller.d.ts
 /** A block controller in a Solid component: `state` follows the controller. */

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
-import { a as AnyModels, i as AnyFunctions } from "../types-BO8lVTun.js";
-import { t as BetterSupabase } from "../define-DXTC706J.js";
-import { t as BetterServer } from "../server-types-fXwJoFjt.js";
-import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-BlcEFQql.js";
-import { t as RefusalRedirects } from "../refusal-Bdr1k47u.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-C2oL4OaO.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
+import { t as BetterSupabase } from "../define-M_r1d2AT.js";
+import { n as BetterServer } from "../server-types-BKN_R4Ws.js";
+import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-BeZX2pR_.js";
+import { t as RefusalRedirects } from "../refusal-CufncwaN.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-D6IFkuAg.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/solid-start/index.d.ts
 /** The part of a SolidStart `FetchEvent` the integration reads and writes. */
@@ -32,7 +32,7 @@ export interface SolidStartMiddleware {
   readonly onRequest: (event: SolidFetchEvent) => Promise<Response | undefined>;
   readonly onBeforeResponse: (event: SolidFetchEvent) => void;
 }
-export interface BetterSolidStart<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
+export interface BetterSolidStart<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> extends BetterServer<M, F, E, C, P, B> {
   /**
    * Verifies the caller, refreshes the session cookie on navigations and
    * form posts, and puts `db`, `bs`, `auth`, `tenant` and `session` on
@@ -44,7 +44,7 @@ export interface BetterSolidStart<M extends AnyModels, F extends AnyFunctions, E
    */
   readonly middleware: SolidStartMiddleware;
   /** The current request's `locals`, inside a `"use server"` function. */
-  readonly locals: () => FrameworkLocals<M, F, E, C, P>;
+  readonly locals: () => FrameworkLocals<M, F, E, C, P, B>;
   /**
    * The caller inside a `"use server"` function (a `query`, an `action`,
    * an API route), or a thrown refusal: a redirect to `signIn` or `mfa`
@@ -58,14 +58,14 @@ export interface BetterSolidStart<M extends AnyModels, F extends AnyFunctions, E
    * }, "notes");
    * ```
    */
-  require<R extends boolean = false>(options?: BlockRequireOptions<C, P, R>): Promise<FrameworkLocals<M, F, E, C, P> & AuthorizedContext<C, P, R>>;
+  require<R extends boolean = false>(options?: BlockRequireOptions<C, P, R>): Promise<FrameworkLocals<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>;
   /**
    * A server function returning an `ActionResult`, for `action()` from
    * `@solidjs/router`: `FormData` or a plain object, validated by `input`.
    */
-  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: BlockActionOptions<S, C, P, R>, fn: (input: ActionParsed<S>, ctx: FrameworkLocals<M, F, E, C, P> & AuthorizedContext<C, P, R>) => T): (input: unknown) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: BlockActionOptions<S, C, P, R>, fn: (input: ActionParsed<S>, ctx: FrameworkLocals<M, F, E, C, P, B> & AuthorizedContext<C, P, R>) => T): (input: unknown) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
 }
 /** SolidStart integration: middleware, guards and server function actions. */
-export declare function createSolidStart<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options: SolidStartOptions): BetterSolidStart<M, F, E, C, P>;
+export declare function createSolidStart<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, options: SolidStartOptions): BetterSolidStart<M, F, E, C, P, B>;
 //#endregion
 export type { ActionResult, RefusalRedirects };

package/dist/solid-start/index.js

@@ -1,9 +1,9 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-rmWaLNe3.js";
-import { t as defaultExpose } from "../respond-Dpx48ATq.js";
-import { i as requireCaller, o as runAction } from "../kit-gqwkVhGU.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-B2WRsRIg.js";
+import { t as defaultExpose } from "../respond-Bhp3G__q.js";
+import { i as requireCaller, o as runAction } from "../kit-LTbHrWWD.js";
 import { i as nitroCloudflareEnv } from "../shared-BmMcMoW9.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-Cfm0IspZ.js";
-import { r as refusalResponse } from "../refusal-Ch-u9dVd.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-Ch8bMmQY.js";
+import { r as refusalResponse } from "../refusal-CFpfmjcS.js";
 import { t as beforeRoute } from "../before-route-B98js9m_.js";
 //#region src/solid-start/index.ts
 /** SolidStart integration: middleware, guards and server function actions. */

package/dist/spec/index.d.ts

@@ -1,8 +1,8 @@
 import { C as ModelWebhook, D as ResourceOperation, E as OperationSource, O as SecurityRequirement, S as ModelTag, T as OAuthFlow, _ as ModelResponseOrRef, a as JsonSchema, b as ModelServer, c as ModelChannelOperation, d as ModelInfo, f as ModelMessage, g as ModelResponse, h as ModelParameter, i as JsonObject, l as ModelContent, m as ModelOperation, n as DataApiOperation, o as ModelBody, p as ModelMessageTrait, r as HttpMethod, s as ModelChannel, t as ApiModel, u as ModelExample, v as ModelSecurityProfileRequirement, w as ModelWorkflow, x as ModelStep, y as ModelSecurityScheme } from "../model-lUafmeBQ.js";
 import { a as FormatVersion, c as SpecDiagnostic, d as defineDocumentFormat, i as DocumentOf, l as VersionOf, n as DiagnosticSeverity, o as LowerContext, r as DocumentFormat, s as RenderedOf, t as AnyDocumentFormat, u as VersionStatus } from "../format-CNwSjXUU.js";
-import { a as ResourcePlan, r as ResourceDescription } from "../resource-DxcgtHq6.js";
-import { B as DEFAULT_ERRORS, C as ApiSource, D as OperationIdContext, E as EnrichHooks, F as EventsOptions, H as SecurityPreset, I as TopicInput, L as topicsFrom, O as ResourceInput, R as DataApiOptions, S as ApiOptions, T as ComponentNameContext, V as PROBLEM_SCHEMA, a as OverlayEngine, c as defineApi, i as OpenApiRenderResult, k as RouteSpec, n as DefineApiOptions, o as RenderOptions, r as OpenApiRenderOptions, s as RenderResult, t as Api, w as BuiltModel, z as CustomSecurity } from "../api-XJcQON_7.js";
-import { t as DescribedFunction } from "../function-contract-B4c0XuTU.js";
+import { a as ResourcePlan, r as ResourceDescription } from "../resource-DYEtc-KN.js";
+import { B as DEFAULT_ERRORS, C as ApiSource, D as OperationIdContext, E as EnrichHooks, F as EventsOptions, H as SecurityPreset, I as TopicInput, L as topicsFrom, O as ResourceInput, R as DataApiOptions, S as ApiOptions, T as ComponentNameContext, V as PROBLEM_SCHEMA, a as OverlayEngine, c as defineApi, i as OpenApiRenderResult, k as RouteSpec, n as DefineApiOptions, o as RenderOptions, r as OpenApiRenderOptions, s as RenderResult, t as Api, w as BuiltModel, z as CustomSecurity } from "../api-DoWK3dTw.js";
+import { t as DescribedFunction } from "../function-contract-DWqFl_QO.js";
 //#region src/spec/build.d.ts
 /**
  * Builds the version-neutral API model once per metadata, plugin list and

package/dist/spec/index.js

@@ -1,8 +1,8 @@
 import { r as isPlainObject } from "../clone-dN9XOL1K.js";
-import { a as methodNotAllowed } from "../problem-pIiL3WbE.js";
+import { a as methodNotAllowed } from "../problem-JRCohp1j.js";
 import { t as FUNCTION_DESCRIPTOR } from "../function-contract-DmkBg19r.js";
-import { o as defineDocumentFormat, t as defineApi } from "../api-CFjuYKFY.js";
-import { a as DEFAULT_ERRORS, i as topicsFrom, l as mergeJson, o as PROBLEM_SCHEMA, t as buildApiModel, u as pointerToken } from "../build-Cm0T5MVG.js";
+import { o as defineDocumentFormat, t as defineApi } from "../api-C43_FYDp.js";
+import { a as DEFAULT_ERRORS, i as topicsFrom, l as mergeJson, o as PROBLEM_SCHEMA, t as buildApiModel, u as pointerToken } from "../build-CT6SPZkI.js";
 //#region src/spec/function-route.ts
 function isDescriptor(value) {
 	return typeof value === "object" && value !== null && "input" in value;

package/dist/sql/index.d.ts

@@ -1,5 +1,5 @@
-import { C as BLOCK_OPTION_SCHEMAS, S as resolveModule, w as BlockOptionsRegistry } from "../authorization-CdJRoZgV.js";
-import { a as ModuleAudit, c as ModuleEmit, d as ModuleTableSpec, f as contractSignature, i as ModuleAction, l as ModuleIdType, m as moduleIdType, n as AuditCategory, o as ModuleContext, p as isModuleIdType, r as MODULE_ID_TYPES, s as ModuleContractFunction, t as AUDIT_CATEGORIES, u as ModuleNames } from "../context-CCfX2szU.js";
-import { $ as ModuleDeprecation, A as APP_TABLES_MODULE, B as moduleFileVersion, C as dataExportPlan, D as adoptedColumnProblems, E as AdoptedTable, F as ModulePermissionKey, G as moduleDeprecations, H as moduleFilePaths, I as moduleEventTriggers, J as customContracts, K as upgradePlan, L as moduleHidingColumns, M as SQL_MODULES, N as resolveModules, O as adoptedTables, P as ModuleExtension, Q as ModuleAccessProvider, R as modulePermissionKeys, S as SECRET_COLUMNS, T as resolveExposeColumns, U as InstalledModule, V as sameModuleFile, W as ModuleUpgradePlan, X as moduleTopics, Y as moduleBody, Z as renderModules, _ as subjectColumns, a as MigrationOptionUse, at as SqlModule, b as sameTenantTrigger, c as SCOPE_ID_TYPES, ct as sameTenantLayout, d as templateFunctions, et as ModuleEntitlementsProvider, f as PolicyGrant, g as rlsTables, h as policyGrants, i as sharedRolesProblems, it as ModuleUpgrade, j as appTablesFiles, k as APP_TABLES_MARKER, l as resolveProviderSql, lt as AuditedTable, m as extensionSchema, n as compileReadSet, nt as ModuleLayout, o as migrationOptionUses, ot as moduleVersion, p as declaredTables, q as ModuleTopic, r as compileReadSets, rt as ModuleTestFile, s as moduleLayout, st as DeclaredForeignKey, t as CompiledReadSet, tt as ModuleFile, u as scopeProblems, ut as auditRegistrations, v as expiredFlagsQuery, w as excludedColumns, x as DataExportPlan, y as sameTenantColumn, z as moduleSchemaExtensions } from "../index-MCXVzkXs.js";
-import { o as appTableEventTypes } from "../app-tables-DVidEHOI.js";
+import { C as BLOCK_OPTION_SCHEMAS, S as resolveModule, w as BlockOptionsRegistry } from "../authorization-ClWBcXJi.js";
+import { a as ModuleAudit, c as ModuleEmit, d as ModuleTableSpec, f as contractSignature, i as ModuleAction, l as ModuleIdType, m as moduleIdType, n as AuditCategory, o as ModuleContext, p as isModuleIdType, r as MODULE_ID_TYPES, s as ModuleContractFunction, t as AUDIT_CATEGORIES, u as ModuleNames } from "../context-Cv3KlxWY.js";
+import { $ as ModuleDeprecation, A as APP_TABLES_MODULE, B as moduleFileVersion, C as dataExportPlan, D as adoptedColumnProblems, E as AdoptedTable, F as ModulePermissionKey, G as moduleDeprecations, H as moduleFilePaths, I as moduleEventTriggers, J as customContracts, K as upgradePlan, L as moduleHidingColumns, M as SQL_MODULES, N as resolveModules, O as adoptedTables, P as ModuleExtension, Q as ModuleAccessProvider, R as modulePermissionKeys, S as SECRET_COLUMNS, T as resolveExposeColumns, U as InstalledModule, V as sameModuleFile, W as ModuleUpgradePlan, X as moduleTopics, Y as moduleBody, Z as renderModules, _ as subjectColumns, a as MigrationOptionUse, at as SqlModule, b as sameTenantTrigger, c as SCOPE_ID_TYPES, ct as sameTenantLayout, d as templateFunctions, et as ModuleEntitlementsProvider, f as PolicyGrant, g as rlsTables, h as policyGrants, i as sharedRolesProblems, it as ModuleUpgrade, j as appTablesFiles, k as APP_TABLES_MARKER, l as resolveProviderSql, lt as AuditedTable, m as extensionSchema, n as compileReadSet, nt as ModuleLayout, o as migrationOptionUses, ot as moduleVersion, p as declaredTables, q as ModuleTopic, r as compileReadSets, rt as ModuleTestFile, s as moduleLayout, st as DeclaredForeignKey, t as CompiledReadSet, tt as ModuleFile, u as scopeProblems, ut as auditRegistrations, v as expiredFlagsQuery, w as excludedColumns, x as DataExportPlan, y as sameTenantColumn, z as moduleSchemaExtensions } from "../index-CEcDqDhc.js";
+import { o as appTableEventTypes } from "../app-tables-BrMBjyuq.js";
 export { APP_TABLES_MARKER, APP_TABLES_MODULE, AUDIT_CATEGORIES, type AdoptedTable, type AuditCategory, type AuditedTable, BLOCK_OPTION_SCHEMAS, type BlockOptionsRegistry, type CompiledReadSet, type DataExportPlan, type DeclaredForeignKey, type InstalledModule, MODULE_ID_TYPES, type MigrationOptionUse, type ModuleAccessProvider, type ModuleAction, type ModuleAudit, type ModuleContext, type ModuleContractFunction, type ModuleDeprecation, type ModuleEmit, type ModuleEntitlementsProvider, type ModuleExtension, type ModuleFile, type ModuleIdType, type ModuleLayout, type ModuleNames, type ModulePermissionKey, type ModuleTableSpec, type ModuleTestFile, type ModuleTopic, type ModuleUpgrade, type ModuleUpgradePlan, type PolicyGrant, SCOPE_ID_TYPES, SECRET_COLUMNS, SQL_MODULES, type SqlModule, adoptedColumnProblems, adoptedTables, appTableEventTypes, appTablesFiles, auditRegistrations, compileReadSet, compileReadSets, contractSignature, customContracts, dataExportPlan, declaredTables, excludedColumns, expiredFlagsQuery, extensionSchema, isModuleIdType, migrationOptionUses, moduleBody, moduleDeprecations, moduleEventTriggers, moduleFilePaths, moduleFileVersion, moduleHidingColumns, moduleIdType, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, moduleVersion, policyGrants, renderModules, resolveExposeColumns, resolveModule, resolveModules, resolveProviderSql, rlsTables, sameModuleFile, sameTenantColumn, sameTenantLayout, sameTenantTrigger, scopeProblems, sharedRolesProblems, subjectColumns, templateFunctions, upgradePlan };

package/dist/sql/index.js

@@ -1,5 +1,5 @@
 import { r as resolveModule } from "../blocks-D2WQ63PI.js";
 import { u as appTableEventTypes } from "../app-tables-BRjMcWhW.js";
-import { c as templateFunctions, o as resolveProviderSql, s as scopeProblems, t as SCOPE_ID_TYPES } from "../access-sql-DUSSMaC3.js";
-import { A as SECRET_COLUMNS, B as migrationOptionUses, C as moduleHidingColumns, D as resolveModules, E as SQL_MODULES, F as rlsTables, G as moduleIdType, H as MODULE_ID_TYPES, I as auditRegistrations, K as BLOCK_OPTION_SCHEMAS, L as subjectColumns, M as declaredTables, N as extensionSchema, O as excludedColumns, P as policyGrants, R as sameTenantColumn, S as moduleEventTriggers, T as moduleSchemaExtensions, U as contractSignature, V as AUDIT_CATEGORIES, W as isModuleIdType, _ as moduleFilePaths, a as expiredFlagsQuery, b as appTablesFiles, c as adoptedTables, d as customContracts, f as moduleBody, g as upgradePlan, h as moduleDeprecations, i as moduleLayout, j as dataExportPlan, k as resolveExposeColumns, l as moduleFileVersion, m as renderModules, n as compileReadSets, o as sameTenantLayout, p as moduleTopics, r as sharedRolesProblems, s as adoptedColumnProblems, t as compileReadSet, u as sameModuleFile, v as APP_TABLES_MARKER, w as modulePermissionKeys, x as moduleVersion, y as APP_TABLES_MODULE, z as sameTenantTrigger } from "../sql-CgTZOQZ7.js";
+import { c as templateFunctions, o as resolveProviderSql, s as scopeProblems, t as SCOPE_ID_TYPES } from "../access-sql-CTJPHjCL.js";
+import { A as SECRET_COLUMNS, B as migrationOptionUses, C as moduleHidingColumns, D as resolveModules, E as SQL_MODULES, F as rlsTables, G as moduleIdType, H as MODULE_ID_TYPES, I as auditRegistrations, K as BLOCK_OPTION_SCHEMAS, L as subjectColumns, M as declaredTables, N as extensionSchema, O as excludedColumns, P as policyGrants, R as sameTenantColumn, S as moduleEventTriggers, T as moduleSchemaExtensions, U as contractSignature, V as AUDIT_CATEGORIES, W as isModuleIdType, _ as moduleFilePaths, a as expiredFlagsQuery, b as appTablesFiles, c as adoptedTables, d as customContracts, f as moduleBody, g as upgradePlan, h as moduleDeprecations, i as moduleLayout, j as dataExportPlan, k as resolveExposeColumns, l as moduleFileVersion, m as renderModules, n as compileReadSets, o as sameTenantLayout, p as moduleTopics, r as sharedRolesProblems, s as adoptedColumnProblems, t as compileReadSet, u as sameModuleFile, v as APP_TABLES_MARKER, w as modulePermissionKeys, x as moduleVersion, y as APP_TABLES_MODULE, z as sameTenantTrigger } from "../sql-DCfCbS2j.js";
 export { APP_TABLES_MARKER, APP_TABLES_MODULE, AUDIT_CATEGORIES, BLOCK_OPTION_SCHEMAS, MODULE_ID_TYPES, SCOPE_ID_TYPES, SECRET_COLUMNS, SQL_MODULES, adoptedColumnProblems, adoptedTables, appTableEventTypes, appTablesFiles, auditRegistrations, compileReadSet, compileReadSets, contractSignature, customContracts, dataExportPlan, declaredTables, excludedColumns, expiredFlagsQuery, extensionSchema, isModuleIdType, migrationOptionUses, moduleBody, moduleDeprecations, moduleEventTriggers, moduleFilePaths, moduleFileVersion, moduleHidingColumns, moduleIdType, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, moduleVersion, policyGrants, renderModules, resolveExposeColumns, resolveModule, resolveModules, resolveProviderSql, rlsTables, sameModuleFile, sameTenantColumn, sameTenantLayout, sameTenantTrigger, scopeProblems, sharedRolesProblems, subjectColumns, templateFunctions, upgradePlan };

package/dist/{sql-BQshMgmB.js → sql-BPKRNutj.js}

@@ -1,8 +1,8 @@
-import { t as MAX_AFFECTED_MARKER } from "./errors-8i6tSICm.js";
-import { n as invalidRequest } from "./build-6jmaPAgx.js";
+import { t as MAX_AFFECTED_MARKER } from "./errors-BV1SKTVs.js";
+import { n as invalidRequest } from "./build-C-D_vn0U.js";
 import { t as lookupOf } from "./lookup-BaP5bI27.js";
 import { n as simplifyOrFalse } from "./simplify-DDO0j0LI.js";
-import { n as whereClause, t as integer } from "./shared-9B02lczf.js";
+import { n as whereClause, t as integer } from "./shared-C9zvURqC.js";
 //#region src/compile/sql.ts
 /** Supabase's default `max_rows`, which PostgREST uses for `count=estimated`. */
 const DEFAULT_ESTIMATED_COUNT_THRESHOLD = 1e3;