better-supabase 0.11.0 → 0.12.0

package/dist/server/index.d.ts

@@ -2,30 +2,30 @@ import { b as DbError, f as Result } from "../result-BREt7qOh.js";
 import { B as TableKey, a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
 import { lt as SupportEventData, wt as Events } from "../events-P3raDX2E.js";
 import { m as RequestContext } from "../plugin-D-95Q0w0.js";
-import { E as writeSession, S as readSession, a as ResolveAuthOptions, c as resolveAuth, d as CookieRecord, g as StoredSession, i as InvalidReason, l as AUTH_CACHE_HEADERS, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as clientIp, t as AuthResolution, u as CookieOptions, w as sessionCookieName } from "../resolve-Bqb8TMTt.js";
+import { E as writeSession, S as readSession, a as ResolveAuthOptions, c as resolveAuth, d as CookieRecord, g as StoredSession, i as InvalidReason, l as AUTH_CACHE_HEADERS, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as clientIp, t as AuthResolution, u as CookieOptions, w as sessionCookieName } from "../resolve-Ceft-18-.js";
 import { n as SqlClient } from "../executor-D1hECPGG.js";
 import { a as SessionActor, c as agentClaims, i as IDENTITY_SCOPES, l as delegationOf, n as ActorOutcome, o as SessionDelegation, r as AgentActOptions, s as actorOf, t as ActClaim } from "../actor-BAhb-d1S.js";
 import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DCDIQiTA.js";
 import { a as AuthorizationSubject, c as defineAuthorizer, i as AuthorizationResource, n as AuthorizationOutcome, o as Authorizer, r as AuthorizationRequest, s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
 import { i as ResourcePagination } from "../resource-DYEtc-KN.js";
-import { j as StorageApi } from "../bucket-BBSNDFNH.js";
-import { Wt as DbStats, _ as Db, t as BetterSupabase } from "../define-M_r1d2AT.js";
+import { j as StorageApi } from "../bucket-BbePDVwc.js";
+import { Wt as DbStats, _ as Db, t as BetterSupabase } from "../define-DYZnvAbs.js";
 import { n as Impersonator, r as impersonatorOf, t as ImpersonationOptions } from "../impersonation-D5chOkrO.js";
-import { _ as SupportAuthorize, a as AutomationHooks, b as TicketSubject, c as ChatActionHook, d as IdentityRef, f as IdentityTarget, g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, l as DelegationPermissions, m as Subscriber, n as Approver, o as AutomationRef, p as PrincipalByIdentity, r as ApproverOf, s as ChatAction, t as ApprovalRequestRef, u as DelegationRef, v as SupportAuthorizeInput, x as defineAuthorizationHooks, y as SupportDecision } from "../authorization-hooks-mLi894KH.js";
-import { A as supportCookieValue, B as SupportSessionStore, C as SupportSessions, D as SupportCookieOptions, E as SUPPORT_COOKIE, F as SupportEndedBy, G as PRIMARY_COOKIE, H as sqlSupportStore, I as SupportListFilter, J as DeleteAccountOptions, K as ReplicaState, L as SupportRequest, M as SupportApprovalQuery, N as SupportApprover, O as clearSupportCookie, P as SupportCallerClaims, R as SupportRequestInput, S as SupportPolicy, T as supportSessions, U as supportClaims, V as SupportStartInput, W as RequestIdOptions, X as deleteAccount, Y as DeleteAccountResult, _ as suspendAccount, a as ServerContext, b as SupportExpireRouteOptions, c as ServerOptions, d as EndSessionsResult, f as LastSignIn, g as lastSignIns, h as endSessions, i as ForContextOptions, j as SqlSupportStoreOptions, k as supportCookie, m as SuspendAccountResult, n as BetterServer, o as ServerDbOptions, p as SuspendAccountOptions, q as LiteDriver, r as ContextOptions, s as ServerKeys, t as AdminDb, u as TENANT_HEADER, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions, y as SupportApi, z as SupportSession } from "../server-types-BKN_R4Ws.js";
+import { _ as SupportAuthorize, a as AutomationHooks, b as TicketSubject, c as ChatActionHook, d as IdentityRef, f as IdentityTarget, g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, l as DelegationPermissions, m as Subscriber, n as Approver, o as AutomationRef, p as PrincipalByIdentity, r as ApproverOf, s as ChatAction, t as ApprovalRequestRef, u as DelegationRef, v as SupportAuthorizeInput, x as defineAuthorizationHooks, y as SupportDecision } from "../authorization-hooks-WDQMKIsc.js";
+import { A as supportCookieValue, B as SupportSessionStore, C as SupportSessions, D as SupportCookieOptions, E as SUPPORT_COOKIE, F as SupportEndedBy, G as PRIMARY_COOKIE, H as sqlSupportStore, I as SupportListFilter, J as DeleteAccountOptions, K as ReplicaState, L as SupportRequest, M as SupportApprovalQuery, N as SupportApprover, O as clearSupportCookie, P as SupportCallerClaims, R as SupportRequestInput, S as SupportPolicy, T as supportSessions, U as supportClaims, V as SupportStartInput, W as RequestIdOptions, X as deleteAccount, Y as DeleteAccountResult, _ as suspendAccount, a as ServerContext, b as SupportExpireRouteOptions, c as ServerOptions, d as EndSessionsResult, f as LastSignIn, g as lastSignIns, h as endSessions, i as ForContextOptions, j as SqlSupportStoreOptions, k as supportCookie, m as SuspendAccountResult, n as BetterServer, o as ServerDbOptions, p as SuspendAccountOptions, q as LiteDriver, r as ContextOptions, s as ServerKeys, t as AdminDb, u as TENANT_HEADER, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions, y as SupportApi, z as SupportSession } from "../server-types-fLdep4gb.js";
 import { a as checkAal, i as amrOf, n as AmrEntry, r as aalOf, t as Aal } from "../mfa-YzkRjNad.js";
-import { n as toSession, t as AuthSession } from "../view-Bf7e07rQ.js";
-import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-CwpfitmI.js";
-import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-CEBC6KUX.js";
-import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-B1Mmo4TU.js";
-import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-BeZX2pR_.js";
-import { n as subjectReaders, t as SubjectReadersOptions } from "../subject-readers-BNQzBDN9.js";
+import { n as toSession, t as AuthSession } from "../view-KQhe6eNc.js";
+import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-DObioXpX.js";
+import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-BSL36dQp.js";
+import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-DzvBL5nb.js";
+import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-De-EVRhw.js";
+import { n as subjectReaders, t as SubjectReadersOptions } from "../subject-readers-BUChuOxL.js";
 import { i as toCsv, n as csvColumns, t as CsvOptions } from "../csv-D3eKxV1T.js";
 import { i as JwsAlgorithm, n as Jwks, r as JwksOfOptions } from "../jws-35a8VhFV.js";
-import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-CGr0BbL-.js";
-import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-AUpl4Ob9.js";
-import { n as supportOf, t as SupportView } from "../support-view-IRnDLuGN.js";
-import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-DQmwYosO.js";
+import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-LW1i5-h3.js";
+import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-BrGopDVG.js";
+import { n as supportOf, t as SupportView } from "../support-view-Bj_lZ8Wr.js";
+import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-De6H52nX.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware, SingleKeyEntry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
@@ -128,7 +128,7 @@ interface SupportStorageOptions {
   readonly admin: StorageApi;
   /** Runs as the target, such as `postgres.asUser(support.claims)`, so RLS on `storage.objects` decides. Writes need its `transaction`. */
   readonly sql: SqlClient;
-  /** Runs as the connection-string role, such as `postgres.admin`. Writes need it to make the target the owner of what they store. */
+  /** Runs as the connection-string role, such as `postgres.admin`. Writes and signed upload claims need it to make the target the owner of what they store. */
   readonly adminSql?: SqlClient;
   /** The session the writes are recorded under. Writes need it. */
   readonly session?: Pick<SupportSession, "id" | "adminId" | "targetUserId">;
@@ -155,9 +155,17 @@ interface SupportStorageOptions {
  * decide as for the target's own request. Then the service client writes,
  * the admin connection makes the target the owner of the stored object,
  * and its `user_metadata` records the session id and the admin's id. A
- * refused dry run resolves to Storage's `403`. Signed uploads resolve to a
- * `403` `SUPPORT_STORAGE_WRITES` error, and every write in a read-only
- * session to a `403` `SUPPORT_READ_ONLY` error.
+ * refused dry run resolves to Storage's `403`.
+ *
+ * `createSignedUploadUrl` runs the same dry run as `upload` before the
+ * service client signs the URL. The object a browser uploads there has no
+ * owner, so `claimSignedUpload(bucket, path)` finishes the upload: it checks again
+ * that the target may insert at the path, then makes the target the owner
+ * of an object without one and stamps the session on its `user_metadata`.
+ * An object another user owns is refused with a `403`. `uploadToSignedUrl`
+ * claims what it stores. Every write in a read-only session resolves to a
+ * `403` `SUPPORT_READ_ONLY` error, and without `adminSql`, `session` or a
+ * `sql` client with `transaction` to a `403` `SUPPORT_STORAGE_WRITES` error.
  */
 export declare function supportStorage(options: SupportStorageOptions): StorageApi;
 //#endregion

package/dist/server/index.js

@@ -6,18 +6,18 @@ import { i as delegationOf, n as actorOf, r as agentClaims, t as IDENTITY_SCOPES
 import { i as userContext, r as impersonatorOf } from "../impersonation-DxU6yHJV.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
 import { r as toCsv, t as csvColumns } from "../csv-CVfXqaAu.js";
-import { A as suspendAccount, C as shouldRefresh, D as SERVER_EVENT_SOURCE, E as defineAuthorizationHooks, O as endSessions, S as shouldCheckSession, T as serverCore, a as unexpectedResponse, b as isPrefetch, c as extendServer, d as clearSupportCookie, f as supportCookie, h as TENANT_HEADER, i as resolveToken, j as deleteAccount, k as lastSignIns, l as supportStorage, m as supportCookieValue, n as flushEvents, o as withFlush, r as handle, s as createServer, u as SUPPORT_COOKIE, x as refreshFor, y as withSession } from "../adapter-B2WRsRIg.js";
+import { A as suspendAccount, C as shouldRefresh, D as SERVER_EVENT_SOURCE, E as defineAuthorizationHooks, O as endSessions, S as shouldCheckSession, T as serverCore, a as unexpectedResponse, b as isPrefetch, c as extendServer, d as clearSupportCookie, f as supportCookie, h as TENANT_HEADER, i as resolveToken, j as deleteAccount, k as lastSignIns, l as supportStorage, m as supportCookieValue, n as flushEvents, o as withFlush, r as handle, s as createServer, u as SUPPORT_COOKIE, x as refreshFor, y as withSession } from "../adapter-CRNH2aX_.js";
 import { n as PRIMARY_COOKIE } from "../replicas-BvIL4_jL.js";
 import { t as authContext } from "../context-BiwgsycK.js";
-import { _ as writeSession, a as clearSessionCookies, h as sessionCookieName, i as refreshSession, o as sessionStatus, p as readSession, r as resolveAuth, s as AUTH_CACHE_HEADERS, t as clientIp } from "../resolve-f8QNuYI3.js";
+import { _ as writeSession, a as clearSessionCookies, h as sessionCookieName, i as refreshSession, o as sessionStatus, p as readSession, r as resolveAuth, s as AUTH_CACHE_HEADERS, t as clientIp } from "../resolve-AtncaPTU.js";
 import { a as checkAal, i as amrOf, n as toSession, r as aalOf } from "../view-CYX1wsgp.js";
 import { a as respond, i as isResult, o as settle, r as guard } from "../respond-Bhp3G__q.js";
-import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-BAhTqI7y.js";
+import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-C2wPYwD7.js";
 import { n as event, t as defineEvents } from "../event-map-Dy2vKHai.js";
 import { t as subjectReaders } from "../subject-readers-BpwUFJtp.js";
 import { t as postgresExecutor } from "../executor-CxGQiQN_.js";
 import { n as jwtClaimsOf, r as userClaimsOf, t as authModeOf } from "../claims-0KZVT804.js";
-import { n as withGuard, t as withBetterSupabase } from "../composite-BFatHqOU.js";
+import { n as withGuard, t as withBetterSupabase } from "../composite-1kPAxXto.js";
 import { c as verifyCompact, t as JwsError } from "../jws-CwBB5QAT.js";
 import { t as jwksSource } from "../jwks-cache-C4rA69hD.js";
 import { i as rateLimitPolicyHeader, n as periodSeconds, r as rateLimitHeader, t as isRateLimitPolicyName } from "../ratelimit-headers-Bsxx0Tj2.js";

package/dist/{server-types-BKN_R4Ws.d.ts → server-types-fLdep4gb.d.ts}

@@ -3,17 +3,17 @@ import { t as AsyncResult } from "./result-BREt7qOh.js";
 import { a as AnyModels, i as AnyFunctions } from "./types-BrpW5ixT.js";
 import { o as EventHub } from "./events-P3raDX2E.js";
 import { m as RequestContext } from "./plugin-D-95Q0w0.js";
-import { t as BetterSupabaseEnv } from "./index-CxmVzT-3.js";
-import { a as ResolveAuthOptions, p as CookieWrite, r as AuthState, t as AuthResolution } from "./resolve-Bqb8TMTt.js";
-import { r as CredentialProvider } from "./provider-CNs0Jx0I.js";
+import { o as EnvSource, t as BetterSupabaseEnv } from "./index-CxmVzT-3.js";
+import { a as ResolveAuthOptions, p as CookieWrite, r as AuthState, t as AuthResolution } from "./resolve-Ceft-18-.js";
+import { r as CredentialProvider } from "./provider-DXgx5oSA.js";
 import { n as SqlClient } from "./executor-D1hECPGG.js";
 import { a as ProblemFormat } from "./problem-DCDIQiTA.js";
 import { t as AnyAuthorizer } from "./authorizer-eiOjo-3l.js";
 import { i as EventSink } from "./cloud-event-DXkNoI6v.js";
-import { j as StorageApi, n as Bucket } from "./bucket-BBSNDFNH.js";
-import { Kt as StatsRecorder, Wt as DbStats, _ as Db, t as BetterSupabase } from "./define-M_r1d2AT.js";
+import { j as StorageApi, n as Bucket } from "./bucket-BbePDVwc.js";
+import { Kt as StatsRecorder, Wt as DbStats, _ as Db, t as BetterSupabase } from "./define-DYZnvAbs.js";
 import { t as ImpersonationOptions } from "./impersonation-D5chOkrO.js";
-import { _ as SupportAuthorize, b as TicketSubject, i as AuthorizationHooks } from "./authorization-hooks-mLi894KH.js";
+import { _ as SupportAuthorize, b as TicketSubject, i as AuthorizationHooks } from "./authorization-hooks-WDQMKIsc.js";
 import { s as SqlClaims, t as BetterPostgres } from "./pool-cM3rpOQr.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
@@ -482,10 +482,12 @@ interface ServerDbOptions {
 }
 interface ServerOptions {
   /**
-   * Defaults to the variables `getEnv` from `@supabase/middleware` reads:
-   * Workers bindings, then `process.env`, then `Deno.env`.
+   * A loaded env, or the variables to load it from (`{ SUPABASE_URL, ... }`),
+   * read without falling back to the runtime's. Defaults to the variables
+   * `getEnv` from `@supabase/middleware` reads: Workers bindings, then
+   * `process.env`, then `Deno.env`.
    */
-  readonly env?: BetterSupabaseEnv;
+  readonly env?: BetterSupabaseEnv | EnvSource;
   /** Enables `ctx.sql` and `actingAs()`. */
   readonly postgres?: BetterPostgres;
   readonly auth?: Omit<ResolveAuthOptions, "env">;

package/dist/{session-CwpfitmI.d.ts → session-DObioXpX.d.ts}

@@ -1,8 +1,8 @@
 import { a as AnyModels, i as AnyFunctions } from "./types-BrpW5ixT.js";
 import { n as AuthOutageEvent, o as EventHub } from "./events-P3raDX2E.js";
-import { f as CookieScope, h as SessionEncoding, r as AuthState, t as AuthResolution } from "./resolve-Bqb8TMTt.js";
-import { a as ServerContext, r as ContextOptions, v as ActiveSupport } from "./server-types-BKN_R4Ws.js";
-import { d as RefreshPolicy } from "./respond-CEBC6KUX.js";
+import { f as CookieScope, h as SessionEncoding, r as AuthState, t as AuthResolution } from "./resolve-Ceft-18-.js";
+import { a as ServerContext, r as ContextOptions, v as ActiveSupport } from "./server-types-fLdep4gb.js";
+import { d as RefreshPolicy } from "./respond-BSL36dQp.js";
 import { SingleKeyEntry } from "@supabase/middleware";
 //#region src/server/entries/core.d.ts
 /**

package/dist/solid/index.d.ts

@@ -1,11 +1,11 @@
 import { b as DbError } from "../result-BREt7qOh.js";
-import { O as TemplateValues } from "../bucket-BBSNDFNH.js";
-import { at as QuerySpec } from "../define-M_r1d2AT.js";
-import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-1WTkDnPd.js";
-import { t as AuthSnapshot } from "../bind-CTNKpBM6.js";
-import { t as AuthSession } from "../view-Bf7e07rQ.js";
-import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-DmJICh93.js";
-import { t as SupportView } from "../support-view-IRnDLuGN.js";
+import { O as TemplateValues } from "../bucket-BbePDVwc.js";
+import { at as QuerySpec } from "../define-DYZnvAbs.js";
+import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-DAY_HOX2.js";
+import { t as AuthSnapshot } from "../bind-Bfo40o63.js";
+import { t as AuthSession } from "../view-KQhe6eNc.js";
+import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-Z-sgsdoN.js";
+import { t as SupportView } from "../support-view-Bj_lZ8Wr.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Accessor, JSX } from "solid-js";
 import { QueryClient } from "@tanstack/query-core";

package/dist/{solid-controller-Uqi5ef6z.d.ts → solid-controller-CWotGxcG.d.ts}

@@ -1,4 +1,4 @@
-import { n as Controller } from "./controller-BBXX1RMw.js";
+import { n as Controller } from "./controller-BZhiIb-N.js";
 import { Accessor } from "solid-js";
 //#region src/blocks/solid-controller.d.ts
 /** A block controller in a Solid component: `state` follows the controller. */

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
-import { t as BetterSupabase } from "../define-M_r1d2AT.js";
-import { n as BetterServer } from "../server-types-BKN_R4Ws.js";
-import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-BeZX2pR_.js";
-import { t as RefusalRedirects } from "../refusal-CufncwaN.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-D6IFkuAg.js";
+import { t as BetterSupabase } from "../define-DYZnvAbs.js";
+import { n as BetterServer } from "../server-types-fLdep4gb.js";
+import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-De-EVRhw.js";
+import { t as RefusalRedirects } from "../refusal-C7geIBRl.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-BQhTsLX-.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/solid-start/index.d.ts
 /** The part of a SolidStart `FetchEvent` the integration reads and writes. */

package/dist/solid-start/index.js

@@ -1,8 +1,8 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-B2WRsRIg.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CRNH2aX_.js";
 import { t as defaultExpose } from "../respond-Bhp3G__q.js";
 import { i as requireCaller, o as runAction } from "../kit-LTbHrWWD.js";
 import { i as nitroCloudflareEnv } from "../shared-BmMcMoW9.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-Ch8bMmQY.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-C6PKBgme.js";
 import { r as refusalResponse } from "../refusal-CFpfmjcS.js";
 import { t as beforeRoute } from "../before-route-B98js9m_.js";
 //#region src/solid-start/index.ts

package/dist/sql/index.d.ts

@@ -1,5 +1,5 @@
 import { C as BLOCK_OPTION_SCHEMAS, S as resolveModule, w as BlockOptionsRegistry } from "../authorization-ClWBcXJi.js";
 import { a as ModuleAudit, c as ModuleEmit, d as ModuleTableSpec, f as contractSignature, i as ModuleAction, l as ModuleIdType, m as moduleIdType, n as AuditCategory, o as ModuleContext, p as isModuleIdType, r as MODULE_ID_TYPES, s as ModuleContractFunction, t as AUDIT_CATEGORIES, u as ModuleNames } from "../context-Cv3KlxWY.js";
-import { $ as ModuleDeprecation, A as APP_TABLES_MODULE, B as moduleFileVersion, C as dataExportPlan, D as adoptedColumnProblems, E as AdoptedTable, F as ModulePermissionKey, G as moduleDeprecations, H as moduleFilePaths, I as moduleEventTriggers, J as customContracts, K as upgradePlan, L as moduleHidingColumns, M as SQL_MODULES, N as resolveModules, O as adoptedTables, P as ModuleExtension, Q as ModuleAccessProvider, R as modulePermissionKeys, S as SECRET_COLUMNS, T as resolveExposeColumns, U as InstalledModule, V as sameModuleFile, W as ModuleUpgradePlan, X as moduleTopics, Y as moduleBody, Z as renderModules, _ as subjectColumns, a as MigrationOptionUse, at as SqlModule, b as sameTenantTrigger, c as SCOPE_ID_TYPES, ct as sameTenantLayout, d as templateFunctions, et as ModuleEntitlementsProvider, f as PolicyGrant, g as rlsTables, h as policyGrants, i as sharedRolesProblems, it as ModuleUpgrade, j as appTablesFiles, k as APP_TABLES_MARKER, l as resolveProviderSql, lt as AuditedTable, m as extensionSchema, n as compileReadSet, nt as ModuleLayout, o as migrationOptionUses, ot as moduleVersion, p as declaredTables, q as ModuleTopic, r as compileReadSets, rt as ModuleTestFile, s as moduleLayout, st as DeclaredForeignKey, t as CompiledReadSet, tt as ModuleFile, u as scopeProblems, ut as auditRegistrations, v as expiredFlagsQuery, w as excludedColumns, x as DataExportPlan, y as sameTenantColumn, z as moduleSchemaExtensions } from "../index-CEcDqDhc.js";
+import { $ as ModuleDeprecation, A as APP_TABLES_MODULE, B as moduleFileVersion, C as dataExportPlan, D as adoptedColumnProblems, E as AdoptedTable, F as ModulePermissionKey, G as moduleDeprecations, H as moduleFilePaths, I as moduleEventTriggers, J as customContracts, K as upgradePlan, L as moduleHidingColumns, M as SQL_MODULES, N as resolveModules, O as adoptedTables, P as ModuleExtension, Q as ModuleAccessProvider, R as modulePermissionKeys, S as SECRET_COLUMNS, T as resolveExposeColumns, U as InstalledModule, V as sameModuleFile, W as ModuleUpgradePlan, X as moduleTopics, Y as moduleBody, Z as renderModules, _ as subjectColumns, a as MigrationOptionUse, at as SqlModule, b as sameTenantTrigger, c as SCOPE_ID_TYPES, ct as sameTenantLayout, d as templateFunctions, et as ModuleEntitlementsProvider, f as PolicyGrant, g as rlsTables, h as policyGrants, i as sharedRolesProblems, it as ModuleUpgrade, j as appTablesFiles, k as APP_TABLES_MARKER, l as resolveProviderSql, lt as AuditedTable, m as extensionSchema, n as compileReadSet, nt as ModuleLayout, o as migrationOptionUses, ot as moduleVersion, p as declaredTables, q as ModuleTopic, r as compileReadSets, rt as ModuleTestFile, s as moduleLayout, st as DeclaredForeignKey, t as CompiledReadSet, tt as ModuleFile, u as scopeProblems, ut as auditRegistrations, v as expiredFlagsQuery, w as excludedColumns, x as DataExportPlan, y as sameTenantColumn, z as moduleSchemaExtensions } from "../index-Cm2-g_4H.js";
 import { o as appTableEventTypes } from "../app-tables-BrMBjyuq.js";
 export { APP_TABLES_MARKER, APP_TABLES_MODULE, AUDIT_CATEGORIES, type AdoptedTable, type AuditCategory, type AuditedTable, BLOCK_OPTION_SCHEMAS, type BlockOptionsRegistry, type CompiledReadSet, type DataExportPlan, type DeclaredForeignKey, type InstalledModule, MODULE_ID_TYPES, type MigrationOptionUse, type ModuleAccessProvider, type ModuleAction, type ModuleAudit, type ModuleContext, type ModuleContractFunction, type ModuleDeprecation, type ModuleEmit, type ModuleEntitlementsProvider, type ModuleExtension, type ModuleFile, type ModuleIdType, type ModuleLayout, type ModuleNames, type ModulePermissionKey, type ModuleTableSpec, type ModuleTestFile, type ModuleTopic, type ModuleUpgrade, type ModuleUpgradePlan, type PolicyGrant, SCOPE_ID_TYPES, SECRET_COLUMNS, SQL_MODULES, type SqlModule, adoptedColumnProblems, adoptedTables, appTableEventTypes, appTablesFiles, auditRegistrations, compileReadSet, compileReadSets, contractSignature, customContracts, dataExportPlan, declaredTables, excludedColumns, expiredFlagsQuery, extensionSchema, isModuleIdType, migrationOptionUses, moduleBody, moduleDeprecations, moduleEventTriggers, moduleFilePaths, moduleFileVersion, moduleHidingColumns, moduleIdType, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, moduleVersion, policyGrants, renderModules, resolveExposeColumns, resolveModule, resolveModules, resolveProviderSql, rlsTables, sameModuleFile, sameTenantColumn, sameTenantLayout, sameTenantTrigger, scopeProblems, sharedRolesProblems, subjectColumns, templateFunctions, upgradePlan };

package/dist/sql/index.js

@@ -1,5 +1,5 @@
 import { r as resolveModule } from "../blocks-D2WQ63PI.js";
 import { u as appTableEventTypes } from "../app-tables-BRjMcWhW.js";
 import { c as templateFunctions, o as resolveProviderSql, s as scopeProblems, t as SCOPE_ID_TYPES } from "../access-sql-CTJPHjCL.js";
-import { A as SECRET_COLUMNS, B as migrationOptionUses, C as moduleHidingColumns, D as resolveModules, E as SQL_MODULES, F as rlsTables, G as moduleIdType, H as MODULE_ID_TYPES, I as auditRegistrations, K as BLOCK_OPTION_SCHEMAS, L as subjectColumns, M as declaredTables, N as extensionSchema, O as excludedColumns, P as policyGrants, R as sameTenantColumn, S as moduleEventTriggers, T as moduleSchemaExtensions, U as contractSignature, V as AUDIT_CATEGORIES, W as isModuleIdType, _ as moduleFilePaths, a as expiredFlagsQuery, b as appTablesFiles, c as adoptedTables, d as customContracts, f as moduleBody, g as upgradePlan, h as moduleDeprecations, i as moduleLayout, j as dataExportPlan, k as resolveExposeColumns, l as moduleFileVersion, m as renderModules, n as compileReadSets, o as sameTenantLayout, p as moduleTopics, r as sharedRolesProblems, s as adoptedColumnProblems, t as compileReadSet, u as sameModuleFile, v as APP_TABLES_MARKER, w as modulePermissionKeys, x as moduleVersion, y as APP_TABLES_MODULE, z as sameTenantTrigger } from "../sql-DCfCbS2j.js";
+import { A as SECRET_COLUMNS, B as migrationOptionUses, C as moduleHidingColumns, D as resolveModules, E as SQL_MODULES, F as rlsTables, G as moduleIdType, H as MODULE_ID_TYPES, I as auditRegistrations, K as BLOCK_OPTION_SCHEMAS, L as subjectColumns, M as declaredTables, N as extensionSchema, O as excludedColumns, P as policyGrants, R as sameTenantColumn, S as moduleEventTriggers, T as moduleSchemaExtensions, U as contractSignature, V as AUDIT_CATEGORIES, W as isModuleIdType, _ as moduleFilePaths, a as expiredFlagsQuery, b as appTablesFiles, c as adoptedTables, d as customContracts, f as moduleBody, g as upgradePlan, h as moduleDeprecations, i as moduleLayout, j as dataExportPlan, k as resolveExposeColumns, l as moduleFileVersion, m as renderModules, n as compileReadSets, o as sameTenantLayout, p as moduleTopics, r as sharedRolesProblems, s as adoptedColumnProblems, t as compileReadSet, u as sameModuleFile, v as APP_TABLES_MARKER, w as modulePermissionKeys, x as moduleVersion, y as APP_TABLES_MODULE, z as sameTenantTrigger } from "../sql-CT1Jnwp8.js";
 export { APP_TABLES_MARKER, APP_TABLES_MODULE, AUDIT_CATEGORIES, BLOCK_OPTION_SCHEMAS, MODULE_ID_TYPES, SCOPE_ID_TYPES, SECRET_COLUMNS, SQL_MODULES, adoptedColumnProblems, adoptedTables, appTableEventTypes, appTablesFiles, auditRegistrations, compileReadSet, compileReadSets, contractSignature, customContracts, dataExportPlan, declaredTables, excludedColumns, expiredFlagsQuery, extensionSchema, isModuleIdType, migrationOptionUses, moduleBody, moduleDeprecations, moduleEventTriggers, moduleFilePaths, moduleFileVersion, moduleHidingColumns, moduleIdType, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, moduleVersion, policyGrants, renderModules, resolveExposeColumns, resolveModule, resolveModules, resolveProviderSql, rlsTables, sameModuleFile, sameTenantColumn, sameTenantLayout, sameTenantTrigger, scopeProblems, sharedRolesProblems, subjectColumns, templateFunctions, upgradePlan };

package/dist/{sql-DCfCbS2j.js → sql-CT1Jnwp8.js}

@@ -101,7 +101,7 @@ import { t as FINAL_RUN_STATES$1 } from "./run-state-CgBKzYMW.js";
 import { t as ISO_4217_MINOR_UNITS } from "./iso4217-A8ev-CNW.js";
 import { a as metricsOf, i as grainDivides, t as METRIC_GRAINS } from "./metric-definition-BjxVn4R5.js";
 import { r as NEGATIVE, t as FILTER_OPERATORS } from "./filter-query-B3lhckKX.js";
-import { t as VERSION } from "./version-TXpQEfh1.js";
+import { t as VERSION } from "./version-DSWxci83.js";
 import { t as compileSql } from "./sql-BPKRNutj.js";
 //#region src/sql/actor-guard.ts
 /**

package/dist/ssr/index.d.ts

@@ -1,5 +1,5 @@
-import { C as serializeCookie, E as writeSession, S as readSession, T as sessionEncoding, _ as WriteSessionOptions, a as ResolveAuthOptions, b as parseCookies, c as resolveAuth, d as CookieRecord, f as CookieScope, g as StoredSession, h as SessionEncoding, l as AUTH_CACHE_HEADERS, m as DEFAULT_SESSION_ENCODING, n as AuthResolver, p as CookieWrite, r as AuthState, t as AuthResolution, u as CookieOptions, v as applyCookieWrites, w as sessionCookieName, x as pruneSessionChunks, y as clearSessionAtScopes } from "../resolve-Bqb8TMTt.js";
-import { n as toSession, t as AuthSession } from "../view-Bf7e07rQ.js";
-import { r as MembershipClaim } from "../entitlements-DgkeStXd.js";
-import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, s as RefreshOptions, t as ClearSessionCookiesOptions } from "../ended-DQmwYosO.js";
+import { C as serializeCookie, E as writeSession, S as readSession, T as sessionEncoding, _ as WriteSessionOptions, a as ResolveAuthOptions, b as parseCookies, c as resolveAuth, d as CookieRecord, f as CookieScope, g as StoredSession, h as SessionEncoding, l as AUTH_CACHE_HEADERS, m as DEFAULT_SESSION_ENCODING, n as AuthResolver, p as CookieWrite, r as AuthState, t as AuthResolution, u as CookieOptions, v as applyCookieWrites, w as sessionCookieName, x as pruneSessionChunks, y as clearSessionAtScopes } from "../resolve-Ceft-18-.js";
+import { n as toSession, t as AuthSession } from "../view-KQhe6eNc.js";
+import { r as MembershipClaim } from "../entitlements-CtBGXb3B.js";
+import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, s as RefreshOptions, t as ClearSessionCookiesOptions } from "../ended-De6H52nX.js";
 export { AUTH_CACHE_HEADERS, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type ClearSessionCookiesOptions, type CookieOptions, type CookieRecord, type CookieScope, type CookieWrite, DEFAULT_SESSION_ENCODING, type MembershipClaim, type RefreshOptions, type RefreshOutcome, type ResolveAuthOptions, type SessionEncoding, type SessionStatus, type SessionStatusOptions, type StoredSession, type WriteSessionOptions, applyCookieWrites, authContext, clearSessionAtScopes, clearSessionCookies, parseCookies, pruneSessionChunks, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, sessionEncoding, sessionStatus, toSession, writeSession };

package/dist/ssr/index.js

@@ -1,4 +1,4 @@
 import { t as authContext } from "../context-BiwgsycK.js";
-import { _ as writeSession, a as clearSessionCookies, c as DEFAULT_SESSION_ENCODING, d as parseCookies, f as pruneSessionChunks, g as sessionEncoding, h as sessionCookieName, i as refreshSession, l as applyCookieWrites, m as serializeCookie, o as sessionStatus, p as readSession, r as resolveAuth, s as AUTH_CACHE_HEADERS, u as clearSessionAtScopes } from "../resolve-f8QNuYI3.js";
+import { _ as writeSession, a as clearSessionCookies, c as DEFAULT_SESSION_ENCODING, d as parseCookies, f as pruneSessionChunks, g as sessionEncoding, h as sessionCookieName, i as refreshSession, l as applyCookieWrites, m as serializeCookie, o as sessionStatus, p as readSession, r as resolveAuth, s as AUTH_CACHE_HEADERS, u as clearSessionAtScopes } from "../resolve-AtncaPTU.js";
 import { n as toSession } from "../view-CYX1wsgp.js";
 export { AUTH_CACHE_HEADERS, DEFAULT_SESSION_ENCODING, applyCookieWrites, authContext, clearSessionAtScopes, clearSessionCookies, parseCookies, pruneSessionChunks, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, sessionEncoding, sessionStatus, toSession, writeSession };

package/dist/storage/index.d.ts

@@ -1,4 +1,4 @@
 import { J as BucketLifecycleRule, X as VersioningStatus, Y as ObjectVersion, n as AccessPolicySql, q as BucketLifecycle, t as AccessBucketPolicy } from "../types-BrpW5ixT.js";
-import { A as TtlPreset, B as StorageListV2Folder, C as UrlOptions, D as TemplateParams, E as AppliedBucket, F as StorageDownloadOptions, G as StorageResponse, H as StorageListV2Result, I as StorageFailure, J as StorageSignedUrlEntry, K as StorageSearchOptions, L as StorageFetchParameters, M as StorageBucketApi, N as StorageClient, O as TemplateValues, P as StorageDestinationOptions, Q as StoragePath, R as StorageFileOptions, S as UploadOptions, T as parseSize, U as StorageObjectInfo, V as StorageListV2Object, W as StorageRemoveEntry, X as StorageUrlOptions, Y as StorageTransform, Z as PathIn, _ as SweepOptions, a as BucketConnectOptions, b as TransformOptions, c as DownloadOptions, d as PurgeCacheOptions, f as ReplaceOptions, g as StoredObject, h as StorageAdminClient, i as BucketConfig, j as StorageApi, k as TTL, l as ObjectTarget, m as Reservation, n as Bucket, o as BucketDrift, p as ReplaceResult, q as StorageSearchV2Options, r as BucketClient, s as BucketPolicy, t as ActualBucket, u as PathValues, v as SweepResult, w as defineBucket, x as UploadBody, y as TransferOptions, z as StorageListEntry } from "../bucket-BBSNDFNH.js";
-import { A as defineBuckets, C as BucketIdOf, D as ConnectedRef, E as Buckets, M as StorageImageSize, N as storageImageUrl, O as ResolvedRef, P as fromStorageError, S as AnyBucket, T as BucketWithId, _ as IMAGE_TYPES, a as VectorHit, b as avatarBucket, c as VectorMetadata, d as defineVectorBucket, f as AnalyticsBucket, g as AvatarBucketOptions, h as defineAnalyticsBucket, i as VectorDistance, j as StorageImageOptions, k as StoredRef, l as VectorQueryOptions, m as AnalyticsCatalog, n as VectorBucketClient, o as VectorIndexClient, p as AnalyticsBucketClient, r as VectorBucketConfig, s as VectorIndexConfig, t as VectorBucket, u as VectorRecord, v as ImageBucketOptions, w as BucketMap, x as organizationLogoBucket, y as OrganizationLogoBucketOptions } from "../index-DHReeV74.js";
+import { A as TtlPreset, B as StorageListV2Folder, C as UrlOptions, D as TemplateParams, E as AppliedBucket, F as StorageDownloadOptions, G as StorageResponse, H as StorageListV2Result, I as StorageFailure, J as StorageSignedUrlEntry, K as StorageSearchOptions, L as StorageFetchParameters, M as StorageBucketApi, N as StorageClient, O as TemplateValues, P as StorageDestinationOptions, Q as StoragePath, R as StorageFileOptions, S as UploadOptions, T as parseSize, U as StorageObjectInfo, V as StorageListV2Object, W as StorageRemoveEntry, X as StorageUrlOptions, Y as StorageTransform, Z as PathIn, _ as SweepOptions, a as BucketConnectOptions, b as TransformOptions, c as DownloadOptions, d as PurgeCacheOptions, f as ReplaceOptions, g as StoredObject, h as StorageAdminClient, i as BucketConfig, j as StorageApi, k as TTL, l as ObjectTarget, m as Reservation, n as Bucket, o as BucketDrift, p as ReplaceResult, q as StorageSearchV2Options, r as BucketClient, s as BucketPolicy, t as ActualBucket, u as PathValues, v as SweepResult, w as defineBucket, x as UploadBody, y as TransferOptions, z as StorageListEntry } from "../bucket-BbePDVwc.js";
+import { A as defineBuckets, C as BucketIdOf, D as ConnectedRef, E as Buckets, M as StorageImageSize, N as storageImageUrl, O as ResolvedRef, P as fromStorageError, S as AnyBucket, T as BucketWithId, _ as IMAGE_TYPES, a as VectorHit, b as avatarBucket, c as VectorMetadata, d as defineVectorBucket, f as AnalyticsBucket, g as AvatarBucketOptions, h as defineAnalyticsBucket, i as VectorDistance, j as StorageImageOptions, k as StoredRef, l as VectorQueryOptions, m as AnalyticsCatalog, n as VectorBucketClient, o as VectorIndexClient, p as AnalyticsBucketClient, r as VectorBucketConfig, s as VectorIndexConfig, t as VectorBucket, u as VectorRecord, v as ImageBucketOptions, w as BucketMap, x as organizationLogoBucket, y as OrganizationLogoBucketOptions } from "../index-Hc4tetmB.js";
 export { type AccessBucketPolicy, type AccessPolicySql, type ActualBucket, type AnalyticsBucket, type AnalyticsBucketClient, type AnalyticsCatalog, type AnyBucket, type AppliedBucket, type AvatarBucketOptions, type Bucket, type BucketClient, type BucketConfig, type BucketConnectOptions, type BucketDrift, type BucketIdOf, type BucketLifecycle, type BucketLifecycleRule, type BucketMap, type BucketPolicy, type BucketWithId, type Buckets, type ConnectedRef, type DownloadOptions, IMAGE_TYPES, type ImageBucketOptions, type ObjectTarget, type ObjectVersion, type OrganizationLogoBucketOptions, type PathIn, type PathValues, type PurgeCacheOptions, type ReplaceOptions, type ReplaceResult, type Reservation, type ResolvedRef, type StorageAdminClient, type StorageApi, type StorageBucketApi, type StorageClient, type StorageDestinationOptions, type StorageDownloadOptions, type StorageFailure, type StorageFetchParameters, type StorageFileOptions, type StorageImageOptions, type StorageImageSize, type StorageListEntry, type StorageListV2Folder, type StorageListV2Object, type StorageListV2Result, type StorageObjectInfo, type StoragePath, type StorageRemoveEntry, type StorageResponse, type StorageSearchOptions, type StorageSearchV2Options, type StorageSignedUrlEntry, type StorageTransform, type StorageUrlOptions, type StoredObject, type StoredRef, type SweepOptions, type SweepResult, TTL, type TemplateParams, type TemplateValues, type TransferOptions, type TransformOptions, type TtlPreset, type UploadBody, type UploadOptions, type UrlOptions, type VectorBucket, type VectorBucketClient, type VectorBucketConfig, type VectorDistance, type VectorHit, type VectorIndexClient, type VectorIndexConfig, type VectorMetadata, type VectorQueryOptions, type VectorRecord, type VersioningStatus, avatarBucket, defineAnalyticsBucket, defineBucket, defineBuckets, defineVectorBucket, fromStorageError, organizationLogoBucket, parseSize, storageImageUrl };

package/dist/storage/index.js

@@ -357,6 +357,11 @@ function connectBucket(bucket, client, resolveTarget, connectOptions, guard) {
 			return err(fromStorageError(cause, bucket.id));
 		}
 	});
+	const claim = (path) => {
+		if (!storage.claimSignedUpload) return AsyncResult.ok(path);
+		const claiming = storage.claimSignedUpload(bucket.id, path);
+		return run(() => claiming);
+	};
 	const fileOptions = (options, contentType) => ({
 		...contentType ? { contentType } : {},
 		...options?.cacheControl ? { cacheControl: options.cacheControl } : {},
@@ -388,6 +393,8 @@ function connectBucket(bucket, client, resolveTarget, connectOptions, guard) {
 				onProgress: options.onProgress
 			});
 			if (failure) return err(fromStorageError(failure, bucket.id));
+			const claimed = await claim(path);
+			if (!claimed.ok) return claimed;
 			evict([path]);
 			return ok({ path });
 		}
@@ -660,6 +667,10 @@ function connectBucket(bucket, client, resolveTarget, connectOptions, guard) {
 				return { path };
 			});
 		}),
+		claimReserved: (reservation) => AsyncResult.from(async () => {
+			const path = resolve(reservation.path);
+			return claim(path).map(() => ({ path }));
+		}),
 		sweep: (options) => AsyncResult.from(async () => {
 			const namespace = optionalTemporal();
 			if (namespace === void 0) return err(temporalMissing());

package/dist/{subject-readers-BNQzBDN9.d.ts → subject-readers-BUChuOxL.d.ts}

@@ -1,5 +1,5 @@
 import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
-import { g as SubscriberPolicy } from "./authorization-hooks-mLi894KH.js";
+import { g as SubscriberPolicy } from "./authorization-hooks-WDQMKIsc.js";
 //#region src/core/subject-readers.d.ts
 interface SubjectReadersOptions {
   /** The schema of the `subjects` module. Default `better_supabase`. */

package/dist/{support-BAhTqI7y.js → support-C2wPYwD7.js}

@@ -5,7 +5,7 @@ import { n as validate } from "./standard-B1BigegP.js";
 import { o as problemResponse } from "./problem-JRCohp1j.js";
 import { i as sqlIdent } from "./template-Dw3dTmKe.js";
 import { t as fromPgError } from "./pg-error-BV_X8Isq.js";
-import { d as clearSupportCookie, f as supportCookie, m as supportCookieValue } from "./adapter-B2WRsRIg.js";
+import { d as clearSupportCookie, f as supportCookie, m as supportCookieValue } from "./adapter-CRNH2aX_.js";
 import { a as emitBlockEvent } from "./block-events-DD9Q_NUz.js";
 import { t as cronRoute } from "./cron-route-mTvWhork.js";
 import { t as boundedTtlCache } from "./ttl-cache-XzZ-Q2eX.js";

package/dist/{support-view-IRnDLuGN.d.ts → support-view-Bj_lZ8Wr.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSession } from "./view-Bf7e07rQ.js";
+import { t as AuthSession } from "./view-KQhe6eNc.js";
 //#region src/auth/support-view.d.ts
 /** A running support session as the target's view shows it, for a banner. */
 interface SupportView {

package/dist/svelte/index.d.ts

@@ -1,10 +1,10 @@
 import { b as DbError } from "../result-BREt7qOh.js";
-import { O as TemplateValues } from "../bucket-BBSNDFNH.js";
-import { at as QuerySpec } from "../define-M_r1d2AT.js";
-import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-1WTkDnPd.js";
-import { t as AuthSnapshot } from "../bind-CTNKpBM6.js";
-import { t as AuthSession } from "../view-Bf7e07rQ.js";
-import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-DmJICh93.js";
+import { O as TemplateValues } from "../bucket-BbePDVwc.js";
+import { at as QuerySpec } from "../define-DYZnvAbs.js";
+import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-DAY_HOX2.js";
+import { t as AuthSnapshot } from "../bind-Bfo40o63.js";
+import { t as AuthSession } from "../view-KQhe6eNc.js";
+import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-Z-sgsdoN.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { QueryClient } from "@tanstack/query-core";
 //#region src/svelte/index.d.ts

package/dist/{svelte-controller-BQOIXWEw.d.ts → svelte-controller-sS4X66yL.d.ts}

@@ -1,4 +1,4 @@
-import { n as Controller } from "./controller-BBXX1RMw.js";
+import { n as Controller } from "./controller-BZhiIb-N.js";
 import { Readable } from "svelte/store";
 //#region src/blocks/svelte-controller.d.ts
 /** A block controller in a Svelte component: a readable store of its state, with its actions. */

package/dist/sveltekit/index.d.ts

@@ -1,11 +1,11 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
-import { t as BetterSupabase } from "../define-M_r1d2AT.js";
-import { n as BetterServer } from "../server-types-BKN_R4Ws.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-BeZX2pR_.js";
-import { t as RefusalRedirects } from "../refusal-CufncwaN.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-D6IFkuAg.js";
+import { t as BetterSupabase } from "../define-DYZnvAbs.js";
+import { n as BetterServer } from "../server-types-fLdep4gb.js";
+import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-De-EVRhw.js";
+import { t as RefusalRedirects } from "../refusal-C7geIBRl.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-BQhTsLX-.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
-import { i as tagFor } from "../tags-AUpl4Ob9.js";
+import { i as tagFor } from "../tags-BrGopDVG.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/bridges/sveltekit.d.ts

package/dist/sveltekit/index.js

@@ -1,12 +1,12 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
 import { r as dbErrorOf } from "../errors-BV1SKTVs.js";
 import { c as toProblem } from "../problem-JRCohp1j.js";
-import { c as extendServer, o as withFlush, s as createServer } from "../adapter-B2WRsRIg.js";
+import { c as extendServer, o as withFlush, s as createServer } from "../adapter-CRNH2aX_.js";
 import { t as defaultExpose } from "../respond-Bhp3G__q.js";
 import { r as tagFor } from "../tags-B99_U9Pp.js";
 import { i as requireCaller, o as runAction } from "../kit-LTbHrWWD.js";
 import { n as bufferInPlace, t as around } from "../shared-BmMcMoW9.js";
-import { a as platformWaitUntil, i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-Ch8bMmQY.js";
+import { a as platformWaitUntil, i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-C6PKBgme.js";
 import { i as refusalTarget } from "../refusal-CFpfmjcS.js";
 //#region src/bridges/sveltekit.ts
 /**

package/dist/{tags-AUpl4Ob9.d.ts → tags-BrGopDVG.d.ts}

@@ -1,4 +1,4 @@
-import { c as CacheTarget, s as CacheAdapter } from "./define-M_r1d2AT.js";
+import { c as CacheTarget, s as CacheAdapter } from "./define-DYZnvAbs.js";
 //#region src/core/tags.d.ts
 interface TagOptions {
   /** The tenant the read is scoped to; `"*"` is every tenant's reads. */

package/dist/tanstack-db/index.d.ts

@@ -1,5 +1,5 @@
 import { B as TableKey, a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
-import { _ as Db, t as BetterSupabase } from "../define-M_r1d2AT.js";
+import { _ as Db, t as BetterSupabase } from "../define-DYZnvAbs.js";
 import { t as BetterQueryMeta } from "../invalidate-BBqhpxyB.js";
 import { QueryClient, SkipToken } from "@tanstack/query-core";
 //#region src/tanstack-db/collection.d.ts

package/dist/tanstack-db/supabase/index.d.ts

@@ -1,5 +1,5 @@
 import { B as TableKey, a as AnyModels, i as AnyFunctions } from "../../types-BrpW5ixT.js";
-import { _ as Db, t as BetterSupabase } from "../../define-M_r1d2AT.js";
+import { _ as Db, t as BetterSupabase } from "../../define-DYZnvAbs.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { supabaseCollectionOptions } from "@supabase-labs/tanstack-db";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/tanstack-start/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
-import { t as BetterSupabase } from "../define-M_r1d2AT.js";
-import { n as BetterServer } from "../server-types-BKN_R4Ws.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-BeZX2pR_.js";
-import { t as RefusalRedirects } from "../refusal-CufncwaN.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-D6IFkuAg.js";
+import { t as BetterSupabase } from "../define-DYZnvAbs.js";
+import { n as BetterServer } from "../server-types-fLdep4gb.js";
+import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-De-EVRhw.js";
+import { t as RefusalRedirects } from "../refusal-C7geIBRl.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-BQhTsLX-.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/tanstack-start/index.js

@@ -1,8 +1,8 @@
-import { c as extendServer, o as withFlush, s as createServer } from "../adapter-B2WRsRIg.js";
+import { c as extendServer, o as withFlush, s as createServer } from "../adapter-CRNH2aX_.js";
 import { t as defaultExpose } from "../respond-Bhp3G__q.js";
 import { i as requireCaller, o as runAction } from "../kit-LTbHrWWD.js";
 import { n as bufferInPlace, t as around } from "../shared-BmMcMoW9.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-Ch8bMmQY.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-C6PKBgme.js";
 import { r as refusalResponse } from "../refusal-CFpfmjcS.js";
 //#region src/bridges/tanstack-start.ts
 /** The `response` of a request middleware's `next()` result; server function results have none. */

package/dist/{tenant-BNp3kBAG.d.ts → tenant-DZMLVuyQ.d.ts}

@@ -1,5 +1,5 @@
-import { t as AuthSnapshot } from "./bind-CTNKpBM6.js";
-import { t as AuthSession } from "./view-Bf7e07rQ.js";
+import { t as AuthSnapshot } from "./bind-Bfo40o63.js";
+import { t as AuthSession } from "./view-KQhe6eNc.js";
 //#region src/auth/tenant.d.ts
 /**
  * The active tenant of a user session: the `claim` claim (`tenant_id` by

package/dist/testing/index.d.ts

@@ -1,37 +1,37 @@
 import { B as TableKey, F as SchemaMeta, G as Update, N as Row, S as Insert, a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
 import { r as Executor } from "../executor-BnMC0lj3.js";
 import { m as RequestContext, n as AnyPlugin } from "../plugin-D-95Q0w0.js";
-import { t as BetterSupabaseEnv } from "../index-CxmVzT-3.js";
-import { n as AuthResolver } from "../resolve-Bqb8TMTt.js";
-import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } from "../provider-CNs0Jx0I.js";
+import { c as InlineJwks, t as BetterSupabaseEnv } from "../index-CxmVzT-3.js";
+import { n as AuthResolver } from "../resolve-Ceft-18-.js";
+import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } from "../provider-DXgx5oSA.js";
 import { n as SqlClient } from "../executor-D1hECPGG.js";
 import { a as BlockTransportMiddleware } from "../block-hooks-DcPJHztl.js";
 import { a as SessionActor, o as SessionDelegation } from "../actor-BAhb-d1S.js";
 import { M as QueueBackend } from "../types-BEEFkNFY.js";
-import { n as Embedder } from "../knowledge-CRk1jOAJ.js";
+import { n as Embedder } from "../knowledge-B5zdpDD-.js";
 import { a as AuthorizationProvider } from "../authorization-ClWBcXJi.js";
 import { o as StreamStore } from "../store-B18bIvKc.js";
 import { t as ApiModel } from "../model-lUafmeBQ.js";
 import { l as VersionOf, t as AnyDocumentFormat } from "../format-CNwSjXUU.js";
 import { o as Authorizer } from "../authorizer-eiOjo-3l.js";
 import { i as EventSink, t as CloudEvent } from "../cloud-event-DXkNoI6v.js";
-import { Wt as DbStats, _ as Db, s as CacheAdapter, t as BetterSupabase } from "../define-M_r1d2AT.js";
+import { Wt as DbStats, _ as Db, s as CacheAdapter, t as BetterSupabase } from "../define-DYZnvAbs.js";
 import { n as Impersonator } from "../impersonation-D5chOkrO.js";
-import { i as AuthorizationHooks } from "../authorization-hooks-mLi894KH.js";
+import { i as AuthorizationHooks } from "../authorization-hooks-WDQMKIsc.js";
 import { t as BetterPostgres } from "../pool-cM3rpOQr.js";
-import { B as SupportSessionStore, a as ServerContext, c as ServerOptions } from "../server-types-BKN_R4Ws.js";
-import { r as GuardOptions } from "../respond-CEBC6KUX.js";
-import { n as Controller } from "../controller-BBXX1RMw.js";
-import { i as AiTaskRun, o as AiTaskRunner, t as AiTask } from "../ai-tasks-BJJChl-D.js";
+import { B as SupportSessionStore, a as ServerContext, c as ServerOptions } from "../server-types-fLdep4gb.js";
+import { r as GuardOptions } from "../respond-BSL36dQp.js";
+import { n as Controller } from "../controller-BZhiIb-N.js";
+import { i as AiTaskRun, o as AiTaskRunner, t as AiTask } from "../ai-tasks-ZvPnNudQ.js";
 import { r as WebhookInput } from "../signatures-BXlDXV3D.js";
 import { n as Money } from "../money-DFpWzQvk.js";
 import { a as Generator, c as GeneratorModel, s as GeneratorInput, x as ResolvedConfig } from "../codegen-C64C0NZG.js";
 import { t as NotificationChannel } from "../channel-D-LHCY11.js";
 import { a as DeliveryTransport } from "../delivery-BeHgwS3k.js";
 import { C as PaymentProvider, l as TaxProvider, r as TaxAddress, y as Payment } from "../tax-DMWDUzKt.js";
-import { B as WorkflowGraph, c as GraphCompiler, i as BuilderStarter, r as BuilderStartCall } from "../types-Bq64h5nY.js";
+import { B as WorkflowGraph, c as GraphCompiler, i as BuilderStarter, r as BuilderStartCall } from "../types-Bels39_u.js";
 import { O as IncomingDestination, f as WebhookSecretStore, o as WebhookSigner, v as WebhookTransport } from "../signers-BwKV-9S6.js";
-import { t as EveDocumentBackend } from "../eve-C_Onyk_j.js";
+import { t as EveDocumentBackend } from "../eve-B6ru2Bt4.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Message, StateAdapter } from "chat";
 import { webcrypto } from "node:crypto";
@@ -57,9 +57,7 @@ export declare function signTestJwt(secret: string, claims: TestJwtClaims): Prom
 export declare function localAuth(secret: string): AuthResolver;
 interface TestSigner {
   /** Public JWKS; pass as `jwks` to `resolveAuth` / `createServer({ auth: { jwks } })`. */
-  readonly jwks: {
-    readonly keys: readonly webcrypto.JsonWebKey[];
-  };
+  readonly jwks: InlineJwks;
   sign(claims: TestJwtClaims): Promise<string>;
 }
 /** A private ES256 JWK, as `better-supabase keys` writes to `supabase/signing_keys.json`. */

package/dist/{topic-1WTkDnPd.d.ts → topic-DAY_HOX2.d.ts}

@@ -2,9 +2,9 @@ import { D as ValidationIssue, b as DbError, t as AsyncResult } from "./result-B
 import { B as TableKey, N as Row, a as AnyModels, i as AnyFunctions, r as AccessTopicPolicy } from "./types-BrpW5ixT.js";
 import { t as AuthorizationFunctions } from "./authorization-ClWBcXJi.js";
 import { t as RealtimeStatus } from "./realtime-status-DcsO00Gw.js";
-import { D as TemplateParams, O as TemplateValues } from "./bucket-BBSNDFNH.js";
-import { t as BetterSupabase } from "./define-M_r1d2AT.js";
-import { g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, m as Subscriber } from "./authorization-hooks-mLi894KH.js";
+import { D as TemplateParams, O as TemplateValues } from "./bucket-BbePDVwc.js";
+import { t as BetterSupabase } from "./define-DYZnvAbs.js";
+import { g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, m as Subscriber } from "./authorization-hooks-WDQMKIsc.js";
 import { RealtimeChannel, SupabaseClient } from "@supabase/supabase-js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/realtime/fan-out.d.ts

package/dist/{types-DDQ-Rsep.d.ts → types-BA1eTvy4.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { T as ErrorMapper, t as AsyncResult } from "./result-BREt7qOh.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { i as CredentialRef, r as CredentialProvider } from "./provider-CNs0Jx0I.js";
+import { i as CredentialRef, r as CredentialProvider } from "./provider-DXgx5oSA.js";
 import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
 import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-CjcQM1yA.js";
 import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";