better-supabase 0.14.0 → 0.15.0

package/dist/undo-BjCChCmH.js

@@ -0,0 +1,44 @@
+import { n as dbError } from "./errors-BVFgt8BZ.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { a as ok, t as AsyncResult } from "./result-ntFBW2p2.js";
+import { o as blockCall } from "./block-helpers-CtBdjgO4.js";
+import { r as withBlockHooks } from "./block-hooks-BfxX3682.js";
+//#region src/blocks/undo/undo.ts
+/** The functions an undo token may call: the inverses the blocks return. */
+const UNDO_FUNCTIONS = [
+	"link",
+	"unlink",
+	"revert_audit_entries"
+];
+function undoToken(calls) {
+	return {
+		v: 1,
+		calls
+	};
+}
+/** Whether a value is an undo token whose calls are all allowed. */
+function isUndoToken(value, allowed = UNDO_FUNCTIONS) {
+	return isRecord(value) && value["v"] === 1 && Array.isArray(value["calls"]) && value["calls"].length > 0 && value["calls"].every((call) => isRecord(call) && typeof call["fn"] === "string" && allowed.includes(call["fn"]) && isRecord(call["args"]));
+}
+function createUndo(options) {
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const allowed = [...UNDO_FUNCTIONS, ...options.allow ?? []];
+	return withBlockHooks({ apply: (token) => {
+		if (!isUndoToken(token, allowed)) return AsyncResult.err(dbError("validation", "not an undo token this app accepts", { issues: [{
+			message: "not an undo token this app accepts",
+			path: []
+		}] }));
+		return AsyncResult.from(async () => {
+			for (const step of token.calls) {
+				const result = await call(step.fn, step.args, () => void 0);
+				if (!result.ok) return result;
+			}
+			return ok(token.calls.length);
+		});
+	} }, options.hooks, {
+		block: "undo",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+//#endregion
+export { undoToken as i, createUndo as n, isUndoToken as r, UNDO_FUNCTIONS as t };

package/dist/upload-claim-B1ZU8ydB.js

@@ -0,0 +1,33 @@
+import { n as dbError } from "./errors-BVFgt8BZ.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-ntFBW2p2.js";
+import { t as fromStorageError } from "./errors-CyxMxzlu.js";
+//#region src/blocks/upload-claim.ts
+function refusal(cause, hints) {
+	const error = fromStorageError(cause, "storage.objects");
+	if (error.kind === "not_found") return dbError("not_found", "The file was not uploaded yet", { hint: hints.notUploaded });
+	if (error.kind === "forbidden") return dbError("forbidden", error.message, {
+		hint: hints.forbidden,
+		...error.code === void 0 ? {} : { code: error.code }
+	});
+	return error;
+}
+/**
+* Claims an object a browser uploaded to a signed upload URL, so a support
+* session records it. Succeeds without a request when the storage has no claim
+* step.
+*/
+function claimUpload(storage, file, hints) {
+	return AsyncResult.from(async () => {
+		if (!storage.claimSignedUpload) return ok(void 0);
+		try {
+			const { error } = await storage.claimSignedUpload(file.bucket, file.path);
+			return error ? err(refusal(error, hints)) : ok(void 0);
+		} catch (cause) {
+			return err(refusal(cause, hints));
+		}
+	});
+}
+/** Whether `storage` has a claim step, so a block needs the file's path first. */
+const claimsUploads = (storage) => storage.claimSignedUpload !== void 0;
+//#endregion
+export { claimsUploads as n, claimUpload as t };

package/dist/usage-D7QkrwzV.d.ts

@@ -0,0 +1,232 @@
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult } from "./result-DZeA5KS6.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { i as CursorPageOptions, n as BlockOptions } from "./block-helpers-CRpAHrp_.js";
+import { t as BlockTransport } from "./block-transport-DWZSJrwN.js";
+import { n as BlockHooks } from "./block-hooks-DZN2w69m.js";
+import { g as JobHandler } from "./types-SFRomQF7.js";
+import { n as StripeSource } from "./stripe-X22LjuH-.js";
+//#region src/blocks/usage/usage.d.ts
+interface UsageOptions extends BlockOptions {
+  /**
+   * `withBlockHooks` hooks around the client's methods, such as a check before
+   * `consume`.
+   */
+  readonly hooks?: BlockHooks<Usage>;
+  /** Receives the errors `after` hooks throw. Default: `console`. */
+  readonly logger?: Logger;
+}
+interface RecordUsageOptions {
+  /** Default 1. */
+  readonly quantity?: number;
+  /** A retried call with the same key counts once. */
+  readonly idempotencyKey?: string;
+  /**
+   * What used it, such as `feature:summary` or `api:/v1/search`, kept in the
+   * history with `blocks.usage.options.history`.
+   */
+  readonly source?: string;
+  /** More detail for the history entry, such as a document id. */
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  /**
+   * Who used it, for a service transport recording on a user's behalf. Ignored
+   * for other callers, whose own user id is recorded.
+   */
+  readonly actor?: string;
+}
+/** One meter of a batch. */
+interface UsageEntry {
+  readonly meter: string;
+  /** Default 1. */
+  readonly quantity?: number;
+}
+interface UsageBatchRecorded {
+  /** False when the idempotency key was seen before for every meter. */
+  readonly recorded: boolean;
+  /** Today's usage per meter (UTC). */
+  readonly today: Readonly<Record<string, number>>;
+  /** Usage per meter in its quota's current period, as `current()` reports it. */
+  readonly used: Readonly<Record<string, number>>;
+}
+/** One entry of the usage history. */
+interface UsageHistoryEntry {
+  readonly id: number;
+  readonly meter: string;
+  readonly quantity: number;
+  /** The user who used it, or `undefined` for service usage without one. */
+  readonly actor: string | undefined;
+  readonly source: string | undefined;
+  readonly metadata: Readonly<Record<string, unknown>>;
+  readonly recordedAt: Temporal.Instant;
+}
+/** Usage of a meter in its current window per actor and source. */
+interface UsageBreakdownEntry {
+  readonly actor: string | undefined;
+  readonly source: string | undefined;
+  readonly quantity: number;
+}
+interface UsageHistoryOptions extends CursorPageOptions<number> {
+  readonly meter?: string;
+  /** Defaults to 100, at most 1000. */
+  readonly limit?: number;
+  /** Only entries with a lower id, for the next page. */
+  readonly cursor?: number;
+}
+interface UsageRecorded {
+  /** False when the idempotency key was seen before. */
+  readonly recorded: boolean;
+  /** Today's usage of the meter (UTC). */
+  readonly today: number;
+  /** Usage in the quota's current period, as `current()` reports it. */
+  readonly used: number;
+}
+/**
+ * A quota period: a UTC calendar period, or `billing` for the window the app's
+ * `usage_billing_period(tenant)` function returns.
+ */
+type UsagePeriod = "day" | "week" | "month" | "year" | "billing";
+/** One meter of `blocks.usage.options.meters`. */
+interface UsageMeterInfo {
+  readonly unit?: string;
+  readonly category?: string;
+  readonly label?: string;
+  /** `counter` when the catalog gives no kind. */
+  readonly kind?: "counter" | "distinct" | "computed";
+  /** The window a distinct or computed meter measures. */
+  readonly period?: UsagePeriod;
+}
+interface UsageStatus {
+  readonly meter: string;
+  /** Usage in the current period. */
+  readonly used: number;
+  /** `undefined` without a quota and for an unlimited one. */
+  readonly limit: number | undefined;
+  readonly remaining: number | undefined;
+  readonly unlimited: boolean;
+  readonly period: UsagePeriod;
+  /** When the current period started. */
+  readonly startsAt: Temporal.Instant | undefined;
+  readonly resetsAt: Temporal.Instant;
+  /** From the meter catalog, when the module has one. */
+  readonly unit?: string;
+  readonly category?: string;
+  readonly label?: string;
+}
+interface Usage {
+  /** Adds usage without checking the quota (metering only). */
+  record(organizationId: string, meter: string, options?: RecordUsageOptions): AsyncResult<UsageRecorded>;
+  /**
+   * Counts `subject` once in the current period of a `distinct` meter (active
+   * users, say). Repeating a subject changes nothing, and quotas and Stripe
+   * reporting read the meter like a counter.
+   */
+  track(organizationId: string, meter: string, subject: string, options?: {
+    readonly period?: UsagePeriod;
+  }): AsyncResult<UsageRecorded>;
+  /**
+   * Recomputes `computed` meters from their query for every tenant it returns,
+   * or for one meter. Service role only; returns the rows written. The
+   * migration schedules it hourly when pg_cron is installed.
+   */
+  refresh(meter?: string): AsyncResult<number>;
+  /** Adds usage when it fits the quota, or returns `quota_exceeded`. */
+  consume(organizationId: string, meter: string, options?: RecordUsageOptions): AsyncResult<UsageRecorded>;
+  /**
+   * Adds several meters in one transaction, all or none, such as input and
+   * output tokens of one call. The idempotency key covers the batch.
+   */
+  recordMany(organizationId: string, entries: readonly UsageEntry[], options?: Omit<RecordUsageOptions, "quantity">): AsyncResult<UsageBatchRecorded>;
+  /**
+   * Like `recordMany`, but checks each meter's quota first; when one doesn't
+   * fit, nothing is recorded and the result is `quota_exceeded`.
+   */
+  consumeMany(organizationId: string, entries: readonly UsageEntry[], options?: Omit<RecordUsageOptions, "quantity">): AsyncResult<UsageBatchRecorded>;
+  current(organizationId: string, meter: string): AsyncResult<UsageStatus>;
+  overview(organizationId: string): AsyncResult<readonly UsageStatus[]>;
+  /** Units left in the period, or `undefined` without a quota. */
+  remaining(organizationId: string, meter: string): AsyncResult<number | undefined>;
+  /** The meter catalog (`options.meters`), empty without one. */
+  meters(): AsyncResult<Readonly<Record<string, UsageMeterInfo>>>;
+  /**
+   * The tenant's usage entries, newest first, with who and what used each
+   * (`usage.read`). Empty without `blocks.usage.options.history`.
+   */
+  history(organizationId: string, options?: UsageHistoryOptions): AsyncResult<readonly UsageHistoryEntry[]>;
+  /**
+   * The meter's usage in its current quota window per actor and source, largest
+   * first (`usage.read`). Empty without the history option.
+   */
+  breakdown(organizationId: string, meter: string): AsyncResult<readonly UsageBreakdownEntry[]>;
+  /**
+   * Deletes up to `batch` history entries older than `olderThan` (default 400
+   * days, `purge_usage_history`); returns how many.
+   */
+  purgeHistory(options?: PurgeUsageOptions): AsyncResult<number>;
+  /**
+   * Deletes up to `batch` idempotency keys of recorded usage older than
+   * `olderThan` (default 30 days, `purge_usage_events`); returns how many. A
+   * retry with a purged key records again.
+   */
+  purgeEvents(options?: PurgeUsageOptions): AsyncResult<number>;
+  /**
+   * A job handler that runs `purgeHistory` and `purgeEvents`; schedule it
+   * nightly.
+   */
+  purgeJob(options?: {
+    readonly history?: PurgeUsageOptions;
+    readonly events?: PurgeUsageOptions;
+  }): JobHandler<unknown>;
+}
+interface PurgeUsageOptions {
+  /** Seconds, or an interval such as `"90 days"`. */
+  readonly olderThan?: number | string;
+  /** Defaults to 10000. */
+  readonly batch?: number;
+}
+/** Usage metering and quotas over the `usage` module's functions. */
+declare function createUsage(options: UsageOptions): Usage;
+interface ReportUsageOptions {
+  /**
+   * A service-role transport: the reporting functions are granted to
+   * `service_role` only.
+   */
+  readonly transport: BlockTransport;
+  readonly stripe: StripeSource;
+  readonly schema?: string;
+  /** The Stripe meter's `event_name` for a meter; default the meter itself. */
+  readonly eventName?: (meter: string) => string | undefined;
+  /**
+   * The tenant's Stripe customer. Default: `tenant_stripe_customer()` from the
+   * `entitlements` module (`config.entitlements.customer`).
+   */
+  readonly customer?: (organizationId: string) => Promise<string | undefined>;
+  /** Counters per run, default 500. */
+  readonly batch?: number;
+  /**
+   * Send only the usage above the tenant's quota (the allowance its plan
+   * includes) in each quota window, instead of every unit. A meter without a
+   * quota sends everything, and one with an unlimited quota sends nothing.
+   */
+  readonly overage?: boolean;
+}
+interface ReportUsageResult {
+  /**
+   * Meter events sent; usage inside the quota with `overage` is marked without
+   * one.
+   */
+  readonly reported: number;
+  /**
+   * Counters left for a later run: no customer, or no event name. They don't
+   * hold up the other counters of the batch.
+   */
+  readonly skipped: number;
+}
+/**
+ * Sends unreported usage to Stripe as meter events, one per counter and delta.
+ * The event `identifier` is the tenant, meter, day and new total, so a run that
+ * fails after sending and before marking resends the same event, and Stripe
+ * drops the duplicate. Run it from a job or a cron route.
+ */
+declare function reportUsageToStripe(options: ReportUsageOptions): Promise<ReportUsageResult>;
+//#endregion
+export { reportUsageToStripe as _, Usage as a, UsageEntry as c, UsageMeterInfo as d, UsageOptions as f, createUsage as g, UsageStatus as h, ReportUsageResult as i, UsageHistoryEntry as l, UsageRecorded as m, RecordUsageOptions as n, UsageBatchRecorded as o, UsagePeriod as p, ReportUsageOptions as r, UsageBreakdownEntry as s, PurgeUsageOptions as t, UsageHistoryOptions as u };

package/dist/user-change-DgWC6RRC.js

@@ -0,0 +1,135 @@
+//#region src/query/invalidate.ts
+function isString(value) {
+	return typeof value === "string";
+}
+function queryTables(query) {
+	const tables = query.meta?.["bsTables"];
+	if (Array.isArray(tables)) {
+		const list = tables;
+		return list.every(isString) ? list : list.filter(isString);
+	}
+	const [prefix, table] = query.queryKey;
+	return prefix === "bsb" && typeof table === "string" ? [table] : void 0;
+}
+const indexes = /* @__PURE__ */ new WeakMap();
+function indexOf(cache) {
+	const existing = indexes.get(cache);
+	if (existing) return existing;
+	const index = {
+		byTable: /* @__PURE__ */ new Map(),
+		tablesOf: /* @__PURE__ */ new Map()
+	};
+	const remove = (hash) => {
+		for (const table of index.tablesOf.get(hash) ?? []) {
+			const set = index.byTable.get(table);
+			set?.delete(hash);
+			if (set?.size === 0) index.byTable.delete(table);
+		}
+		index.tablesOf.delete(hash);
+	};
+	const add = (hash) => {
+		const query = cache.get(hash);
+		const tables = query ? queryTables(query) : void 0;
+		const known = index.tablesOf.get(hash);
+		if (known !== void 0 && tables !== void 0 && known.length === tables.length && known.every((table, at) => table === tables[at])) return;
+		remove(hash);
+		if (!tables || tables.length === 0) return;
+		index.tablesOf.set(hash, tables);
+		for (const table of tables) {
+			let set = index.byTable.get(table);
+			if (!set) index.byTable.set(table, set = /* @__PURE__ */ new Set());
+			set.add(hash);
+		}
+	};
+	for (const query of cache.getAll()) add(query.queryHash);
+	cache.subscribe((event) => {
+		const hash = event.query.queryHash;
+		if (event.type === "removed") remove(hash);
+		else if (event.type === "added" || event.type === "observerAdded" || event.type === "observerOptionsUpdated" || event.type === "updated" && event.action.type === "fetch") add(hash);
+	});
+	indexes.set(cache, index);
+	return index;
+}
+/**
+* Invalidates every query that read one of `tables` or block instances: tables
+* and instances share the key space `['bsb', name, method, ...args]`, so
+* better-supabase queries match by their `meta.bsTables` and other `['bsb',
+* name, ...]` keys by prefix. `methods` narrows it to the queries of those
+* methods. An index from name to queries finds them, so a write nothing read
+* skips the cache scan.
+*/
+function invalidateTables(client, tables, methods) {
+	if (tables.length === 0) return Promise.resolve();
+	const { byTable } = indexOf(client.getQueryCache());
+	const matched = /* @__PURE__ */ new Set();
+	for (const table of tables) for (const hash of byTable.get(table) ?? []) matched.add(hash);
+	if (matched.size === 0) return Promise.resolve();
+	return client.invalidateQueries({ predicate: (query) => matched.has(query.queryHash) && (methods === void 0 || methods.has(String(query.queryKey[2]))) });
+}
+//#endregion
+//#region src/query/user-change.ts
+/**
+* Claims every refresh changes; the rest says who the caller is and what RLS
+* lets them read.
+*/
+const TIME_CLAIMS = /* @__PURE__ */ new Set([
+	"exp",
+	"iat",
+	"nbf",
+	"jti"
+]);
+/**
+* The user plus every claim except the time claims, so a token refresh keeps
+* the identity and an organization switch, a role change or a second factor (a
+* new `tenant_id`, `role` or `aal`) changes it.
+*/
+function identityKey(snapshot) {
+	if (!snapshot.user) return null;
+	const claims = Object.entries(snapshot.claims ?? {}).filter(([key]) => !TIME_CLAIMS.has(key)).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	return JSON.stringify([snapshot.user.id, claims]);
+}
+/**
+* Resets every `['bsb', ...]` query when the caller changes: another user,
+* signing out, or new claims for the same user (an organization switch, a role
+* change). Mounted queries refetch, so no one sees the previous identity's
+* rows. Returns the function that stops listening. `BetterSupabaseProvider`
+* calls it for React; call it yourself with Vue, Solid, Svelte or Angular
+* Query.
+*
+* Queries that fetched while the session was still loading ran as anon, so they
+* are reset when a user arrives. Data already in the cache when loading started
+* (hydrated from the server) stays.
+*
+* ```ts
+* const stop = clearOnUserChange(queryClient, bsb.auth);
+* ```
+*/
+function clearOnUserChange(queryClient, auth) {
+	let identity;
+	let before;
+	const bsQueries = () => queryClient.getQueryCache().findAll({ queryKey: ["bsb"] });
+	const check = () => {
+		const snapshot = auth.current();
+		if (snapshot.status === "loading") {
+			before ??= new Map(bsQueries().map((query) => [query.queryHash, query.state.dataUpdatedAt]));
+			return;
+		}
+		const next = identityKey(snapshot);
+		if (identity !== void 0 && identity !== next) queryClient.resetQueries({ queryKey: ["bsb"] });
+		else if (identity === void 0 && next !== null && before) {
+			const known = before;
+			const fetchedAsAnon = new Set(bsQueries().filter((query) => query.state.dataUpdatedAt > 0 && known.get(query.queryHash) !== query.state.dataUpdatedAt).map((query) => query.queryHash));
+			if (fetchedAsAnon.size > 0) queryClient.resetQueries({
+				queryKey: ["bsb"],
+				predicate: (query) => fetchedAsAnon.has(query.queryHash)
+			});
+		}
+		before = void 0;
+		identity = next;
+	};
+	const stop = auth.subscribe(check);
+	check();
+	return stop;
+}
+//#endregion
+export { identityKey as n, invalidateTables as r, clearOnUserChange as t };

package/dist/variants-Cy--Ub-a.js

@@ -0,0 +1,53 @@
+import { t as DbException } from "./db-exception-Lngc1W49.js";
+import { n as dbError } from "./errors-BVFgt8BZ.js";
+import { n as QUALITY, t as MAX_SIDE } from "./image-url-_d7xYsXK.js";
+//#region src/storage/ttl.ts
+const TTL = {
+	minute: 60,
+	hour: 3600,
+	day: 86400,
+	week: 604800
+};
+function ttlSeconds(ttl) {
+	return typeof ttl === "number" ? ttl : TTL[ttl ?? "hour"];
+}
+//#endregion
+//#region src/storage/variants.ts
+const side = (value) => value === void 0 || Number.isInteger(value) && value >= 1 && value <= 2500;
+/** Throws for a variant Storage would refuse, when the bucket is defined. */
+function checkVariants(bucketId, variants) {
+	for (const [name, transform] of Object.entries(variants)) {
+		if (!side(transform.width) || !side(transform.height)) throw new TypeError(`defineBucket("${bucketId}"): variant "${name}" needs a width and height from 1 to ${String(MAX_SIDE)}`);
+		if (transform.quality !== void 0 && (!Number.isInteger(transform.quality) || transform.quality < QUALITY.min || transform.quality > QUALITY.max)) throw new TypeError(`defineBucket("${bucketId}"): variant "${name}" needs a quality from ${String(QUALITY.min)} to ${String(QUALITY.max)}`);
+	}
+}
+/**
+* The transform a variant name stands for, or the inline transform. An unknown
+* name throws an `invalid_input` `DbException`, which the bucket methods turn
+* into an error `Result`.
+*/
+function transformFor(bucketId, variants, transform) {
+	if (typeof transform !== "string") return transform;
+	const found = Object.hasOwn(variants, transform) ? variants[transform] : void 0;
+	if (!found) throw new DbException(dbError("invalid_input", `Bucket "${bucketId}" has no image variant "${transform}"`, { table: bucketId }));
+	return found;
+}
+/**
+* The transform at `density` times its size, for a `srcset` entry. Width and
+* height scale by the same factor, which stops at Storage's 2500 limit, so a
+* crop keeps its aspect ratio.
+*/
+function scaleTransform(transform, density) {
+	const sides = [transform.width, transform.height].filter((value) => value !== void 0);
+	const factor = Math.min(density, ...sides.map((value) => MAX_SIDE / value));
+	const scale = (value) => value === void 0 ? void 0 : Math.max(1, Math.min(MAX_SIDE, Math.round(value * factor)));
+	const width = scale(transform.width);
+	const height = scale(transform.height);
+	return {
+		...transform,
+		...width === void 0 ? {} : { width },
+		...height === void 0 ? {} : { height }
+	};
+}
+//#endregion
+export { ttlSeconds as a, TTL as i, scaleTransform as n, transformFor as r, checkVariants as t };

package/dist/vault-O-YlAyHb.d.ts

@@ -0,0 +1,62 @@
+import { T as ErrorMapper, t as AsyncResult } from "./result-DZeA5KS6.js";
+import { c as SetCredentialOptions, i as CredentialRef, r as CredentialProvider } from "./provider-CqwEOLCA.js";
+import { t as BlockTransport } from "./block-transport-DWZSJrwN.js";
+//#region src/credentials/vault.d.ts
+/** How a request the third party sends is signed with the stored secret. */
+type VaultInboundScheme = "standard-webhooks" | "hmac-sha256" | "shared-secret";
+/**
+ * A credential in Vault. `scope: 'user'` keeps one secret per user subject. The
+ * token goes out as `<header>: <scheme> <token>`, `Authorization: Bearer` by
+ * default; `scheme: null` sends it bare (`x-api-key`).
+ */
+interface VaultCredentialRef {
+  readonly provider: "vault";
+  readonly secret: string;
+  /**
+   * Stores the secret as `tenant/<tenant>/<secret>`, apart from every other
+   * tenant's.
+   */
+  readonly tenant?: string;
+  readonly scope?: "app" | "user";
+  readonly header?: string;
+  readonly scheme?: string | null;
+  readonly inbound?: VaultInboundScheme;
+  /**
+   * Defaults to `x-hub-signature-256` for `hmac-sha256`, `authorization` for
+   * `shared-secret`.
+   */
+  readonly signatureHeader?: string;
+}
+interface VaultCredentialsOptions {
+  /**
+   * `sqlTransport(postgres.asService())` or `rpcTransport` with the service
+   * role key.
+   */
+  readonly transport: BlockTransport;
+  /** The schema of the `credentials` module. Defaults to `better_supabase`. */
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+  /**
+   * How long a read secret stays in memory, in milliseconds. Defaults to 60000;
+   * `0` reads Vault on every call. `set` and `revoke` clear it.
+   */
+  readonly cacheMs?: number;
+}
+interface VaultCredentials extends CredentialProvider {
+  readonly name: "vault";
+  /**
+   * Stores or replaces the credential a ref names, for `subject` when the ref
+   * is per user.
+   */
+  set(ref: CredentialRef, value: string, options?: SetCredentialOptions): AsyncResult<void>;
+  verifyInbound(request: Request, ref: CredentialRef): AsyncResult<boolean>;
+}
+/**
+ * A `CredentialProvider` over the `credentials` SQL module: tokens and API keys
+ * in Supabase Vault, read through security definer functions only the service
+ * role may call. Static secrets only; OAuth connections come from a provider
+ * such as `better-supabase/vercel-connect`.
+ */
+declare function vaultCredentials(options: VaultCredentialsOptions): VaultCredentials;
+//#endregion
+export { vaultCredentials as a, VaultInboundScheme as i, VaultCredentials as n, VaultCredentialsOptions as r, VaultCredentialRef as t };

package/dist/vercel-connect/index.d.ts

@@ -1,4 +1,4 @@
-import { a as CredentialSubject, r as CredentialProvider } from "../provider-DmiaI1qt.js";
+import { a as CredentialSubject, r as CredentialProvider } from "../provider-CqwEOLCA.js";
 //#region src/vercel-connect/vercel-connect.d.ts
 interface ConnectTokenParams {
   subject: CredentialSubject;

package/dist/vercel-connect/index.js

@@ -1,7 +1,7 @@
-import { n as dbError } from "../errors-03ysrOt4.js";
-import { c as optionalTemporal } from "../temporal-DLZlWbOi.js";
-import { a as ok, r as err, t as AsyncResult } from "../result-B3m7xtRY.js";
+import { n as dbError } from "../errors-BVFgt8BZ.js";
 import { n as isRecord } from "../guards-6F2bCtQR.js";
+import { c as optionalTemporal } from "../temporal-DLZlWbOi.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-ntFBW2p2.js";
 import { t as importOptionalPeer } from "../optional-peer-C1NbBRJm.js";
 //#region src/vercel-connect/vercel-connect.ts
 const isModule = (value) => isRecord(value) && typeof value["getTokenResponse"] === "function" && typeof value["revokeToken"] === "function" && typeof value["startAuthorization"] === "function";