better-supabase 0.14.0 → 0.15.0

package/dist/signing-keys-B3RHGMMu.d.ts

@@ -1,119 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { t as AsyncResult } from "./result-C6jDfedy.js";
-import { n as Logger } from "./logger-DWVYUmwi.js";
-import { n as BlockOptions } from "./block-helpers-BaugZlJV.js";
-import { n as BlockHooks } from "./block-hooks-CmjPKqQ_.js";
-import { i as JwsAlgorithm, n as Jwks, o as SigningAlgorithm, t as Jwk } from "./jws-D0toeQlA.js";
-//#region src/blocks/signing-keys/signing-keys.d.ts
-interface SigningKeysOptions extends BlockOptions {
-  /**
-   * The JWS `alg` an Ed25519 key signs with: `EdDSA` (RFC 8037), which most
-   * verifiers read, or the fully specified `Ed25519` (RFC 9864). Default:
-   * `EdDSA`.
-   */
-  readonly ed25519Alg?: "EdDSA" | "Ed25519";
-  /** How long a signer keeps the imported private key, in seconds. Default: 300. */
-  readonly cacheSeconds?: number;
-  /** `withBlockHooks` hooks around the client's methods. */
-  readonly hooks?: NoInfer<BlockHooks<SigningKeys>>;
-  /** Receives the errors `after` hooks throw. Default: `console`. */
-  readonly logger?: Logger;
-}
-/** Who a key belongs to: an organization, an app, a stream. */
-interface SigningKeyOwner {
-  /** Lowercase letters, digits, `-` and `_`, such as `organization`. */
-  readonly type: string;
-  readonly id: string;
-}
-/**
- * The owner of the platform's own keys, for a single authorization server that
- * signs for every tenant. A key per tenant uses `{ type, id }` of the tenant
- * instead, such as `{ type: "environment", id: environment.id }`.
- */
-declare const PLATFORM_OWNER: SigningKeyOwner;
-/**
- * The `typ` header for a token kind of your own: `jwtType("invite")` is
- * `vnd.invite+jwt`. Sign with `{ typ }` and verify with `verifyCompact(..., {
- * typ })` so a token of one kind can't be replayed as another (RFC 8725 section
- * 3.11). Throws a `TypeError` for a name outside lower-case letters, digits and
- * `-`.
- */
-declare function jwtType(name: string): string;
-/** What `create` and `rotate` return. The private key never leaves Vault again. */
-interface CreatedSigningKey {
-  readonly kid: string;
-  readonly alg: SigningAlgorithm;
-  readonly publicKey: Jwk;
-  /**
-   * The kid the new key replaced, which stays in the JWKS until its tokens
-   * expire.
-   */
-  readonly retired: string | null;
-}
-/** What `sign` returns. */
-interface Signature {
-  readonly kid: string;
-  readonly alg: JwsAlgorithm;
-  readonly signature: Uint8Array;
-}
-/** Signs with an owner's active key. */
-interface Signer {
-  readonly owner: SigningKeyOwner;
-  /** The raw signature of `data` with the active key. */
-  sign(data: Uint8Array): AsyncResult<Signature>;
-  /**
-   * A compact JWS over `claims`, with `alg`, `kid` and `typ: "JWT"` in the
-   * header unless `header` sets them. A custom `typ` has to be `JWT` or end in
-   * `+jwt` (see `jwtType`); anything else fails with `SIGNING_TYP_INVALID`. A
-   * numeric `exp` keeps the key in the JWKS until then
-   * (`note_signing_key_exp`), so a rotation can't strand the token.
-   */
-  signJwt(claims: Readonly<Record<string, unknown>>, header?: Readonly<Record<string, unknown>>): AsyncResult<string>;
-}
-interface JwksOptions {
-  /**
-   * How long a retired key stays published past its last `exp`. Default:
-   * `blocks.signing-keys.options.jwksGrace`.
-   */
-  readonly grace?: Temporal.Duration;
-}
-interface JwksResponseOptions extends JwksOptions {
-  /** The `Cache-Control` max-age, in seconds. Default: 300. */
-  readonly maxAge?: number;
-}
-interface SignerOptions {
-  /**
-   * Creates a key of this type when the owner has none, instead of failing with
-   * `SIGNING_KEY_MISSING`.
-   */
-  readonly create?: SigningAlgorithm;
-}
-interface SigningKeys {
-  /**
-   * Generates a key for the owner and makes it active; the previous key is
-   * retired.
-   */
-  create(owner: SigningKeyOwner, alg?: SigningAlgorithm): AsyncResult<CreatedSigningKey>;
-  /** `create` with the active key's type, or `alg` when given. */
-  rotate(owner: SigningKeyOwner, alg?: SigningAlgorithm): AsyncResult<CreatedSigningKey>;
-  /** Retires a key without a replacement. `false` when it was not active. */
-  retire(kid: string): AsyncResult<boolean>;
-  /** Keeps a key published until at least `exp`. `false` for an unknown kid. */
-  noteExp(kid: string, exp: Temporal.Instant): AsyncResult<boolean>;
-  /** The owner's public keys still in use, as a JWK Set. */
-  jwks(owner: SigningKeyOwner, options?: JwksOptions): AsyncResult<Jwks>;
-  /** `jwks` as an `application/jwk-set+json` response with `Cache-Control`. */
-  jwksResponse(owner: SigningKeyOwner, options?: JwksResponseOptions): Promise<Response>;
-  /** Deletes every key of the owner. */
-  remove(owner: SigningKeyOwner): AsyncResult<number>;
-  /** Deletes retired keys no token can still need. */
-  purge(options?: JwksOptions): AsyncResult<number>;
-  signer(owner: SigningKeyOwner, options?: SignerOptions): Signer;
-}
-/**
- * The `signing-keys` SQL module as typed calls: keys are generated and used
- * with WebCrypto here, kept in Supabase Vault there. Service role only.
- */
-declare function createSigningKeys(options: SigningKeysOptions): SigningKeys;
-//#endregion
-export { Signature as a, SigningKeyOwner as c, createSigningKeys as d, jwtType as f, PLATFORM_OWNER as i, SigningKeys as l, JwksOptions as n, Signer as o, JwksResponseOptions as r, SignerOptions as s, CreatedSigningKey as t, SigningKeysOptions as u };

package/dist/signing-keys-fWapUzi0.js

@@ -1,164 +0,0 @@
-import { n as dbError } from "./errors-03ysrOt4.js";
-import { t as temporal } from "./temporal-required-B8qQHYbI.js";
-import { t as AsyncResult } from "./result-B3m7xtRY.js";
-import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { D as recordOf, I as textOf, d as enumOrThrow, j as run, n as applyTemporal, o as blockCall } from "./block-helpers-CiKtrb6g.js";
-import { r as withBlockHooks } from "./block-hooks-BymdcD0V.js";
-import { a as jwksOf, n as generateSigningKey, o as signBytes, r as importSigningKey, s as signCompact } from "./jws-DOgHJKHb.js";
-//#region src/blocks/signing-keys/signing-keys.ts
-const ALGORITHMS = ["Ed25519", "ES256"];
-/**
-* The owner of the platform's own keys, for a single authorization server that
-* signs for every tenant. A key per tenant uses `{ type, id }` of the tenant
-* instead, such as `{ type: "environment", id: environment.id }`.
-*/
-const PLATFORM_OWNER = {
-	type: "platform",
-	id: "default"
-};
-const TYPE_NAME = /^[a-z0-9][a-z0-9-]{0,62}$/;
-const JWT_TYPE = /^(?:JWT|[a-z0-9][a-z0-9.-]{0,126}\+jwt)$/i;
-/**
-* The `typ` header for a token kind of your own: `jwtType("invite")` is
-* `vnd.invite+jwt`. Sign with `{ typ }` and verify with `verifyCompact(..., {
-* typ })` so a token of one kind can't be replayed as another (RFC 8725 section
-* 3.11). Throws a `TypeError` for a name outside lower-case letters, digits and
-* `-`.
-*/
-function jwtType(name) {
-	if (!TYPE_NAME.test(name)) throw new TypeError(`jwtType name must be lower-case letters, digits and "-", got ${JSON.stringify(name)}`);
-	return `vnd.${name}+jwt`;
-}
-const HOUR = 3600;
-const interval = (duration) => duration === void 0 ? null : `${String(duration.total({ unit: "seconds" }))} seconds`;
-const ownerArgs = (owner) => ({
-	owner_type: owner.type,
-	owner_id: owner.id
-});
-/**
-* The `signing-keys` SQL module as typed calls: keys are generated and used
-* with WebCrypto here, kept in Supabase Vault there. Service role only.
-*/
-function createSigningKeys(options) {
-	applyTemporal(options);
-	const call = blockCall(options.transport, options.schema, options.mappers);
-	const ed25519Alg = options.ed25519Alg ?? "EdDSA";
-	const cacheMs = (options.cacheSeconds ?? 300) * 1e3;
-	const keys = /* @__PURE__ */ new Map();
-	const noted = /* @__PURE__ */ new Map();
-	const jwsAlg = (alg) => alg === "Ed25519" ? ed25519Alg : "ES256";
-	const add = (owner, alg) => run(() => generateSigningKey(alg)).andThen((generated) => call("add_signing_key", {
-		...ownerArgs(owner),
-		kid: generated.kid,
-		alg,
-		public_jwk: generated.publicKey,
-		private_jwk: JSON.stringify(generated.privateKey)
-	}, (value) => {
-		const row = recordOf(value, "add_signing_key");
-		keys.delete(`${owner.type}:${owner.id}`);
-		return {
-			kid: generated.kid,
-			alg,
-			publicKey: generated.publicKey,
-			retired: typeof row["retired"] === "string" ? row["retired"] : null
-		};
-	}));
-	const stored = (owner) => call("signing_key", ownerArgs(owner), (value) => {
-		if (value === null || value === void 0) return null;
-		const row = recordOf(value, "signing_key");
-		return {
-			kid: textOf(row["kid"]),
-			alg: enumOrThrow(row["alg"], ALGORITHMS, "signing key alg"),
-			privateKey: textOf(row["privateKey"])
-		};
-	});
-	const active = (owner, create) => {
-		const cacheKey = `${owner.type}:${owner.id}`;
-		const cached = keys.get(cacheKey);
-		if (cached && Date.now() - cached.at < cacheMs) return AsyncResult.ok(cached);
-		return stored(owner).andThen((found) => {
-			if (found) return run(async () => {
-				const parsed = JSON.parse(found.privateKey);
-				if (!isRecord(parsed) || typeof parsed["kty"] !== "string") throw new TypeError("The stored signing key is not a JWK");
-				const key = await importSigningKey(parsed);
-				const entry = {
-					kid: found.kid,
-					alg: found.alg,
-					key,
-					at: Date.now()
-				};
-				keys.set(cacheKey, entry);
-				return entry;
-			});
-			if (create === void 0) return AsyncResult.err(dbError("not_found", `${cacheKey} has no signing key`, { hint: "SIGNING_KEY_MISSING" }));
-			return add(owner, create).andThen(() => active(owner, void 0));
-		});
-	};
-	const noteExp = (kid, exp) => call("note_signing_key_exp", {
-		kid,
-		exp: exp.toString()
-	}, (value) => value === true);
-	const client = {
-		create: (owner, alg = "Ed25519") => add(owner, alg),
-		rotate: (owner, alg) => alg === void 0 ? stored(owner).andThen((found) => add(owner, found?.alg ?? "Ed25519")) : add(owner, alg),
-		retire: (kid) => call("retire_signing_key", { kid }, (value) => {
-			for (const [owner, entry] of keys) if (entry.kid === kid) keys.delete(owner);
-			return value === true;
-		}),
-		noteExp,
-		jwks: (owner, jwksOptions = {}) => call("signing_jwks", {
-			...ownerArgs(owner),
-			grace: interval(jwksOptions.grace)
-		}, jwksOf),
-		jwksResponse: async (owner, responseOptions = {}) => {
-			const result = await client.jwks(owner, responseOptions);
-			if (!result.ok) return Response.json({
-				title: "The key set is unavailable",
-				status: 503
-			}, {
-				status: 503,
-				headers: { "content-type": "application/problem+json" }
-			});
-			return Response.json(result.data, { headers: {
-				"content-type": "application/jwk-set+json",
-				"cache-control": `public, max-age=${String(responseOptions.maxAge ?? 300)}`
-			} });
-		},
-		remove: (owner) => call("delete_signing_keys", ownerArgs(owner), (value) => {
-			keys.delete(`${owner.type}:${owner.id}`);
-			return Number(value);
-		}),
-		purge: (purgeOptions = {}) => call("purge_signing_keys", { grace: interval(purgeOptions.grace) }, Number),
-		signer: (owner, signerOptions = {}) => ({
-			owner,
-			sign: (data) => active(owner, signerOptions.create).andThen((key) => run(async () => ({
-				kid: key.kid,
-				alg: jwsAlg(key.alg),
-				signature: await signBytes(key.key, key.alg, data)
-			}))),
-			signJwt: (claims, header = {}) => {
-				const typ = header["typ"];
-				if (typ !== void 0 && (typeof typ !== "string" || !JWT_TYPE.test(typ))) return AsyncResult.err(dbError("invalid_input", "The typ header is not a JWT media type", { hint: "SIGNING_TYP_INVALID" }));
-				return active(owner, signerOptions.create).andThen((key) => {
-					const exp = claims["exp"];
-					const until = typeof exp === "number" && Number.isFinite(exp) ? Math.ceil(exp / HOUR) * HOUR : void 0;
-					return (until !== void 0 && until > (noted.get(key.kid) ?? 0) ? noteExp(key.kid, temporal().Instant.fromEpochMilliseconds(until * 1e3)).map((known) => {
-						noted.set(key.kid, until);
-						return known;
-					}) : AsyncResult.ok(true)).andThen(() => run(() => signCompact(key.key, key.alg, {
-						alg: jwsAlg(key.alg),
-						kid: key.kid,
-						typ: "JWT",
-						...header
-					}, claims)));
-				});
-			}
-		})
-	};
-	return withBlockHooks(client, options.hooks, {
-		block: "signing-keys",
-		...options.logger ? { logger: options.logger } : {}
-	});
-}
-//#endregion
-export { createSigningKeys as n, jwtType as r, PLATFORM_OWNER as t };

package/dist/solid-bind-C1jeq4Qm.d.ts

@@ -1,11 +0,0 @@
-import { n as Controller } from "./controller-DAD4hbl4.js";
-import { Accessor } from "solid-js";
-//#region src/blocks/solid-bind.d.ts
-/** A block controller in a Solid component: `state` follows the controller. */
-interface SolidController<S, A> {
-  readonly state: Accessor<S>;
-  readonly actions: A;
-  readonly controller: Controller<S, A>;
-}
-//#endregion
-export { SolidController as t };

package/dist/solid-bind-iHGfGtBK.js

@@ -1,38 +0,0 @@
-import { createContext, from, onCleanup, onMount, useContext } from "solid-js";
-//#region src/solid/context.ts
-const ClientContext = createContext();
-/** What `<BetterSupabaseProvider>` provides. */
-function useContext$1() {
-	const context = useContext(ClientContext);
-	if (!context) throw new Error("better-supabase: wrap your app in <BetterSupabaseProvider client={bs}>");
-	return context;
-}
-//#endregion
-//#region src/blocks/solid-bind.ts
-/**
-* Reads a controller through `from`. Its work starts on mount (never during
-* server rendering), and the controller is disposed with the owner.
-*/
-function bindSolidController(controller) {
-	const state = from({ subscribe: (next) => {
-		next(controller.getSnapshot());
-		let stop;
-		onMount(() => {
-			stop = controller.subscribe(() => {
-				next(controller.getSnapshot());
-			});
-			next(controller.getSnapshot());
-		});
-		return () => stop?.();
-	} }, controller.getSnapshot());
-	onCleanup(() => {
-		controller.dispose();
-	});
-	return {
-		state,
-		actions: controller.actions,
-		controller
-	};
-}
-//#endregion
-export { ClientContext as n, useContext$1 as r, bindSolidController as t };

package/dist/solid-controller-DGuv7V8a.js

@@ -1,13 +0,0 @@
-import { n as withEnv, t as blockEnv } from "./block-env-DJiUu1fq.js";
-import { r as useContext, t as bindSolidController } from "./solid-bind-iHGfGtBK.js";
-//#region src/blocks/solid-controller.ts
-/**
-* Makes a controller once and reads it through `from`. Its work starts on mount
-* (never during server rendering), and the controller is disposed with the
-* owner.
-*/
-function useBlockController(create, options, usesEnv = true) {
-	return bindSolidController(create(withEnv(options, usesEnv ? () => blockEnv(useContext().client) : void 0)));
-}
-//#endregion
-export { useBlockController as t };

package/dist/spec-CoWHDoud.js

@@ -1,119 +0,0 @@
-import { i as tableMeta, t as builderFor } from "./build-g9wTbQdp.js";
-import { n as touchedTables } from "./tables-Cb-3_VWc.js";
-//#region src/core/spec.ts
-const READ_METHODS = [
-	"findMany",
-	"findFirst",
-	"findOnly",
-	"findUnique",
-	"findById",
-	"count",
-	"aggregate",
-	"exists",
-	"paginate"
-];
-function createSpecs(meta) {
-	const specs = {};
-	for (const table of Object.keys(meta.tables)) {
-		const methods = {};
-		for (const method of READ_METHODS) methods[method] = (...args) => ({
-			v: 1,
-			table,
-			method,
-			args: trimUndefined(args)
-		});
-		specs[table] = methods;
-	}
-	return specs;
-}
-function trimUndefined(args) {
-	const out = [...args];
-	while (out.length > 0 && out.at(-1) === void 0) out.pop();
-	return out;
-}
-function isQuerySpec(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const spec = value;
-	return spec.v === 1 && typeof spec.table === "string" && READ_METHODS.includes(spec.method) && Array.isArray(spec.args);
-}
-/** The argument object of a spec's method (`findById` takes it second). */
-function specOptions(spec) {
-	const value = spec.method === "findById" ? spec.args[1] : spec.args[0];
-	return typeof value === "object" && value !== null ? value : void 0;
-}
-/**
-* App keys of every table a spec reads: its table, included relations and
-* relations used in `where`. Queries keyed by a spec go stale when any of them
-* changes. Invalid arguments yield just the spec's table; running the spec
-* reports the error.
-*/
-function specTables(meta, spec) {
-	const table = meta.tables[spec.table];
-	const args = specOptions(spec);
-	if (table && args?.["include"] === void 0 && !touchesRelations(table, args?.["where"])) return [spec.table];
-	const key = specKey(spec);
-	let byKey = tablesByMeta.get(meta);
-	if (!byKey) {
-		byKey = /* @__PURE__ */ new Map();
-		tablesByMeta.set(meta, byKey);
-	}
-	const known = key === void 0 ? void 0 : byKey.get(key);
-	if (known) return [...known];
-	let tables;
-	try {
-		tables = readTables(meta, spec);
-	} catch {
-		tables = [spec.table];
-	}
-	if (key !== void 0) {
-		if (byKey.size >= SPEC_CACHE_SIZE) byKey.clear();
-		byKey.set(key, tables);
-	}
-	return [...tables];
-}
-const SPEC_CACHE_SIZE = 500;
-const tablesByMeta = /* @__PURE__ */ new WeakMap();
-/** A text key for the spec, or `undefined` when its arguments do not serialize. */
-function specKey(spec) {
-	try {
-		return JSON.stringify([
-			spec.table,
-			spec.method,
-			spec.args
-		], (_key, value) => typeof value === "bigint" ? `${value}n` : value);
-	} catch {
-		return;
-	}
-}
-function touchesRelations(table, where) {
-	if (typeof where !== "object" || where === null) return false;
-	if (Array.isArray(where)) return where.some((item) => touchesRelations(table, item));
-	for (const [key, value] of Object.entries(where)) {
-		if (key in table.relations) return true;
-		if ((key === "AND" || key === "OR" || key === "NOT") && touchesRelations(table, value)) return true;
-	}
-	return false;
-}
-function readTables(meta, spec) {
-	const builder = builderFor(meta);
-	const table = tableMeta(meta, spec.table);
-	const args = specOptions(spec);
-	const counts = spec.method === "count" || spec.method === "exists" || spec.method === "aggregate";
-	return touchedTables({
-		kind: "select",
-		table,
-		selection: counts ? {
-			columns: [],
-			includes: []
-		} : builder.selection(table, args?.["select"], args?.["include"]),
-		where: builder.where(table, args?.["where"]),
-		orderBy: [],
-		limit: void 0,
-		offset: void 0,
-		count: void 0,
-		head: counts,
-		single: void 0
-	});
-}
-//#endregion
-export { isQuerySpec as n, specTables as r, createSpecs as t };

package/dist/spec-pins-CZ2CL8YZ.d.ts

@@ -1,120 +0,0 @@
-//#region src/core/spec-pins.d.ts
-/**
- * Versions of evolving specs and conventions the code follows. Moving a pin is
- * a minor release with a changeset (see the standards docs page).
- */
-declare const SPEC_PINS: {
-  readonly otelSemconv: "1.37.0";
-  /** OTLP/HTTP JSON that the webhooks block's `otlpLogs()` encoder writes. */
-  readonly otlp: "1.7.0";
-  readonly mcp: "2026-07-28";
-  /** The default OpenAPI version `createOpenApi` emits. */
-  readonly openapi: "3.1.2";
-  readonly openapi30: "3.0.4";
-  readonly openapi31: "3.1.2";
-  readonly openapi32: "3.2.1";
-  /** `src/oas.md` on the `v3.3-dev` branch of OAI/OpenAPI-Specification. */
-  readonly openapi33Preview: "aa2f6c0";
-  /** OAI sig-security discussion #50, as of this date. */
-  readonly securityProfiles: "sig-security#50@2026-05-05";
-  readonly overlay10: "1.0.0";
-  readonly overlay11: "1.1.0";
-  readonly overlay12: "1.2.0";
-  readonly arazzo10: "1.0.1";
-  readonly arazzo11: "1.1.0";
-  readonly asyncapi30: "3.0.0";
-  readonly asyncapi31: "3.1.0";
-  /** OpenID AuthZEN Authorization API, the vocabulary of `Authorizer`. */
-  readonly authzen: "1.0";
-  readonly cloudevents: "1.0.2";
-  readonly standardWebhooks: "1.0.0";
-  readonly sarif: "2.1.0";
-  readonly jsonSchema: "2020-12";
-  readonly postgrestAggregates: "12";
-  readonly serverTiming: "WD-20260407";
-  readonly stripeSyncEngine: "0.48.5";
-  readonly pgvector: "0.8";
-  readonly ocsf: "1.9.0";
-  readonly openfeature: "0.9.0";
-  readonly scim: "2.0";
-  readonly supabaseSdkCapabilities: "1.14.0";
-  readonly aiMessage: "1";
-  readonly aiSdkUiMessageStream: "v1";
-  readonly anthropicMemoryTool: "20250818";
-  /** RFC 5545 recurrence rules expanded by the reminders block. */
-  readonly rfc5545: "2009-09";
-  /** RFC 4180 CSV read by `parseCsv` and written by `toCsv`. */
-  readonly rfc4180: "2005-10";
-  /**
-   * ISO 4217 List One publication behind `better-supabase/commerce` minor
-   * units.
-   */
-  readonly iso4217: "2026-09-17";
-  /**
-   * RFC 6902 JSON Patch that the versions block's `createPatch` writes and
-   * `applyPatch` applies.
-   */
-  readonly rfc6902: "2013-04";
-  /**
-   * RFC 9396 `authorization_details` that delegated tokens and job envelopes
-   * carry.
-   */
-  readonly rfc9396: "2023-05";
-  /**
-   * RFC 9864 fully specified JOSE algorithms; `Ed25519` is the alg the
-   * signing-keys block can write instead of `EdDSA`.
-   */
-  readonly rfc9864: "2025-10";
-  /**
-   * RFC 8417 Security Event Tokens that the shared-signals block mints and
-   * verifies.
-   */
-  readonly rfc8417: "2018-07";
-  /**
-   * RFC 8935 push delivery of SETs: the `set` webhook format and the receiver's
-   * push endpoint.
-   */
-  readonly rfc8935: "2020-11";
-  /**
-   * RFC 8936 poll delivery of SETs that the transmitter serves and the receiver
-   * runs.
-   */
-  readonly rfc8936: "2020-11";
-  /**
-   * OpenID Shared Signals Framework: metadata, streams, status and
-   * verification.
-   */
-  readonly ssf: "1.0";
-  /** OpenID CAEP event types in `CAEP_EVENTS`. */
-  readonly caep: "1.0";
-  /** OpenID RISC event types in `RISC_EVENTS`. */
-  readonly risc: "1.0";
-  /** RFC 9068 JWT access tokens that `accessTokenResolver` verifies. */
-  readonly rfc9068: "2021-10";
-  /** RFC 7591 client registration metadata the oauth-server block stores. */
-  readonly rfc7591: "2015-07";
-  /** RFC 7636 PKCE; the oauth-server block accepts only the S256 method. */
-  readonly rfc7636: "2015-09";
-  /**
-   * RFC 8628 device authorization that the oauth-server block's device codes
-   * follow.
-   */
-  readonly rfc8628: "2019-08";
-  /**
-   * RFC 9700 OAuth security best current practice behind code reuse and
-   * redirect URI rules.
-   */
-  readonly rfc9700: "2025-01";
-  /**
-   * Draft-ietf-httpapi-ratelimit-headers revision behind `rateLimitHeader` and
-   * the Hono and oRPC `rateLimit()`.
-   */
-  readonly ratelimitHeaders: "draft-11";
-  /**
-   * The shadcn release whose registry schemas the `@better-supabase` items
-   * follow.
-   */
-  readonly shadcnRegistry: "4.21.4";
-};
-//#endregion
-export { SPEC_PINS as t };

package/dist/spec-pins-D3Tm6HJi.js

@@ -1,60 +0,0 @@
-//#region src/core/spec-pins.ts
-/**
-* Versions of evolving specs and conventions the code follows. Moving a pin is
-* a minor release with a changeset (see the standards docs page).
-*/
-const SPEC_PINS = {
-	otelSemconv: "1.37.0",
-	otlp: "1.7.0",
-	mcp: "2026-07-28",
-	openapi: "3.1.2",
-	openapi30: "3.0.4",
-	openapi31: "3.1.2",
-	openapi32: "3.2.1",
-	openapi33Preview: "aa2f6c0",
-	securityProfiles: "sig-security#50@2026-05-05",
-	overlay10: "1.0.0",
-	overlay11: "1.1.0",
-	overlay12: "1.2.0",
-	arazzo10: "1.0.1",
-	arazzo11: "1.1.0",
-	asyncapi30: "3.0.0",
-	asyncapi31: "3.1.0",
-	authzen: "1.0",
-	cloudevents: "1.0.2",
-	standardWebhooks: "1.0.0",
-	sarif: "2.1.0",
-	jsonSchema: "2020-12",
-	postgrestAggregates: "12",
-	serverTiming: "WD-20260407",
-	stripeSyncEngine: "0.48.5",
-	pgvector: "0.8",
-	ocsf: "1.9.0",
-	openfeature: "0.9.0",
-	scim: "2.0",
-	supabaseSdkCapabilities: "1.14.0",
-	aiMessage: "1",
-	aiSdkUiMessageStream: "v1",
-	anthropicMemoryTool: "20250818",
-	rfc5545: "2009-09",
-	rfc4180: "2005-10",
-	iso4217: "2026-09-17",
-	rfc6902: "2013-04",
-	rfc9396: "2023-05",
-	rfc9864: "2025-10",
-	rfc8417: "2018-07",
-	rfc8935: "2020-11",
-	rfc8936: "2020-11",
-	ssf: "1.0",
-	caep: "1.0",
-	risc: "1.0",
-	rfc9068: "2021-10",
-	rfc7591: "2015-07",
-	rfc7636: "2015-09",
-	rfc8628: "2019-08",
-	rfc9700: "2025-01",
-	ratelimitHeaders: "draft-11",
-	shadcnRegistry: "4.21.4"
-};
-//#endregion
-export { SPEC_PINS as t };