better-supabase 0.5.0 → 0.6.0

package/dist/cloud-event-C1JCc1bH.d.ts

@@ -0,0 +1,50 @@
+/// <reference lib="esnext.temporal" />
+import { S as BlockEvent, T as BlockEventPattern, a as EventHub } from "./events-DWDhx77e.js";
+//#region src/events/cloud-event.d.ts
+/** A CloudEvents 1.0 event. Extension attributes are lowercase alphanumerics. */
+interface CloudEvent<T = unknown> {
+  readonly specversion: "1.0";
+  readonly id: string;
+  readonly source: string;
+  readonly type: string;
+  readonly subject?: string;
+  readonly time?: string;
+  readonly datacontenttype?: string;
+  readonly dataschema?: string;
+  readonly data?: T;
+  readonly [extension: string]: unknown;
+}
+interface CloudEventOptions {
+  /** URI-reference of the producer, e.g. `https://crm.example.com` or `/crm`. */
+  readonly source: string;
+  /** Replaces the `dev.better-supabase` type prefix. */
+  readonly typePrefix?: string;
+  readonly id?: () => string;
+  readonly now?: () => Temporal.Instant;
+}
+/** Sends events somewhere: a queue, a bus, an outbox table, an HTTP endpoint. */
+interface EventSink {
+  send(events: readonly CloudEvent[]): void | Promise<void>;
+}
+/**
+ * A block event as a CloudEvent: `dev.better-supabase.support.started` with
+ * the event data and the actor (`actorId`) as `data` and the tenant as
+ * `partitionkey`.
+ */
+declare function blockCloudEvent(event: BlockEvent, options: CloudEventOptions): CloudEvent;
+interface ForwardBlockOptions extends CloudEventOptions {
+  /** Only forward events that match, e.g. `support.*`. Defaults to all. */
+  readonly types?: readonly BlockEventPattern[];
+  /** Sink failures never fail the block call. Defaults to the `Logger`. */
+  readonly onError?: (error: unknown, events: readonly CloudEvent[]) => void;
+}
+/**
+ * Sends a CloudEvent for every block event (`support.*`, `organization.*`, ...) to
+ * `sink`. Returns a function that stops forwarding. Like
+ * `forwardMutations`, sends are tracked on `betterSupabase.events`.
+ */
+declare function forwardBlockEvents(betterSupabase: {
+  readonly events: EventHub;
+}, sink: EventSink, options: ForwardBlockOptions): () => void;
+//#endregion
+export { blockCloudEvent as a, ForwardBlockOptions as i, CloudEventOptions as n, forwardBlockEvents as o, EventSink as r, CloudEvent as t };

package/dist/{compiler-BXH_aZ7N.d.ts → compiler-DY_wkj4R.d.ts}

@@ -1,5 +1,5 @@
-import { U as Operation } from "./executor-BunPOO-k.js";
-import { i as PostgrestPlan } from "./postgrest-CruYKAvV.js";
+import { v as Operation } from "./executor-DvsBbNBS.js";
+import { a as PostgrestPlan } from "./postgrest-BLVdEnfe.js";
 //#region src/core/compiler.d.ts
 /**
  * Turns an IR operation into something a backend runs. An `Executor` for a

package/dist/compose-BIBNgAnq.js

@@ -0,0 +1,53 @@
+import { n as dbError } from "./errors-B11Duf73.js";
+import { t as AsyncResult } from "./result-DzUbqgdW.js";
+import { n as credentialRefInTenant, t as credentialProviderOf } from "./provider-Di3sRutW.js";
+//#region src/credentials/compose.ts
+const NO_CAPABILITIES = {
+	userSubjects: false,
+	authorization: false,
+	revoke: false,
+	inbound: false
+};
+const unsupported = (provider, what) => dbError("unsupported", `The credential provider "${provider}" ${what}`, { hint: "CREDENTIAL_UNSUPPORTED" });
+/**
+* One provider over several: each call goes to the provider whose `name`
+* is the ref's `provider`. A ref no provider handles fails with
+* `invalid_input` (`CREDENTIAL_PROVIDER_UNKNOWN`), and an optional method
+* the chosen provider lacks with `unsupported`.
+*/
+function credentialRouter(providers, options = {}) {
+	const byName = /* @__PURE__ */ new Map();
+	for (const provider of providers) {
+		if (byName.has(provider.name)) throw new TypeError(`credentialRouter got two providers named "${provider.name}"`);
+		byName.set(provider.name, credentialProviderOf(provider));
+	}
+	const unknown = (ref) => dbError("invalid_input", `No credential provider named "${ref.provider}" is configured`, { hint: "CREDENTIAL_PROVIDER_UNKNOWN" });
+	const route = (ref, then) => {
+		const provider = byName.get(ref.provider);
+		return provider === void 0 ? AsyncResult.err(unknown(ref)) : then(provider);
+	};
+	return {
+		apiVersion: 1,
+		name: options.name ?? "router",
+		getToken: (ref, tokenOptions) => route(ref, (provider) => provider.getToken(ref, tokenOptions)),
+		capabilities: (ref) => byName.get(ref.provider)?.capabilities(ref) ?? NO_CAPABILITIES,
+		startAuthorization: (ref, startOptions) => route(ref, (provider) => provider.startAuthorization === void 0 ? AsyncResult.err(unsupported(provider.name, "doesn't authorize accounts")) : provider.startAuthorization(ref, startOptions)),
+		completeAuthorization: (ref, completeOptions) => route(ref, (provider) => provider.completeAuthorization === void 0 ? AsyncResult.err(unsupported(provider.name, "doesn't authorize accounts")) : provider.completeAuthorization(ref, completeOptions)),
+		revoke: (ref, revokeOptions) => route(ref, (provider) => provider.revoke(ref, revokeOptions)),
+		verifyInbound: (request, ref) => route(ref, (provider) => provider.verifyInbound === void 0 ? AsyncResult.err(unsupported(provider.name, "doesn't verify inbound requests")) : provider.verifyInbound(request, ref)),
+		set: (ref, value, setOptions) => route(ref, (provider) => provider.set === void 0 ? AsyncResult.err(unsupported(provider.name, "can't store secrets")) : provider.set(ref, value, setOptions))
+	};
+}
+/**
+* Revokes the credential a ref names when a provider is configured and can
+* revoke it. Resolves `false` without a provider, for a provider without
+* revocation, or for a ref outside `options.tenant`.
+*/
+function revokeIfConfigured(provider, ref, options) {
+	if (provider === void 0) return AsyncResult.ok(false);
+	if ("tenant" in options && !credentialRefInTenant(ref, options.tenant)) return AsyncResult.ok(false);
+	if (!provider.capabilities(ref).revoke) return AsyncResult.ok(false);
+	return provider.revoke(ref, { subject: options.subject });
+}
+//#endregion
+export { revokeIfConfigured as n, credentialRouter as t };

package/dist/composite-Bt1YK3Ke.d.ts

@@ -0,0 +1,146 @@
+import { a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
+import { a as EventHub } from "./events-DWDhx77e.js";
+import { i as CookieScope, s as SessionEncoding } from "./session-ChiXDZdZ.js";
+import { r as AuthState, t as AuthResolution } from "./resolve-KW8nCeL6.js";
+import { b as Db, t as BetterSupabase } from "./define-CJJkkr1-.js";
+import { b as ActiveSupport, g as ReplicaState, i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer } from "./server-CeVeeXwz.js";
+import { d as RefreshPolicy, r as GuardOptions } from "./respond-DoBijysA.js";
+import { SupabaseClient } from "@supabase/supabase-js";
+import { Entry, SingleKeyEntry } from "@supabase/middleware";
+import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
+//#region src/server/entries/core.d.ts
+/**
+ * What the entries need from a `createServer` server: its resolver, its
+ * request-scoped context builder and the settings behind them. The server
+ * registers it once; entries read it with `serverCore(server)`.
+ */
+interface ServerCore<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
+  readonly events: EventHub;
+  /** How long reads stay on the primary after a write. */
+  readonly pinMs: number;
+  resolve(request: Request, options: {
+    readonly refresh?: boolean;
+    readonly cookies?: boolean;
+    readonly encode?: SessionEncoding;
+    readonly checkSession?: boolean;
+  }): Promise<AuthResolution<C, P>>;
+  /** The session cookie's name (`auth.cookie.name`, else `sb-<ref>-auth-token`). */
+  sessionCookie(): string;
+  /** `ServerOptions.tenant`, or `undefined` without one. */
+  tenant(request: Request, auth: AuthState<C, P>): string | undefined | PromiseLike<string | undefined>;
+  support(request: Request, auth: AuthState<C, P>): Promise<ActiveSupport | undefined>;
+  context(resolution: AuthResolution<C, P>, request: Request, options: ContextOptions, tenant: string | undefined): ServerContext<M, F, E, C, P>;
+}
+/** The core of a server built by `createServer` or one of the adapter factories. */
+declare function serverCore<M extends AnyModels, F extends AnyFunctions, E, C, P>(server: {
+  readonly events: EventHub;
+  context(request: Request): Promise<ServerContext<M, F, E, C, P>>;
+}): ServerCore<M, F, E, C, P>;
+//#endregion
+//#region src/server/entries/guard.d.ts
+interface GuardEntryConfig extends GuardOptions {
+  /** Include error messages in problem responses. Defaults to `NODE_ENV === 'development'`. */
+  readonly expose?: boolean;
+}
+/**
+ * Entry that answers callers `allow`, `aal` or `scopes` refuse with a 401 or
+ * 403 Problem Details response, before the handler runs. It contributes
+ * `ctx.guard`, the options the caller passed.
+ */
+declare function withGuard<C, P>(config?: GuardEntryConfig): SingleKeyEntry<"guard", {
+  readonly auth: AuthState<C, P>;
+}, GuardOptions>;
+//#endregion
+//#region src/server/entries/session.d.ts
+interface SessionEntryConfig {
+  /**
+   * Refresh an expired cookie session and send the new cookies on the
+   * response. Only where cookies can be written once per request (a proxy, a
+   * framework middleware); never in Server Components. `'navigation'`
+   * refreshes page loads, navigations and form posts (`shouldRefresh`), so
+   * parallel `fetch` calls never race on the refresh token. Defaults to false.
+   */
+  readonly refresh?: RefreshPolicy;
+  /**
+   * Ask the Auth server whether the session still exists, so a session
+   * ended elsewhere (sign-out on another device, an admin revoke) is anon
+   * here too. One Auth call per matching request: `true` checks every
+   * request, `'navigation'` full page loads (`shouldCheckSession`). Off by
+   * default, because a valid token otherwise never calls the Auth server.
+   */
+  readonly checkSession?: boolean | "navigation" | ((request: Request) => boolean);
+  /** Read the session cookie. Defaults to true; `false` resolves bearer tokens only. */
+  readonly cookies?: boolean;
+  /**
+   * Keeps the invocation alive for event sink sends the handler started:
+   * `EdgeRuntime.waitUntil`, the Workers `ctx.waitUntil` or Next's `after`.
+   */
+  readonly waitUntil?: (promise: Promise<unknown>) => void;
+  /**
+   * The shape refreshed sessions are written in, `cookies.encode` in
+   * `@supabase/ssr`. Use the browser client's value. Defaults to the
+   * server's `auth.cookie.encode`, then `user-and-tokens`.
+   */
+  readonly encode?: SessionEncoding;
+  /**
+   * Cookie scopes (`domain`, `path`) earlier deploys wrote the session at.
+   * Each response to a request that carries the session cookie expires it
+   * at these scopes, like `clearAuthCookiesAtScopes` in `@supabase/ssr`, so
+   * moving the cookie to a new domain or path is one config change. Never
+   * list the current scope: that clears the live session.
+   */
+  readonly cookieScopes?: readonly CookieScope[];
+}
+/**
+ * Entry contributing `ctx.session`, the request's `AuthResolution`: a bearer
+ * token first, the session cookie second. It is the only entry with a
+ * response seam for cookies: on the way out it adds the refreshed session
+ * cookies and the no-store headers, and hands pending event sends to
+ * `waitUntil`.
+ */
+declare function withSession<M extends AnyModels, F extends AnyFunctions, E, C, P>(core: ServerCore<M, F, E, C, P>, config?: SessionEntryConfig): SingleKeyEntry<"session", Record<never, never>, AuthResolution<C, P>>;
+//#endregion
+//#region src/server/composite.d.ts
+/** What `withBetterSupabase` takes besides the definition or server. */
+interface BetterSupabaseConfig extends SessionEntryConfig, GuardEntryConfig {}
+/** The keys `withBetterSupabase` puts on `ctx`. */
+interface BetterSupabaseContributions<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
+  /** The full request context: `auth`, `supabase`, `stats()`, `apply()` and the rest. */
+  bs: ServerContext<M, F, E, C, P>;
+  /** The verified token's payload, or `null`; the key `withSupabase` uses. */
+  jwtClaims: (JWTClaims & C) | null;
+  userClaims: UserClaims | null;
+  authMode: AuthMode;
+  /** Repositories over PostgREST as the caller. */
+  db: Db<M, F, E, SupabaseClient>;
+  /** Repositories over direct Postgres as the caller, when Postgres is configured or upstream. */
+  sql: Db<M, F, E, undefined> | undefined;
+  tenant: string | undefined;
+  support: ActiveSupport | undefined;
+  replica: ReplicaState | undefined;
+}
+/** The entry `withBetterSupabase` returns, for `pipeline` and the framework bridges. */
+type BetterSupabaseEntry<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> = Entry<BetterSupabaseContributions<M, F, E, C, P>>;
+/**
+ * The whole better-supabase server as one `@supabase/middleware` entry: it
+ * verifies the caller (bearer token or session cookie), refuses callers the
+ * guard rejects with Problem Details, and contributes `ctx.db`, `ctx.sql`,
+ * `ctx.bs` and the `withSupabase` keys (`jwtClaims`, `userClaims`,
+ * `authMode`), so `withPostgresClient` and `withOpenFeature` compose after
+ * it. Refreshed cookies and `bs-primary-until` go out on the response.
+ *
+ * ```ts
+ * export default {
+ *   fetch: pipeline([withBetterSupabase(betterSupabase)], async (req, ctx) =>
+ *     Response.json(await ctx.db.notes.findMany().orThrow())),
+ * }
+ * ```
+ *
+ * Pass a server from `createServer` to share its clients and JWKS cache
+ * with the rest of the app; pass the definition to build one with
+ * `config`'s server options.
+ */
+declare function withBetterSupabase<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, config?: BetterSupabaseConfig & ServerOptions): BetterSupabaseEntry<M, F, E, C, P>;
+declare function withBetterSupabase<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown>(server: BetterServer<M, F, E, C, P>, config?: BetterSupabaseConfig): BetterSupabaseEntry<M, F, E, C, P>;
+//#endregion
+export { SessionEntryConfig as a, withGuard as c, withBetterSupabase as i, ServerCore as l, BetterSupabaseContributions as n, withSession as o, BetterSupabaseEntry as r, GuardEntryConfig as s, BetterSupabaseConfig as t, serverCore as u };

package/dist/composite-DhE66P5u.js

@@ -0,0 +1,130 @@
+import { a as problemResponse } from "./problem-BreOl8b8.js";
+import { C as serverCore, S as withServerContext, _ as withSession, g as withSupport, h as withTenant, s as createServer } from "./adapter-Bc1o3zyy.js";
+import { s as withPrimaryPin } from "./replicas-CwrYp5Zj.js";
+import { r as guard, t as defaultExpose } from "./respond-BUgsXNgk.js";
+import { a as withAuthMode, i as withAuth, o as withJwtClaims, s as withUserClaims } from "./claims-DDBQT6BK.js";
+import { defineComposite, defineMiddleware } from "@supabase/middleware";
+//#region src/server/entries/db.ts
+/**
+* Entry contributing `ctx.db`: repositories over PostgREST as the caller
+* (RLS applies), from `ctx.bs`. Reads go to the read replica when one is
+* configured.
+*/
+function withDb() {
+	return defineMiddleware({
+		key: "db",
+		run: () => (_request, ctx) => Promise.resolve({ db: ctx.bs.db })
+	})();
+}
+//#endregion
+//#region src/server/entries/guard.ts
+/**
+* Entry that answers callers `allow`, `aal` or `scopes` refuse with a 401 or
+* 403 Problem Details response, before the handler runs. It contributes
+* `ctx.guard`, the options the caller passed.
+*/
+function withGuard(config = {}) {
+	const { expose = defaultExpose(), ...options } = config;
+	return defineMiddleware({
+		key: "guard",
+		run: () => (request, ctx) => {
+			const denied = guard(ctx.auth, options.allow, options.aal, options.scopes);
+			return Promise.resolve(denied ? problemResponse(denied, {
+				instance: new URL(request.url).pathname,
+				expose
+			}) : { guard: options });
+		}
+	})();
+}
+//#endregion
+//#region src/server/entries/replica.ts
+/**
+* Entry contributing `ctx.replica`, where `ctx.db` reads go when a read URL
+* is configured (`undefined` without one). On the way out it sets the
+* `bs-primary-until` cookie after a write, so the caller's next reads see it.
+*/
+function withReplica(core) {
+	return defineMiddleware({
+		key: "replica",
+		run: () => async function* (_request, ctx) {
+			const { replica } = ctx.bs;
+			const response = yield { replica };
+			return withPrimaryPin(response, ctx.bs.replica, core.pinMs);
+		}
+	})();
+}
+//#endregion
+//#region src/server/entries/sql.ts
+/**
+* Entry contributing `ctx.sql`: repositories over direct Postgres as the
+* caller, with RLS, from `createServer`'s `postgres`, else `undefined`.
+* `withPostgresClient` reads `jwtClaims`, so it runs after this entry and
+* can't back `ctx.sql`; importing the SQL compiler here would also ship it
+* to every app without Postgres.
+*/
+function withSql() {
+	return defineMiddleware({
+		key: "sql",
+		run: () => (_request, ctx) => Promise.resolve({ sql: ctx.bs.sql })
+	})();
+}
+//#endregion
+//#region src/server/composite.ts
+/**
+* The single-key entries `withBetterSupabase` bundles, outermost first. The
+* framework factories run these directly, so their terminal sees `auth`.
+*/
+function betterSupabaseParts(core, config = {}) {
+	const { refresh, cookies, waitUntil, encode, cookieScopes, checkSession, ...guardConfig } = config;
+	return [
+		withSession(core, {
+			...refresh === void 0 ? {} : { refresh },
+			...cookies === void 0 ? {} : { cookies },
+			...waitUntil === void 0 ? {} : { waitUntil },
+			...encode === void 0 ? {} : { encode },
+			...cookieScopes === void 0 ? {} : { cookieScopes },
+			...checkSession === void 0 ? {} : { checkSession }
+		}),
+		withTenant(core),
+		withSupport(core),
+		withServerContext(core),
+		withAuth(),
+		withGuard(guardConfig),
+		withJwtClaims(),
+		withUserClaims(),
+		withAuthMode(),
+		withDb(),
+		withSql(),
+		withReplica(core)
+	];
+}
+function isDefinition(source) {
+	return "connect" in source && typeof source.connect === "function";
+}
+function withBetterSupabase(source, config = {}) {
+	const server = isDefinition(source) ? createServer(source, config) : source;
+	const core = serverCore(server);
+	const { refresh, cookies, waitUntil, encode, cookieScopes, checkSession, allow, aal, scopes, expose } = config;
+	const parts = betterSupabaseParts(core, {
+		...refresh === void 0 ? {} : { refresh },
+		...cookies === void 0 ? {} : { cookies },
+		...waitUntil === void 0 ? {} : { waitUntil },
+		...encode === void 0 ? {} : { encode },
+		...cookieScopes === void 0 ? {} : { cookieScopes },
+		...checkSession === void 0 ? {} : { checkSession },
+		...allow === void 0 ? {} : { allow },
+		...aal === void 0 ? {} : { aal },
+		...scopes === void 0 ? {} : { scopes },
+		...expose === void 0 ? {} : { expose }
+	});
+	return defineComposite({
+		build: () => parts,
+		internal: [
+			"session",
+			"auth",
+			"guard"
+		]
+	})();
+}
+//#endregion
+export { withGuard as n, withBetterSupabase as t };

package/dist/config/index.d.ts

@@ -1,4 +1,6 @@
-import { o as Casing } from "../types-Dnf_wRDz.js";
-import { $ as GeneratorMetadata, A as VectorSearchConfig, B as CatalogFunction, C as SoftDeleteConfig, D as TenantConfig, E as TableConfig, F as CatalogCheck, G as CatalogTable, H as CatalogGrant, I as CatalogColumn, J as ExtrasFunction, K as CatalogTrigger, L as CatalogColumnGrant, M as resolveConfig, N as resolveJsonSchema, O as TimestampsConfig, P as Catalog, Q as ForeignKeyAction, R as CatalogEnum, S as SeedConfig, T as SqlConfig, U as CatalogIndex, V as CatalogFunctionArg, W as CatalogPolicy, X as ExtrasHookFunction, Y as ExtrasHook, Z as ExtrasTable, _ as PluginFlagsConfig, a as ClaimsConfig, at as DEFAULT_ACTIVE_TENANT, b as ResolvedConfig, c as EntitlementsConfig, ct as KitsConfig, d as Generator, et as Snapshot, f as GeneratorInput, g as PermdockPathsConfig, h as OpenApiConfig, i as CONFIG_SCHEMA_URL, it as ActiveTenantSource, j as defineConfig, k as VectorDistance, l as ExposeConfig, m as JsonTypeConfig, n as BetterSupabaseConfig, nt as SnapshotExtras, o as CodecsConfig, ot as KitMode, p as JsonSchemaSource, q as CatalogUnique, r as BucketConfig, rt as AccessKitConfig, s as DoctorConfig, st as KitModuleConfig, t as ActorConfig, tt as SnapshotBucket, u as GeneratedFile, v as Privilege, w as SourceConfig, x as ResolvedExpose, y as RealtimeConfig, z as CatalogForeignKey } from "../config-T_ejwyd3.js";
-import { a as JsonSchemaGeneratorOptions, c as DEFAULT_CLAIMS, i as valibot, l as tenantClaimPaths, n as zod, o as buildJsonSchema, r as ValibotGeneratorOptions, s as jsonSchema, t as ZodGeneratorOptions } from "../index-Dxn2a5cw.js";
-export { type AccessKitConfig, type ActiveTenantSource, type ActorConfig, type BetterSupabaseConfig, type BucketConfig, CONFIG_SCHEMA_URL, type Casing, type Catalog, type CatalogCheck, type CatalogColumn, type CatalogColumnGrant, type CatalogEnum, type CatalogForeignKey, type CatalogFunction, type CatalogFunctionArg, type CatalogGrant, type CatalogIndex, type CatalogPolicy, type CatalogTable, type CatalogTrigger, type CatalogUnique, type ClaimsConfig, type CodecsConfig, DEFAULT_ACTIVE_TENANT, DEFAULT_CLAIMS, type DoctorConfig, type EntitlementsConfig, type ExposeConfig, type ExtrasFunction, type ExtrasHook, type ExtrasHookFunction, type ExtrasTable, type ForeignKeyAction, type GeneratedFile, type Generator, type GeneratorInput, type GeneratorMetadata, type JsonSchemaGeneratorOptions, type JsonSchemaSource, type JsonTypeConfig, type KitMode, type KitModuleConfig, type KitsConfig, type OpenApiConfig, type PermdockPathsConfig, type PluginFlagsConfig, type Privilege, type RealtimeConfig, type ResolvedConfig, type ResolvedExpose, type SeedConfig, type Snapshot, type SnapshotBucket, type SnapshotExtras, type SoftDeleteConfig, type SourceConfig, type SqlConfig, type TableConfig, type TenantConfig, type TimestampsConfig, type ValibotGeneratorOptions, type VectorDistance, type VectorSearchConfig, type ZodGeneratorOptions, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, tenantClaimPaths, valibot, zod };
+import { c as Casing } from "../types-6BdhkmZe.js";
+import { a as ModuleConfig, i as DisabledRow, n as ActiveTenantSource, o as ModuleMode, r as DEFAULT_ACTIVE_TENANT, s as ModulesConfig, t as AccessModuleConfig } from "../modules-DpPwzC7E.js";
+import { a as AuthorizationRequirement, c as AuthorizationTokenHook, i as AuthorizationProvider, l as providerApiProblem, n as AuthorizationMembership, o as AuthorizationRoleSource, r as AuthorizationPermission, s as AuthorizationScope, t as AuthorizationFunctions } from "../authorization-BFCqamMs.js";
+import { $ as CatalogTable, A as SeedConfig, B as resolveConfig, C as PluginFlagsConfig, D as ResolvedConfig, E as RelationsConfig, F as TenantConfig, G as CatalogColumnGrant, H as Catalog, I as TimestampsConfig, J as CatalogFunction, K as CatalogEnum, L as VectorDistance, M as SourceConfig, N as SqlConfig, O as ResolvedExpose, P as TableConfig, Q as CatalogPolicy, R as VectorSearchConfig, S as OpenApiConfig, T as RealtimeConfig, U as CatalogCheck, V as resolveJsonSchema, W as CatalogColumn, X as CatalogGrant, Y as CatalogFunctionArg, Z as CatalogIndex, _ as GeneratorInput, a as ClaimsConfig, at as ExtrasTable, b as JsonSchemaSource, c as DoctorConfig, ct as SnapshotBucket, d as ExposeConfig, dt as PostgresColumn, et as CatalogTrigger, f as ExposePrivilege, ft as PostgresFunction, g as GeneratorColumn, h as Generator, i as CONFIG_SCHEMA_URL, it as ExtrasHookFunction, j as SoftDeleteConfig, k as ResolvedSqlConfig, l as EntitlementPlansSource, lt as SnapshotExtras, m as GeneratedFile, n as BetterSupabaseConfig, nt as ExtrasFunction, o as CodecsConfig, ot as ForeignKeyAction, p as ExposeRole, pt as PostgresFunctionArg, q as CatalogForeignKey, r as BucketConfig, rt as ExtrasHook, s as ColumnPrivilege, st as Snapshot, t as ActorConfig, tt as CatalogUnique, u as EntitlementsConfig, ut as GeneratorMetadata, v as GeneratorModel, w as Privilege, x as JsonTypeConfig, y as GeneratorTable, z as defineConfig } from "../config-D44Y7PAv.js";
+import { a as JsonSchemaGeneratorOptions, c as ClaimPaths, d as tenantClaimPaths, i as valibot, l as DEFAULT_CLAIMS, n as zod, o as buildJsonSchema, r as ValibotGeneratorOptions, s as jsonSchema, t as ZodGeneratorOptions, u as claimPaths } from "../index-DQh4VCc9.js";
+export { type AccessModuleConfig, type ActiveTenantSource, type ActorConfig, type AuthorizationFunctions, type AuthorizationMembership, type AuthorizationPermission, type AuthorizationProvider, type AuthorizationRequirement, type AuthorizationRoleSource, type AuthorizationScope, type AuthorizationTokenHook, type BetterSupabaseConfig, type BucketConfig, CONFIG_SCHEMA_URL, type Casing, type Catalog, type CatalogCheck, type CatalogColumn, type CatalogColumnGrant, type CatalogEnum, type CatalogForeignKey, type CatalogFunction, type CatalogFunctionArg, type CatalogGrant, type CatalogIndex, type CatalogPolicy, type CatalogTable, type CatalogTrigger, type CatalogUnique, type ClaimPaths, type ClaimsConfig, type CodecsConfig, type ColumnPrivilege, DEFAULT_ACTIVE_TENANT, DEFAULT_CLAIMS, type DisabledRow, type DoctorConfig, type EntitlementPlansSource, type EntitlementsConfig, type ExposeConfig, type ExposePrivilege, type ExposeRole, type ExtrasFunction, type ExtrasHook, type ExtrasHookFunction, type ExtrasTable, type ForeignKeyAction, type GeneratedFile, type Generator, type GeneratorColumn, type GeneratorInput, type GeneratorMetadata, type GeneratorModel, type GeneratorTable, type JsonSchemaGeneratorOptions, type JsonSchemaSource, type JsonTypeConfig, type ModuleConfig, type ModuleMode, type ModulesConfig, type OpenApiConfig, type PluginFlagsConfig, type PostgresColumn, type PostgresFunction, type PostgresFunctionArg, type Privilege, type RealtimeConfig, type RelationsConfig, type ResolvedConfig, type ResolvedExpose, type ResolvedSqlConfig, type SeedConfig, type Snapshot, type SnapshotBucket, type SnapshotExtras, type SoftDeleteConfig, type SourceConfig, type SqlConfig, type TableConfig, type TenantConfig, type TimestampsConfig, type ValibotGeneratorOptions, type VectorDistance, type VectorSearchConfig, type ZodGeneratorOptions, buildJsonSchema, claimPaths, defineConfig, jsonSchema, providerApiProblem, resolveConfig, resolveJsonSchema, tenantClaimPaths, valibot, zod };

package/dist/config/index.js

@@ -1,5 +1,5 @@
-import { i as tenantClaimPaths, t as DEFAULT_CLAIMS } from "../claims-BAf6c7is.js";
-import { a as resolveConfig, i as defineConfig, o as resolveJsonSchema, r as CONFIG_SCHEMA_URL, t as DEFAULT_ACTIVE_TENANT } from "../kits-CGLLrNPd.js";
-import { n as jsonSchema, t as buildJsonSchema } from "../json-schema-m1fiwKgN.js";
-import { n as valibot, t as zod } from "../config-DreERlKo.js";
-export { CONFIG_SCHEMA_URL, DEFAULT_ACTIVE_TENANT, DEFAULT_CLAIMS, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, tenantClaimPaths, valibot, zod };
+import { a as tenantClaimPaths, r as claimPaths, t as DEFAULT_CLAIMS } from "../claims-PqzCxaTD.js";
+import { a as resolveConfig, i as defineConfig, o as resolveJsonSchema, r as CONFIG_SCHEMA_URL, s as providerApiProblem, t as DEFAULT_ACTIVE_TENANT } from "../modules-dxrVK3ID.js";
+import { n as jsonSchema, t as buildJsonSchema } from "../json-schema-CvER4kgT.js";
+import { n as valibot, t as zod } from "../config-Dn7F5k9A.js";
+export { CONFIG_SCHEMA_URL, DEFAULT_ACTIVE_TENANT, DEFAULT_CLAIMS, buildJsonSchema, claimPaths, defineConfig, jsonSchema, providerApiProblem, resolveConfig, resolveJsonSchema, tenantClaimPaths, valibot, zod };