better-supabase 0.6.0 → 0.6.1

package/dist/{adapter-Bc1o3zyy.js → adapter-CHnPkCPd.js}

@@ -426,6 +426,57 @@ function withTenant(core) {
 	})();
 }
 //#endregion
+//#region src/server/request-ids.ts
+const REQUEST_ID_PATTERN = /^[A-Za-z0-9._:;,@/+=-]{1,128}$/;
+function requestIdOrUndefined(value) {
+	return typeof value === "string" && REQUEST_ID_PATTERN.test(value) ? value : void 0;
+}
+function sessionWith(ids, tenant, readOnly = false) {
+	const settings = {
+		...ids.requestId === void 0 ? {} : { "better_supabase.request_id": ids.requestId },
+		...ids.correlationId === void 0 ? {} : { "better_supabase.correlation_id": ids.correlationId },
+		...tenant === void 0 ? {} : { "better_supabase.tenant": tenant }
+	};
+	const hasSettings = Object.keys(settings).length > 0;
+	if (!hasSettings && !readOnly) return void 0;
+	return {
+		...readOnly ? { readOnly: true } : {},
+		...hasSettings ? { settings } : {}
+	};
+}
+function requestIdPolicy(options = {}) {
+	const on = options !== false;
+	const settings = on ? options : {};
+	const requestHeader = (settings.requestHeader ?? "x-request-id").toLowerCase();
+	const correlationHeader = (settings.correlationHeader ?? "x-correlation-id").toLowerCase();
+	const incoming = on && (settings.incoming ?? true);
+	const generate = on && (settings.generate ?? true);
+	const generated = /* @__PURE__ */ new WeakMap();
+	const fromHeader = (request, name) => incoming && request ? requestIdOrUndefined(request.headers.get(name)) : void 0;
+	const generatedFor = (request) => {
+		if (!generate || !request) return void 0;
+		const known = generated.get(request);
+		if (known !== void 0) return known;
+		const id = crypto.randomUUID();
+		generated.set(request, id);
+		return id;
+	};
+	return {
+		forRequest(request, explicit) {
+			const requestId = requestIdOrUndefined(explicit.requestId) ?? fromHeader(request, requestHeader) ?? generatedFor(request);
+			const correlationId = requestIdOrUndefined(explicit.correlationId) ?? fromHeader(request, correlationHeader) ?? requestId;
+			return {
+				...requestId === void 0 ? {} : { requestId },
+				...correlationId === void 0 ? {} : { correlationId }
+			};
+		},
+		headers: (ids) => ({
+			...ids.requestId === void 0 ? {} : { [requestHeader]: ids.requestId },
+			...ids.correlationId === void 0 ? {} : { [correlationHeader]: ids.correlationId }
+		})
+	};
+}
+//#endregion
 //#region src/auth/support-cookie.ts
 /** The cookie that carries the support session id. */
 const SUPPORT_COOKIE = "bs-support";
@@ -674,6 +725,7 @@ function createServer(betterSupabase, options = {}) {
 		return tenant;
 	};
 	const pinMs = options.replicas?.pinMs ?? 5e3;
+	const idPolicy = requestIdPolicy(options.requestIds);
 	if (options.support && !options.postgres) throw new TypeError("Support sessions need createServer(betterSupabase, { postgres: createPostgres(), support })");
 	const audit = serverAudit(betterSupabase, options.audit);
 	const support = options.support ? options.support.create(betterSupabase.events, options.auth?.claims ?? betterSupabase.claimsSchema) : supportOff;
@@ -682,7 +734,7 @@ function createServer(betterSupabase, options = {}) {
 	* Postgres with the target's claims plus `act`, read-only unless the
 	* session allows writes; nothing reaches Supabase with the admin's token.
 	*/
-	const supportContextFor = (resolution, active, parent, tenant) => {
+	const supportContextFor = (resolution, active, parent, tenant, ids) => {
 		const { session, claims } = active;
 		const record = (key) => {
 			const value = claims[key];
@@ -711,10 +763,7 @@ function createServer(betterSupabase, options = {}) {
 			...base,
 			tenant: scope
 		};
-		const sessionOptions = {
-			...session.readOnly ? { readOnly: true } : {},
-			...scope === void 0 ? {} : { settings: { "better_supabase.tenant": scope } }
-		};
+		const sessionOptions = sessionWith(ids, scope, session.readOnly);
 		const recorder = new StatsRecorder(parent);
 		const sqlClaims = claims;
 		const unavailable = () => {
@@ -724,6 +773,7 @@ function createServer(betterSupabase, options = {}) {
 		let sql;
 		return {
 			...credentials,
+			...ids,
 			auth,
 			resolution,
 			support: active,
@@ -753,19 +803,20 @@ function createServer(betterSupabase, options = {}) {
 	* `ctx.sql` run over direct Postgres with the key's synthesized claims,
 	* scoped to its organization unless the tenant option names another.
 	*/
-	const apiKeyContextFor = (resolution, auth, parent, tenant) => {
+	const apiKeyContextFor = (resolution, auth, parent, tenant, ids) => {
 		const scope = tenant ?? auth.organizationId;
 		const base = authContext(auth);
 		const context = scope === void 0 ? base : {
 			...base,
 			tenant: scope
 		};
-		const session = scope === void 0 ? void 0 : { settings: { "better_supabase.tenant": scope } };
+		const session = sessionWith(ids, scope);
 		const recorder = new StatsRecorder(parent);
 		let db;
 		let sql;
 		return {
 			...credentials,
+			...ids,
 			auth: resolution.auth,
 			resolution,
 			get supabase() {
@@ -790,25 +841,30 @@ function createServer(betterSupabase, options = {}) {
 		};
 	};
 	/** Clients and repositories are built on first access: most scopes use one of them. */
-	const contextFor = (resolution, requestHeaders, parent, until = 0, tenant, active) => {
-		if (active) return supportContextFor(resolution, active, parent, tenant);
+	const contextFor = (resolution, requestHeaders, parent, until = 0, tenant, active, ids = {}) => {
+		if (active) return supportContextFor(resolution, active, parent, tenant, ids);
 		const { auth } = resolution;
-		if (auth.kind === "apiKey") return apiKeyContextFor(resolution, auth, parent, tenant);
+		if (auth.kind === "apiKey") return apiKeyContextFor(resolution, auth, parent, tenant, ids);
 		const context = tenant === void 0 ? authContext(auth) : {
 			...authContext(auth),
 			tenant
 		};
-		const headers = tenant === void 0 ? requestHeaders : {
+		const clientHeaders = tenant === void 0 ? requestHeaders : {
 			...requestHeaders,
 			[TENANT_HEADER]: tenant
 		};
-		const session = tenant === void 0 ? void 0 : { settings: { "better_supabase.tenant": tenant } };
+		const headers = {
+			...idPolicy.headers(ids),
+			...clientHeaders
+		};
+		const sharesClient = auth.kind !== "user";
+		const session = sessionWith(ids, tenant);
 		const recorder = new StatsRecorder(parent);
 		let supabase;
 		let db;
 		let sql;
 		const sqlClaims = auth.kind === "user" ? auth.claims : auth.kind === "anon" ? { role: "anon" } : void 0;
-		const client = () => supabase ??= supabaseFor(auth, headers);
+		const client = () => supabase ??= supabaseFor(auth, sharesClient ? clientHeaders : headers);
 		let replica;
 		const replicaUrl = () => {
 			const url = readUrl();
@@ -817,6 +873,7 @@ function createServer(betterSupabase, options = {}) {
 		};
 		return {
 			...credentials,
+			...ids,
 			auth,
 			resolution,
 			get supabase() {
@@ -825,7 +882,7 @@ function createServer(betterSupabase, options = {}) {
 			get db() {
 				if (db) return db;
 				const url = replicaUrl();
-				const rest = supabase ?? restAt(env().url, auth, headers);
+				const rest = (sharesClient ? void 0 : supabase) ?? restAt(env().url, auth, headers);
 				const connected = betterSupabase.connect(rest, context, {
 					stats: recorder,
 					...url && replica ? { executor: routedExecutor(postgrestExecutor(rest, executorOptions), postgrestExecutor(restAt(url, auth, headers), executorOptions), replica) } : tunedExecutor ? { executor: postgrestExecutor(rest, executorOptions) } : {}
@@ -850,7 +907,7 @@ function createServer(betterSupabase, options = {}) {
 			}
 		};
 	};
-	const fromResolution = (resolution, request, contextOptions, tenant) => contextFor(resolution, options.headers?.(request) ?? {}, contextOptions.stats, contextOptions.pinnedUntil ?? (readUrl() ? pinnedUntil(resolution.requestCookies) : 0), tenant, contextOptions.support);
+	const fromResolution = (resolution, request, contextOptions, tenant) => contextFor(resolution, options.headers?.(request) ?? {}, contextOptions.stats, contextOptions.pinnedUntil ?? (readUrl() ? pinnedUntil(resolution.requestCookies) : 0), tenant, contextOptions.support, idPolicy.forRequest(request, contextOptions));
 	const resolve = async (request, resolveOptions = {}) => {
 		const claims = options.auth?.claims ?? betterSupabase.claimsSchema;
 		const userMetadata = betterSupabase.userMetadataSchema;
@@ -902,7 +959,7 @@ function createServer(betterSupabase, options = {}) {
 			headers: {},
 			requestCookies: [],
 			apply: (response) => response
-		}, {}, contextOptions.stats, contextOptions.pinnedUntil, contextOptions.tenant, contextOptions.support),
+		}, {}, contextOptions.stats, contextOptions.pinnedUntil, contextOptions.tenant, contextOptions.support, idPolicy.forRequest(void 0, contextOptions)),
 		context(request, contextOptions = {}) {
 			const { refresh, cookies, ...rest } = contextOptions;
 			const key = Object.keys(rest).length === 0 ? `${String(refresh ?? false)}:${String(cookies ?? true)}` : void 0;
@@ -998,10 +1055,7 @@ function createServer(betterSupabase, options = {}) {
 						reason: forOptions.reason ?? "job"
 					}) } : {}
 				};
-				const session = {
-					...support?.readOnly ? { readOnly: true } : {},
-					...tenant === void 0 ? {} : { settings: { "better_supabase.tenant": tenant } }
-				};
+				const session = sessionWith({}, tenant, support?.readOnly);
 				return ok(sqlFor(claims, {
 					actor: {
 						id: actor.id,
@@ -1011,7 +1065,7 @@ function createServer(betterSupabase, options = {}) {
 					},
 					claims,
 					...tenant === void 0 ? {} : { tenant }
-				}, void 0, Object.keys(session).length === 0 ? void 0 : session));
+				}, void 0, session));
 			});
 		}
 	};

package/dist/astro/index.d.ts

@@ -1,10 +1,10 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-CeVeeXwz.js";
+import { t as BetterServer } from "../server-C6DWVEVG.js";
 import { j as StorageImageOptions } from "../index-D48jVS-N.js";
 import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
 import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-DuVb4Xa8.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-CdPDPpFs.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/astro/index.d.ts
 /** The part of Astro's `APIContext` (middleware, pages, endpoints, actions) the integration uses. */

package/dist/astro/index.js

@@ -1,9 +1,9 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
 import { t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
 import { t as storageImageUrl } from "../image-url-pIVlO6R1.js";
 import { t as around } from "../shared-CBxosKK3.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-CONDyPYx.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-xjTBoyBB.js";
 import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
 //#region src/astro/index.ts
 function runtimeEnv(locals) {

package/dist/blocks/attachments/index.d.ts

@@ -152,9 +152,16 @@ interface AttachmentScanJob {
 interface AttachmentScanner {
   /** Scans one uploaded file and records the verdict. */
   scan(id: string, signal?: AbortSignal): AsyncResult<Attachment>;
-  /** A jobs handler: `queue.work('attachment-scans', scanner.job)`. */
+  /**
+   * A jobs handler: `queue.work('attachment-scans', scanner.job)`. A deleted
+   * attachment completes the job; other errors throw so the queue retries.
+   */
   readonly job: JobHandler<AttachmentScanJob>;
-  /** An outbox sink that scans each `attachment.uploaded` event's file. */
+  /**
+   * An outbox sink that scans each `attachment.uploaded` event's file. An
+   * event for a deleted attachment is skipped, so it never holds up the
+   * events behind it; other errors throw so the relay retries the batch.
+   */
   sink(): EventSink;
 }
 /**
@@ -193,9 +200,16 @@ interface ObjectScanJob {
 interface ObjectScanner {
   /** Scans one object and records the verdict; a clean or infected object is not scanned again. */
   scan(bucket: string, path: string, signal?: AbortSignal): AsyncResult<ScannedObject>;
-  /** A jobs handler: `queue.work('object-scans', scanner.job)`. */
+  /**
+   * A jobs handler: `queue.work('object-scans', scanner.job)`. An object
+   * deleted from storage completes the job; other errors throw.
+   */
   readonly job: JobHandler<ObjectScanJob>;
-  /** An outbox sink that scans each `object.uploaded` event's object. */
+  /**
+   * An outbox sink that scans each `object.uploaded` event's object. An
+   * event for an object deleted from storage is skipped; other errors throw
+   * so the relay retries the batch.
+   */
   sink(): EventSink;
 }
 /**

package/dist/blocks/attachments/index.js

@@ -49,6 +49,18 @@ function stored(reply) {
 		}
 	});
 }
+/**
+* Waits for a scan from a job or an event. A scan whose target is gone (the
+* attachment row, or for an object the stored object) is done, not a
+* failure, so the job or event is not retried; every other error throws.
+*/
+async function settle(scanned, gone) {
+	const result = await scanned;
+	if (result.ok || gone(result.error)) return;
+	await scanned.orThrow();
+}
+const attachmentGone = (error) => error.kind === "not_found" && error.hint === "ATTACHMENT_NOT_FOUND";
+const objectGone = (error) => error.kind === "not_found" && error.code === "NoSuchKey";
 function lookup(call, id) {
 	return call("get_attachment", { id }, (value) => value).andThen((value) => Promise.resolve(isRecord(value) ? ok(attachmentOf(value)) : err(notFound())));
 }
@@ -145,13 +157,13 @@ function createAttachmentScanner(options) {
 	return {
 		scan,
 		job: async (payload, _job, signal) => {
-			await scan(payload.attachmentId, signal).orThrow();
+			await settle(scan(payload.attachmentId, signal), attachmentGone);
 		},
 		sink: () => ({ async send(events) {
 			for (const event of events) {
 				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "attachment.uploaded" || !isRecord(event.data)) continue;
 				const id = optionalText(event.data["attachmentId"]);
-				if (id !== void 0) await scan(id).orThrow();
+				if (id !== void 0) await settle(scan(id), attachmentGone);
 			}
 		} })
 	};
@@ -206,14 +218,14 @@ function createObjectScanner(options) {
 	return {
 		scan,
 		job: async (payload, _job, signal) => {
-			await scan(payload.bucket, payload.path, signal).orThrow();
+			await settle(scan(payload.bucket, payload.path, signal), objectGone);
 		},
 		sink: () => ({ async send(events) {
 			for (const event of events) {
 				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "object.uploaded" || !isRecord(event.data)) continue;
 				const bucket = optionalText(event.data["bucket"]);
 				const path = optionalText(event.data["path"]);
-				if (bucket !== void 0 && path !== void 0) await scan(bucket, path).orThrow();
+				if (bucket !== void 0 && path !== void 0) await settle(scan(bucket, path), objectGone);
 			}
 		} })
 	};

package/dist/blocks/data-lifecycle/index.d.ts

@@ -132,9 +132,17 @@ interface DataExporter {
    * emits `data_export.completed`). A failure marks it failed and returns the error.
    */
   run(exportId: string, signal?: AbortSignal): AsyncResult<DataExport>;
-  /** A jobs handler: `queue.work('data-exports', exporter.job)`. */
+  /**
+   * A jobs handler: `queue.work('data-exports', exporter.job)`. An export
+   * that is no longer pending or failed (cancelled, deleted, running or
+   * ready) completes the job; other errors throw so the queue retries.
+   */
   readonly job: JobHandler<DataExportJob>;
-  /** An outbox sink that runs each `data_export.requested` export. */
+  /**
+   * An outbox sink that runs each `data_export.requested` export. An event
+   * for an export that is no longer pending or failed is skipped, so it never
+   * holds up the events behind it; other errors throw so the relay retries.
+   */
   sink(): EventSink;
 }
 /** Runs requested exports with a service-role client. */

package/dist/blocks/data-lifecycle/index.js

@@ -180,16 +180,21 @@ function createDataExporter(options) {
 			files: written.data
 		}, exportOf);
 	});
+	const settle = async (ran) => {
+		const result = await ran;
+		if (result.ok || result.error.hint === "DATA_EXPORT_NOT_FOUND") return;
+		await ran.orThrow();
+	};
 	return {
 		run,
 		job: async (payload, _job, signal) => {
-			await run(payload.exportId, signal).orThrow();
+			await settle(run(payload.exportId, signal));
 		},
 		sink: () => ({ async send(events) {
 			for (const event of events) {
 				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "data_export.requested" || !isRecord(event.data)) continue;
 				const id = optionalText(event.data["exportId"]);
-				if (id !== void 0) await run(id).orThrow();
+				if (id !== void 0) await settle(run(id));
 			}
 		} })
 	};

package/dist/cli/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as run } from "./run-DNWxHynX.js";
+import { i as run } from "./run-C8tnlHSb.js";
 import { t as colorEnabled } from "./style-C0NFdJRL.js";
 import { text } from "node:stream/consumers";
 //#region src/cli/bin.ts

package/dist/cli/{doctor-B4JOm_ox.js → doctor-BMqBgM3X.js}

@@ -2,12 +2,12 @@ import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError } from "./errors-4v4DTtda.js";
 import { i as writeIfChanged, t as display } from "./io-DI1mTdSA.js";
 import { i as plain, r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-hr88OZG0.js";
+import { t as VERSION } from "./version-C_4JwyiM.js";
 import { s as providerLabel, t as compiledReadSets } from "./read-sets-CETOSFx4.js";
 import { s as stdinDatabaseUrl } from "./config-NiPxAmUF.js";
 import { c as migrationCommand, d as schemaPaths, i as findRepoRoot, l as pgFunctionHooks, n as declarativeSchemasDir, p as tomlGet, r as diffEngine, s as httpHooks, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { A as exposed, C as MetadataRejectedError, D as accessModule, E as AUTHORIZATION_RULES, F as qualified, I as tableObject, M as lineOf, N as permissionCatalogKeys, O as entitlementsModule, P as policyObject, S as configFor, _ as METADATA_GAPS_TEXT, a as renderFiles, c as loadSnapshot, j as exposedSchemas, k as catalogOf, l as managementTarget, p as snapshotFile, r as readMetadataSnapshot, u as openSource, v as CACHE_DIR } from "./gen-BGLb_zou.js";
+import { A as exposed, C as MetadataRejectedError, D as accessModule, E as AUTHORIZATION_RULES, F as qualified, I as tableObject, M as lineOf, N as permissionCatalogKeys, O as entitlementsModule, P as policyObject, S as configFor, _ as METADATA_GAPS_TEXT, a as renderFiles, c as loadSnapshot, j as exposedSchemas, k as catalogOf, l as managementTarget, p as snapshotFile, r as readMetadataSnapshot, u as openSource, v as CACHE_DIR } from "./gen-DeuDgPxN.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { t as connect } from "./db-DOBPt660.js";
 import { dirname, resolve } from "node:path";

package/dist/cli/gen-4JlOwgWG.js

@@ -0,0 +1,2 @@
+import { n as genCommand } from "./gen-DeuDgPxN.js";
+export { genCommand };

package/dist/cli/{gen-BGLb_zou.js → gen-DeuDgPxN.js}

@@ -2,7 +2,7 @@ import { r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError } from "./errors-4v4DTtda.js";
 import { i as writeIfChanged, n as importPath, r as sameText, t as display } from "./io-DI1mTdSA.js";
 import { r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-hr88OZG0.js";
+import { t as VERSION } from "./version-C_4JwyiM.js";
 import { a as entitlementsMode, c as unsafeKey, i as entitlementRequirements, n as accessProviderMode, o as moduleKeyProblems, r as accessRequirements, s as providerLabel, t as compiledReadSets } from "./read-sets-CETOSFx4.js";
 import { s as stdinDatabaseUrl, t as databaseUrl } from "./config-NiPxAmUF.js";
 import { l as pgFunctionHooks, p as tomlGet, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";

package/dist/cli/index.d.ts

@@ -527,6 +527,6 @@ export declare function emitModule(model: Model, options: EmitOptions): string;
 export declare function loadConfig(cwd: string, explicit?: string): Promise<ResolvedConfig>;
 //#endregion
 //#region src/cli/version.d.ts
-export declare const VERSION = "0.6.0";
+export declare const VERSION = "0.6.1";
 //#endregion
 export type { Catalog, CatalogCheck, CatalogColumn, CatalogColumnGrant, CatalogEnum, CatalogForeignKey, CatalogFunction, CatalogFunctionArg, CatalogGrant, CatalogIndex, CatalogPolicy, CatalogTable, CatalogTrigger, CatalogUnique, CliArgs, CliCommandDef, CliContext, CliEnv, CliErrorCode, CliErrorOptions, CliIo, CliProblem, CliProblemExtensions, Command, CommandContext, CommandResult, ExitCode, ExtrasFunction, ExtrasHook, ExtrasHookFunction, ExtrasTable, ForeignKeyAction, GeneratorMetadata, IntrospectionSource, ManagementSourceOptions, ParsedArgs, Queryable, RunOptions, RunResult, Snapshot, SnapshotBucket, SnapshotExtras };

package/dist/cli/index.js

@@ -1,9 +1,9 @@
 import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError, t as CLI_ERRORS_URL } from "./errors-4v4DTtda.js";
-import { i as run, n as help, r as registerCommand, t as commandNames } from "./run-DNWxHynX.js";
-import { t as VERSION } from "./version-hr88OZG0.js";
+import { i as run, n as help, r as registerCommand, t as commandNames } from "./run-C8tnlHSb.js";
+import { t as VERSION } from "./version-C_4JwyiM.js";
 import { a as loadConfig } from "./config-NiPxAmUF.js";
-import { L as toCatalog, a as renderFiles, b as emitModule, c as loadSnapshot, d as parseSnapshot, f as serializeSnapshot, g as pgSource, h as managementSource, m as introspect, o as runGen, x as buildModel, y as GENERATED_HEADER } from "./gen-BGLb_zou.js";
+import { L as toCatalog, a as renderFiles, b as emitModule, c as loadSnapshot, d as parseSnapshot, f as serializeSnapshot, g as pgSource, h as managementSource, m as introspect, o as runGen, x as buildModel, y as GENERATED_HEADER } from "./gen-DeuDgPxN.js";
 //#region src/cli/introspect/from-catalog.ts
 /**
 * Builds a snapshot from catalog records: the inverse of `toCatalog`. Tests

package/dist/cli/{init-BIIwclPg.js → init-C7Xd0Kda.js}

@@ -1,6 +1,6 @@
 import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { i as writeIfChanged, t as display } from "./io-DI1mTdSA.js";
-import { t as VERSION } from "./version-hr88OZG0.js";
+import { t as VERSION } from "./version-C_4JwyiM.js";
 import { a as loadConfig, r as findConfig } from "./config-NiPxAmUF.js";
 import { a as findSupabaseRoot, p as tomlGet, r as diffEngine, t as PGDELTA_TABLE, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
 import { t as TYPEGEN_VERSION } from "./typegen-version-DeFbtzYI.js";

package/dist/cli/{introspect-DNUTuNvb.js → introspect-CSnMJ94U.js}

@@ -2,7 +2,7 @@ import { r as defineCliCommand } from "./command-CK14fP91.js";
 import { i as writeIfChanged, r as sameText, t as display } from "./io-DI1mTdSA.js";
 import { r as painter } from "./style-C0NFdJRL.js";
 import { t as fileDiff } from "./diff-SjkO5rNr.js";
-import { T as serializeGenerator, c as loadSnapshot, f as serializeSnapshot, s as sourceArgs, t as SOURCE_ARGS, w as restrictSchemas } from "./gen-BGLb_zou.js";
+import { T as serializeGenerator, c as loadSnapshot, f as serializeSnapshot, s as sourceArgs, t as SOURCE_ARGS, w as restrictSchemas } from "./gen-DeuDgPxN.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";

package/dist/cli/{run-DNWxHynX.js → run-C8tnlHSb.js}

@@ -2,7 +2,7 @@ import { n as __toESM } from "./rolldown-runtime-BPOCksWG.js";
 import { c as parseArgs$2, i as joinRepeated, l as renderUsage, n as cliContext, o as listArgs, s as defineCommand, t as GLOBAL_ARGS, u as runCommand } from "./command-CK14fP91.js";
 import { n as CliError, r as toCliError } from "./errors-4v4DTtda.js";
 import { n as highlight, r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-hr88OZG0.js";
+import { t as VERSION } from "./version-C_4JwyiM.js";
 import { stripVTControlCharacters } from "node:util";
 import { resolve } from "node:path";
 //#region src/cli/legacy.ts
@@ -134,11 +134,11 @@ function renderError(error, options) {
 //#region src/cli/run.ts
 const COMMANDS = /* @__PURE__ */ new Map([
 	["init", {
-		load: () => import("./init-BIIwclPg.js").then((m) => m.initCommand),
+		load: () => import("./init-C7Xd0Kda.js").then((m) => m.initCommand),
 		description: "Writes better-supabase.config.ts, src/lib/supabase/index.ts and glue for the frameworks in package.json"
 	}],
 	["add", {
-		load: () => import("./init-BIIwclPg.js").then((m) => m.addCommand),
+		load: () => import("./init-C7Xd0Kda.js").then((m) => m.addCommand),
 		description: "Adds glue for an integration to an existing project"
 	}],
 	["env", {
@@ -154,11 +154,11 @@ const COMMANDS = /* @__PURE__ */ new Map([
 		description: "Installs the Agent Skills that ship with this version of better-supabase"
 	}],
 	["gen", {
-		load: () => import("./gen-DAH8FM2W.js").then((m) => m.genCommand),
+		load: () => import("./gen-4JlOwgWG.js").then((m) => m.genCommand),
 		description: "Writes database.types.ts, generated.ts and its metadata module from the database"
 	}],
 	["introspect", {
-		load: () => import("./introspect-DNUTuNvb.js").then((m) => m.introspectCommand),
+		load: () => import("./introspect-CSnMJ94U.js").then((m) => m.introspectCommand),
 		description: "Saves the database schema as a snapshot for offline gen"
 	}],
 	["openapi", {
@@ -170,7 +170,7 @@ const COMMANDS = /* @__PURE__ */ new Map([
 		description: "Renders the fixtures from defineSeed() (better-supabase/testing) to SQL"
 	}],
 	["doctor", {
-		load: () => import("./doctor-B4JOm_ox.js").then((m) => m.doctorCommand),
+		load: () => import("./doctor-BMqBgM3X.js").then((m) => m.doctorCommand),
 		description: "Checks RLS, indexes, drift, auth config and env files; exits 1 on errors, or on warnings with --strict"
 	}],
 	["sql", {

package/dist/cli/{version-hr88OZG0.js → version-C_4JwyiM.js}

@@ -1,4 +1,4 @@
 //#region src/cli/version.ts
-const VERSION = "0.6.0";
+const VERSION = "0.6.1";
 //#endregion
 export { VERSION as t };

package/dist/{composite-DhE66P5u.js → composite-CLqs9-OA.js}

@@ -1,5 +1,5 @@
 import { a as problemResponse } from "./problem-BreOl8b8.js";
-import { C as serverCore, S as withServerContext, _ as withSession, g as withSupport, h as withTenant, s as createServer } from "./adapter-Bc1o3zyy.js";
+import { C as serverCore, S as withServerContext, _ as withSession, g as withSupport, h as withTenant, s as createServer } from "./adapter-CHnPkCPd.js";
 import { s as withPrimaryPin } from "./replicas-CwrYp5Zj.js";
 import { r as guard, t as defaultExpose } from "./respond-BUgsXNgk.js";
 import { a as withAuthMode, i as withAuth, o as withJwtClaims, s as withUserClaims } from "./claims-DDBQT6BK.js";

package/dist/{composite-Bt1YK3Ke.d.ts → composite-pSfeJNce.d.ts}

@@ -3,7 +3,7 @@ import { a as EventHub } from "./events-DWDhx77e.js";
 import { i as CookieScope, s as SessionEncoding } from "./session-ChiXDZdZ.js";
 import { r as AuthState, t as AuthResolution } from "./resolve-KW8nCeL6.js";
 import { b as Db, t as BetterSupabase } from "./define-CJJkkr1-.js";
-import { b as ActiveSupport, g as ReplicaState, i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer } from "./server-CeVeeXwz.js";
+import { _ as ReplicaState, i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer, x as ActiveSupport } from "./server-C6DWVEVG.js";
 import { d as RefreshPolicy, r as GuardOptions } from "./respond-DoBijysA.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Entry, SingleKeyEntry } from "@supabase/middleware";

package/dist/edge/index.d.ts

@@ -1,6 +1,6 @@
 import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-CeVeeXwz.js";
+import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-C6DWVEVG.js";
 import { t as AuthSession } from "../view-DbxLNu8L.js";
 import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DoBijysA.js";
 import { s as BlockRequireOptions } from "../kit-B5tid-q5.js";

package/dist/edge/index.js

@@ -1,12 +1,12 @@
 import { n as dbError } from "../errors-B11Duf73.js";
 import { r as err } from "../result-DzUbqgdW.js";
 import { a as problemResponse } from "../problem-BreOl8b8.js";
-import { a as unexpectedResponse, c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { a as unexpectedResponse, c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
 import { a as respond, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as withBetterSupabase } from "../composite-DhE66P5u.js";
+import { t as withBetterSupabase } from "../composite-CLqs9-OA.js";
 import { t as defineResource } from "../resource-BsvzCMlX.js";
 import { i as requireCaller } from "../kit-Fm-Fv7q5.js";
-import { t as EVERY_CALLER } from "../framework-CONDyPYx.js";
+import { t as EVERY_CALLER } from "../framework-xjTBoyBB.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { withCors } from "@supabase/middleware/cors";
 //#region src/bridges/edge.ts

package/dist/expo/index.d.ts

@@ -1,6 +1,6 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer } from "../server-CeVeeXwz.js";
+import { i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer } from "../server-C6DWVEVG.js";
 import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DoBijysA.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";

package/dist/expo/index.js

@@ -1,9 +1,9 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
 import { o as toProblem } from "../problem-BreOl8b8.js";
-import { a as unexpectedResponse, c as extendServer, s as createServer, y as refreshFor } from "../adapter-Bc1o3zyy.js";
+import { a as unexpectedResponse, c as extendServer, s as createServer, y as refreshFor } from "../adapter-CHnPkCPd.js";
 import { m as serializeCookie } from "../resolve-D_IcnvFd.js";
 import { a as respond, r as guard, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as withBetterSupabase } from "../composite-DhE66P5u.js";
+import { t as withBetterSupabase } from "../composite-CLqs9-OA.js";
 import { r as handoffOf } from "../shared-CBxosKK3.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { StatusError, setResponseHeaders } from "expo-server";

package/dist/{framework-DuVb4Xa8.d.ts → framework-CdPDPpFs.d.ts}

@@ -1,7 +1,7 @@
 import { a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
-import { o as ServerOptions } from "./server-CeVeeXwz.js";
+import { o as ServerOptions } from "./server-C6DWVEVG.js";
 import { t as AuthSession } from "./view-DbxLNu8L.js";
-import { a as SessionEntryConfig, n as BetterSupabaseContributions } from "./composite-Bt1YK3Ke.js";
+import { a as SessionEntryConfig, n as BetterSupabaseContributions } from "./composite-pSfeJNce.js";
 import { t as RefusalRedirects } from "./refusal-D1rgbzNq.js";
 //#region src/server/framework.d.ts
 /** What the framework factories (`createSvelteKit`, `createReactRouter`, `createTanStackStart`) take. */

package/dist/{framework-CONDyPYx.js → framework-xjTBoyBB.js}

@@ -1,5 +1,5 @@
 import { n as toSession } from "./view-BeFcRV6G.js";
-import { t as withBetterSupabase } from "./composite-DhE66P5u.js";
+import { t as withBetterSupabase } from "./composite-CLqs9-OA.js";
 //#region src/server/framework.ts
 /** Every caller: the framework factories guard per loader, action or route instead. */
 const EVERY_CALLER = [

package/dist/hono/index.d.ts

@@ -1,7 +1,7 @@
 import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { r as AuthState } from "../resolve-KW8nCeL6.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-CeVeeXwz.js";
+import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-C6DWVEVG.js";
 import { t as AuthSession } from "../view-DbxLNu8L.js";
 import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DoBijysA.js";
 import { s as BlockRequireOptions } from "../kit-B5tid-q5.js";

package/dist/hono/index.js

@@ -1,9 +1,9 @@
 import { r as dbErrorOf } from "../errors-B11Duf73.js";
 import { a as problemResponse } from "../problem-BreOl8b8.js";
-import { a as unexpectedResponse, c as extendServer, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { a as unexpectedResponse, c as extendServer, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
 import { n as toSession } from "../view-BeFcRV6G.js";
 import { a as respond, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as withBetterSupabase } from "../composite-DhE66P5u.js";
+import { t as withBetterSupabase } from "../composite-CLqs9-OA.js";
 import { t as defineResource } from "../resource-BsvzCMlX.js";
 import { i as requireCaller } from "../kit-Fm-Fv7q5.js";
 import { r as handoffOf } from "../shared-CBxosKK3.js";

package/dist/mcp/index.d.ts

@@ -1,6 +1,6 @@
 import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-CeVeeXwz.js";
+import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-C6DWVEVG.js";
 import { r as GuardOptions } from "../respond-DoBijysA.js";
 import { i as ResourceOperation } from "../index-Bxih3l0u.js";
 import { a as ResourceRouteOptions } from "../resource-D6Uc7Sk7.js";

package/dist/mcp/index.js

@@ -4,7 +4,7 @@ import { n as validate } from "../standard-BK0cqJ7y.js";
 import { a as problemResponse, o as toProblem } from "../problem-BreOl8b8.js";
 import { t as SPEC_PINS } from "../spec-pins--j6mTok4.js";
 import { t as buildJsonSchema } from "../json-schema-CvER4kgT.js";
-import { c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
 import { n as jsonResponse, t as jsonReplacer } from "../json-CEnpTHlZ.js";
 import { o as settle, r as guard, t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { t as defineResource } from "../resource-BsvzCMlX.js";

package/dist/mcp/sdk/index.d.ts

@@ -1,7 +1,7 @@
 import { a as AnyModels, i as AnyFunctions } from "../../types-6BdhkmZe.js";
 import { r as AuthState } from "../../resolve-KW8nCeL6.js";
 import { t as BetterSupabase } from "../../define-CJJkkr1-.js";
-import { i as ServerContext$1, o as ServerOptions, t as BetterServer } from "../../server-CeVeeXwz.js";
+import { i as ServerContext$1, o as ServerOptions, t as BetterServer } from "../../server-C6DWVEVG.js";
 import { r as GuardOptions, t as AllowedCaller } from "../../respond-DoBijysA.js";
 import { AuthInfo, CallToolResult, Icon, InputRequiredResult, OAuthTokenVerifier, RegisteredTool, ScopeChallengeHandler, ServerContext, StandardSchemaWithJSON, ToolAnnotations } from "@modelcontextprotocol/server";
 //#region src/mcp/sdk/sdk.d.ts

package/dist/mcp/sdk/index.js

@@ -1,5 +1,5 @@
 import { o as delegationOf } from "../../impersonation-DcqaTBHx.js";
-import { c as extendServer, i as resolveToken, l as withExtra, n as flushEvents, s as createServer } from "../../adapter-Bc1o3zyy.js";
+import { c as extendServer, i as resolveToken, l as withExtra, n as flushEvents, s as createServer } from "../../adapter-CHnPkCPd.js";
 import { r as guard } from "../../respond-BUgsXNgk.js";
 import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../../http-DdYadv-o.js";
 import { OAuthError, bearerAuthChallengeResponse, verifyBearerToken } from "@modelcontextprotocol/server";

package/dist/next/index.d.ts

@@ -1,7 +1,7 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { r as AuthState } from "../resolve-KW8nCeL6.js";
 import { B as DbStats, K as ReadSet, it as QuerySpec, t as BetterSupabase, u as CacheAdapter } from "../define-CJJkkr1-.js";
-import { C as SupportOptions, D as supportSessions, E as SupportStartRequest, T as SupportSessions, b as ActiveSupport, i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer, w as SupportPolicy } from "../server-CeVeeXwz.js";
+import { D as SupportStartRequest, E as SupportSessions, O as supportSessions, T as SupportPolicy, i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer, w as SupportOptions, x as ActiveSupport } from "../server-C6DWVEVG.js";
 import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-Daak8ukG.js";
 import { t as tenantOf } from "../tenant-icPeuUBN.js";
 import { n as toSession, t as AuthSession } from "../view-DbxLNu8L.js";

package/dist/next/index.js

@@ -9,10 +9,10 @@ import { a as problemResponse } from "../problem-BreOl8b8.js";
 import { i as claimsOf } from "../claims-PqzCxaTD.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
 import { t as tenantOf } from "../tenant-I1TEZ_BX.js";
-import { C as serverCore, c as extendServer, l as withExtra, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as isPrefetch } from "../adapter-Bc1o3zyy.js";
+import { C as serverCore, c as extendServer, l as withExtra, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as isPrefetch } from "../adapter-CHnPkCPd.js";
 import { a as checkAal, n as toSession } from "../view-BeFcRV6G.js";
 import { o as settle, r as guard, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as supportSessions } from "../support-BivNqSpK.js";
+import { t as supportSessions } from "../support-zIa1URaN.js";
 import { r as tagFor, t as cacheTagsOf } from "../tags-B99_U9Pp.js";
 import { n as formDataObject } from "../kit-Fm-Fv7q5.js";
 import { cache } from "react";

package/dist/orpc/index.d.ts

@@ -3,7 +3,7 @@ import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { r as AuthState } from "../resolve-KW8nCeL6.js";
 import { i as ProblemDetails } from "../problem-DD8LZFjc.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-CeVeeXwz.js";
+import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-C6DWVEVG.js";
 import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DoBijysA.js";
 import { s as BlockRequireOptions } from "../kit-B5tid-q5.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";

package/dist/orpc/index.js

@@ -2,7 +2,7 @@ import { r as dbErrorOf } from "../errors-B11Duf73.js";
 import { o as toProblem } from "../problem-BreOl8b8.js";
 import { i as claimsOf } from "../claims-PqzCxaTD.js";
 import { t as tenantOf } from "../tenant-I1TEZ_BX.js";
-import { c as extendServer, n as flushEvents, s as createServer, y as refreshFor } from "../adapter-Bc1o3zyy.js";
+import { c as extendServer, n as flushEvents, s as createServer, y as refreshFor } from "../adapter-CHnPkCPd.js";
 import { n as toSession } from "../view-BeFcRV6G.js";
 import { o as settle, r as guard, t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { t as authorizeCaller } from "../kit-Fm-Fv7q5.js";

package/dist/otel/index.js

@@ -1,7 +1,7 @@
 import { r as definePlugin } from "../plugin-tfXW1-qO.js";
 import { t as SPEC_PINS } from "../spec-pins--j6mTok4.js";
 import { r as blockEventAttributes } from "../block-events-CrT8r7Fe.js";
-import "../version-Bvv6aLjZ.js";
+import "../version-CQt77F3T.js";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 //#region src/otel/index.ts
 const INSTRUMENTATION_NAME = "better-supabase";
@@ -40,9 +40,9 @@ function systemOf(executor) {
 * ```
 */
 function otel(options = {}) {
-	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.6.0");
+	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.6.1");
 	let histogram;
-	if (options.metrics !== false) histogram = (options.meter ?? metrics.getMeter("better-supabase", "0.6.0")).createHistogram("db.client.operation.duration", {
+	if (options.metrics !== false) histogram = (options.meter ?? metrics.getMeter("better-supabase", "0.6.1")).createHistogram("db.client.operation.duration", {
 		unit: "s",
 		description: "Duration of database client operations.",
 		advice: { explicitBucketBoundaries: [
@@ -181,7 +181,7 @@ function otel(options = {}) {
 * Returns a function that stops listening.
 */
 function traceAuth(betterSupabase, options = {}) {
-	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.6.0");
+	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.6.1");
 	const offAuth = betterSupabase.events.on("auth", (event) => {
 		const span = tracer.startSpan("auth.resolve", {
 			kind: SpanKind.INTERNAL,
@@ -219,7 +219,7 @@ function traceAuth(betterSupabase, options = {}) {
 * set an error status. Returns a function that stops listening.
 */
 function traceBlockEvents(betterSupabase, options = {}) {
-	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.6.0");
+	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.6.1");
 	return betterSupabase.events.on("block", (event) => {
 		const attributes = {
 			...options.attributes,

package/dist/react-router/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-CeVeeXwz.js";
+import { t as BetterServer } from "../server-C6DWVEVG.js";
 import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
 import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-DuVb4Xa8.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-CdPDPpFs.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/react-router/index.js

@@ -1,9 +1,9 @@
 import { a as problemResponse } from "../problem-BreOl8b8.js";
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
 import { o as settle, t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
 import { n as bufferInPlace, t as around } from "../shared-CBxosKK3.js";
-import { i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-CONDyPYx.js";
+import { i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-xjTBoyBB.js";
 import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
 //#region src/bridges/react-router.ts
 /**

package/dist/server/index.d.ts

@@ -5,11 +5,11 @@ import { _ as writeSession, a as CookieWrite, c as StoredSession, h as sessionCo
 import { a as ResolveAuthOptions, c as clientIp, i as InvalidReason, l as resolveAuth, n as AuthResolver, o as ResolvedState, r as AuthState, s as authContext, t as AuthResolution } from "../resolve-KW8nCeL6.js";
 import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DD8LZFjc.js";
 import { B as DbStats, b as Db, t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { A as clearSupportCookie, B as sqlSupportStore, C as SupportOptions, D as supportSessions, E as SupportStartRequest, F as SupportEndedBy, I as SupportListFilter, L as SupportSession, M as supportCookieValue, N as SqlSupportStoreOptions, O as SUPPORT_COOKIE, P as SupportCallerClaims, R as SupportSessionStore, S as SupportAuthorizeInput, T as SupportSessions, V as supportClaims, _ as DeleteAccountOptions, a as ServerDbOptions, b as ActiveSupport, c as createServer, d as SuspendAccountOptions, f as SuspendAccountResult, g as ReplicaState, h as PRIMARY_COOKIE, i as ServerContext, j as supportCookie, k as SupportCookieOptions, l as extendServer, m as suspendAccount, n as ContextOptions, o as ServerOptions, p as endSessions, r as ForContextOptions, s as TENANT_HEADER, t as BetterServer, u as EndSessionsResult, v as DeleteAccountResult, w as SupportPolicy, x as SupportApi, y as deleteAccount, z as SupportStartInput } from "../server-CeVeeXwz.js";
+import { A as SupportCookieOptions, B as SupportStartInput, C as SupportAuthorizeInput, D as SupportStartRequest, E as SupportSessions, F as SupportCallerClaims, H as supportClaims, I as SupportEndedBy, L as SupportListFilter, M as supportCookie, N as supportCookieValue, O as supportSessions, P as SqlSupportStoreOptions, R as SupportSession, S as SupportApi, T as SupportPolicy, V as sqlSupportStore, _ as ReplicaState, a as ServerDbOptions, b as deleteAccount, c as createServer, d as SuspendAccountOptions, f as SuspendAccountResult, g as PRIMARY_COOKIE, h as RequestIdOptions, i as ServerContext, j as clearSupportCookie, k as SUPPORT_COOKIE, l as extendServer, m as suspendAccount, n as ContextOptions, o as ServerOptions, p as endSessions, r as ForContextOptions, s as TENANT_HEADER, t as BetterServer, u as EndSessionsResult, v as DeleteAccountOptions, w as SupportOptions, x as ActiveSupport, y as DeleteAccountResult, z as SupportSessionStore } from "../server-C6DWVEVG.js";
 import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-Daak8ukG.js";
 import { n as SessionActor, r as SessionDelegation, t as ActClaim } from "../actor-CQTlc1Hh.js";
 import { n as toSession, t as AuthSession } from "../view-DbxLNu8L.js";
-import { a as SessionEntryConfig, c as withGuard, i as withBetterSupabase, l as ServerCore, n as BetterSupabaseContributions, o as withSession, r as BetterSupabaseEntry, s as GuardEntryConfig, t as BetterSupabaseConfig, u as serverCore } from "../composite-Bt1YK3Ke.js";
+import { a as SessionEntryConfig, c as withGuard, i as withBetterSupabase, l as ServerCore, n as BetterSupabaseContributions, o as withSession, r as BetterSupabaseEntry, s as GuardEntryConfig, t as BetterSupabaseConfig, u as serverCore } from "../composite-pSfeJNce.js";
 import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-DoBijysA.js";
 import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-B5tid-q5.js";
 import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-D6Uc7Sk7.js";
@@ -188,4 +188,4 @@ export declare function withDbStats(options?: {
   };
 }, () => DbStats>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizeOptions, type AuthorizedContext, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, aalOf, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, createServer, defineResource, deleteAccount, endSessions, extendServer, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, type Aal, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizeOptions, type AuthorizedContext, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, aalOf, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, createServer, defineResource, deleteAccount, endSessions, extendServer, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };

package/dist/server/index.js

@@ -3,14 +3,14 @@ import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toPr
 import { i as userContext, r as impersonatorOf } from "../impersonation-DcqaTBHx.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
 import { n as postgresExecutor } from "../executor-De1Of3m3.js";
-import { C as serverCore, D as deleteAccount, E as suspendAccount, T as endSessions, _ as withSession, a as unexpectedResponse, b as shouldCheckSession, c as extendServer, d as clearSupportCookie, f as supportCookie, i as resolveToken, m as supportCookieValue, n as flushEvents, o as TENANT_HEADER, r as handle, s as createServer, u as SUPPORT_COOKIE, v as isPrefetch, w as SERVER_EVENT_SOURCE, x as shouldRefresh, y as refreshFor } from "../adapter-Bc1o3zyy.js";
+import { C as serverCore, D as deleteAccount, E as suspendAccount, T as endSessions, _ as withSession, a as unexpectedResponse, b as shouldCheckSession, c as extendServer, d as clearSupportCookie, f as supportCookie, i as resolveToken, m as supportCookieValue, n as flushEvents, o as TENANT_HEADER, r as handle, s as createServer, u as SUPPORT_COOKIE, v as isPrefetch, w as SERVER_EVENT_SOURCE, x as shouldRefresh, y as refreshFor } from "../adapter-CHnPkCPd.js";
 import { n as PRIMARY_COOKIE } from "../replicas-CwrYp5Zj.js";
 import { _ as writeSession, a as refreshSession, c as AUTH_CACHE_HEADERS, h as sessionCookieName, i as resolveAuth, n as clientIp, o as clearSessionCookies, p as readSession, s as sessionStatus, t as authContext } from "../resolve-D_IcnvFd.js";
 import { a as checkAal, i as amrOf, n as toSession, r as aalOf } from "../view-BeFcRV6G.js";
 import { a as respond, i as isResult, o as settle, r as guard } from "../respond-BUgsXNgk.js";
-import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-BivNqSpK.js";
+import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-zIa1URaN.js";
 import { n as jwtClaimsOf, r as userClaimsOf, t as authModeOf } from "../claims-DDBQT6BK.js";
-import { n as withGuard, t as withBetterSupabase } from "../composite-DhE66P5u.js";
+import { n as withGuard, t as withBetterSupabase } from "../composite-CLqs9-OA.js";
 import { t as defineResource } from "../resource-BsvzCMlX.js";
 import { i as withServerTiming, n as parseDbStats, r as withDbStats, t as DB_CALLS_HEADER } from "../timing-CyTQPubY.js";
 import { n as tagCache, r as tagFor, t as cacheTagsOf } from "../tags-B99_U9Pp.js";

package/dist/{server-CeVeeXwz.d.ts → server-C6DWVEVG.d.ts}

@@ -278,6 +278,14 @@ interface ReplicaState {
   pin(): void;
 }
 //#endregion
+//#region src/server/request-ids.d.ts
+interface RequestIdOptions {
+  readonly requestHeader?: string;
+  readonly correlationHeader?: string;
+  readonly incoming?: boolean;
+  readonly generate?: boolean;
+}
+//#endregion
 //#region src/server/suspend-account.d.ts
 interface EndSessionsResult {
   readonly userId: string;
@@ -334,6 +342,7 @@ interface ServerOptions {
    * `current_setting('request.headers')` (channel, request id, client IP for audit).
    */
   readonly headers?: (request: Request) => Readonly<Record<string, string>>;
+  readonly requestIds?: RequestIdOptions | false;
   /**
    * PostgREST URL for the caller's reads: a read replica or the `<ref>-all`
    * load balancer. Defaults to `SUPABASE_READ_URL`; `false` reads from the
@@ -431,6 +440,8 @@ interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unkn
   readonly support?: ActiveSupport;
   /** `options.credentials`, when the server has one. */
   readonly credentials?: CredentialProvider;
+  readonly requestId?: string;
+  readonly correlationId?: string;
 }
 interface ContextOptions {
   readonly refresh?: boolean;
@@ -447,6 +458,8 @@ interface ContextOptions {
    * looks it up itself; `contextFromResolution` only uses this.
    */
   readonly support?: ActiveSupport;
+  readonly requestId?: string;
+  readonly correlationId?: string;
 }
 interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
   readonly env: BetterSupabaseEnv;
@@ -513,4 +526,4 @@ declare function extendServer<R extends object>(server: object, extra: Omit<R, S
  */
 declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
 //#endregion
-export { clearSupportCookie as A, sqlSupportStore as B, SupportOptions as C, supportSessions as D, SupportStartRequest as E, SupportEndedBy as F, SupportListFilter as I, SupportSession as L, supportCookieValue as M, SqlSupportStoreOptions as N, SUPPORT_COOKIE as O, SupportCallerClaims as P, SupportSessionStore as R, SupportAuthorizeInput as S, SupportSessions as T, supportClaims as V, DeleteAccountOptions as _, ServerDbOptions as a, ActiveSupport as b, createServer as c, SuspendAccountOptions as d, SuspendAccountResult as f, ReplicaState as g, PRIMARY_COOKIE as h, ServerContext as i, supportCookie as j, SupportCookieOptions as k, extendServer as l, suspendAccount as m, ContextOptions as n, ServerOptions as o, endSessions as p, ForContextOptions as r, TENANT_HEADER as s, BetterServer as t, EndSessionsResult as u, DeleteAccountResult as v, SupportPolicy as w, SupportApi as x, deleteAccount as y, SupportStartInput as z };
+export { SupportCookieOptions as A, SupportStartInput as B, SupportAuthorizeInput as C, SupportStartRequest as D, SupportSessions as E, SupportCallerClaims as F, supportClaims as H, SupportEndedBy as I, SupportListFilter as L, supportCookie as M, supportCookieValue as N, supportSessions as O, SqlSupportStoreOptions as P, SupportSession as R, SupportApi as S, SupportPolicy as T, sqlSupportStore as V, ReplicaState as _, ServerDbOptions as a, deleteAccount as b, createServer as c, SuspendAccountOptions as d, SuspendAccountResult as f, PRIMARY_COOKIE as g, RequestIdOptions as h, ServerContext as i, clearSupportCookie as j, SUPPORT_COOKIE as k, extendServer as l, suspendAccount as m, ContextOptions as n, ServerOptions as o, endSessions as p, ForContextOptions as r, TENANT_HEADER as s, BetterServer as t, EndSessionsResult as u, DeleteAccountOptions as v, SupportOptions as w, ActiveSupport as x, DeleteAccountResult as y, SupportSessionStore as z };

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-CeVeeXwz.js";
+import { t as BetterServer } from "../server-C6DWVEVG.js";
 import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
 import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-DuVb4Xa8.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-CdPDPpFs.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/solid-start/index.d.ts
 /** The part of a SolidStart `FetchEvent` the integration reads and writes. */

package/dist/solid-start/index.js

@@ -1,7 +1,7 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
 import { t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-CONDyPYx.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-xjTBoyBB.js";
 import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
 import { t as beforeRoute } from "../before-route-CnR0C0Jr.js";
 //#region src/solid-start/index.ts

package/dist/sql/index.js

@@ -9,7 +9,7 @@ import { t as FINAL_RUN_STATES$1 } from "../run-state-CgBKzYMW.js";
 import { t as AI_MESSAGE_PART_TYPES } from "../message-CaKlqdsX.js";
 import { A as jwtClaim, B as replaceColumnCheck, C as canIn, D as disabledHelpersNeedLaterTables, E as disabledHelpers, F as pageSize, G as splitTable$1, H as serviceGrant, I as quotedTable, J as userGrant, K as tenantIn, L as raise$1, M as membershipDisabledAt, N as membershipSuspended, O as ensureCheck, P as organizationMissing, R as recordTrigger, S as addForeignKey, T as columnsObject, U as serviceOnly$1, V as schemaPreamble, W as sha256Hex, _ as SCHEMA, a as MODULE_PERMISSION_SCOPES, b as activeMembership, c as modulePermission, d as roleNames, f as roleScopeIs, g as NOTHING, h as EQUIVALENT_TRIGGERS, i as MODULE_PERMISSIONS, j as memberAddedRecord, k as jsonSchemaChecks, l as modulePermissionKey, m as tenantScope, n as WORKFLOW_SDK_WORLD, o as accessModel, p as rolesOf, q as updatedAt, s as hasPlatformRoles, u as providerPlatformRoles, v as SERVICE_CALLER, w as columnRef, x as addExtraColumns, y as accessDefinesDisabledHelpers, z as renameSql } from "../workflow-sdk-world-D-prir6O.js";
 import { c as templateFunctions, i as fillTemplate, o as resolveProviderSql, s as scopeProblems, t as SCOPE_ID_TYPES } from "../access-sql-B0dF-SoF.js";
-import { t as VERSION } from "../version-Bvv6aLjZ.js";
+import { t as VERSION } from "../version-CQt77F3T.js";
 //#region src/sql/api-schema.ts
 /** The roles PostgREST runs a request as. */
 const API_ROLES = /* @__PURE__ */ new Set([
@@ -10196,6 +10196,20 @@ revoke execute on function better_supabase.audit_settings(regclass) from public,
 revoke execute on function better_supabase.audit_schema_calls(text, text, text[]) from public, anon, authenticated;
 revoke execute on function better_supabase.audit_schema(text, text, text[]) from public, anon, authenticated;`;
 //#endregion
+//#region src/sql/modules/audit-request.ts
+const requestHeader = (name) => `better_supabase.request_header(${sqlString(name)})`;
+const traceId = (setting, header) => `coalesce(better_supabase.request_id_or_null(current_setting(${sqlString(setting)}, true)), better_supabase.request_id_or_null(${requestHeader(header)}))`;
+const requestIdSql = (ctx) => traceId("better_supabase.request_id", ctx.text("requestIdHeader", "x-request-id").toLowerCase());
+const correlationIdSql = (ctx) => traceId("better_supabase.correlation_id", ctx.text("correlationIdHeader", "x-correlation-id").toLowerCase());
+const REQUEST_ID_OR_NULL = `create or replace function better_supabase.request_id_or_null(value text)
+returns text
+language sql
+immutable
+set search_path = ''
+as $$
+  select case when value ~ '^[A-Za-z0-9._:;,@/+=-]{1,128}$' then value end;
+$$;`;
+//#endregion
 //#region src/sql/modules/audit-retention.ts
 /**
 * `purge_audit_log`, which honours an `audit_retention(tenant)` hook, and
@@ -10437,6 +10451,7 @@ const NAMES$24 = {
 	} },
 	options: [
 		"appendOnly",
+		"correlationIdHeader",
 		"eventCategory",
 		"eventRoles",
 		"trustedRoles",
@@ -10446,6 +10461,7 @@ const NAMES$24 = {
 		"keepMappedMetadata",
 		"metadataColumns",
 		"readPolicy",
+		"requestIdHeader",
 		"restricted",
 		"tenantColumn",
 		"tenantLabel",
@@ -10562,8 +10578,6 @@ function castId(value, idType) {
 		default: return idType;
 	}
 }
-/** The request header `name`, or null outside a Data API request. */
-const requestHeader = (name) => `better_supabase.request_header(${sqlString(name)})`;
 /** How the caller acted: service, support, impersonation, oauth-client, user or system. */
 const ACTOR_KIND = `case
       when coalesce(auth.jwt() ->> 'role', '') = 'service_role' then 'service'
@@ -10582,7 +10596,7 @@ function contextPairs(ctx, tenant, values) {
 		["tenantLabel", tenantLabel(ctx, tenant)],
 		["targetLabel", values.targetLabel],
 		["summary", values.summary],
-		["requestId", values.requestId ?? requestHeader("x-request-id")],
+		["requestId", values.requestId ?? requestIdSql(ctx)],
 		["correlationId", values.correlationId],
 		["scope", auditWrite(ctx, "scope", values.scope ?? `case when ${tenant} is null then 'platform' else 'tenant' end`)]
 	];
@@ -10632,7 +10646,8 @@ revoke all on ${ctx.table("restricted")} from anon, authenticated;` : "";
 -- Semantic events (audit_event) and the per-table registry fill these.${add("eventType", "text")}${add("category", "text")}${add("outcome", "text")}${add("source", "text")}${add("targetType", "text")}${add("metadata", "jsonb")}${add("idempotencyKey", "text")}
 -- Who acted and on what, as it was then, for audit pages.${add("actorKind", "text")}${add("actorLabel", "text")}${add("tenantLabel", "text")}${add("targetLabel", "text")}${add("summary", "text")}${add("requestId", "text")}${add("correlationId", "text")}${add("scope", "text")}
 ${ctx.has("log", "table") && ctx.has("log", "record") ? `create index if not exists audit_events_record_idx on ${log} (${c("table")}, ${c("record")}, ${c("occurredAt")} desc);\n` : ""}create index if not exists audit_events_organization_idx on ${log} (${c("tenant")}, ${c("occurredAt")} desc);
-create index if not exists audit_events_occurred_at_idx on ${log} (${c("occurredAt")});${ctx.has("log", "idempotencyKey") ? `
+create index if not exists audit_events_occurred_at_idx on ${log} (${c("occurredAt")});${ctx.has("log", "correlationId") ? `
+create index if not exists audit_events_correlation_idx on ${log} (${c("correlationId")}) where ${c("correlationId")} is not null;` : ""}${ctx.has("log", "idempotencyKey") ? `
 create unique index if not exists audit_events_idempotency_idx on ${log} (${c("idempotencyKey")}, ${c("tenant")}) nulls not distinct where ${c("idempotencyKey")} is not null;` : ""}
 alter table ${log} enable row level security;
 revoke all on ${log} from anon, authenticated;
@@ -10682,6 +10697,8 @@ exception when others then
 end;
 $$;
 
+${REQUEST_ID_OR_NULL}
+
 -- The client address the API gateway appended to x-forwarded-for (the
 -- right-most hop; clients can forge the ones before it), or null.
 create or replace function better_supabase.request_ip()
@@ -10750,7 +10767,7 @@ function triggerFunction(ctx, tenantColumn, restricted) {
 		...contextPairs(ctx, "row_tenant", {
 			targetLabel: "row_data ->> entry.label_column",
 			summary: "null",
-			correlationId: requestHeader("x-correlation-id")
+			correlationId: correlationIdSql(ctx)
 		})
 	]);
 	const tenantValue = castId(`row_data ->> coalesce(entry.tenant_column, ${sqlString(tenantColumn)})`, ctx.idType);
@@ -10864,10 +10881,10 @@ function auditEvent(ctx, restricted) {
 		...contextPairs(ctx, "tenant", {
 			targetLabel: "target_label",
 			summary: "summary",
-			correlationId: `coalesce(correlation_id, ${requestHeader("x-correlation-id")})`,
+			correlationId: `coalesce(better_supabase.request_id_or_null(correlation_id), ${correlationIdSql(ctx)})`,
 			actorKind: `coalesce(actor_kind, ${ACTOR_KIND})`,
 			actorLabel: `coalesce(actor_label, ${ACTOR_LABEL})`,
-			requestId: `coalesce(request_id, ${requestHeader("x-request-id")})`,
+			requestId: `coalesce(better_supabase.request_id_or_null(request_id), ${requestIdSql(ctx)})`,
 			scope: "coalesce(audit_event.scope, case when tenant is null then 'platform' else 'tenant' end)"
 		})
 	]);
@@ -11075,7 +11092,7 @@ const AUDIT = {
 	dependencies: (layout) => layout.modules?.["audit"]?.options?.["readPolicy"] === true ? ["access"] : [],
 	target: "schema",
 	modes: ["managed", "adopt"],
-	version: 5,
+	version: 6,
 	names: NAMES$24,
 	contract: () => [
 		{
@@ -11170,6 +11187,11 @@ const AUDIT = {
 			from: 4,
 			description: "Drops the read-only audit_log view that 0.5 kept for the 0.4 names; read better_supabase.audit_events.",
 			sql: (ctx) => `drop view if exists ${sqlIdent(ctx.tableName("log").schema)}.audit_log;`
+		},
+		{
+			from: 5,
+			description: "Row changes and audit_event read the request and correlation ids from the better_supabase.request_id and better_supabase.correlation_id settings, then from the requestIdHeader and correlationIdHeader headers, and keep only ids of up to 128 safe characters; managed logs index correlation_id.",
+			sql: () => ""
 		}
 	],
 	deprecated: [{

package/dist/{support-BivNqSpK.js → support-zIa1URaN.js}

@@ -3,7 +3,7 @@ import { t as temporal } from "./temporal-required-BVvW7SYJ.js";
 import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-DzUbqgdW.js";
 import { n as validate } from "./standard-BK0cqJ7y.js";
 import { t as fromPgError } from "./executor-De1Of3m3.js";
-import { d as clearSupportCookie, f as supportCookie, m as supportCookieValue } from "./adapter-Bc1o3zyy.js";
+import { d as clearSupportCookie, f as supportCookie, m as supportCookieValue } from "./adapter-CHnPkCPd.js";
 import { r as sqlIdent } from "./template--jDkl3UP.js";
 import { i as emitBlockEvent } from "./block-events-CrT8r7Fe.js";
 //#region src/auth/support.ts

package/dist/sveltekit/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-CeVeeXwz.js";
+import { t as BetterServer } from "../server-C6DWVEVG.js";
 import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
 import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-DuVb4Xa8.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-CdPDPpFs.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { i as tagFor } from "../tags-Cx-LnIQP.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";

package/dist/sveltekit/index.js

@@ -1,12 +1,12 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
 import { r as dbErrorOf } from "../errors-B11Duf73.js";
 import { o as toProblem } from "../problem-BreOl8b8.js";
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
 import { t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { r as tagFor } from "../tags-B99_U9Pp.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
 import { n as bufferInPlace, t as around } from "../shared-CBxosKK3.js";
-import { a as platformWaitUntil, i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-CONDyPYx.js";
+import { a as platformWaitUntil, i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-xjTBoyBB.js";
 import { i as refusalTarget } from "../refusal-CeJWxmkH.js";
 //#region src/bridges/sveltekit.ts
 /**

package/dist/tanstack-start/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-CeVeeXwz.js";
+import { t as BetterServer } from "../server-C6DWVEVG.js";
 import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
 import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-DuVb4Xa8.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-CdPDPpFs.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/tanstack-start/index.js

@@ -1,8 +1,8 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
 import { t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
 import { n as bufferInPlace, t as around } from "../shared-CBxosKK3.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-CONDyPYx.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-xjTBoyBB.js";
 import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
 //#region src/bridges/tanstack-start.ts
 /** The `response` of a request middleware's `next()` result; server function results have none. */

package/dist/testing/index.d.ts

@@ -10,7 +10,7 @@ import { o as StreamStore } from "../store-CGjgWu5n.js";
 import { B as DbStats, b as Db, t as BetterSupabase, u as CacheAdapter } from "../define-CJJkkr1-.js";
 import { r as EventSink, t as CloudEvent } from "../cloud-event-C1JCc1bH.js";
 import { t as BetterPostgres } from "../pool-CAu2nLrL.js";
-import { R as SupportSessionStore, i as ServerContext, o as ServerOptions } from "../server-CeVeeXwz.js";
+import { i as ServerContext, o as ServerOptions, z as SupportSessionStore } from "../server-C6DWVEVG.js";
 import { s as Impersonator } from "../mfa-Daak8ukG.js";
 import { n as SessionActor, r as SessionDelegation } from "../actor-CQTlc1Hh.js";
 import { r as GuardOptions } from "../respond-DoBijysA.js";

package/dist/{version-Bvv6aLjZ.js → version-CQt77F3T.js}

@@ -1,4 +1,4 @@
 //#region src/core/version.ts
-const VERSION = "0.6.0";
+const VERSION = "0.6.1";
 //#endregion
 export { VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-supabase",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "description": "Strongly typed Supabase: generated schema, typed repositories, plugins, auth glue, framework integrations and the better-supabase CLI.",
   "keywords": [
     "cli",

package/dist/cli/gen-DAH8FM2W.js

@@ -1,2 +0,0 @@
-import { n as genCommand } from "./gen-BGLb_zou.js";
-export { genCommand };