better-supabase 0.6.0 → 0.7.0

package/dist/server/index.d.ts

@@ -2,24 +2,61 @@ import { b as DbError } from "../result-D7y2fT87.js";
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { m as RequestContext } from "../plugin-FGY8UhYm.js";
 import { _ as writeSession, a as CookieWrite, c as StoredSession, h as sessionCookieName, n as CookieOptions, p as readSession, r as CookieRecord, t as AUTH_CACHE_HEADERS } from "../session-ChiXDZdZ.js";
-import { a as ResolveAuthOptions, c as clientIp, i as InvalidReason, l as resolveAuth, n as AuthResolver, o as ResolvedState, r as AuthState, s as authContext, t as AuthResolution } from "../resolve-KW8nCeL6.js";
+import { a as ResolveAuthOptions, c as clientIp, i as InvalidReason, l as resolveAuth, n as AuthResolver, o as ResolvedState, r as AuthState, s as authContext, t as AuthResolution } from "../resolve-ChTYeTEl.js";
 import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DD8LZFjc.js";
 import { B as DbStats, b as Db, t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { A as clearSupportCookie, B as sqlSupportStore, C as SupportOptions, D as supportSessions, E as SupportStartRequest, F as SupportEndedBy, I as SupportListFilter, L as SupportSession, M as supportCookieValue, N as SqlSupportStoreOptions, O as SUPPORT_COOKIE, P as SupportCallerClaims, R as SupportSessionStore, S as SupportAuthorizeInput, T as SupportSessions, V as supportClaims, _ as DeleteAccountOptions, a as ServerDbOptions, b as ActiveSupport, c as createServer, d as SuspendAccountOptions, f as SuspendAccountResult, g as ReplicaState, h as PRIMARY_COOKIE, i as ServerContext, j as supportCookie, k as SupportCookieOptions, l as extendServer, m as suspendAccount, n as ContextOptions, o as ServerOptions, p as endSessions, r as ForContextOptions, s as TENANT_HEADER, t as BetterServer, u as EndSessionsResult, v as DeleteAccountResult, w as SupportPolicy, x as SupportApi, y as deleteAccount, z as SupportStartInput } from "../server-CeVeeXwz.js";
+import { A as supportSessions, B as SupportSession, C as ActiveSupport, D as SupportPolicy, E as SupportOptions, F as supportCookieValue, H as SupportStartInput, I as SqlSupportStoreOptions, L as SupportCallerClaims, M as SupportCookieOptions, N as clearSupportCookie, O as SupportSessions, P as supportCookie, R as SupportEndedBy, S as deleteAccount, T as SupportAuthorizeInput, U as sqlSupportStore, V as SupportSessionStore, W as supportClaims, _ as RequestIdOptions, a as ServerDbOptions, b as DeleteAccountOptions, c as createServer, d as LastSignIn, f as SuspendAccountOptions, g as suspendAccount, h as lastSignIns, i as ServerContext, j as SUPPORT_COOKIE, k as SupportStartRequest, l as extendServer, m as endSessions, n as ContextOptions, o as ServerOptions, p as SuspendAccountResult, r as ForContextOptions, s as TENANT_HEADER, t as BetterServer, u as EndSessionsResult, v as PRIMARY_COOKIE, w as SupportApi, x as DeleteAccountResult, y as ReplicaState, z as SupportListFilter } from "../server-ZSJ9rCcV.js";
 import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-Daak8ukG.js";
 import { n as SessionActor, r as SessionDelegation, t as ActClaim } from "../actor-CQTlc1Hh.js";
-import { n as toSession, t as AuthSession } from "../view-DbxLNu8L.js";
-import { a as SessionEntryConfig, c as withGuard, i as withBetterSupabase, l as ServerCore, n as BetterSupabaseContributions, o as withSession, r as BetterSupabaseEntry, s as GuardEntryConfig, t as BetterSupabaseConfig, u as serverCore } from "../composite-Bt1YK3Ke.js";
-import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-DoBijysA.js";
-import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-B5tid-q5.js";
-import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-D6Uc7Sk7.js";
+import { n as toSession, t as AuthSession } from "../view-CF7ihnkg.js";
+import { a as SessionEntryConfig, c as withGuard, i as withBetterSupabase, l as ServerCore, n as BetterSupabaseContributions, o as withSession, r as BetterSupabaseEntry, s as GuardEntryConfig, t as BetterSupabaseConfig, u as serverCore } from "../composite-CpHLEo-G.js";
+import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-DprrgyXX.js";
+import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-CkNzZUqv.js";
+import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-IPS5xi9q.js";
 import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-Cx-LnIQP.js";
-import { n as supportOf, t as SupportView } from "../support-view-33Oi07TT.js";
-import { a as sessionStatus, c as refreshSession, i as clearSessionCookies, n as SessionStatus, r as SessionStatusOptions, s as RefreshOutcome, t as ClearSessionCookiesOptions } from "../ended-jLfvw8h-.js";
+import { n as supportOf, t as SupportView } from "../support-view-CVOJJLpc.js";
+import { a as sessionStatus, c as refreshSession, i as clearSessionCookies, n as SessionStatus, r as SessionStatusOptions, s as RefreshOutcome, t as ClearSessionCookiesOptions } from "../ended-XjeGQ5XW.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware, SingleKeyEntry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
 import { PostgresApi } from "@supabase/server/middleware/postgres";
+//#region src/blocks/csv.d.ts
+interface CsvOptions {
+  /**
+   * The columns in order. Defaults to every key of the rows, in the order
+   * they first appear.
+   */
+  readonly columns?: readonly string[];
+  /**
+   * Prefixes a text cell that starts with `=`, `+`, `-`, `@`, a tab or a
+   * carriage return with `'`, so a spreadsheet shows it instead of running
+   * it as a formula (CSV injection). Default true.
+   */
+  readonly escapeFormulas?: boolean;
+}
+/** The columns of `rows`: every key, in the order it first appears. */
+export declare function csvColumns(rows: readonly Readonly<Record<string, unknown>>[]): string[];
+/**
+ * RFC 4180 CSV with a header row and CRLF line ends. Objects and arrays are
+ * written as JSON, null and undefined as empty cells.
+ */
+export declare function toCsv(rows: readonly Readonly<Record<string, unknown>>[], options?: CsvOptions): string;
+//#endregion
+//#region src/server/csv.d.ts
+interface CsvResponseOptions extends CsvOptions {
+  /** The download name, such as `invoices.csv`. */
+  readonly filename: string;
+  /** Extra headers, such as `cache-control`. `content-type` and `content-disposition` win. */
+  readonly headers?: ConstructorParameters<typeof Headers>[0];
+  readonly status?: number;
+}
+/**
+ * `rows` as a CSV download: `text/csv; charset=utf-8` with an `attachment`
+ * `Content-Disposition`. Text cells that start with a formula character are
+ * escaped unless `escapeFormulas` is false.
+ */
+export declare function csvResponse(rows: readonly Readonly<Record<string, unknown>>[], options: CsvResponseOptions): Response;
+//#endregion
 //#region src/server/audit.d.ts
 /** The CloudEvents `source` of the events the server sends to its `audit` sink. */
 export declare const SERVER_EVENT_SOURCE = "/better-supabase/server";
@@ -188,4 +225,4 @@ export declare function withDbStats(options?: {
   };
 }, () => DbStats>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizeOptions, type AuthorizedContext, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, aalOf, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, createServer, defineResource, deleteAccount, endSessions, extendServer, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, type Aal, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizeOptions, type AuthorizedContext, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, aalOf, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, createServer, defineResource, deleteAccount, endSessions, extendServer, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };

package/dist/server/index.js

@@ -2,20 +2,42 @@ import { n as dbError } from "../errors-B11Duf73.js";
 import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-BreOl8b8.js";
 import { i as userContext, r as impersonatorOf } from "../impersonation-DcqaTBHx.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
+import { n as toCsv, t as csvColumns } from "../csv-DCK-PT1n.js";
 import { n as postgresExecutor } from "../executor-De1Of3m3.js";
-import { C as serverCore, D as deleteAccount, E as suspendAccount, T as endSessions, _ as withSession, a as unexpectedResponse, b as shouldCheckSession, c as extendServer, d as clearSupportCookie, f as supportCookie, i as resolveToken, m as supportCookieValue, n as flushEvents, o as TENANT_HEADER, r as handle, s as createServer, u as SUPPORT_COOKIE, v as isPrefetch, w as SERVER_EVENT_SOURCE, x as shouldRefresh, y as refreshFor } from "../adapter-Bc1o3zyy.js";
+import { C as serverCore, D as suspendAccount, E as lastSignIns, O as deleteAccount, T as endSessions, _ as withSession, a as unexpectedResponse, b as shouldCheckSession, c as extendServer, d as clearSupportCookie, f as supportCookie, i as resolveToken, m as supportCookieValue, n as flushEvents, o as TENANT_HEADER, r as handle, s as createServer, u as SUPPORT_COOKIE, v as isPrefetch, w as SERVER_EVENT_SOURCE, x as shouldRefresh, y as refreshFor } from "../adapter-B-tL8hqg.js";
 import { n as PRIMARY_COOKIE } from "../replicas-CwrYp5Zj.js";
-import { _ as writeSession, a as refreshSession, c as AUTH_CACHE_HEADERS, h as sessionCookieName, i as resolveAuth, n as clientIp, o as clearSessionCookies, p as readSession, s as sessionStatus, t as authContext } from "../resolve-D_IcnvFd.js";
+import { _ as writeSession, a as refreshSession, c as AUTH_CACHE_HEADERS, h as sessionCookieName, i as resolveAuth, n as clientIp, o as clearSessionCookies, p as readSession, s as sessionStatus, t as authContext } from "../resolve-tJZY3FEa.js";
 import { a as checkAal, i as amrOf, n as toSession, r as aalOf } from "../view-BeFcRV6G.js";
 import { a as respond, i as isResult, o as settle, r as guard } from "../respond-BUgsXNgk.js";
-import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-BivNqSpK.js";
+import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-DWwzVf-O.js";
 import { n as jwtClaimsOf, r as userClaimsOf, t as authModeOf } from "../claims-DDBQT6BK.js";
-import { n as withGuard, t as withBetterSupabase } from "../composite-DhE66P5u.js";
+import { n as withGuard, t as withBetterSupabase } from "../composite-C6I8ZyaF.js";
 import { t as defineResource } from "../resource-BsvzCMlX.js";
 import { i as withServerTiming, n as parseDbStats, r as withDbStats, t as DB_CALLS_HEADER } from "../timing-CyTQPubY.js";
 import { n as tagCache, r as tagFor, t as cacheTagsOf } from "../tags-B99_U9Pp.js";
 import { a as rolesAt, r as hasRole } from "../kit-Fm-Fv7q5.js";
 import { defineMiddleware } from "@supabase/middleware";
+//#region src/server/csv.ts
+function disposition(filename) {
+	const safe = filename.replaceAll(/[\r\n]/g, " ");
+	return `attachment; filename="${safe.replaceAll(/[^\u0020-\u007E]|["\\]/g, "_")}"; filename*=UTF-8''${encodeURIComponent(safe).replaceAll(/['()*]/g, (char) => `%${char.codePointAt(0).toString(16).toUpperCase()}`)}`;
+}
+/**
+* `rows` as a CSV download: `text/csv; charset=utf-8` with an `attachment`
+* `Content-Disposition`. Text cells that start with a formula character are
+* escaped unless `escapeFormulas` is false.
+*/
+function csvResponse(rows, options) {
+	const { filename, headers, status, ...csv } = options;
+	const response = new Response(toCsv(rows, csv), {
+		status: status ?? 200,
+		...headers ? { headers } : {}
+	});
+	response.headers.set("content-type", "text/csv; charset=utf-8");
+	response.headers.set("content-disposition", disposition(filename));
+	return response;
+}
+//#endregion
 //#region src/server/entries/upstream.ts
 /** Repository context from a `@supabase/server` context. */
 function contextFromSupabase(ctx) {
@@ -120,4 +142,4 @@ async function checkSession(sql, auth) {
 	return row?.active === true ? void 0 : revoked;
 }
 //#endregion
-export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, amrOf, authContext, authModeOf, cacheTagsOf, checkAal, checkSession, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, defineResource, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, jwtClaimsOf, parseDbStats, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, resolveToken, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withGuard, withServerTiming, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, amrOf, authContext, authModeOf, cacheTagsOf, checkAal, checkSession, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, csvColumns, csvResponse, defineResource, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, jwtClaimsOf, lastSignIns, parseDbStats, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, resolveToken, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withGuard, withServerTiming, withSession, writeSession };

package/dist/{server-CeVeeXwz.d.ts → server-ZSJ9rCcV.d.ts}

@@ -6,8 +6,8 @@ import { m as RequestContext } from "./plugin-FGY8UhYm.js";
 import { a as EventHub } from "./events-DWDhx77e.js";
 import { t as BetterSupabaseEnv } from "./index-CLg87OBW.js";
 import { a as CookieWrite } from "./session-ChiXDZdZ.js";
-import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-KW8nCeL6.js";
-import { r as CredentialProvider } from "./provider-BH5UWZJ6.js";
+import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-ChTYeTEl.js";
+import { r as CredentialProvider } from "./provider-D-UEMvSD.js";
 import { B as DbStats, H as StatsRecorder, b as Db, t as BetterSupabase } from "./define-CJJkkr1-.js";
 import { r as EventSink } from "./cloud-event-C1JCc1bH.js";
 import { s as SqlClaims, t as BetterPostgres } from "./pool-CAu2nLrL.js";
@@ -278,6 +278,14 @@ interface ReplicaState {
   pin(): void;
 }
 //#endregion
+//#region src/server/request-ids.d.ts
+interface RequestIdOptions {
+  readonly requestHeader?: string;
+  readonly correlationHeader?: string;
+  readonly incoming?: boolean;
+  readonly generate?: boolean;
+}
+//#endregion
 //#region src/server/suspend-account.d.ts
 interface EndSessionsResult {
   readonly userId: string;
@@ -293,6 +301,17 @@ interface SuspendAccountResult {
   readonly ended: number;
 }
 declare function endSessions(sql: SqlClient, userId: string): AsyncResult<EndSessionsResult>;
+interface LastSignIn {
+  readonly userId: string;
+  /** `null` for a user who never signed in. */
+  readonly lastSignInAt: Temporal.Instant | null;
+}
+/**
+ * The last sign-in of each user, in one query (`better_supabase.last_sign_ins`
+ * from the `sessions` module, which only the service role may call). Users
+ * that don't exist are missing from the map.
+ */
+declare function lastSignIns(sql: SqlClient, userIds: readonly string[]): AsyncResult<ReadonlyMap<string, LastSignIn>>;
 declare function suspendAccount(service: SupabaseClient | (() => SupabaseClient), sql: SqlClient, userId: string, options: SuspendAccountOptions): AsyncResult<SuspendAccountResult>;
 //#endregion
 //#region src/server/server.d.ts
@@ -334,6 +353,7 @@ interface ServerOptions {
    * `current_setting('request.headers')` (channel, request id, client IP for audit).
    */
   readonly headers?: (request: Request) => Readonly<Record<string, string>>;
+  readonly requestIds?: RequestIdOptions | false;
   /**
    * PostgREST URL for the caller's reads: a read replica or the `<ref>-all`
    * load balancer. Defaults to `SUPABASE_READ_URL`; `false` reads from the
@@ -431,6 +451,8 @@ interface ServerContext<M extends AnyModels, F extends AnyFunctions, E, C = unkn
   readonly support?: ActiveSupport;
   /** `options.credentials`, when the server has one. */
   readonly credentials?: CredentialProvider;
+  readonly requestId?: string;
+  readonly correlationId?: string;
 }
 interface ContextOptions {
   readonly refresh?: boolean;
@@ -447,6 +469,8 @@ interface ContextOptions {
    * looks it up itself; `contextFromResolution` only uses this.
    */
   readonly support?: ActiveSupport;
+  readonly requestId?: string;
+  readonly correlationId?: string;
 }
 interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
   readonly env: BetterSupabaseEnv;
@@ -513,4 +537,4 @@ declare function extendServer<R extends object>(server: object, extra: Omit<R, S
  */
 declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
 //#endregion
-export { clearSupportCookie as A, sqlSupportStore as B, SupportOptions as C, supportSessions as D, SupportStartRequest as E, SupportEndedBy as F, SupportListFilter as I, SupportSession as L, supportCookieValue as M, SqlSupportStoreOptions as N, SUPPORT_COOKIE as O, SupportCallerClaims as P, SupportSessionStore as R, SupportAuthorizeInput as S, SupportSessions as T, supportClaims as V, DeleteAccountOptions as _, ServerDbOptions as a, ActiveSupport as b, createServer as c, SuspendAccountOptions as d, SuspendAccountResult as f, ReplicaState as g, PRIMARY_COOKIE as h, ServerContext as i, supportCookie as j, SupportCookieOptions as k, extendServer as l, suspendAccount as m, ContextOptions as n, ServerOptions as o, endSessions as p, ForContextOptions as r, TENANT_HEADER as s, BetterServer as t, EndSessionsResult as u, DeleteAccountResult as v, SupportPolicy as w, SupportApi as x, deleteAccount as y, SupportStartInput as z };
+export { supportSessions as A, SupportSession as B, ActiveSupport as C, SupportPolicy as D, SupportOptions as E, supportCookieValue as F, SupportStartInput as H, SqlSupportStoreOptions as I, SupportCallerClaims as L, SupportCookieOptions as M, clearSupportCookie as N, SupportSessions as O, supportCookie as P, SupportEndedBy as R, deleteAccount as S, SupportAuthorizeInput as T, sqlSupportStore as U, SupportSessionStore as V, supportClaims as W, RequestIdOptions as _, ServerDbOptions as a, DeleteAccountOptions as b, createServer as c, LastSignIn as d, SuspendAccountOptions as f, suspendAccount as g, lastSignIns as h, ServerContext as i, SUPPORT_COOKIE as j, SupportStartRequest as k, extendServer as l, endSessions as m, ContextOptions as n, ServerOptions as o, SuspendAccountResult as p, ForContextOptions as r, TENANT_HEADER as s, BetterServer as t, EndSessionsResult as u, PRIMARY_COOKIE as v, SupportApi as w, DeleteAccountResult as x, ReplicaState as y, SupportListFilter as z };

package/dist/solid/index.d.ts

@@ -2,9 +2,9 @@ import { b as DbError } from "../result-D7y2fT87.js";
 import { it as QuerySpec } from "../define-CJJkkr1-.js";
 import { n as TemplateValues } from "../template-CwO38Do8.js";
 import { t as AuthSnapshot } from "../bind-Bu_ZNa3W.js";
-import { t as AuthSession } from "../view-DbxLNu8L.js";
+import { t as AuthSession } from "../view-CF7ihnkg.js";
 import { S as Topic, f as PresenceMember, u as EventSchemas, w as TopicHandlers, x as SubscriptionStatus } from "../index-DunNRdnT.js";
-import { t as SupportView } from "../support-view-33Oi07TT.js";
+import { t as SupportView } from "../support-view-CVOJJLpc.js";
 import { a as BroadcastOptions, c as LiveCountSource, d as PresenceTopic, f as UseActionOptions, i as ActionState, l as LiveQueryHookOptions, n as ActionInputOf, o as ClientLike, r as ActionResultOf, s as LiveCountHookOptions, t as fieldErrorsOf, u as PresenceHookOptions } from "../field-errors-BFOa7WhB.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Accessor, JSX } from "solid-js";

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-CeVeeXwz.js";
-import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
-import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-DuVb4Xa8.js";
+import { t as BetterServer } from "../server-ZSJ9rCcV.js";
+import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
+import { t as RefusalRedirects } from "../refusal-DhSU2Vvr.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-KIPvRQJU.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/solid-start/index.d.ts
 /** The part of a SolidStart `FetchEvent` the integration reads and writes. */

package/dist/solid-start/index.js

@@ -1,7 +1,7 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-B-tL8hqg.js";
 import { t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-CONDyPYx.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-BDCpJI7o.js";
 import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
 import { t as beforeRoute } from "../before-route-CnR0C0Jr.js";
 //#region src/solid-start/index.ts

package/dist/sql/index.d.ts

@@ -191,6 +191,8 @@ interface ModuleLayout {
   readonly policyGrants?: readonly TableGrant[];
   /** The tables the schema files create, for `sql.modules.sessions.options.policies`. */
   readonly declaredTables?: readonly string[];
+  /** The declared tables with row level security on, for tables `fromPolicies` makes service-only. */
+  readonly rlsTables?: readonly string[];
   /** `config.readSets`, compiled: the functions the `read-sets` module writes. */
   readonly readSets?: readonly {
     readonly name: string;
@@ -417,6 +419,14 @@ interface PolicyGrant {
 export declare function declaredTables(files: readonly {
   readonly text: string;
 }[], schemas: readonly string[]): string[];
+/**
+ * The tables in `schemas` that `files` leave with row level security on:
+ * `alter table ... enable row level security`, until a later `disable` or
+ * `drop table`.
+ */
+export declare function rlsTables(files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): string[];
 /**
  * The privileges the permissive policies in `files` imply, per table and
  * role: `for all` gives the four commands, `to public` (or no `to`) counts

package/dist/sql/index.js

@@ -9,7 +9,7 @@ import { t as FINAL_RUN_STATES$1 } from "../run-state-CgBKzYMW.js";
 import { t as AI_MESSAGE_PART_TYPES } from "../message-CaKlqdsX.js";
 import { A as jwtClaim, B as replaceColumnCheck, C as canIn, D as disabledHelpersNeedLaterTables, E as disabledHelpers, F as pageSize, G as splitTable$1, H as serviceGrant, I as quotedTable, J as userGrant, K as tenantIn, L as raise$1, M as membershipDisabledAt, N as membershipSuspended, O as ensureCheck, P as organizationMissing, R as recordTrigger, S as addForeignKey, T as columnsObject, U as serviceOnly$1, V as schemaPreamble, W as sha256Hex, _ as SCHEMA, a as MODULE_PERMISSION_SCOPES, b as activeMembership, c as modulePermission, d as roleNames, f as roleScopeIs, g as NOTHING, h as EQUIVALENT_TRIGGERS, i as MODULE_PERMISSIONS, j as memberAddedRecord, k as jsonSchemaChecks, l as modulePermissionKey, m as tenantScope, n as WORKFLOW_SDK_WORLD, o as accessModel, p as rolesOf, q as updatedAt, s as hasPlatformRoles, u as providerPlatformRoles, v as SERVICE_CALLER, w as columnRef, x as addExtraColumns, y as accessDefinesDisabledHelpers, z as renameSql } from "../workflow-sdk-world-D-prir6O.js";
 import { c as templateFunctions, i as fillTemplate, o as resolveProviderSql, s as scopeProblems, t as SCOPE_ID_TYPES } from "../access-sql-B0dF-SoF.js";
-import { t as VERSION } from "../version-Bvv6aLjZ.js";
+import { t as VERSION } from "../version--AolB5ej.js";
 //#region src/sql/api-schema.ts
 /** The roles PostgREST runs a request as. */
 const API_ROLES = /* @__PURE__ */ new Set([
@@ -10196,6 +10196,20 @@ revoke execute on function better_supabase.audit_settings(regclass) from public,
 revoke execute on function better_supabase.audit_schema_calls(text, text, text[]) from public, anon, authenticated;
 revoke execute on function better_supabase.audit_schema(text, text, text[]) from public, anon, authenticated;`;
 //#endregion
+//#region src/sql/modules/audit-request.ts
+const requestHeader = (name) => `better_supabase.request_header(${sqlString(name)})`;
+const traceId = (setting, header) => `coalesce(better_supabase.request_id_or_null(current_setting(${sqlString(setting)}, true)), better_supabase.request_id_or_null(${requestHeader(header)}))`;
+const requestIdSql = (ctx) => traceId("better_supabase.request_id", ctx.text("requestIdHeader", "x-request-id").toLowerCase());
+const correlationIdSql = (ctx) => traceId("better_supabase.correlation_id", ctx.text("correlationIdHeader", "x-correlation-id").toLowerCase());
+const REQUEST_ID_OR_NULL = `create or replace function better_supabase.request_id_or_null(value text)
+returns text
+language sql
+immutable
+set search_path = ''
+as $$
+  select case when value ~ '^[A-Za-z0-9._:;,@/+=-]{1,128}$' then value end;
+$$;`;
+//#endregion
 //#region src/sql/modules/audit-retention.ts
 /**
 * `purge_audit_log`, which honours an `audit_retention(tenant)` hook, and
@@ -10437,6 +10451,7 @@ const NAMES$24 = {
 	} },
 	options: [
 		"appendOnly",
+		"correlationIdHeader",
 		"eventCategory",
 		"eventRoles",
 		"trustedRoles",
@@ -10446,6 +10461,7 @@ const NAMES$24 = {
 		"keepMappedMetadata",
 		"metadataColumns",
 		"readPolicy",
+		"requestIdHeader",
 		"restricted",
 		"tenantColumn",
 		"tenantLabel",
@@ -10562,8 +10578,6 @@ function castId(value, idType) {
 		default: return idType;
 	}
 }
-/** The request header `name`, or null outside a Data API request. */
-const requestHeader = (name) => `better_supabase.request_header(${sqlString(name)})`;
 /** How the caller acted: service, support, impersonation, oauth-client, user or system. */
 const ACTOR_KIND = `case
       when coalesce(auth.jwt() ->> 'role', '') = 'service_role' then 'service'
@@ -10582,7 +10596,7 @@ function contextPairs(ctx, tenant, values) {
 		["tenantLabel", tenantLabel(ctx, tenant)],
 		["targetLabel", values.targetLabel],
 		["summary", values.summary],
-		["requestId", values.requestId ?? requestHeader("x-request-id")],
+		["requestId", values.requestId ?? requestIdSql(ctx)],
 		["correlationId", values.correlationId],
 		["scope", auditWrite(ctx, "scope", values.scope ?? `case when ${tenant} is null then 'platform' else 'tenant' end`)]
 	];
@@ -10632,7 +10646,8 @@ revoke all on ${ctx.table("restricted")} from anon, authenticated;` : "";
 -- Semantic events (audit_event) and the per-table registry fill these.${add("eventType", "text")}${add("category", "text")}${add("outcome", "text")}${add("source", "text")}${add("targetType", "text")}${add("metadata", "jsonb")}${add("idempotencyKey", "text")}
 -- Who acted and on what, as it was then, for audit pages.${add("actorKind", "text")}${add("actorLabel", "text")}${add("tenantLabel", "text")}${add("targetLabel", "text")}${add("summary", "text")}${add("requestId", "text")}${add("correlationId", "text")}${add("scope", "text")}
 ${ctx.has("log", "table") && ctx.has("log", "record") ? `create index if not exists audit_events_record_idx on ${log} (${c("table")}, ${c("record")}, ${c("occurredAt")} desc);\n` : ""}create index if not exists audit_events_organization_idx on ${log} (${c("tenant")}, ${c("occurredAt")} desc);
-create index if not exists audit_events_occurred_at_idx on ${log} (${c("occurredAt")});${ctx.has("log", "idempotencyKey") ? `
+create index if not exists audit_events_occurred_at_idx on ${log} (${c("occurredAt")});${ctx.has("log", "correlationId") ? `
+create index if not exists audit_events_correlation_idx on ${log} (${c("correlationId")}) where ${c("correlationId")} is not null;` : ""}${ctx.has("log", "idempotencyKey") ? `
 create unique index if not exists audit_events_idempotency_idx on ${log} (${c("idempotencyKey")}, ${c("tenant")}) nulls not distinct where ${c("idempotencyKey")} is not null;` : ""}
 alter table ${log} enable row level security;
 revoke all on ${log} from anon, authenticated;
@@ -10682,6 +10697,8 @@ exception when others then
 end;
 $$;
 
+${REQUEST_ID_OR_NULL}
+
 -- The client address the API gateway appended to x-forwarded-for (the
 -- right-most hop; clients can forge the ones before it), or null.
 create or replace function better_supabase.request_ip()
@@ -10750,7 +10767,7 @@ function triggerFunction(ctx, tenantColumn, restricted) {
 		...contextPairs(ctx, "row_tenant", {
 			targetLabel: "row_data ->> entry.label_column",
 			summary: "null",
-			correlationId: requestHeader("x-correlation-id")
+			correlationId: correlationIdSql(ctx)
 		})
 	]);
 	const tenantValue = castId(`row_data ->> coalesce(entry.tenant_column, ${sqlString(tenantColumn)})`, ctx.idType);
@@ -10864,10 +10881,10 @@ function auditEvent(ctx, restricted) {
 		...contextPairs(ctx, "tenant", {
 			targetLabel: "target_label",
 			summary: "summary",
-			correlationId: `coalesce(correlation_id, ${requestHeader("x-correlation-id")})`,
+			correlationId: `coalesce(better_supabase.request_id_or_null(correlation_id), ${correlationIdSql(ctx)})`,
 			actorKind: `coalesce(actor_kind, ${ACTOR_KIND})`,
 			actorLabel: `coalesce(actor_label, ${ACTOR_LABEL})`,
-			requestId: `coalesce(request_id, ${requestHeader("x-request-id")})`,
+			requestId: `coalesce(better_supabase.request_id_or_null(request_id), ${requestIdSql(ctx)})`,
 			scope: "coalesce(audit_event.scope, case when tenant is null then 'platform' else 'tenant' end)"
 		})
 	]);
@@ -11075,7 +11092,7 @@ const AUDIT = {
 	dependencies: (layout) => layout.modules?.["audit"]?.options?.["readPolicy"] === true ? ["access"] : [],
 	target: "schema",
 	modes: ["managed", "adopt"],
-	version: 5,
+	version: 6,
 	names: NAMES$24,
 	contract: () => [
 		{
@@ -11170,6 +11187,11 @@ const AUDIT = {
 			from: 4,
 			description: "Drops the read-only audit_log view that 0.5 kept for the 0.4 names; read better_supabase.audit_events.",
 			sql: (ctx) => `drop view if exists ${sqlIdent(ctx.tableName("log").schema)}.audit_log;`
+		},
+		{
+			from: 5,
+			description: "Row changes and audit_event read the request and correlation ids from the better_supabase.request_id and better_supabase.correlation_id settings, then from the requestIdHeader and correlationIdHeader headers, and keep only ids of up to 128 safe characters; managed logs index correlation_id.",
+			sql: () => ""
 		}
 	],
 	deprecated: [{
@@ -35105,6 +35127,33 @@ function declaredTables(files, schemas) {
 	}
 	return [...found];
 }
+const RLS_TOGGLE = new RegExp(String.raw`\balter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?(${NAME}(?:\s*\.\s*${NAME})?)\s+(enable|disable)\s+row\s+level\s+security\b`, "gi");
+/**
+* The tables in `schemas` that `files` leave with row level security on:
+* `alter table ... enable row level security`, until a later `disable` or
+* `drop table`.
+*/
+function rlsTables(files, schemas) {
+	const found = /* @__PURE__ */ new Set();
+	for (const file of files) {
+		const text = withoutComments(file.text);
+		inOrder([[...text.matchAll(RLS_TOGGLE)].map((match) => ({
+			index: match.index,
+			apply: () => {
+				const table = qualified$1(match[1]);
+				if (!schemas.includes(table.slice(0, table.indexOf(".")))) return;
+				if (match[2].toLowerCase() === "enable") found.add(table);
+				else found.delete(table);
+			}
+		})), [...text.matchAll(DROP_TABLE)].map((match) => ({
+			index: match.index,
+			apply: () => {
+				for (const table of droppedTables(match[1])) found.delete(table);
+			}
+		}))]);
+	}
+	return [...found];
+}
 const TABLE_CONSTRAINT = /^(constraint|check|unique|primary|foreign|exclude|like)\b/i;
 /**
 * Columns each `create table` in `files` declares, as `schema.table` to
@@ -35487,6 +35536,23 @@ $$;
 revoke execute on function better_supabase.session_active() from public, anon;
 grant execute on function better_supabase.session_active() to authenticated;
 
+-- The last sign-in of many users in one query, for admin lists. auth.users
+-- isn't readable through the Data API, so only the service role calls this.
+create or replace function better_supabase.last_sign_ins(p_users uuid[])
+returns table (user_id uuid, last_sign_in_at timestamptz)
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select u.id, u.last_sign_in_at
+  from auth.users u
+  where u.id = any(p_users)
+$$;
+
+revoke execute on function better_supabase.last_sign_ins(uuid[]) from public, anon, authenticated;
+grant execute on function better_supabase.last_sign_ins(uuid[]) to service_role;
+
 -- Restrictive, so it applies on top of the table's other policies. Wrapped in
 -- a select, it runs one indexed lookup per statement:
 -- create policy session_required on public.invoices as restrictive
@@ -37379,17 +37445,20 @@ const keyOf = (name) => name.includes(".") ? name : `public.${name}`;
 * Each listed table's complete privilege set: everything is revoked from
 * the API roles first, then the listed privileges are granted. Policy
 * grants fill tables `expose` doesn't list, with every privilege for
-* `service_role`.
+* `service_role`. With policy grants on, a declared table that `expose`
+* doesn't list, with RLS on and no permissive policy reaching it, is service-only.
 */
 function tableGrants(layout) {
 	const listed = layout.grants ?? [];
 	const named = new Set(listed.map((grant) => keyOf(grant.table)));
 	const derived = (layout.policyGrants ?? []).filter((grant) => !named.has(keyOf(grant.table)));
 	const derivedTables = [...new Set(derived.map((grant) => grant.table))];
+	const reached = new Set((layout.policyGrants ?? []).map((grant) => keyOf(grant.table)));
+	const serviceOnly = layout.policyGrants === void 0 ? [] : (layout.declaredTables ?? []).filter((table) => (layout.rlsTables ?? []).includes(table) && !named.has(keyOf(table)) && !reached.has(keyOf(table)));
 	const grants = [
 		...listed,
 		...derived,
-		...derivedTables.map((table) => ({
+		...[...derivedTables, ...serviceOnly].map((table) => ({
 			table,
 			role: "service_role",
 			privileges: [
@@ -37407,7 +37476,7 @@ function tableGrants(layout) {
 	});
 	const all = [...statements, ...functions];
 	if (all.length === 0) return "";
-	return `\n-- config.expose${derived.length > 0 ? " and the policies (sql.modules.grants.options.fromPolicies)" : ""}\n${all.join("\n")}\n`;
+	return `\n-- config.expose${derived.length > 0 || serviceOnly.length > 0 ? " and the policies (sql.modules.grants.options.fromPolicies)" : ""}\n${all.join("\n")}\n`;
 }
 /** A jsonb column and the JSON Schema its values must match. */
 /** Users with a membership in a tenant of `customer`, from the provider's membership tables. */
@@ -38203,4 +38272,4 @@ async function compileReadSets(sets) {
 	return Promise.all(names.map((name) => compileReadSet(byName.get(name))));
 }
 //#endregion
-export { AUDIT_CATEGORIES, MODULE_ID_TYPES, SCOPE_ID_TYPES, SQL_MODULES, adoptedColumnProblems, auditRegistrations, compileReadSet, compileReadSets, contractSignature, customContracts, declaredTables, extensionSchema, isModuleIdType, migrationOptionUses, moduleBody, moduleDeprecations, moduleEventTriggers, moduleFilePaths, moduleFileVersion, moduleIdType, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, moduleVersion, policyGrants, renderModules, resolveModules, resolveProviderSql, sameModuleFile, scopeProblems, sharedRolesProblems, templateFunctions, upgradePlan };
+export { AUDIT_CATEGORIES, MODULE_ID_TYPES, SCOPE_ID_TYPES, SQL_MODULES, adoptedColumnProblems, auditRegistrations, compileReadSet, compileReadSets, contractSignature, customContracts, declaredTables, extensionSchema, isModuleIdType, migrationOptionUses, moduleBody, moduleDeprecations, moduleEventTriggers, moduleFilePaths, moduleFileVersion, moduleIdType, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, moduleVersion, policyGrants, renderModules, resolveModules, resolveProviderSql, rlsTables, sameModuleFile, scopeProblems, sharedRolesProblems, templateFunctions, upgradePlan };

package/dist/ssr/index.d.ts

@@ -1,6 +1,6 @@
 import { _ as writeSession, a as CookieWrite, c as StoredSession, d as clearSessionAtScopes, f as parseCookies, g as sessionEncoding, h as sessionCookieName, i as CookieScope, l as WriteSessionOptions, m as serializeCookie, n as CookieOptions, o as DEFAULT_SESSION_ENCODING, p as readSession, r as CookieRecord, s as SessionEncoding, t as AUTH_CACHE_HEADERS, u as applyCookieWrites } from "../session-ChiXDZdZ.js";
-import { a as ResolveAuthOptions, l as resolveAuth, n as AuthResolver, r as AuthState, s as authContext, t as AuthResolution } from "../resolve-KW8nCeL6.js";
-import { n as toSession, t as AuthSession } from "../view-DbxLNu8L.js";
-import { r as MembershipClaim } from "../entitlements-DHrY2UDZ.js";
-import { a as sessionStatus, c as refreshSession, i as clearSessionCookies, n as SessionStatus, o as RefreshOptions, r as SessionStatusOptions, s as RefreshOutcome, t as ClearSessionCookiesOptions } from "../ended-jLfvw8h-.js";
+import { a as ResolveAuthOptions, l as resolveAuth, n as AuthResolver, r as AuthState, s as authContext, t as AuthResolution } from "../resolve-ChTYeTEl.js";
+import { n as toSession, t as AuthSession } from "../view-CF7ihnkg.js";
+import { r as MembershipClaim } from "../entitlements-BKSVGtrG.js";
+import { a as sessionStatus, c as refreshSession, i as clearSessionCookies, n as SessionStatus, o as RefreshOptions, r as SessionStatusOptions, s as RefreshOutcome, t as ClearSessionCookiesOptions } from "../ended-XjeGQ5XW.js";
 export { AUTH_CACHE_HEADERS, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type ClearSessionCookiesOptions, type CookieOptions, type CookieRecord, type CookieScope, type CookieWrite, DEFAULT_SESSION_ENCODING, type MembershipClaim, type RefreshOptions, type RefreshOutcome, type ResolveAuthOptions, type SessionEncoding, type SessionStatus, type SessionStatusOptions, type StoredSession, type WriteSessionOptions, applyCookieWrites, authContext, clearSessionAtScopes, clearSessionCookies, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, sessionEncoding, sessionStatus, toSession, writeSession };

package/dist/ssr/index.js

@@ -1,3 +1,3 @@
-import { _ as writeSession, a as refreshSession, c as AUTH_CACHE_HEADERS, d as clearSessionAtScopes, f as parseCookies, g as sessionEncoding, h as sessionCookieName, i as resolveAuth, l as DEFAULT_SESSION_ENCODING, m as serializeCookie, o as clearSessionCookies, p as readSession, s as sessionStatus, t as authContext, u as applyCookieWrites } from "../resolve-D_IcnvFd.js";
+import { _ as writeSession, a as refreshSession, c as AUTH_CACHE_HEADERS, d as clearSessionAtScopes, f as parseCookies, g as sessionEncoding, h as sessionCookieName, i as resolveAuth, l as DEFAULT_SESSION_ENCODING, m as serializeCookie, o as clearSessionCookies, p as readSession, s as sessionStatus, t as authContext, u as applyCookieWrites } from "../resolve-tJZY3FEa.js";
 import { n as toSession } from "../view-BeFcRV6G.js";
 export { AUTH_CACHE_HEADERS, DEFAULT_SESSION_ENCODING, applyCookieWrites, authContext, clearSessionAtScopes, clearSessionCookies, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, sessionEncoding, sessionStatus, toSession, writeSession };

package/dist/{support-BivNqSpK.js → support-DWwzVf-O.js}

@@ -3,7 +3,7 @@ import { t as temporal } from "./temporal-required-BVvW7SYJ.js";
 import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-DzUbqgdW.js";
 import { n as validate } from "./standard-BK0cqJ7y.js";
 import { t as fromPgError } from "./executor-De1Of3m3.js";
-import { d as clearSupportCookie, f as supportCookie, m as supportCookieValue } from "./adapter-Bc1o3zyy.js";
+import { d as clearSupportCookie, f as supportCookie, m as supportCookieValue } from "./adapter-B-tL8hqg.js";
 import { r as sqlIdent } from "./template--jDkl3UP.js";
 import { i as emitBlockEvent } from "./block-events-CrT8r7Fe.js";
 //#region src/auth/support.ts

package/dist/{support-view-33Oi07TT.d.ts → support-view-CVOJJLpc.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSession } from "./view-DbxLNu8L.js";
+import { t as AuthSession } from "./view-CF7ihnkg.js";
 //#region src/auth/support-view.d.ts
 /** A running support session as the target's view shows it, for a banner. */
 interface SupportView {

package/dist/svelte/index.d.ts

@@ -2,7 +2,7 @@ import { b as DbError } from "../result-D7y2fT87.js";
 import { it as QuerySpec } from "../define-CJJkkr1-.js";
 import { n as TemplateValues } from "../template-CwO38Do8.js";
 import { t as AuthSnapshot } from "../bind-Bu_ZNa3W.js";
-import { t as AuthSession } from "../view-DbxLNu8L.js";
+import { t as AuthSession } from "../view-CF7ihnkg.js";
 import { S as Topic, f as PresenceMember, u as EventSchemas, w as TopicHandlers, x as SubscriptionStatus } from "../index-DunNRdnT.js";
 import { a as BroadcastOptions, c as LiveCountSource, d as PresenceTopic, f as UseActionOptions, i as ActionState, l as LiveQueryHookOptions, n as ActionInputOf, o as ClientLike, r as ActionResultOf, s as LiveCountHookOptions, t as fieldErrorsOf, u as PresenceHookOptions } from "../field-errors-BFOa7WhB.js";
 import { SupabaseClient } from "@supabase/supabase-js";

package/dist/sveltekit/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-CeVeeXwz.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
-import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-DuVb4Xa8.js";
+import { t as BetterServer } from "../server-ZSJ9rCcV.js";
+import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
+import { t as RefusalRedirects } from "../refusal-DhSU2Vvr.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-KIPvRQJU.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { i as tagFor } from "../tags-Cx-LnIQP.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";

package/dist/sveltekit/index.js

@@ -1,12 +1,12 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
 import { r as dbErrorOf } from "../errors-B11Duf73.js";
 import { o as toProblem } from "../problem-BreOl8b8.js";
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-B-tL8hqg.js";
 import { t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { r as tagFor } from "../tags-B99_U9Pp.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
 import { n as bufferInPlace, t as around } from "../shared-CBxosKK3.js";
-import { a as platformWaitUntil, i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-CONDyPYx.js";
+import { a as platformWaitUntil, i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-BDCpJI7o.js";
 import { i as refusalTarget } from "../refusal-CeJWxmkH.js";
 //#region src/bridges/sveltekit.ts
 /**

package/dist/tanstack-start/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-CeVeeXwz.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
-import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-DuVb4Xa8.js";
+import { t as BetterServer } from "../server-ZSJ9rCcV.js";
+import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
+import { t as RefusalRedirects } from "../refusal-DhSU2Vvr.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-KIPvRQJU.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";