better-supabase 0.6.1 → 0.7.1

package/dist/{adapter-CHnPkCPd.js → adapter-iKgjHVPx.js}

@@ -1,4 +1,5 @@
-import { c as mapDbError, n as dbError, o as isDbError } from "./errors-B11Duf73.js";
+import { c as mapDbError, n as dbError, o as isDbError, r as dbErrorOf } from "./errors-B11Duf73.js";
+import { t as temporal } from "./temporal-required-BVvW7SYJ.js";
 import { a as ok, r as err, t as AsyncResult } from "./result-DzUbqgdW.js";
 import { a as postgrestExecutor, n as StatsRecorder } from "./stats-D_AD9GGu.js";
 import { a as problemResponse } from "./problem-BreOl8b8.js";
@@ -7,7 +8,7 @@ import { a as actorOf, i as userContext, n as impersonatorClaim, t as actClaim }
 import { t as fromPgError } from "./executor-De1Of3m3.js";
 import { n as forwardBlockEvents } from "./cloud-event-BnmD5fb9.js";
 import { a as replicaState, i as primaryCookieWrite, o as routedExecutor, r as pinnedUntil, s as withPrimaryPin } from "./replicas-CwrYp5Zj.js";
-import { c as AUTH_CACHE_HEADERS, d as clearSessionAtScopes, f as parseCookies, h as sessionCookieName, i as resolveAuth, m as serializeCookie, r as prefetchJwks, t as authContext } from "./resolve-D_IcnvFd.js";
+import { c as AUTH_CACHE_HEADERS, d as clearSessionAtScopes, f as parseCookies, h as sessionCookieName, i as resolveAuth, m as serializeCookie, r as prefetchJwks, t as authContext } from "./resolve-tJZY3FEa.js";
 import { t as credentialProviderOf } from "./provider-Di3sRutW.js";
 import { a as respond, n as defaultPrefetchJwks, r as guard, t as defaultExpose } from "./respond-BUgsXNgk.js";
 import { createClient } from "@supabase/supabase-js";
@@ -137,7 +138,8 @@ function invalidUser(userId) {
 	return dbError("invalid_request", `"${userId}" is not a user id`, { table: "auth.users" });
 }
 function fromSqlError(cause) {
-	if (isDbError(cause)) return cause;
+	const known = dbErrorOf(cause);
+	if (known) return known;
 	const raw = fromPgError(cause);
 	if (raw) return {
 		...mapDbError(raw),
@@ -162,6 +164,29 @@ function endSessions(sql, userId) {
 		}
 	});
 }
+const LAST_SIGN_INS = `select user_id, last_sign_in_at
+from better_supabase.last_sign_ins($1::uuid[])`;
+/**
+* The last sign-in of each user, in one query (`better_supabase.last_sign_ins`
+* from the `sessions` module, which only the service role may call). Users
+* that don't exist are missing from the map.
+*/
+function lastSignIns(sql, userIds) {
+	return AsyncResult.from(async () => {
+		const invalid = userIds.find((userId) => !UUID.test(userId));
+		if (invalid !== void 0) return err(invalidUser(invalid));
+		if (userIds.length === 0) return ok(/* @__PURE__ */ new Map());
+		try {
+			const rows = await sql.queryRaw(LAST_SIGN_INS, [[...new Set(userIds)]]);
+			return ok(new Map(rows.map((row) => [row.user_id, {
+				userId: row.user_id,
+				lastSignInAt: row.last_sign_in_at === null ? null : temporal().Instant.from(row.last_sign_in_at instanceof Date ? row.last_sign_in_at.toISOString() : row.last_sign_in_at)
+			}])));
+		} catch (cause) {
+			return err(fromSqlError(cause));
+		}
+	});
+}
 async function ban(client, userId, duration) {
 	try {
 		const { error } = await client.auth.admin.updateUserById(userId, { ban_duration: duration });
@@ -178,6 +203,11 @@ function suspendAccount(service, sql, userId, options) {
 		if (suspended) {
 			const refused = await ban(client, userId, options.duration ?? FOREVER);
 			if (refused) return err(refused);
+			if (options.endSessions !== true) return ok({
+				userId,
+				suspended,
+				ended: 0
+			});
 		}
 		let ended;
 		try {
@@ -1157,4 +1187,4 @@ async function resolveToken(server, token) {
 	return auth;
 }
 //#endregion
-export { serverCore as C, deleteAccount as D, suspendAccount as E, withServerContext as S, endSessions as T, withSession as _, unexpectedResponse as a, shouldCheckSession as b, extendServer as c, clearSupportCookie as d, supportCookie as f, withSupport as g, withTenant as h, resolveToken as i, withExtra as l, supportCookieValue as m, flushEvents as n, TENANT_HEADER as o, supportCookieMaxAge as p, handle as r, createServer as s, bearerRequest as t, SUPPORT_COOKIE as u, isPrefetch as v, SERVER_EVENT_SOURCE as w, shouldRefresh as x, refreshFor as y };
+export { serverCore as C, suspendAccount as D, lastSignIns as E, deleteAccount as O, withServerContext as S, endSessions as T, withSession as _, unexpectedResponse as a, shouldCheckSession as b, extendServer as c, clearSupportCookie as d, supportCookie as f, withSupport as g, withTenant as h, resolveToken as i, withExtra as l, supportCookieValue as m, flushEvents as n, TENANT_HEADER as o, supportCookieMaxAge as p, handle as r, createServer as s, bearerRequest as t, SUPPORT_COOKIE as u, isPrefetch as v, SERVER_EVENT_SOURCE as w, shouldRefresh as x, refreshFor as y };

package/dist/ai-sdk/batches/index.d.ts

@@ -1,7 +1,7 @@
 import { t as AsyncResult } from "../../result-D7y2fT87.js";
 import { i as CursorPageOptions } from "../../block-helpers-CKtbFcRv.js";
 import { m as JobHandler } from "../../queue-CLJurhdy.js";
-import { i as AiBatchItemInput, r as AiBatchItem, t as AiBatch, u as AiProviders } from "../../types-TaiEeBGA.js";
+import { i as AiBatchItemInput, r as AiBatchItem, t as AiBatch, u as AiProviders } from "../../types-6rocye-y.js";
 import { Experimental_BatchItemResult, Experimental_BatchProvider, Experimental_BatchReference, Experimental_BatchStatus, Experimental_StartBatchOptions, Experimental_StartBatchResult } from "ai";
 //#region src/ai-sdk/batches/batches.d.ts
 /** The AI SDK batch calls, replaceable in tests. */

package/dist/ai-sdk/index.d.ts

@@ -2,7 +2,7 @@
 import { b as DbError, t as AsyncResult } from "../result-D7y2fT87.js";
 import { m as JobHandler } from "../queue-CLJurhdy.js";
 import { U as AiSandboxes } from "../ai-chat-7amvXjmQ.js";
-import { p as ResolvedProviderKey, u as AiProviders } from "../types-TaiEeBGA.js";
+import { p as ResolvedProviderKey, u as AiProviders } from "../types-6rocye-y.js";
 import { i as Usage } from "../usage-CrvrL2vw.js";
 import { _ as usageOf, a as GatewayClient, c as GatewayOptions, d as costBackfill, f as gatewayOptions, g as usageEntries, h as problem429, i as CostBackfillPayload, l as ModelCatalogRefreshOptions, m as modelInputOf, n as AiUsageMeters, o as GatewayContext, p as modelCatalogRefresh, r as CostBackfillOptions, s as GatewayModelEntry, t as AiUsage, u as UsageSource, v as usageQuota } from "../gateway-C1ssRHnf.js";
 import { a as ModelSource, c as isUIMessage, i as ModelApproval, l as toUIMessage, n as DENIED_TOOL_OUTPUT, o as fromModelMessages, r as FromModelMessagesOptions, s as fromUIMessage, t as AI_SDK_UI_FORMAT, u as toUIMessages } from "../messages-DYP0sUTe.js";

package/dist/ai-sdk/mcp/index.d.ts

@@ -1,7 +1,7 @@
 import { b as DbError, t as AsyncResult } from "../../result-D7y2fT87.js";
-import { i as CredentialRef, r as CredentialProvider } from "../../provider-BH5UWZJ6.js";
-import { r as ConnectorServer, s as Connectors } from "../../connectors-hkLCwyEz.js";
-import { n as VaultCredentials } from "../../vault-CSO7ss5C.js";
+import { i as CredentialRef, r as CredentialProvider } from "../../provider-D-UEMvSD.js";
+import { r as ConnectorServer, s as Connectors } from "../../connectors-CrpknU0P.js";
+import { n as VaultCredentials } from "../../vault-wlbBhqm7.js";
 import { ToolSet } from "ai";
 import { ElicitResult, ElicitationRequest, MCPClient, OAuthClientMetadata, OAuthClientProvider } from "@ai-sdk/mcp";
 //#region src/ai-sdk/mcp/mcp.d.ts

package/dist/{api-keys-rCGtKaZA.d.ts → api-keys-CIjghYjV.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult } from "./result-D7y2fT87.js";
 import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { n as AuthResolver } from "./resolve-KW8nCeL6.js";
+import { n as AuthResolver } from "./resolve-ChTYeTEl.js";
 import { r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
 import { JWTClaims } from "@supabase/server";
 //#region src/blocks/api-keys/api-keys.d.ts

package/dist/astro/index.d.ts

@@ -1,10 +1,10 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-C6DWVEVG.js";
+import { t as BetterServer } from "../server-Bh0EVSwU.js";
 import { j as StorageImageOptions } from "../index-D48jVS-N.js";
-import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
-import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-CdPDPpFs.js";
+import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
+import { t as RefusalRedirects } from "../refusal-DhSU2Vvr.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-BmzgK32X.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/astro/index.d.ts
 /** The part of Astro's `APIContext` (middleware, pages, endpoints, actions) the integration uses. */

package/dist/astro/index.js

@@ -1,9 +1,9 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-iKgjHVPx.js";
 import { t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
 import { t as storageImageUrl } from "../image-url-pIVlO6R1.js";
 import { t as around } from "../shared-CBxosKK3.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-xjTBoyBB.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-a7aRCIqv.js";
 import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
 //#region src/astro/index.ts
 function runtimeEnv(locals) {

package/dist/blocks/ai-providers/index.d.ts

@@ -1,5 +1,5 @@
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
-import { a as AiBatchItemStatus, c as AiProviderKey, d as AiProvidersOptions, f as NewAiBatch, i as AiBatchItemInput, l as AiProviderKeyInput, n as AiBatchCounts, o as AiBatchPatch, p as ResolvedProviderKey, r as AiBatchItem, s as AiBatchStatus, t as AiBatch, u as AiProviders } from "../../types-TaiEeBGA.js";
+import { a as AiBatchItemStatus, c as AiProviderKey, d as AiProvidersOptions, f as NewAiBatch, i as AiBatchItemInput, l as AiProviderKeyInput, n as AiBatchCounts, o as AiBatchPatch, p as ResolvedProviderKey, r as AiBatchItem, s as AiBatchStatus, t as AiBatch, u as AiProviders } from "../../types-6rocye-y.js";
 //#region src/blocks/ai-providers/ai-providers.d.ts
 /** Per-tenant provider keys and provider batch jobs. */
 export declare function createAiProviders(options: AiProvidersOptions): AiProviders;

package/dist/blocks/api-keys/index.d.ts

@@ -1,7 +1,7 @@
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
-import { r as AuthState } from "../../resolve-KW8nCeL6.js";
+import { r as AuthState } from "../../resolve-ChTYeTEl.js";
 import { t as BlockProblemOptions } from "../../problem-DD8LZFjc.js";
-import { a as ApiKeyResolverOptions, c as ApiKeysOptions, d as ParsedApiKey, f as apiKeyChecksum, g as parseApiKey, h as createApiKeys, i as ApiKeyExtraClaim, l as CreateApiKeyInput, m as apiKeyResolver, n as ApiKeyCheck, o as ApiKeyState, p as apiKeyClaims, r as ApiKeyClaimsOptions, s as ApiKeys, t as ApiKey, u as CreatedApiKey } from "../../api-keys-rCGtKaZA.js";
+import { a as ApiKeyResolverOptions, c as ApiKeysOptions, d as ParsedApiKey, f as apiKeyChecksum, g as parseApiKey, h as createApiKeys, i as ApiKeyExtraClaim, l as CreateApiKeyInput, m as apiKeyResolver, n as ApiKeyCheck, o as ApiKeyState, p as apiKeyClaims, r as ApiKeyClaimsOptions, s as ApiKeys, t as ApiKey, u as CreatedApiKey } from "../../api-keys-CIjghYjV.js";
 import { Entry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
 //#region src/blocks/api-keys/pipeline.d.ts

package/dist/blocks/audit/index.js

@@ -3,11 +3,11 @@ import { n as dbError } from "../../errors-B11Duf73.js";
 import { t as temporal } from "../../temporal-required-BVvW7SYJ.js";
 import { a as ok, r as err, t as AsyncResult } from "../../result-DzUbqgdW.js";
 import { t as SPEC_PINS } from "../../spec-pins--j6mTok4.js";
+import { n as toCsv } from "../../csv-DCK-PT1n.js";
 import { r as sqlIdent } from "../../template--jDkl3UP.js";
 import { n as rpcTransport, r as sqlTransport } from "../../block-transport-BLr-ZgLc.js";
 import { C as run, D as stringsOf, O as textOf, d as isRecord, g as pageOf, h as optionalText, i as blockCall, m as optionalInstant, n as applyTemporal, u as instantArg, w as seconds } from "../../block-helpers-DWHxHsEQ.js";
 import { n as defineListQuery } from "../../list-query-gl808ac1.js";
-import { t as toCsv } from "../../csv-CPAzEmB6.js";
 //#region src/blocks/audit/audit.ts
 const RETENTION_MANY = /* @__PURE__ */ new WeakMap();
 /**

package/dist/blocks/connectors/index.d.ts

@@ -1,3 +1,3 @@
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
-import { a as ConnectorSession, c as ConnectorsOptions, i as ConnectorServerFields, l as FingerprintStatus, n as ConnectorGrant, o as ConnectorTransport, r as ConnectorServer, s as Connectors, t as ConnectorAuth, u as createConnectors } from "../../connectors-hkLCwyEz.js";
+import { a as ConnectorSession, c as ConnectorsOptions, i as ConnectorServerFields, l as FingerprintStatus, n as ConnectorGrant, o as ConnectorTransport, r as ConnectorServer, s as Connectors, t as ConnectorAuth, u as createConnectors } from "../../connectors-CrpknU0P.js";
 export { type BlockTransport, type ConnectorAuth, type ConnectorGrant, type ConnectorServer, type ConnectorServerFields, type ConnectorSession, type ConnectorTransport, type Connectors, type ConnectorsOptions, type FingerprintStatus, createConnectors, rpcTransport, sqlTransport };

package/dist/blocks/data-lifecycle/index.d.ts

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult, w as ErrorMapper } from "../../result-D7y2fT87.js";
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
-import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } from "../../provider-BH5UWZJ6.js";
+import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } from "../../provider-D-UEMvSD.js";
 import { r as BlockTemporalOptions } from "../../block-helpers-CKtbFcRv.js";
 import { m as JobHandler } from "../../queue-CLJurhdy.js";
 import { r as EventSink } from "../../cloud-event-C1JCc1bH.js";

package/dist/blocks/data-lifecycle/index.js

@@ -1,9 +1,9 @@
 import { n as dbError } from "../../errors-B11Duf73.js";
 import { a as ok, r as err, t as AsyncResult } from "../../result-DzUbqgdW.js";
+import { n as toCsv } from "../../csv-DCK-PT1n.js";
 import { n as credentialRefInTenant } from "../../provider-Di3sRutW.js";
 import { n as rpcTransport, r as sqlTransport } from "../../block-transport-BLr-ZgLc.js";
 import { D as stringsOf, O as textOf, c as errorText, d as isRecord, h as optionalText, i as blockCall, k as toInstant, m as optionalInstant, n as applyTemporal, x as recordsOf, y as recordOf } from "../../block-helpers-DWHxHsEQ.js";
-import { t as toCsv } from "../../csv-CPAzEmB6.js";
 import { t as fromStorageError } from "../../errors-DLjJHPLK.js";
 //#region src/blocks/data-lifecycle/data-lifecycle.ts
 const EXPORT_STATUSES = [

package/dist/blocks/entitlements/index.d.ts

@@ -1,6 +1,6 @@
 import { t as AsyncResult } from "../../result-D7y2fT87.js";
 import { t as SqlClient } from "../../executor-DbvExCFC.js";
-import { i as hasEntitlement, n as EntitlementKey, t as EntitlementClaimOptions } from "../../entitlements-DHrY2UDZ.js";
+import { i as hasEntitlement, n as EntitlementKey, t as EntitlementClaimOptions } from "../../entitlements-BKSVGtrG.js";
 //#region src/blocks/entitlements/entitlements.d.ts
 /** The Stripe event sent when a customer's active entitlements change. */
 export declare const ENTITLEMENTS_UPDATED = "entitlements.active_entitlement_summary.updated";

package/dist/blocks/index.d.ts

@@ -1,6 +1,6 @@
 import { i as sqlTransport, n as RpcClient, r as rpcTransport, t as BlockTransport } from "../block-transport-DvaoPuZ9.js";
 import { a as EventHub } from "../events-DWDhx77e.js";
-import { r as CredentialProvider } from "../provider-BH5UWZJ6.js";
+import { r as CredentialProvider } from "../provider-D-UEMvSD.js";
 import { i as CursorPageOptions, n as BlockOptions } from "../block-helpers-CKtbFcRv.js";
 import { f as AiFiles } from "../types-C05bxW-W.js";
 import { n as FinalRunState, r as RunState, t as FINAL_RUN_STATES } from "../run-state-CPo-1X2B.js";

package/dist/blocks/sso/index.d.ts

@@ -2,7 +2,7 @@
 import { t as AsyncResult, w as ErrorMapper } from "../../result-D7y2fT87.js";
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
 import { r as BlockTemporalOptions } from "../../block-helpers-CKtbFcRv.js";
-import { s as ApiKeys } from "../../api-keys-rCGtKaZA.js";
+import { s as ApiKeys } from "../../api-keys-CIjghYjV.js";
 //#region src/blocks/sso/sso.d.ts
 /** The DNS record that proves a domain belongs to the organization. */
 interface DomainRecord {

package/dist/blocks/workflow-builder/index.d.ts

@@ -1,6 +1,6 @@
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
-import { A as approved, C as WorkflowCondition, D as WorkflowGraphEdge, E as WorkflowGraphDiff, F as validateGraph, M as durationMs, N as evaluateCondition, O as WorkflowGraphNode, P as topologicalOrder, S as WorkflowVersionStatus, T as WorkflowGraph, _ as WorkflowNodeRunStatus, a as CredentialInput, b as WorkflowTriggerKind, c as NodeRunRecord, d as TriggerInput, f as WorkflowAlert, g as WorkflowNodeRun, h as WorkflowDefinition, i as BuilderStarter, j as diffGraphs, k as WorkflowNodeKind, l as OutboxLikeEvent, m as WorkflowCredential, n as BuilderOptions, o as DefinitionInput, p as WorkflowBuilder, r as BuilderStartCall, s as GraphCompiler, t as AlertInput, u as RunInput, v as WorkflowStepInfo, w as WorkflowConditionOperator, x as WorkflowVersion, y as WorkflowTrigger } from "../../types-BI-0Sl2v.js";
-import { i as executeGraph, n as GraphStepCall, r as approvalToken, t as GraphRuntime } from "../../executor-D14tGopJ.js";
+import { A as approved, C as WorkflowCondition, D as WorkflowGraphEdge, E as WorkflowGraphDiff, F as validateGraph, M as durationMs, N as evaluateCondition, O as WorkflowGraphNode, P as topologicalOrder, S as WorkflowVersionStatus, T as WorkflowGraph, _ as WorkflowNodeRunStatus, a as CredentialInput, b as WorkflowTriggerKind, c as NodeRunRecord, d as TriggerInput, f as WorkflowAlert, g as WorkflowNodeRun, h as WorkflowDefinition, i as BuilderStarter, j as diffGraphs, k as WorkflowNodeKind, l as OutboxLikeEvent, m as WorkflowCredential, n as BuilderOptions, o as DefinitionInput, p as WorkflowBuilder, r as BuilderStartCall, s as GraphCompiler, t as AlertInput, u as RunInput, v as WorkflowStepInfo, w as WorkflowConditionOperator, x as WorkflowVersion, y as WorkflowTrigger } from "../../types-AYOvcyep.js";
+import { i as executeGraph, n as GraphStepCall, r as approvalToken, t as GraphRuntime } from "../../executor-BVBFM86G.js";
 //#region src/blocks/workflow-builder/workflow-builder.d.ts
 /**
  * The `workflow-builder` module's definitions, versions, triggers,

package/dist/blocks/workflow-builder/react/index.d.ts

@@ -1,7 +1,7 @@
 import { b as DbError } from "../../../result-D7y2fT87.js";
 import { x as SubscriptionStatus } from "../../../index-DunNRdnT.js";
 import { t as WorkflowRun } from "../../../workflows-B0j9WKPu.js";
-import { g as WorkflowNodeRun, h as WorkflowDefinition, p as WorkflowBuilder, v as WorkflowStepInfo } from "../../../types-BI-0Sl2v.js";
+import { g as WorkflowNodeRun, h as WorkflowDefinition, p as WorkflowBuilder, v as WorkflowStepInfo } from "../../../types-AYOvcyep.js";
 //#region src/blocks/workflow-builder/react/index.d.ts
 export interface UseWorkflowBuilderOptions {
   /** The tenant whose definitions to list. */

package/dist/chat-sdk/index.d.ts

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult, w as ErrorMapper } from "../result-D7y2fT87.js";
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../block-transport-DvaoPuZ9.js";
-import { a as CredentialSubject, i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "../provider-BH5UWZJ6.js";
+import { a as CredentialSubject, i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "../provider-D-UEMvSD.js";
 import { o as StreamStore } from "../store-CGjgWu5n.js";
 import { C as InboxMessage, T as MessageAttachment, a as Inbox, b as InboundResult, h as Conversation, j as StoredInboundEvent, y as DeliveryStatus } from "../inbox-i7E1ppo6.js";
 import { Adapter, AdapterPostableMessage, Attachment, Message, RawMessage, StateAdapter, WebhookOptions } from "chat";

package/dist/cli/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as run } from "./run-C8tnlHSb.js";
+import { i as run } from "./run-BqDPh9UH.js";
 import { t as colorEnabled } from "./style-C0NFdJRL.js";
 import { text } from "node:stream/consumers";
 //#region src/cli/bin.ts

package/dist/cli/{doctor-BMqBgM3X.js → doctor-DJk0aeBi.js}

@@ -2,14 +2,15 @@ import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError } from "./errors-4v4DTtda.js";
 import { i as writeIfChanged, t as display } from "./io-DI1mTdSA.js";
 import { i as plain, r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-C_4JwyiM.js";
+import { t as VERSION } from "./version-59gcepIG.js";
 import { s as providerLabel, t as compiledReadSets } from "./read-sets-CETOSFx4.js";
 import { s as stdinDatabaseUrl } from "./config-NiPxAmUF.js";
-import { c as migrationCommand, d as schemaPaths, i as findRepoRoot, l as pgFunctionHooks, n as declarativeSchemasDir, p as tomlGet, r as diffEngine, s as httpHooks, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
+import { c as migrationCommand, d as schemaPaths, i as findRepoRoot, l as pgFunctionHooks, p as tomlGet, r as diffEngine, s as httpHooks, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { A as exposed, C as MetadataRejectedError, D as accessModule, E as AUTHORIZATION_RULES, F as qualified, I as tableObject, M as lineOf, N as permissionCatalogKeys, O as entitlementsModule, P as policyObject, S as configFor, _ as METADATA_GAPS_TEXT, a as renderFiles, c as loadSnapshot, j as exposedSchemas, k as catalogOf, l as managementTarget, p as snapshotFile, r as readMetadataSnapshot, u as openSource, v as CACHE_DIR } from "./gen-DeuDgPxN.js";
+import { A as exposed, C as MetadataRejectedError, D as accessModule, E as AUTHORIZATION_RULES, F as qualified, I as tableObject, M as lineOf, N as permissionCatalogKeys, O as entitlementsModule, P as policyObject, S as configFor, _ as METADATA_GAPS_TEXT, a as renderFiles, c as loadSnapshot, j as exposedSchemas, k as catalogOf, l as managementTarget, p as snapshotFile, r as readMetadataSnapshot, u as openSource, v as CACHE_DIR } from "./gen-CCMc39Dx.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { t as connect } from "./db-DOBPt660.js";
+import { n as moduleLayoutFor } from "./sql-layout-D6cphHT3.js";
 import { dirname, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { glob, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
@@ -955,6 +956,8 @@ const EXTRAS_RULES = /* @__PURE__ */ new Set([
 	"BS112",
 	"BS113",
 	"BS114",
+	"BS115",
+	"BS116",
 	"BS204",
 	"BS205",
 	"BS206",
@@ -1031,7 +1034,7 @@ from (
 /** `rate-limit` in `sql.modules` without PostgREST's pre-request hook reaching `check_request()`. */
 async function rateLimitHook(context) {
 	const db = context.database;
-	if (!context.config.sql.moduleNames.includes("rate-limit") || !db || "skipped" in db) return [];
+	if (!context.config.sql.moduleNames.includes("rate-limit") || context.config.sql.modules["rate-limit"]?.options?.["preRequest"] === false || !db || "skipped" in db) return [];
 	let rows;
 	try {
 		rows = await db.query(PRE_REQUEST_HOOK);
@@ -1749,7 +1752,7 @@ function notInlinable(fn) {
 	const settings = Object.keys(fn.settings);
 	if (settings.length > 0) return `a function with \`set ${settings.join(", ")}\``;
 }
-const rlsTables = (context) => exposed(context).filter((table) => table.rls);
+const rlsTables$1 = (context) => exposed(context).filter((table) => table.rls);
 const COMMANDS$1 = [
 	"select",
 	"insert",
@@ -1922,7 +1925,7 @@ const RLS_RULES = [
 		description: "A policy passes a column of the row to a function Postgres cannot inline: plpgsql, volatile, security definer, or with a `set` option such as `search_path`. It runs once for every row the query reads.",
 		check: (context) => {
 			const functions = functionsByName(context);
-			return rlsTables(context).flatMap((table) => table.policies.flatMap((policy) => {
+			return rlsTables$1(context).flatMap((table) => table.policies.flatMap((policy) => {
 				for (const name of policy.functions ?? []) {
 					const slow = functions.get(name)?.find((fn) => notInlinable(fn) !== void 0);
 					if (!slow) continue;
@@ -1948,7 +1951,7 @@ const RLS_RULES = [
 			const limit = context.config.doctor.policyHelperLimit;
 			const functions = functionsByName(context);
 			const uses = /* @__PURE__ */ new Map();
-			for (const table of rlsTables(context)) for (const policy of table.policies) for (const name of policy.functions ?? []) {
+			for (const table of rlsTables$1(context)) for (const policy of table.policies) for (const name of policy.functions ?? []) {
 				const list = uses.get(name) ?? [];
 				list.push(`${qualified(table)}.${policy.name}`);
 				uses.set(name, list);
@@ -1974,7 +1977,7 @@ const RLS_RULES = [
 		description: "Postgres evaluates every permissive policy that applies and ORs them, so each extra policy adds its cost to every row. Merge them into one policy per command and role. When the performance advisor (BS200) runs, splinter's `multiple_permissive_policies` reports a table it covers and this rule skips it; on a saved snapshot this rule reports every table.",
 		check: async (context) => {
 			const splinter = await splinterTables(context, "multiple_permissive_policies");
-			return rlsTables(context).flatMap((table) => {
+			return rlsTables$1(context).flatMap((table) => {
 				if (splinter?.has(qualified(table))) return [];
 				const overlaps = permissiveOverlaps(table);
 				if (overlaps.length === 0) return [];
@@ -2234,6 +2237,50 @@ const POLICY_RULES = [
 			}];
 		})
 	},
+	{
+		code: "BS115",
+		severity: "warning",
+		title: "Table without a policy still granted to the Data API",
+		description: "A table with RLS on and no permissive policy for `anon` or `authenticated` answers every Data API request with no rows or a denied write, yet a grant lists it in the API schema. Under `sql.modules.grants.options.fromPolicies`, `better-supabase sql sync` revokes these grants and keeps `service_role`; until the migration is applied, doctor reports the live grants. Tables in `expose` are skipped.",
+		check: (context) => exposed(context).flatMap((table) => {
+			if (table.kind !== "table" || !table.rls) return [];
+			const options = configFor(context.config.tables, table.schema, table.name);
+			if (options?.exclude || options?.serviceRole) return [];
+			if (context.config.expose[qualified(table)] ?? context.config.expose[table.name]) return [];
+			const roles = ["anon", "authenticated"].filter((role) => table.grants.some((grant) => (grant.role === role || grant.role === "PUBLIC") && grant.privileges.length > 0));
+			if (roles.length === 0) return [];
+			if (table.policies.some((policy) => policy.permissive && roles.some((role) => appliesTo(policy, role)))) return [];
+			return [{
+				message: `${qualified(table)} has RLS on and no permissive policy for ${roles.join(" or ")}, but ${roles.join(" and ")} still hold grants on it. Run \`revoke all on table ${qualified(table)} from public, anon, authenticated;\`, or set \`sql.modules.grants.options.fromPolicies\` and run \`better-supabase sql sync\` so the migration revokes it.`,
+				target: qualified(table),
+				object: tableObject(table)
+			}];
+		})
+	},
+	{
+		code: "BS116",
+		severity: "warning",
+		title: "Security definer function open to the API roles without being exposed",
+		description: "Postgres grants `execute` on a new function to `public`, so a `security definer` function in an exposed schema is callable at `/rpc` by `anon` and `authenticated` unless it is revoked. When no `expose` entry lists it and no policy calls it, nothing in the project says the API roles should reach it. Doctor never revokes it; list it in `expose` with the roles that call it, or revoke `execute` from `public`, `anon` and `authenticated` and grant it back to those roles.",
+		check: (context) => {
+			const schemas = exposedSchemas(context);
+			const listed = new Set(Object.keys(context.config.exposeFunctions).map((signature) => {
+				const name = signature.slice(0, signature.indexOf("(")).trim();
+				return name.includes(".") ? name : `public.${name}`;
+			}));
+			const inPolicies = new Set(catalogOf(context).tables.flatMap((table) => table.policies.flatMap((policy) => policy.functions ?? [])));
+			return (context.snapshot.extras.functions ?? []).flatMap((fn) => {
+				const name = `${fn.schema}.${fn.name}`;
+				const callers = fn.execute ?? [];
+				if (!fn.securityDefiner || !schemas.includes(fn.schema) || callers.length === 0 || listed.has(name) || inPolicies.has(name)) return [];
+				return [{
+					message: `${name}(${fn.signature}) is security definer, ${callers.join(" and ")} may execute it through /rpc, and no \`expose\` entry or policy uses it. Run \`revoke all on function ${name}(${fn.signature}) from public, anon, authenticated;\`, then \`grant execute on function ${name}(${fn.signature}) to <the roles that call it>;\`, or list it in \`expose\`.`,
+					target: name,
+					object: functionObject(fn)
+				}];
+			});
+		}
+	},
 	{
 		code: "BS215",
 		severity: "warning",
@@ -2452,10 +2499,14 @@ async function moduleFiles(context) {
 	const skipped = readSets !== void 0 && "skipped" in readSets;
 	let rendered;
 	try {
-		rendered = renderModules(context.config.sql.moduleNames, {
-			...moduleLayout(context.config, context.config.sql.testsDir, skipped ? [] : readSets, entitlementsModule(context), access.kind === "provider" ? access.access : void 0, permissionCatalogKeys(context)),
-			schemasDir: declarativeSchemasDir(context.configToml)
-		});
+		rendered = renderModules(context.config.sql.moduleNames, await moduleLayoutFor(context.config, {
+			names: context.config.sql.moduleNames,
+			testsDir: context.config.sql.testsDir,
+			readSets: skipped ? [] : readSets,
+			entitlementsProvider: entitlementsModule(context),
+			accessProvider: access.kind === "provider" ? access.access : void 0,
+			permissionCatalog: permissionCatalogKeys(context)
+		}));
 	} catch {
 		return [];
 	}
@@ -2572,7 +2623,7 @@ const RULES = [
 			code: "BS106",
 			severity: "error",
 			title: "Table not granted to the Data API",
-			description: "Supabase no longer grants new tables to anon and authenticated. Without a grant, every Data API request fails with 42501 before RLS runs. Tables in `expose` need the privileges listed there; other tables need `select` for authenticated. Tables marked `serviceRole` in `tables` must have no grants for either role.",
+			description: "Supabase no longer grants new tables to anon and authenticated. Without a grant, every Data API request fails with 42501 before RLS runs. Tables in `expose` need the privileges listed there; other tables need `select` for authenticated, except tables with RLS on and no permissive policy under `sql.modules.grants.options.fromPolicies`, which are service-only. Tables marked `serviceRole` in `tables` must have no grants for either role.",
 			check: (context) => {
 				const auto = context.configToml ? tomlGet(context.configToml.document, ["api", "auto_expose_new_tables"]) : void 0;
 				const note = auto === false || auto === "false" ? " config.toml sets [api] auto_expose_new_tables = false, so new tables start without grants." : "";
@@ -2593,9 +2644,10 @@ const RULES = [
 							}];
 						});
 					}
+					const serviceOnly = context.config.sql.moduleNames.includes("grants") && context.config.sql.modules["grants"]?.options?.["fromPolicies"] === true && table.rls && !table.policies.some((policy) => policy.permissive && (appliesTo(policy, "anon") || appliesTo(policy, "authenticated")));
 					const wanted = context.config.expose[qualified(table)] ?? context.config.expose[table.name] ?? {
 						anon: [],
-						authenticated: ["select"]
+						authenticated: serviceOnly ? [] : ["select"]
 					};
 					return ["anon", "authenticated"].flatMap((role) => {
 						const have = granted(role);

package/dist/cli/{gen-DeuDgPxN.js → gen-CCMc39Dx.js}

@@ -2,7 +2,7 @@ import { r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError } from "./errors-4v4DTtda.js";
 import { i as writeIfChanged, n as importPath, r as sameText, t as display } from "./io-DI1mTdSA.js";
 import { r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-C_4JwyiM.js";
+import { t as VERSION } from "./version-59gcepIG.js";
 import { a as entitlementsMode, c as unsafeKey, i as entitlementRequirements, n as accessProviderMode, o as moduleKeyProblems, r as accessRequirements, s as providerLabel, t as compiledReadSets } from "./read-sets-CETOSFx4.js";
 import { s as stdinDatabaseUrl, t as databaseUrl } from "./config-NiPxAmUF.js";
 import { l as pgFunctionHooks, p as tomlGet, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";

package/dist/cli/gen-DRmzPI75.js

@@ -0,0 +1,2 @@
+import { n as genCommand } from "./gen-CCMc39Dx.js";
+export { genCommand };

package/dist/cli/index.d.ts

@@ -527,6 +527,6 @@ export declare function emitModule(model: Model, options: EmitOptions): string;
 export declare function loadConfig(cwd: string, explicit?: string): Promise<ResolvedConfig>;
 //#endregion
 //#region src/cli/version.d.ts
-export declare const VERSION = "0.6.1";
+export declare const VERSION = "0.7.1";
 //#endregion
 export type { Catalog, CatalogCheck, CatalogColumn, CatalogColumnGrant, CatalogEnum, CatalogForeignKey, CatalogFunction, CatalogFunctionArg, CatalogGrant, CatalogIndex, CatalogPolicy, CatalogTable, CatalogTrigger, CatalogUnique, CliArgs, CliCommandDef, CliContext, CliEnv, CliErrorCode, CliErrorOptions, CliIo, CliProblem, CliProblemExtensions, Command, CommandContext, CommandResult, ExitCode, ExtrasFunction, ExtrasHook, ExtrasHookFunction, ExtrasTable, ForeignKeyAction, GeneratorMetadata, IntrospectionSource, ManagementSourceOptions, ParsedArgs, Queryable, RunOptions, RunResult, Snapshot, SnapshotBucket, SnapshotExtras };

package/dist/cli/index.js

@@ -1,9 +1,9 @@
 import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError, t as CLI_ERRORS_URL } from "./errors-4v4DTtda.js";
-import { i as run, n as help, r as registerCommand, t as commandNames } from "./run-C8tnlHSb.js";
-import { t as VERSION } from "./version-C_4JwyiM.js";
+import { i as run, n as help, r as registerCommand, t as commandNames } from "./run-BqDPh9UH.js";
+import { t as VERSION } from "./version-59gcepIG.js";
 import { a as loadConfig } from "./config-NiPxAmUF.js";
-import { L as toCatalog, a as renderFiles, b as emitModule, c as loadSnapshot, d as parseSnapshot, f as serializeSnapshot, g as pgSource, h as managementSource, m as introspect, o as runGen, x as buildModel, y as GENERATED_HEADER } from "./gen-DeuDgPxN.js";
+import { L as toCatalog, a as renderFiles, b as emitModule, c as loadSnapshot, d as parseSnapshot, f as serializeSnapshot, g as pgSource, h as managementSource, m as introspect, o as runGen, x as buildModel, y as GENERATED_HEADER } from "./gen-CCMc39Dx.js";
 //#region src/cli/introspect/from-catalog.ts
 /**
 * Builds a snapshot from catalog records: the inverse of `toCatalog`. Tests

package/dist/cli/{init-C7Xd0Kda.js → init-BHuEQrQK.js}

@@ -1,6 +1,6 @@
 import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { i as writeIfChanged, t as display } from "./io-DI1mTdSA.js";
-import { t as VERSION } from "./version-C_4JwyiM.js";
+import { t as VERSION } from "./version-59gcepIG.js";
 import { a as loadConfig, r as findConfig } from "./config-NiPxAmUF.js";
 import { a as findSupabaseRoot, p as tomlGet, r as diffEngine, t as PGDELTA_TABLE, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
 import { t as TYPEGEN_VERSION } from "./typegen-version-DeFbtzYI.js";

package/dist/cli/{introspect-CSnMJ94U.js → introspect-DzR2nyQb.js}

@@ -2,7 +2,7 @@ import { r as defineCliCommand } from "./command-CK14fP91.js";
 import { i as writeIfChanged, r as sameText, t as display } from "./io-DI1mTdSA.js";
 import { r as painter } from "./style-C0NFdJRL.js";
 import { t as fileDiff } from "./diff-SjkO5rNr.js";
-import { T as serializeGenerator, c as loadSnapshot, f as serializeSnapshot, s as sourceArgs, t as SOURCE_ARGS, w as restrictSchemas } from "./gen-DeuDgPxN.js";
+import { T as serializeGenerator, c as loadSnapshot, f as serializeSnapshot, s as sourceArgs, t as SOURCE_ARGS, w as restrictSchemas } from "./gen-CCMc39Dx.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";

package/dist/cli/{run-C8tnlHSb.js → run-BqDPh9UH.js}

@@ -2,7 +2,7 @@ import { n as __toESM } from "./rolldown-runtime-BPOCksWG.js";
 import { c as parseArgs$2, i as joinRepeated, l as renderUsage, n as cliContext, o as listArgs, s as defineCommand, t as GLOBAL_ARGS, u as runCommand } from "./command-CK14fP91.js";
 import { n as CliError, r as toCliError } from "./errors-4v4DTtda.js";
 import { n as highlight, r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-C_4JwyiM.js";
+import { t as VERSION } from "./version-59gcepIG.js";
 import { stripVTControlCharacters } from "node:util";
 import { resolve } from "node:path";
 //#region src/cli/legacy.ts
@@ -134,11 +134,11 @@ function renderError(error, options) {
 //#region src/cli/run.ts
 const COMMANDS = /* @__PURE__ */ new Map([
 	["init", {
-		load: () => import("./init-C7Xd0Kda.js").then((m) => m.initCommand),
+		load: () => import("./init-BHuEQrQK.js").then((m) => m.initCommand),
 		description: "Writes better-supabase.config.ts, src/lib/supabase/index.ts and glue for the frameworks in package.json"
 	}],
 	["add", {
-		load: () => import("./init-C7Xd0Kda.js").then((m) => m.addCommand),
+		load: () => import("./init-BHuEQrQK.js").then((m) => m.addCommand),
 		description: "Adds glue for an integration to an existing project"
 	}],
 	["env", {
@@ -154,11 +154,11 @@ const COMMANDS = /* @__PURE__ */ new Map([
 		description: "Installs the Agent Skills that ship with this version of better-supabase"
 	}],
 	["gen", {
-		load: () => import("./gen-4JlOwgWG.js").then((m) => m.genCommand),
+		load: () => import("./gen-DRmzPI75.js").then((m) => m.genCommand),
 		description: "Writes database.types.ts, generated.ts and its metadata module from the database"
 	}],
 	["introspect", {
-		load: () => import("./introspect-CSnMJ94U.js").then((m) => m.introspectCommand),
+		load: () => import("./introspect-DzR2nyQb.js").then((m) => m.introspectCommand),
 		description: "Saves the database schema as a snapshot for offline gen"
 	}],
 	["openapi", {
@@ -170,11 +170,11 @@ const COMMANDS = /* @__PURE__ */ new Map([
 		description: "Renders the fixtures from defineSeed() (better-supabase/testing) to SQL"
 	}],
 	["doctor", {
-		load: () => import("./doctor-BMqBgM3X.js").then((m) => m.doctorCommand),
+		load: () => import("./doctor-DJk0aeBi.js").then((m) => m.doctorCommand),
 		description: "Checks RLS, indexes, drift, auth config and env files; exits 1 on errors, or on warnings with --strict"
 	}],
 	["sql", {
-		load: () => import("./sql-D0GUtUPp.js").then((m) => m.sqlCommand),
+		load: () => import("./sql-B8csQPyn.js").then((m) => m.sqlCommand),
 		description: "Lists, adds, syncs, upgrades and prints SQL modules"
 	}],
 	["config", {