better-supabase 0.6.1 → 0.7.1

package/dist/cli/{sql-D0GUtUPp.js → sql-B8csQPyn.js}

@@ -5,10 +5,11 @@ import { a as entitlementsMode, n as accessProviderMode, o as moduleKeyProblems,
 import { t as importFresh } from "./fresh-import-BeYf9I3x.js";
 import { c as migrationCommand, d as schemaPaths, n as declarativeSchemasDir, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
 import { t as fileDiff } from "./diff-SjkO5rNr.js";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { n as moduleLayoutFor, t as migrationsDir } from "./sql-layout-D6cphHT3.js";
+import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { readFile, readdir, rm } from "node:fs/promises";
-import { SQL_MODULES, adoptedColumnProblems, auditRegistrations, contractSignature, customContracts, declaredTables, extensionSchema, moduleBody, moduleFilePaths, moduleFileVersion, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, policyGrants, renderModules, resolveModules, sameModuleFile, upgradePlan } from "better-supabase/sql";
+import { SQL_MODULES, contractSignature, customContracts, moduleBody, moduleFilePaths, moduleFileVersion, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, renderModules, resolveModules, sameModuleFile, upgradePlan } from "better-supabase/sql";
 //#region src/cli/topic-policies.ts
 const isTopic = (value) => typeof value === "object" && value !== null && "template" in value && typeof value.template === "string" && "sql" in value && typeof value.sql === "function" && "triggerSql" in value;
 const literalParts = (template) => template.replaceAll(/\{[^}]+\}/g, "{}");
@@ -124,46 +125,22 @@ async function layout(config, args, names) {
 		schemasDir: declarativeSchemasDir(await readSupabaseToml(config.root))
 	};
 }
-/** The declarative schema files, then the migrations oldest first. */
-async function schemaTexts(config) {
-	const toml = await readSupabaseToml(config.root);
-	const migrations = resolve(config.root, migrationsDir(config));
-	const paths = [...(await schemaPaths(config.root, toml)).files, ...existsSync(migrations) ? (await readdir(migrations)).filter((name) => name.endsWith(".sql")).toSorted().map((name) => join(migrations, name)) : []];
-	return Promise.all(paths.map(async (path) => ({ text: await readFile(resolve(config.root, path), "utf8") })));
-}
-async function declarativeTexts(config) {
-	const { files } = await schemaPaths(config.root, await readSupabaseToml(config.root));
-	if (files.length === 0) return schemaTexts(config);
-	return Promise.all(files.map(async (path) => ({ text: await readFile(resolve(config.root, path), "utf8") })));
-}
-/**
-* The `better_supabase.audit(...)` calls in the declarative schemas, then
-* the migrations oldest first, so a later call or `unaudit` wins.
-*/
-async function auditedTables(config) {
-	return auditRegistrations(await schemaTexts(config));
-}
 /**
 * The layout, with `config.readSets` compiled when `names` includes
-* `read-sets` and the audited tables when it includes `audit`.
+* `read-sets`.
 */
 async function layoutFor(config, args, names) {
 	const entitlementsProvider = entitlementsProviderFor(config, names);
 	const resolved = new Set(resolveModules(names, { ...entitlementsProvider ? { entitlementsProvider } : {} }).map((module) => module.name));
-	const adopted = adoptedColumnProblems(config.sql.modules, await declarativeTexts(config), config.schemas);
-	if (adopted.length > 0) throw new TypeError(adopted.join("\n"));
-	return {
-		...moduleLayout(config, args["tests-dir"], resolved.has("read-sets") ? await compiledReadSets(config) : [], entitlementsProvider, accessProviderFor(config, names), permissionKeysFor(config)),
-		schemasDir: declarativeSchemasDir(await readSupabaseToml(config.root)),
-		...resolved.has("audit") ? { auditedTables: await auditedTables(config) } : {},
-		...resolved.has("vector-search") ? vectorSchemaOf(await schemaTexts(config)) : {},
-		...resolved.has("grants") && config.sql.modules["grants"]?.options?.["fromPolicies"] === true ? { policyGrants: policyGrants(await declarativeTexts(config), config.schemas) } : {},
-		...resolved.has("sessions") && config.sql.modules["sessions"]?.options?.["policies"] === true ? { declaredTables: declaredTables(await declarativeTexts(config), config.schemas) } : {}
-	};
-}
-function vectorSchemaOf(sources) {
-	const schema = extensionSchema(sources, "vector");
-	return schema === void 0 ? {} : { vectorSchema: schema };
+	const accessProvider = accessProviderFor(config, names);
+	return moduleLayoutFor(config, {
+		names,
+		testsDir: args["tests-dir"],
+		readSets: resolved.has("read-sets") ? await compiledReadSets(config) : [],
+		...entitlementsProvider ? { entitlementsProvider } : {},
+		...accessProvider ? { accessProvider } : {},
+		permissionCatalog: permissionKeysFor(config)
+	});
 }
 const MODULE_TEST_MARKER = /^-- @bs-module-test ([a-z0-9-]+)$/m;
 /**
@@ -185,24 +162,6 @@ async function staleModuleTests(config, names, sqlLayout, files) {
 	}
 	return stale;
 }
-/**
-* The migrations folder next to the `config.toml` found walking up from
-* `sql.dir`, relative to the root; `supabase/migrations` without one. The
-* walk stops where `sql.dir` and the root meet, so a `sql.dir` outside the
-* project (a shared stack in a monorepo) finds that stack's folder.
-*/
-function migrationsDir(config) {
-	const root = resolve(config.root);
-	let dir = resolve(root, config.sql.dir);
-	let stop = root;
-	while (dir !== stop && !dir.startsWith(stop + sep) && dirname(stop) !== stop) stop = dirname(stop);
-	for (;;) {
-		if (existsSync(join(dir, "config.toml"))) return relative(root, join(dir, "migrations")).replaceAll("\\", "/");
-		if (dir === stop || dirname(dir) === dir) break;
-		dir = dirname(dir);
-	}
-	return "supabase/migrations";
-}
 /** `YYYYMMDDHHMMSS` in UTC, the Supabase CLI's migration prefix. */
 const migrationStamp = (now) => now.toISOString().replaceAll(/[-:T]/g, "").slice(0, 14);
 /**

package/dist/cli/sql-layout-D6cphHT3.js

@@ -0,0 +1,69 @@
+import { d as schemaPaths, n as declarativeSchemasDir, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { existsSync } from "node:fs";
+import { readFile, readdir } from "node:fs/promises";
+import { adoptedColumnProblems, auditRegistrations, declaredTables, extensionSchema, moduleLayout, policyGrants, resolveModules, rlsTables } from "better-supabase/sql";
+//#region src/cli/sql-layout.ts
+/** The declarative schema files, then the migrations oldest first. */
+async function schemaTexts(config) {
+	const toml = await readSupabaseToml(config.root);
+	const migrations = resolve(config.root, migrationsDir(config));
+	const paths = [...(await schemaPaths(config.root, toml)).files, ...existsSync(migrations) ? (await readdir(migrations)).filter((name) => name.endsWith(".sql")).toSorted().map((name) => join(migrations, name)) : []];
+	return Promise.all(paths.map(async (path) => ({ text: await readFile(resolve(config.root, path), "utf8") })));
+}
+async function declarativeTexts(config) {
+	const { files } = await schemaPaths(config.root, await readSupabaseToml(config.root));
+	if (files.length === 0) return schemaTexts(config);
+	return Promise.all(files.map(async (path) => ({ text: await readFile(resolve(config.root, path), "utf8") })));
+}
+/**
+* The `better_supabase.audit(...)` calls in the declarative schemas, then
+* the migrations oldest first, so a later call or `unaudit` wins.
+*/
+async function auditedTables(config) {
+	return auditRegistrations(await schemaTexts(config));
+}
+/**
+* The layout `sql sync` and doctor render the module files with, so both
+* see the same grants, session policies, audit triggers and vector schema.
+*/
+async function moduleLayoutFor(config, input) {
+	const resolved = new Set(resolveModules(input.names, { ...input.entitlementsProvider ? { entitlementsProvider: input.entitlementsProvider } : {} }).map((module) => module.name));
+	const adopted = adoptedColumnProblems(config.sql.modules, await declarativeTexts(config), config.schemas);
+	if (adopted.length > 0) throw new TypeError(adopted.join("\n"));
+	const fromPolicies = resolved.has("grants") && config.sql.modules["grants"]?.options?.["fromPolicies"] === true;
+	const sessionPolicies = resolved.has("sessions") && config.sql.modules["sessions"]?.options?.["policies"] === true;
+	return {
+		...moduleLayout(config, input.testsDir, input.readSets ?? [], input.entitlementsProvider, input.accessProvider, input.permissionCatalog),
+		schemasDir: declarativeSchemasDir(await readSupabaseToml(config.root)),
+		...resolved.has("audit") ? { auditedTables: await auditedTables(config) } : {},
+		...resolved.has("vector-search") ? vectorSchemaOf(await schemaTexts(config)) : {},
+		...fromPolicies ? { policyGrants: policyGrants(await declarativeTexts(config), config.schemas) } : {},
+		...fromPolicies ? { rlsTables: rlsTables(await declarativeTexts(config), config.schemas) } : {},
+		...fromPolicies || sessionPolicies ? { declaredTables: declaredTables(await declarativeTexts(config), config.schemas) } : {}
+	};
+}
+function vectorSchemaOf(sources) {
+	const schema = extensionSchema(sources, "vector");
+	return schema === void 0 ? {} : { vectorSchema: schema };
+}
+/**
+* The migrations folder next to the `config.toml` found walking up from
+* `sql.dir`, relative to the root; `supabase/migrations` without one. The
+* walk stops where `sql.dir` and the root meet, so a `sql.dir` outside the
+* project (a shared stack in a monorepo) finds that stack's folder.
+*/
+function migrationsDir(config) {
+	const root = resolve(config.root);
+	let dir = resolve(root, config.sql.dir);
+	let stop = root;
+	while (dir !== stop && !dir.startsWith(stop + sep) && dirname(stop) !== stop) stop = dirname(stop);
+	for (;;) {
+		if (existsSync(join(dir, "config.toml"))) return relative(root, join(dir, "migrations")).replaceAll("\\", "/");
+		if (dir === stop || dirname(dir) === dir) break;
+		dir = dirname(dir);
+	}
+	return "supabase/migrations";
+}
+//#endregion
+export { moduleLayoutFor as n, migrationsDir as t };

package/dist/cli/{version-C_4JwyiM.js → version-59gcepIG.js}

@@ -1,4 +1,4 @@
 //#region src/cli/version.ts
-const VERSION = "0.6.1";
+const VERSION = "0.7.1";
 //#endregion
 export { VERSION as t };

package/dist/{composite-pSfeJNce.d.ts → composite--yqry7uW.d.ts}

@@ -1,10 +1,10 @@
 import { a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
 import { a as EventHub } from "./events-DWDhx77e.js";
 import { i as CookieScope, s as SessionEncoding } from "./session-ChiXDZdZ.js";
-import { r as AuthState, t as AuthResolution } from "./resolve-KW8nCeL6.js";
+import { r as AuthState, t as AuthResolution } from "./resolve-ChTYeTEl.js";
 import { b as Db, t as BetterSupabase } from "./define-CJJkkr1-.js";
-import { _ as ReplicaState, i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer, x as ActiveSupport } from "./server-C6DWVEVG.js";
-import { d as RefreshPolicy, r as GuardOptions } from "./respond-DoBijysA.js";
+import { C as ActiveSupport, i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer, y as ReplicaState } from "./server-Bh0EVSwU.js";
+import { d as RefreshPolicy, r as GuardOptions } from "./respond-DprrgyXX.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Entry, SingleKeyEntry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";

package/dist/{composite-CLqs9-OA.js → composite-DXVUibdi.js}

@@ -1,5 +1,5 @@
 import { a as problemResponse } from "./problem-BreOl8b8.js";
-import { C as serverCore, S as withServerContext, _ as withSession, g as withSupport, h as withTenant, s as createServer } from "./adapter-CHnPkCPd.js";
+import { C as serverCore, S as withServerContext, _ as withSession, g as withSupport, h as withTenant, s as createServer } from "./adapter-iKgjHVPx.js";
 import { s as withPrimaryPin } from "./replicas-CwrYp5Zj.js";
 import { r as guard, t as defaultExpose } from "./respond-BUgsXNgk.js";
 import { a as withAuthMode, i as withAuth, o as withJwtClaims, s as withUserClaims } from "./claims-DDBQT6BK.js";

package/dist/{connectors-hkLCwyEz.d.ts → connectors-CrpknU0P.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
 import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { i as CredentialRef, r as CredentialProvider } from "./provider-BH5UWZJ6.js";
+import { i as CredentialRef, r as CredentialProvider } from "./provider-D-UEMvSD.js";
 import { r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
 //#region src/blocks/connectors/connectors.d.ts
 type ConnectorTransport = "http" | "sse";

package/dist/credentials/index.d.ts

@@ -1,7 +1,7 @@
 import { t as AsyncResult } from "../result-D7y2fT87.js";
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../block-transport-DvaoPuZ9.js";
-import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-BH5UWZJ6.js";
-import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-CSO7ss5C.js";
+import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-D-UEMvSD.js";
+import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-wlbBhqm7.js";
 //#region src/credentials/compose.d.ts
 /**
  * One provider over several: each call goes to the provider whose `name`

package/dist/{csv-CPAzEmB6.js → csv-DCK-PT1n.js}

@@ -22,4 +22,4 @@ function toCsv(rows, options = {}) {
 	return `${[columns.map((column) => cell(column, false)).join(","), ...rows.map((row) => columns.map((column) => cell(row[column], escape)).join(","))].join("\r\n")}\r\n`;
 }
 //#endregion
-export { toCsv as t };
+export { toCsv as n, csvColumns as t };

package/dist/edge/index.d.ts

@@ -1,11 +1,11 @@
 import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-C6DWVEVG.js";
-import { t as AuthSession } from "../view-DbxLNu8L.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DoBijysA.js";
-import { s as BlockRequireOptions } from "../kit-B5tid-q5.js";
+import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-Bh0EVSwU.js";
+import { t as AuthSession } from "../view-CF7ihnkg.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DprrgyXX.js";
+import { s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
-import { a as ResourceRouteOptions } from "../resource-D6Uc7Sk7.js";
+import { a as ResourceRouteOptions } from "../resource-IPS5xi9q.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { WithCorsConfig } from "@supabase/middleware/cors";
 //#region src/bridges/edge.d.ts

package/dist/edge/index.js

@@ -1,12 +1,12 @@
 import { n as dbError } from "../errors-B11Duf73.js";
 import { r as err } from "../result-DzUbqgdW.js";
 import { a as problemResponse } from "../problem-BreOl8b8.js";
-import { a as unexpectedResponse, c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
+import { a as unexpectedResponse, c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-iKgjHVPx.js";
 import { a as respond, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as withBetterSupabase } from "../composite-CLqs9-OA.js";
+import { t as withBetterSupabase } from "../composite-DXVUibdi.js";
 import { t as defineResource } from "../resource-BsvzCMlX.js";
 import { i as requireCaller } from "../kit-Fm-Fv7q5.js";
-import { t as EVERY_CALLER } from "../framework-xjTBoyBB.js";
+import { t as EVERY_CALLER } from "../framework-a7aRCIqv.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { withCors } from "@supabase/middleware/cors";
 //#region src/bridges/edge.ts

package/dist/elysia/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../refusal-D1rgbzNq.js";
+import { n as RouteGuardOptions } from "../refusal-DhSU2Vvr.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 //#region src/bridges/elysia.d.ts

package/dist/{ended-jLfvw8h-.d.ts → ended-XjeGQ5XW.d.ts}

@@ -30,6 +30,8 @@ type RefreshOutcome = {
   /** `rejected`: the refresh token is dead, sign the user out. `network`: keep the session and retry later. */
   readonly reason: "rejected" | "network";
   readonly status?: number;
+  /** The Auth server's `error_code`, such as `user_banned` or `refresh_token_not_found`. */
+  readonly code?: string;
   readonly message: string;
 };
 /**
@@ -40,7 +42,8 @@ type RefreshOutcome = {
 declare function refreshSession(refreshToken: string, options: RefreshOptions): Promise<RefreshOutcome>;
 //#endregion
 //#region src/auth/ended.d.ts
-type SessionStatus = "active" | "ended" | "unknown";
+/** `banned`: Auth rejected the token with `error_code: "user_banned"`. */
+type SessionStatus = "active" | "ended" | "banned" | "unknown";
 interface SessionStatusOptions {
   readonly url: string;
   readonly publishableKey: string;

package/dist/{entitlements-DHrY2UDZ.d.ts → entitlements-BKSVGtrG.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSession } from "./view-DbxLNu8L.js";
+import { t as AuthSession } from "./view-CF7ihnkg.js";
 //#region src/auth/entitlements.d.ts
 /**
  * One entry of the `memberships` claim when a hook writes it as a list.

package/dist/eve/index.d.ts

@@ -1,5 +1,5 @@
-import { a as ResolveAuthOptions, r as AuthState } from "../resolve-KW8nCeL6.js";
-import { i as CredentialRef, r as CredentialProvider } from "../provider-BH5UWZJ6.js";
+import { a as ResolveAuthOptions, r as AuthState } from "../resolve-ChTYeTEl.js";
+import { i as CredentialRef, r as CredentialProvider } from "../provider-D-UEMvSD.js";
 import { i as AiChat } from "../ai-chat-7amvXjmQ.js";
 import { a as Inbox } from "../inbox-i7E1ppo6.js";
 import { a as EveMemoryToolsContext, c as MemoryDocumentConflictError, d as supabaseDocumentBackend, f as supabaseMemory, i as EveMemoryTool, l as SupabaseDocumentBackendOptions, m as EveSessionContext, n as EveMemoryContext, o as EveRecallMessage, p as EveSessionAuth, r as EveMemoryProvider, s as EveRecallResult, t as EveDocumentBackend, u as SupabaseMemoryOptions } from "../eve-gT2Fpjut.js";

package/dist/eve/index.js

@@ -1,6 +1,6 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
 import { a as tenantClaimPaths, n as claimAt, t as DEFAULT_CLAIMS } from "../claims-PqzCxaTD.js";
-import { i as resolveAuth } from "../resolve-D_IcnvFd.js";
+import { i as resolveAuth } from "../resolve-tJZY3FEa.js";
 import { t as isAnonymousUser } from "../view-BeFcRV6G.js";
 import { d as isRecord } from "../block-helpers-DWHxHsEQ.js";
 //#region src/eve/ids.ts

package/dist/{executor-D14tGopJ.d.ts → executor-BVBFM86G.d.ts}

@@ -1,4 +1,4 @@
-import { T as WorkflowGraph } from "./types-BI-0Sl2v.js";
+import { T as WorkflowGraph } from "./types-AYOvcyep.js";
 //#region src/blocks/workflow-builder/executor.d.ts
 /** What a step node passes to the engine's step: plain data, so it serializes. */
 interface GraphStepCall {

package/dist/expo/index.d.ts

@@ -1,7 +1,7 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer } from "../server-C6DWVEVG.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DoBijysA.js";
+import { i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer } from "../server-Bh0EVSwU.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DprrgyXX.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { ImmutableRequest, MiddlewareFunction } from "expo-server";

package/dist/expo/index.js

@@ -1,9 +1,9 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
 import { o as toProblem } from "../problem-BreOl8b8.js";
-import { a as unexpectedResponse, c as extendServer, s as createServer, y as refreshFor } from "../adapter-CHnPkCPd.js";
-import { m as serializeCookie } from "../resolve-D_IcnvFd.js";
+import { a as unexpectedResponse, c as extendServer, s as createServer, y as refreshFor } from "../adapter-iKgjHVPx.js";
+import { m as serializeCookie } from "../resolve-tJZY3FEa.js";
 import { a as respond, r as guard, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as withBetterSupabase } from "../composite-CLqs9-OA.js";
+import { t as withBetterSupabase } from "../composite-DXVUibdi.js";
 import { r as handoffOf } from "../shared-CBxosKK3.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { StatusError, setResponseHeaders } from "expo-server";

package/dist/{framework-CdPDPpFs.d.ts → framework-BmzgK32X.d.ts}

@@ -1,8 +1,8 @@
 import { a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
-import { o as ServerOptions } from "./server-C6DWVEVG.js";
-import { t as AuthSession } from "./view-DbxLNu8L.js";
-import { a as SessionEntryConfig, n as BetterSupabaseContributions } from "./composite-pSfeJNce.js";
-import { t as RefusalRedirects } from "./refusal-D1rgbzNq.js";
+import { o as ServerOptions } from "./server-Bh0EVSwU.js";
+import { t as AuthSession } from "./view-CF7ihnkg.js";
+import { a as SessionEntryConfig, n as BetterSupabaseContributions } from "./composite--yqry7uW.js";
+import { t as RefusalRedirects } from "./refusal-DhSU2Vvr.js";
 //#region src/server/framework.d.ts
 /** What the framework factories (`createSvelteKit`, `createReactRouter`, `createTanStackStart`) take. */
 interface FrameworkOptions extends ServerOptions, RefusalRedirects, Pick<SessionEntryConfig, "checkSession" | "cookieScopes" | "encode"> {

package/dist/{framework-xjTBoyBB.js → framework-a7aRCIqv.js}

@@ -1,5 +1,5 @@
 import { n as toSession } from "./view-BeFcRV6G.js";
-import { t as withBetterSupabase } from "./composite-CLqs9-OA.js";
+import { t as withBetterSupabase } from "./composite-DXVUibdi.js";
 //#region src/server/framework.ts
 /** Every caller: the framework factories guard per loader, action or route instead. */
 const EVERY_CALLER = [

package/dist/h3/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../refusal-D1rgbzNq.js";
+import { n as RouteGuardOptions } from "../refusal-DhSU2Vvr.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 //#region src/bridges/h3.d.ts

package/dist/h3/v1/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../../refusal-D1rgbzNq.js";
+import { n as RouteGuardOptions } from "../../refusal-DhSU2Vvr.js";
 import { t as Validated } from "../../shared-DDSjEGDR.js";
 import { n as NodeRequestHead, t as NodeHeaderTarget } from "../../node-headers-AO06VhqH.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";

package/dist/hono/index.d.ts

@@ -1,11 +1,11 @@
 import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
-import { r as AuthState } from "../resolve-KW8nCeL6.js";
+import { r as AuthState } from "../resolve-ChTYeTEl.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-C6DWVEVG.js";
-import { t as AuthSession } from "../view-DbxLNu8L.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DoBijysA.js";
-import { s as BlockRequireOptions } from "../kit-B5tid-q5.js";
-import { a as ResourceRouteOptions } from "../resource-D6Uc7Sk7.js";
+import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-Bh0EVSwU.js";
+import { t as AuthSession } from "../view-CF7ihnkg.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DprrgyXX.js";
+import { s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
+import { a as ResourceRouteOptions } from "../resource-IPS5xi9q.js";
 import { AnyEntry, Contributions, ValidateEntries } from "@supabase/middleware";
 import { Context, ErrorHandler, Hono, MiddlewareHandler } from "hono";
 //#region src/bridges/hono.d.ts

package/dist/hono/index.js

@@ -1,9 +1,9 @@
 import { r as dbErrorOf } from "../errors-B11Duf73.js";
 import { a as problemResponse } from "../problem-BreOl8b8.js";
-import { a as unexpectedResponse, c as extendServer, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
+import { a as unexpectedResponse, c as extendServer, n as flushEvents, s as createServer } from "../adapter-iKgjHVPx.js";
 import { n as toSession } from "../view-BeFcRV6G.js";
 import { a as respond, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as withBetterSupabase } from "../composite-CLqs9-OA.js";
+import { t as withBetterSupabase } from "../composite-DXVUibdi.js";
 import { t as defineResource } from "../resource-BsvzCMlX.js";
 import { i as requireCaller } from "../kit-Fm-Fv7q5.js";
 import { r as handoffOf } from "../shared-CBxosKK3.js";

package/dist/{index-DDrYaUcq.d.ts → index-CdZKQF98.d.ts}

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "./refusal-D1rgbzNq.js";
+import { n as RouteGuardOptions } from "./refusal-DhSU2Vvr.js";
 import { t as Validated } from "./shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { IncomingMessage, ServerResponse } from "node:http";

package/dist/{index-CtuakVRc.d.ts → index-CewnYSpv.d.ts}

@@ -3,7 +3,7 @@ import { it as QuerySpec } from "./define-CJJkkr1-.js";
 import { C as UrlOptions, S as UploadOptions, x as UploadBody } from "./bucket-Cl46E3jS.js";
 import { n as TemplateValues } from "./template-CwO38Do8.js";
 import { t as AuthSnapshot } from "./bind-Bu_ZNa3W.js";
-import { t as AuthSession } from "./view-DbxLNu8L.js";
+import { t as AuthSession } from "./view-CF7ihnkg.js";
 import { S as Topic, _ as RealtimeClient, f as PresenceMember, g as PresenceSubscription, p as PresenceOptions, r as LiveCountSeed, u as EventSchemas, w as TopicHandlers, x as SubscriptionStatus, y as SubscribeOptions } from "./index-DunNRdnT.js";
 import { a as BroadcastOptions, f as UseActionOptions, l as LiveQueryHookOptions, n as ActionInputOf, o as ClientLike, r as ActionResultOf, s as LiveCountHookOptions } from "./field-errors-BFOa7WhB.js";
 import { SupabaseClient } from "@supabase/supabase-js";

package/dist/{kit-B5tid-q5.d.ts → kit-CkNzZUqv.d.ts}

@@ -1,7 +1,7 @@
 import { b as DbError } from "./result-D7y2fT87.js";
-import { r as AuthState } from "./resolve-KW8nCeL6.js";
-import { t as AuthSession } from "./view-DbxLNu8L.js";
-import { r as GuardOptions } from "./respond-DoBijysA.js";
+import { r as AuthState } from "./resolve-ChTYeTEl.js";
+import { t as AuthSession } from "./view-CF7ihnkg.js";
+import { r as GuardOptions } from "./respond-DprrgyXX.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/server/kit.d.ts
 /** What a server action returns: plain data, safe across any serialization boundary. */

package/dist/mcp/index.d.ts

@@ -1,9 +1,9 @@
 import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-C6DWVEVG.js";
-import { r as GuardOptions } from "../respond-DoBijysA.js";
+import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-Bh0EVSwU.js";
+import { r as GuardOptions } from "../respond-DprrgyXX.js";
 import { i as ResourceOperation } from "../index-Bxih3l0u.js";
-import { a as ResourceRouteOptions } from "../resource-D6Uc7Sk7.js";
+import { a as ResourceRouteOptions } from "../resource-IPS5xi9q.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/mcp/mcp.d.ts
 export declare const MCP_PROTOCOL_VERSION: string;

package/dist/mcp/index.js

@@ -4,7 +4,7 @@ import { n as validate } from "../standard-BK0cqJ7y.js";
 import { a as problemResponse, o as toProblem } from "../problem-BreOl8b8.js";
 import { t as SPEC_PINS } from "../spec-pins--j6mTok4.js";
 import { t as buildJsonSchema } from "../json-schema-CvER4kgT.js";
-import { c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
+import { c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-iKgjHVPx.js";
 import { n as jsonResponse, t as jsonReplacer } from "../json-CEnpTHlZ.js";
 import { o as settle, r as guard, t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { t as defineResource } from "../resource-BsvzCMlX.js";

package/dist/mcp/sdk/index.d.ts

@@ -1,8 +1,8 @@
 import { a as AnyModels, i as AnyFunctions } from "../../types-6BdhkmZe.js";
-import { r as AuthState } from "../../resolve-KW8nCeL6.js";
+import { r as AuthState } from "../../resolve-ChTYeTEl.js";
 import { t as BetterSupabase } from "../../define-CJJkkr1-.js";
-import { i as ServerContext$1, o as ServerOptions, t as BetterServer } from "../../server-C6DWVEVG.js";
-import { r as GuardOptions, t as AllowedCaller } from "../../respond-DoBijysA.js";
+import { i as ServerContext$1, o as ServerOptions, t as BetterServer } from "../../server-Bh0EVSwU.js";
+import { r as GuardOptions, t as AllowedCaller } from "../../respond-DprrgyXX.js";
 import { AuthInfo, CallToolResult, Icon, InputRequiredResult, OAuthTokenVerifier, RegisteredTool, ScopeChallengeHandler, ServerContext, StandardSchemaWithJSON, ToolAnnotations } from "@modelcontextprotocol/server";
 //#region src/mcp/sdk/sdk.d.ts
 interface McpAuthOptions extends ServerOptions, Omit<GuardOptions, "scopes"> {

package/dist/mcp/sdk/index.js

@@ -1,5 +1,5 @@
 import { o as delegationOf } from "../../impersonation-DcqaTBHx.js";
-import { c as extendServer, i as resolveToken, l as withExtra, n as flushEvents, s as createServer } from "../../adapter-CHnPkCPd.js";
+import { c as extendServer, i as resolveToken, l as withExtra, n as flushEvents, s as createServer } from "../../adapter-iKgjHVPx.js";
 import { r as guard } from "../../respond-BUgsXNgk.js";
 import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../../http-DdYadv-o.js";
 import { OAuthError, bearerAuthChallengeResponse, verifyBearerToken } from "@modelcontextprotocol/server";

package/dist/nestjs/index.d.ts

@@ -1,6 +1,6 @@
-import { n as RouteGuardOptions } from "../refusal-D1rgbzNq.js";
+import { n as RouteGuardOptions } from "../refusal-DhSU2Vvr.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
-import { l as ToNodeOptions } from "../index-DDrYaUcq.js";
+import { l as ToNodeOptions } from "../index-CdZKQF98.js";
 import { AnyEntry } from "@supabase/middleware";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/nestjs/index.d.ts

package/dist/next/index.d.ts

@@ -1,16 +1,16 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
-import { r as AuthState } from "../resolve-KW8nCeL6.js";
+import { r as AuthState } from "../resolve-ChTYeTEl.js";
 import { B as DbStats, K as ReadSet, it as QuerySpec, t as BetterSupabase, u as CacheAdapter } from "../define-CJJkkr1-.js";
-import { D as SupportStartRequest, E as SupportSessions, O as supportSessions, T as SupportPolicy, i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer, w as SupportOptions, x as ActiveSupport } from "../server-C6DWVEVG.js";
+import { A as supportSessions, C as ActiveSupport, D as SupportPolicy, E as SupportOptions, O as SupportSessions, i as ServerContext, k as SupportStartRequest, n as ContextOptions, o as ServerOptions, t as BetterServer } from "../server-Bh0EVSwU.js";
 import { n as AmrEntry, s as Impersonator, t as Aal } from "../mfa-Daak8ukG.js";
-import { t as tenantOf } from "../tenant-icPeuUBN.js";
-import { n as toSession, t as AuthSession } from "../view-DbxLNu8L.js";
-import { n as AuthKind, r as GuardOptions } from "../respond-DoBijysA.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-B5tid-q5.js";
+import { t as tenantOf } from "../tenant-BxNFk9bx.js";
+import { n as toSession, t as AuthSession } from "../view-CF7ihnkg.js";
+import { n as AuthKind, r as GuardOptions } from "../respond-DprrgyXX.js";
+import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-CkNzZUqv.js";
 import { r as LiveCountSeed, t as CountRunner } from "../index-DunNRdnT.js";
-import { r as MembershipClaim } from "../entitlements-DHrY2UDZ.js";
+import { r as MembershipClaim } from "../entitlements-BKSVGtrG.js";
 import { i as tagFor, t as TagOptions } from "../tags-Cx-LnIQP.js";
-import { n as supportOf, t as SupportView } from "../support-view-33Oi07TT.js";
+import { n as supportOf, t as SupportView } from "../support-view-CVOJJLpc.js";
 import { NextRequest } from "next/server.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/collector.d.ts
@@ -78,6 +78,11 @@ interface ProxyOptions<C = unknown, P = unknown> {
 interface EndedSessionOptions {
   readonly paths?: readonly string[];
   readonly redirect?: string;
+  /** The `reason` query value on the redirect. Defaults to `session_ended` and `account_banned`. */
+  readonly reasons?: {
+    readonly ended?: string;
+    readonly banned?: string;
+  };
 }
 interface ActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R> {
   /** Validates the input (plain object or `FormData`) with any Standard Schema. */

package/dist/next/index.js

@@ -9,10 +9,10 @@ import { a as problemResponse } from "../problem-BreOl8b8.js";
 import { i as claimsOf } from "../claims-PqzCxaTD.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
 import { t as tenantOf } from "../tenant-I1TEZ_BX.js";
-import { C as serverCore, c as extendServer, l as withExtra, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as isPrefetch } from "../adapter-CHnPkCPd.js";
+import { C as serverCore, c as extendServer, l as withExtra, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as isPrefetch } from "../adapter-iKgjHVPx.js";
 import { a as checkAal, n as toSession } from "../view-BeFcRV6G.js";
 import { o as settle, r as guard, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as supportSessions } from "../support-zIa1URaN.js";
+import { t as supportSessions } from "../support-ig_K4PvS.js";
 import { r as tagFor, t as cacheTagsOf } from "../tags-B99_U9Pp.js";
 import { n as formDataObject } from "../kit-Fm-Fv7q5.js";
 import { cache } from "react";
@@ -286,9 +286,9 @@ function requireAal(level, options = {}) {
 		return NextResponse.redirect(target);
 	};
 }
-function endedRedirect(request, path) {
+function endedRedirect(request, path, reason) {
 	const target = new URL(path, request.url);
-	target.searchParams.set("reason", "session_ended");
+	target.searchParams.set("reason", reason);
 	return NextResponse.redirect(target);
 }
 function shouldCheckSession(request, options = {}) {
@@ -485,7 +485,7 @@ function createNext(betterSupabase, options = {}) {
 			const rendersSignedOut = proxyOptions.expiredPrefetch === "render" && resolution.auth.kind === "anon" && resolution.auth.reason === "expired" && isPrefetch(request);
 			const protectMethods = proxyOptions.protectMethods;
 			const runsProtect = protectMethods === true ? true : (protectMethods ?? ["GET", "HEAD"]).includes(request.method);
-			const custom = (resolution.sessionEnded === true && sessionCheck?.redirect !== void 0 && request.nextUrl.pathname !== sessionCheck.redirect ? endedRedirect(request, sessionCheck.redirect) : void 0) ?? (rendersSignedOut || !runsProtect ? void 0 : await proxyOptions.protect?.(resolution.auth, request));
+			const custom = (resolution.sessionEnded === true && sessionCheck?.redirect !== void 0 && request.nextUrl.pathname !== sessionCheck.redirect ? endedRedirect(request, sessionCheck.redirect, resolution.sessionEndedReason === "banned" ? sessionCheck.reasons?.banned ?? "account_banned" : sessionCheck.reasons?.ended ?? "session_ended") : void 0) ?? (rendersSignedOut || !runsProtect ? void 0 : await proxyOptions.protect?.(resolution.auth, request));
 			const initial = custom ?? early;
 			if (!initial && resolution.cookies.length === 0 && !id && !proxyOptions.after && !proxyOptions.serverTiming) {
 				flushAfter();

package/dist/node/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../refusal-D1rgbzNq.js";
+import { n as RouteGuardOptions } from "../refusal-DhSU2Vvr.js";
 import { i as toWebHeaders, r as applyWebHeaders, t as NodeHeaderTarget } from "../node-headers-AO06VhqH.js";
-import { _ as toNodeHandler, a as FastifyReplyLike, b as toWebRequest, c as KoaMiddleware, d as guard, f as koaGuard, g as toKoa, h as toFastify, i as FastifyHook, l as ToNodeOptions, m as toExpress, n as ExpressMiddleware, o as FastifyRequestLike, p as problemErrorHandler, r as ExpressResponse, s as KoaContextLike, t as ExpressErrorHandler, u as fastifyGuard, v as WebRequestOptions, y as sendWebResponse } from "../index-DDrYaUcq.js";
+import { _ as toNodeHandler, a as FastifyReplyLike, b as toWebRequest, c as KoaMiddleware, d as guard, f as koaGuard, g as toKoa, h as toFastify, i as FastifyHook, l as ToNodeOptions, m as toExpress, n as ExpressMiddleware, o as FastifyRequestLike, p as problemErrorHandler, r as ExpressResponse, s as KoaContextLike, t as ExpressErrorHandler, u as fastifyGuard, v as WebRequestOptions, y as sendWebResponse } from "../index-CdZKQF98.js";
 export { ExpressErrorHandler, ExpressMiddleware, ExpressResponse, FastifyHook, FastifyReplyLike, FastifyRequestLike, KoaContextLike, KoaMiddleware, type NodeHeaderTarget, type RouteGuardOptions, ToNodeOptions, type WebRequestOptions, applyWebHeaders, fastifyGuard, guard, koaGuard, problemErrorHandler, sendWebResponse, toExpress, toFastify, toKoa, toNodeHandler, toWebHeaders, toWebRequest };