better-supabase 0.6.1 → 0.7.1

package/dist/orpc/index.d.ts

@@ -1,11 +1,11 @@
 import { b as DbError, f as Result } from "../result-D7y2fT87.js";
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
-import { r as AuthState } from "../resolve-KW8nCeL6.js";
+import { r as AuthState } from "../resolve-ChTYeTEl.js";
 import { i as ProblemDetails } from "../problem-DD8LZFjc.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-C6DWVEVG.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DoBijysA.js";
-import { s as BlockRequireOptions } from "../kit-B5tid-q5.js";
+import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-Bh0EVSwU.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DprrgyXX.js";
+import { s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { BuilderWithMiddlewares, DecoratedMiddleware, ORPCError } from "@orpc/server";

package/dist/orpc/index.js

@@ -2,7 +2,7 @@ import { r as dbErrorOf } from "../errors-B11Duf73.js";
 import { o as toProblem } from "../problem-BreOl8b8.js";
 import { i as claimsOf } from "../claims-PqzCxaTD.js";
 import { t as tenantOf } from "../tenant-I1TEZ_BX.js";
-import { c as extendServer, n as flushEvents, s as createServer, y as refreshFor } from "../adapter-CHnPkCPd.js";
+import { c as extendServer, n as flushEvents, s as createServer, y as refreshFor } from "../adapter-iKgjHVPx.js";
 import { n as toSession } from "../view-BeFcRV6G.js";
 import { o as settle, r as guard, t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { t as authorizeCaller } from "../kit-Fm-Fv7q5.js";

package/dist/otel/index.js

@@ -1,7 +1,7 @@
 import { r as definePlugin } from "../plugin-tfXW1-qO.js";
 import { t as SPEC_PINS } from "../spec-pins--j6mTok4.js";
 import { r as blockEventAttributes } from "../block-events-CrT8r7Fe.js";
-import "../version-CQt77F3T.js";
+import "../version-C6OfRAIn.js";
 import { SpanKind, SpanStatusCode, context, metrics, propagation, trace } from "@opentelemetry/api";
 //#region src/otel/index.ts
 const INSTRUMENTATION_NAME = "better-supabase";
@@ -40,9 +40,9 @@ function systemOf(executor) {
 * ```
 */
 function otel(options = {}) {
-	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.6.1");
+	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.7.1");
 	let histogram;
-	if (options.metrics !== false) histogram = (options.meter ?? metrics.getMeter("better-supabase", "0.6.1")).createHistogram("db.client.operation.duration", {
+	if (options.metrics !== false) histogram = (options.meter ?? metrics.getMeter("better-supabase", "0.7.1")).createHistogram("db.client.operation.duration", {
 		unit: "s",
 		description: "Duration of database client operations.",
 		advice: { explicitBucketBoundaries: [
@@ -181,7 +181,7 @@ function otel(options = {}) {
 * Returns a function that stops listening.
 */
 function traceAuth(betterSupabase, options = {}) {
-	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.6.1");
+	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.7.1");
 	const offAuth = betterSupabase.events.on("auth", (event) => {
 		const span = tracer.startSpan("auth.resolve", {
 			kind: SpanKind.INTERNAL,
@@ -219,7 +219,7 @@ function traceAuth(betterSupabase, options = {}) {
 * set an error status. Returns a function that stops listening.
 */
 function traceBlockEvents(betterSupabase, options = {}) {
-	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.6.1");
+	const tracer = options.tracer ?? trace.getTracer("better-supabase", "0.7.1");
 	return betterSupabase.events.on("block", (event) => {
 		const attributes = {
 			...options.attributes,

package/dist/{provider-BH5UWZJ6.d.ts → provider-D-UEMvSD.d.ts}

@@ -1,6 +1,6 @@
 /// <reference lib="esnext.temporal" />
 import { b as DbError, t as AsyncResult } from "./result-D7y2fT87.js";
-import { r as AuthState } from "./resolve-KW8nCeL6.js";
+import { r as AuthState } from "./resolve-ChTYeTEl.js";
 //#region src/credentials/provider.d.ts
 /**
  * Names a credential without holding it. Tables store this as a

package/dist/react/index.d.ts

@@ -1,12 +1,12 @@
 import { t as escapeLike } from "../escape-like-ImTK0ps_.js";
 import { s as Impersonator } from "../mfa-Daak8ukG.js";
-import { t as tenantOf } from "../tenant-icPeuUBN.js";
-import { t as AuthSession } from "../view-DbxLNu8L.js";
+import { t as tenantOf } from "../tenant-BxNFk9bx.js";
+import { t as AuthSession } from "../view-CF7ihnkg.js";
 import { r as LiveCountSeed } from "../index-DunNRdnT.js";
-import { r as MembershipClaim } from "../entitlements-DHrY2UDZ.js";
-import { n as supportOf, t as SupportView } from "../support-view-33Oi07TT.js";
+import { r as MembershipClaim } from "../entitlements-BKSVGtrG.js";
+import { n as supportOf, t as SupportView } from "../support-view-CVOJJLpc.js";
 import { a as BroadcastOptions, f as UseActionOptions, l as LiveQueryHookOptions, n as ActionInputOf, o as ClientLike, r as ActionResultOf, s as LiveCountHookOptions, t as fieldErrorsOf } from "../field-errors-BFOa7WhB.js";
-import { A as useLiveCount, C as BetterSupabaseProviderProps, D as createHooks, E as ProfileOf, M as useSupabase, O as useAuth, S as BetterSupabaseProvider, T as LiveCount, _ as ActionHandle, a as UploadTarget, b as useActionForm, c as useUpload, d as useDebouncedSearch, f as Presence, g as ActionForm, h as usePresence, i as UploadStatus, j as useLiveQuery, k as useBroadcast, l as DebouncedSearch, m as PresenceTopic, n as SignedUrlSource, o as UseUploadOptions, p as PresenceHookOptions, r as Upload, s as useSignedUrl, t as SignedUrl, u as DebouncedSearchOptions, v as UseActionFormOptions, w as ClaimsOf, x as BetterHooks, y as useAction } from "../index-CtuakVRc.js";
+import { A as useLiveCount, C as BetterSupabaseProviderProps, D as createHooks, E as ProfileOf, M as useSupabase, O as useAuth, S as BetterSupabaseProvider, T as LiveCount, _ as ActionHandle, a as UploadTarget, b as useActionForm, c as useUpload, d as useDebouncedSearch, f as Presence, g as ActionForm, h as usePresence, i as UploadStatus, j as useLiveQuery, k as useBroadcast, l as DebouncedSearch, m as PresenceTopic, n as SignedUrlSource, o as UseUploadOptions, p as PresenceHookOptions, r as Upload, s as useSignedUrl, t as SignedUrl, u as DebouncedSearchOptions, v as UseActionFormOptions, w as ClaimsOf, x as BetterHooks, y as useAction } from "../index-CewnYSpv.js";
 import { SessionProvider, SessionProviderProps, useSession, useSupportSession } from "./session.js";
 import { a as useSignIn, i as SignOut, n as PendingState, o as useSignOut, r as SignIn, t as AuthHookOptions } from "../sign-in-BCV5S2WZ.js";
 export { type ActionForm, type ActionHandle, type ActionInputOf, type ActionResultOf, type AuthHookOptions, type AuthSession, type BetterHooks, BetterSupabaseProvider, type BetterSupabaseProviderProps, type BroadcastOptions, type ClaimsOf, type ClientLike, type DebouncedSearch, type DebouncedSearchOptions, type Impersonator, type LiveCount, type LiveCountHookOptions, type LiveCountSeed, type LiveQueryHookOptions, type MembershipClaim, type PendingState, type Presence, type PresenceHookOptions, type PresenceTopic, type ProfileOf, SessionProvider, type SessionProviderProps, type SignIn, type SignOut, type SignedUrl, type SignedUrlSource, type SupportView, type Upload, type UploadStatus, type UploadTarget, type UseActionFormOptions, type UseActionOptions, type UseUploadOptions, createHooks, escapeLike, fieldErrorsOf, supportOf, tenantOf, useAction, useActionForm, useAuth, useBroadcast, useDebouncedSearch, useLiveCount, useLiveQuery, usePresence, useSession, useSignIn, useSignOut, useSignedUrl, useSupabase, useSupportSession, useUpload };

package/dist/react/server.d.ts

@@ -1,13 +1,13 @@
 import { t as escapeLike } from "../escape-like-ImTK0ps_.js";
 import { it as QuerySpec } from "../define-CJJkkr1-.js";
 import { s as Impersonator } from "../mfa-Daak8ukG.js";
-import { t as tenantOf } from "../tenant-icPeuUBN.js";
-import { t as AuthSession } from "../view-DbxLNu8L.js";
+import { t as tenantOf } from "../tenant-BxNFk9bx.js";
+import { t as AuthSession } from "../view-CF7ihnkg.js";
 import { r as LiveCountSeed } from "../index-DunNRdnT.js";
-import { r as MembershipClaim } from "../entitlements-DHrY2UDZ.js";
-import { n as supportOf, t as SupportView } from "../support-view-33Oi07TT.js";
+import { r as MembershipClaim } from "../entitlements-BKSVGtrG.js";
+import { n as supportOf, t as SupportView } from "../support-view-CVOJJLpc.js";
 import { a as BroadcastOptions, f as UseActionOptions, l as LiveQueryHookOptions, n as ActionInputOf, o as ClientLike, r as ActionResultOf, s as LiveCountHookOptions, t as fieldErrorsOf } from "../field-errors-BFOa7WhB.js";
-import { C as BetterSupabaseProviderProps, E as ProfileOf, M as useSupabase, O as useAuth, S as BetterSupabaseProvider, T as LiveCount, _ as ActionHandle, a as UploadTarget, c as useUpload$1, d as useDebouncedSearch$1, f as Presence, g as ActionForm, h as usePresence$1, i as UploadStatus, j as useLiveQuery, k as useBroadcast, l as DebouncedSearch, m as PresenceTopic, n as SignedUrlSource, o as UseUploadOptions, p as PresenceHookOptions, r as Upload, s as useSignedUrl$1, t as SignedUrl, u as DebouncedSearchOptions, v as UseActionFormOptions, w as ClaimsOf, x as BetterHooks } from "../index-CtuakVRc.js";
+import { C as BetterSupabaseProviderProps, E as ProfileOf, M as useSupabase, O as useAuth, S as BetterSupabaseProvider, T as LiveCount, _ as ActionHandle, a as UploadTarget, c as useUpload$1, d as useDebouncedSearch$1, f as Presence, g as ActionForm, h as usePresence$1, i as UploadStatus, j as useLiveQuery, k as useBroadcast, l as DebouncedSearch, m as PresenceTopic, n as SignedUrlSource, o as UseUploadOptions, p as PresenceHookOptions, r as Upload, s as useSignedUrl$1, t as SignedUrl, u as DebouncedSearchOptions, v as UseActionFormOptions, w as ClaimsOf, x as BetterHooks } from "../index-CewnYSpv.js";
 import { SessionProvider, SessionProviderProps } from "./session.js";
 import { a as useSignIn$1, i as SignOut, n as PendingState, o as useSignOut$1, r as SignIn, t as AuthHookOptions } from "../sign-in-BCV5S2WZ.js";
 //#region src/react/server.d.ts

package/dist/react/session.d.ts

@@ -1,5 +1,5 @@
-import { t as AuthSession } from "../view-DbxLNu8L.js";
-import { t as SupportView } from "../support-view-33Oi07TT.js";
+import { t as AuthSession } from "../view-CF7ihnkg.js";
+import { t as SupportView } from "../support-view-CVOJJLpc.js";
 import { ReactNode } from "react";
 //#region src/react/session.d.ts
 export interface SessionProviderProps {

package/dist/react-router/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-C6DWVEVG.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
-import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-CdPDPpFs.js";
+import { t as BetterServer } from "../server-Bh0EVSwU.js";
+import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
+import { t as RefusalRedirects } from "../refusal-DhSU2Vvr.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-BmzgK32X.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/react-router/index.js

@@ -1,9 +1,9 @@
 import { a as problemResponse } from "../problem-BreOl8b8.js";
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-iKgjHVPx.js";
 import { o as settle, t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
 import { n as bufferInPlace, t as around } from "../shared-CBxosKK3.js";
-import { i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-xjTBoyBB.js";
+import { i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-a7aRCIqv.js";
 import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
 //#region src/bridges/react-router.ts
 /**

package/dist/{refusal-D1rgbzNq.d.ts → refusal-DhSU2Vvr.d.ts}

@@ -1,4 +1,4 @@
-import { s as BlockRequireOptions } from "./kit-B5tid-q5.js";
+import { s as BlockRequireOptions } from "./kit-CkNzZUqv.js";
 //#region src/server/refusal.d.ts
 /** Where refused callers go instead of a Problem Details response. */
 interface RefusalRedirects {

package/dist/{resolve-KW8nCeL6.d.ts → resolve-ChTYeTEl.d.ts}

@@ -147,7 +147,10 @@ interface AuthResolution<C = unknown, P = unknown> {
   readonly requestCookies: readonly CookieRecord[];
   /** Adds `cookies` and `headers` to a response. */
   apply(response: Response): Response;
+  /** The session was ended server-side (revoked, deleted or banned); the cookies are cleared. */
   readonly sessionEnded?: boolean;
+  /** Why `sessionEnded` is set: `banned` when Auth rejected the user as banned. */
+  readonly sessionEndedReason?: "ended" | "banned";
 }
 /** The first `x-forwarded-for` hop, the client as your edge saw it. */
 declare function clientIp(request: Request): string | undefined;

package/dist/{resolve-D_IcnvFd.js → resolve-tJZY3FEa.js}

@@ -164,8 +164,8 @@ async function sessionStatus(input, options) {
 			},
 			signal: AbortSignal.timeout(options.timeoutMs ?? DEFAULT_TIMEOUT_MS$1)
 		});
+		if (response.status === 401 || response.status === 403) return (await response.json().catch(() => null))?.["error_code"] === "user_banned" ? "banned" : "ended";
 		await response.body?.cancel();
-		if (response.status === 401 || response.status === 403) return "ended";
 		return response.ok ? "active" : "unknown";
 	} catch {
 		return "unknown";
@@ -237,6 +237,7 @@ async function request(refreshToken, options, now) {
 			ok: false,
 			reason: response.status >= 500 || response.status === 429 ? "network" : "rejected",
 			status: response.status,
+			...typeof body?.["error_code"] === "string" ? { code: body["error_code"] } : {},
 			message
 		};
 	}
@@ -502,12 +503,15 @@ async function verifyOnce(credentials, modes, options, source) {
 		reason: "none"
 	};
 }
-function resolution(auth, cookies, writes = [], ended = false) {
+function resolution(auth, cookies, writes = [], ended) {
 	const headers = writes.length > 0 ? AUTH_CACHE_HEADERS : {};
 	let requestCookies;
 	return {
 		auth,
-		...ended ? { sessionEnded: true } : {},
+		...ended ? {
+			sessionEnded: true,
+			sessionEndedReason: ended
+		} : {},
 		cookies: writes,
 		headers,
 		/** Parsed on first read: bearer requests rarely need their cookies. */
@@ -588,16 +592,17 @@ async function resolveAuth(request, options) {
 			token: session.access_token,
 			apikey: null
 		}, ["user"], options, "cookie");
-		if (state.kind === "user" && options.checkSession && await sessionStatus(state.token, {
+		const status = state.kind === "user" && options.checkSession ? await sessionStatus(state.token, {
 			url: options.env.url,
 			publishableKey: options.env.publishableKey,
 			...options.fetch ? { fetch: options.fetch } : {},
 			...options.refreshTimeoutMs === void 0 ? {} : { timeoutMs: options.refreshTimeoutMs },
 			...options.now ? { now: options.now } : {}
-		}) === "ended") return resolution({
+		}) : void 0;
+		if (status === "ended" || status === "banned") return resolution({
 			kind: "anon",
 			reason: "signed_out"
-		}, cookies, options.refresh ? writeSession(cookies(), name, null, options.cookie?.options, encoding) : [], true);
+		}, cookies, options.refresh ? writeSession(cookies(), name, null, options.cookie?.options, encoding) : [], status);
 		if (state.kind !== "invalid" || state.reason !== "token" || state.error.kind === "network") return resolution(state, cookies);
 		if (!options.refresh) return resolution({
 			kind: "anon",
@@ -643,7 +648,7 @@ async function resolveAuth(request, options) {
 		return resolution({
 			kind: "anon",
 			reason: "signed_out"
-		}, cookies, writeSession(cookies(), name, null, options.cookie?.options, encoding));
+		}, cookies, writeSession(cookies(), name, null, options.cookie?.options, encoding), outcome.code === "user_banned" ? "banned" : void 0);
 	}
 	const writes = writeSession(cookies(), name, outcome.session, options.cookie?.options, encoding);
 	return resolution(await verify({

package/dist/{resource-D6Uc7Sk7.d.ts → resource-IPS5xi9q.d.ts}

@@ -1,7 +1,7 @@
 import { E as ValidationIssue, f as Result } from "./result-D7y2fT87.js";
 import { H as Update, L as TableKey, R as TableMeta, a as AnyModels, i as AnyFunctions, x as Insert } from "./types-6BdhkmZe.js";
 import { It as SelectArg, t as BetterSupabase } from "./define-CJJkkr1-.js";
-import { a as RespondOptions } from "./respond-DoBijysA.js";
+import { a as RespondOptions } from "./respond-DprrgyXX.js";
 import { i as ResourceOperation } from "./index-Bxih3l0u.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/server/resource.d.ts

package/dist/{respond-DoBijysA.d.ts → respond-DprrgyXX.d.ts}

@@ -1,5 +1,5 @@
 import { b as DbError } from "./result-D7y2fT87.js";
-import { r as AuthState } from "./resolve-KW8nCeL6.js";
+import { r as AuthState } from "./resolve-ChTYeTEl.js";
 import { t as Aal } from "./mfa-Daak8ukG.js";
 //#region src/server/refresh.d.ts
 /** A router or browser prefetch, by its request headers. */

package/dist/server/index.d.ts

@@ -2,24 +2,61 @@ import { b as DbError } from "../result-D7y2fT87.js";
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { m as RequestContext } from "../plugin-FGY8UhYm.js";
 import { _ as writeSession, a as CookieWrite, c as StoredSession, h as sessionCookieName, n as CookieOptions, p as readSession, r as CookieRecord, t as AUTH_CACHE_HEADERS } from "../session-ChiXDZdZ.js";
-import { a as ResolveAuthOptions, c as clientIp, i as InvalidReason, l as resolveAuth, n as AuthResolver, o as ResolvedState, r as AuthState, s as authContext, t as AuthResolution } from "../resolve-KW8nCeL6.js";
+import { a as ResolveAuthOptions, c as clientIp, i as InvalidReason, l as resolveAuth, n as AuthResolver, o as ResolvedState, r as AuthState, s as authContext, t as AuthResolution } from "../resolve-ChTYeTEl.js";
 import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DD8LZFjc.js";
 import { B as DbStats, b as Db, t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { A as SupportCookieOptions, B as SupportStartInput, C as SupportAuthorizeInput, D as SupportStartRequest, E as SupportSessions, F as SupportCallerClaims, H as supportClaims, I as SupportEndedBy, L as SupportListFilter, M as supportCookie, N as supportCookieValue, O as supportSessions, P as SqlSupportStoreOptions, R as SupportSession, S as SupportApi, T as SupportPolicy, V as sqlSupportStore, _ as ReplicaState, a as ServerDbOptions, b as deleteAccount, c as createServer, d as SuspendAccountOptions, f as SuspendAccountResult, g as PRIMARY_COOKIE, h as RequestIdOptions, i as ServerContext, j as clearSupportCookie, k as SUPPORT_COOKIE, l as extendServer, m as suspendAccount, n as ContextOptions, o as ServerOptions, p as endSessions, r as ForContextOptions, s as TENANT_HEADER, t as BetterServer, u as EndSessionsResult, v as DeleteAccountOptions, w as SupportOptions, x as ActiveSupport, y as DeleteAccountResult, z as SupportSessionStore } from "../server-C6DWVEVG.js";
+import { A as supportSessions, B as SupportSession, C as ActiveSupport, D as SupportPolicy, E as SupportOptions, F as supportCookieValue, H as SupportStartInput, I as SqlSupportStoreOptions, L as SupportCallerClaims, M as SupportCookieOptions, N as clearSupportCookie, O as SupportSessions, P as supportCookie, R as SupportEndedBy, S as deleteAccount, T as SupportAuthorizeInput, U as sqlSupportStore, V as SupportSessionStore, W as supportClaims, _ as RequestIdOptions, a as ServerDbOptions, b as DeleteAccountOptions, c as createServer, d as LastSignIn, f as SuspendAccountOptions, g as suspendAccount, h as lastSignIns, i as ServerContext, j as SUPPORT_COOKIE, k as SupportStartRequest, l as extendServer, m as endSessions, n as ContextOptions, o as ServerOptions, p as SuspendAccountResult, r as ForContextOptions, s as TENANT_HEADER, t as BetterServer, u as EndSessionsResult, v as PRIMARY_COOKIE, w as SupportApi, x as DeleteAccountResult, y as ReplicaState, z as SupportListFilter } from "../server-Bh0EVSwU.js";
 import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-Daak8ukG.js";
 import { n as SessionActor, r as SessionDelegation, t as ActClaim } from "../actor-CQTlc1Hh.js";
-import { n as toSession, t as AuthSession } from "../view-DbxLNu8L.js";
-import { a as SessionEntryConfig, c as withGuard, i as withBetterSupabase, l as ServerCore, n as BetterSupabaseContributions, o as withSession, r as BetterSupabaseEntry, s as GuardEntryConfig, t as BetterSupabaseConfig, u as serverCore } from "../composite-pSfeJNce.js";
-import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-DoBijysA.js";
-import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-B5tid-q5.js";
-import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-D6Uc7Sk7.js";
+import { n as toSession, t as AuthSession } from "../view-CF7ihnkg.js";
+import { a as SessionEntryConfig, c as withGuard, i as withBetterSupabase, l as ServerCore, n as BetterSupabaseContributions, o as withSession, r as BetterSupabaseEntry, s as GuardEntryConfig, t as BetterSupabaseConfig, u as serverCore } from "../composite--yqry7uW.js";
+import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-DprrgyXX.js";
+import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-CkNzZUqv.js";
+import { a as ResourceRouteOptions, i as ResourcePagination, n as ResourceInput, o as defineResource, r as ResourceList, t as ResourceHandler } from "../resource-IPS5xi9q.js";
 import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-Cx-LnIQP.js";
-import { n as supportOf, t as SupportView } from "../support-view-33Oi07TT.js";
-import { a as sessionStatus, c as refreshSession, i as clearSessionCookies, n as SessionStatus, r as SessionStatusOptions, s as RefreshOutcome, t as ClearSessionCookiesOptions } from "../ended-jLfvw8h-.js";
+import { n as supportOf, t as SupportView } from "../support-view-CVOJJLpc.js";
+import { a as sessionStatus, c as refreshSession, i as clearSessionCookies, n as SessionStatus, r as SessionStatusOptions, s as RefreshOutcome, t as ClearSessionCookiesOptions } from "../ended-XjeGQ5XW.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware, SingleKeyEntry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
 import { PostgresApi } from "@supabase/server/middleware/postgres";
+//#region src/blocks/csv.d.ts
+interface CsvOptions {
+  /**
+   * The columns in order. Defaults to every key of the rows, in the order
+   * they first appear.
+   */
+  readonly columns?: readonly string[];
+  /**
+   * Prefixes a text cell that starts with `=`, `+`, `-`, `@`, a tab or a
+   * carriage return with `'`, so a spreadsheet shows it instead of running
+   * it as a formula (CSV injection). Default true.
+   */
+  readonly escapeFormulas?: boolean;
+}
+/** The columns of `rows`: every key, in the order it first appears. */
+export declare function csvColumns(rows: readonly Readonly<Record<string, unknown>>[]): string[];
+/**
+ * RFC 4180 CSV with a header row and CRLF line ends. Objects and arrays are
+ * written as JSON, null and undefined as empty cells.
+ */
+export declare function toCsv(rows: readonly Readonly<Record<string, unknown>>[], options?: CsvOptions): string;
+//#endregion
+//#region src/server/csv.d.ts
+interface CsvResponseOptions extends CsvOptions {
+  /** The download name, such as `invoices.csv`. */
+  readonly filename: string;
+  /** Extra headers, such as `cache-control`. `content-type` and `content-disposition` win. */
+  readonly headers?: ConstructorParameters<typeof Headers>[0];
+  readonly status?: number;
+}
+/**
+ * `rows` as a CSV download: `text/csv; charset=utf-8` with an `attachment`
+ * `Content-Disposition`. Text cells that start with a formula character are
+ * escaped unless `escapeFormulas` is false.
+ */
+export declare function csvResponse(rows: readonly Readonly<Record<string, unknown>>[], options: CsvResponseOptions): Response;
+//#endregion
 //#region src/server/audit.d.ts
 /** The CloudEvents `source` of the events the server sends to its `audit` sink. */
 export declare const SERVER_EVENT_SOURCE = "/better-supabase/server";
@@ -188,4 +225,4 @@ export declare function withDbStats(options?: {
   };
 }, () => DbStats>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizeOptions, type AuthorizedContext, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, aalOf, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, createServer, defineResource, deleteAccount, endSessions, extendServer, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, type Aal, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizeOptions, type AuthorizedContext, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, aalOf, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, createServer, defineResource, deleteAccount, endSessions, extendServer, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };

package/dist/server/index.js

@@ -2,20 +2,42 @@ import { n as dbError } from "../errors-B11Duf73.js";
 import { a as problemResponse, i as isProblem, n as PROBLEM_TYPE_BASE, o as toProblem, r as fromProblem, t as PROBLEM_CONTENT_TYPE } from "../problem-BreOl8b8.js";
 import { i as userContext, r as impersonatorOf } from "../impersonation-DcqaTBHx.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
+import { n as toCsv, t as csvColumns } from "../csv-DCK-PT1n.js";
 import { n as postgresExecutor } from "../executor-De1Of3m3.js";
-import { C as serverCore, D as deleteAccount, E as suspendAccount, T as endSessions, _ as withSession, a as unexpectedResponse, b as shouldCheckSession, c as extendServer, d as clearSupportCookie, f as supportCookie, i as resolveToken, m as supportCookieValue, n as flushEvents, o as TENANT_HEADER, r as handle, s as createServer, u as SUPPORT_COOKIE, v as isPrefetch, w as SERVER_EVENT_SOURCE, x as shouldRefresh, y as refreshFor } from "../adapter-CHnPkCPd.js";
+import { C as serverCore, D as suspendAccount, E as lastSignIns, O as deleteAccount, T as endSessions, _ as withSession, a as unexpectedResponse, b as shouldCheckSession, c as extendServer, d as clearSupportCookie, f as supportCookie, i as resolveToken, m as supportCookieValue, n as flushEvents, o as TENANT_HEADER, r as handle, s as createServer, u as SUPPORT_COOKIE, v as isPrefetch, w as SERVER_EVENT_SOURCE, x as shouldRefresh, y as refreshFor } from "../adapter-iKgjHVPx.js";
 import { n as PRIMARY_COOKIE } from "../replicas-CwrYp5Zj.js";
-import { _ as writeSession, a as refreshSession, c as AUTH_CACHE_HEADERS, h as sessionCookieName, i as resolveAuth, n as clientIp, o as clearSessionCookies, p as readSession, s as sessionStatus, t as authContext } from "../resolve-D_IcnvFd.js";
+import { _ as writeSession, a as refreshSession, c as AUTH_CACHE_HEADERS, h as sessionCookieName, i as resolveAuth, n as clientIp, o as clearSessionCookies, p as readSession, s as sessionStatus, t as authContext } from "../resolve-tJZY3FEa.js";
 import { a as checkAal, i as amrOf, n as toSession, r as aalOf } from "../view-BeFcRV6G.js";
 import { a as respond, i as isResult, o as settle, r as guard } from "../respond-BUgsXNgk.js";
-import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-zIa1URaN.js";
+import { n as sqlSupportStore, r as supportClaims, t as supportSessions } from "../support-ig_K4PvS.js";
 import { n as jwtClaimsOf, r as userClaimsOf, t as authModeOf } from "../claims-DDBQT6BK.js";
-import { n as withGuard, t as withBetterSupabase } from "../composite-CLqs9-OA.js";
+import { n as withGuard, t as withBetterSupabase } from "../composite-DXVUibdi.js";
 import { t as defineResource } from "../resource-BsvzCMlX.js";
 import { i as withServerTiming, n as parseDbStats, r as withDbStats, t as DB_CALLS_HEADER } from "../timing-CyTQPubY.js";
 import { n as tagCache, r as tagFor, t as cacheTagsOf } from "../tags-B99_U9Pp.js";
 import { a as rolesAt, r as hasRole } from "../kit-Fm-Fv7q5.js";
 import { defineMiddleware } from "@supabase/middleware";
+//#region src/server/csv.ts
+function disposition(filename) {
+	const safe = filename.replaceAll(/[\r\n]/g, " ");
+	return `attachment; filename="${safe.replaceAll(/[^\u0020-\u007E]|["\\]/g, "_")}"; filename*=UTF-8''${encodeURIComponent(safe).replaceAll(/['()*]/g, (char) => `%${char.codePointAt(0).toString(16).toUpperCase()}`)}`;
+}
+/**
+* `rows` as a CSV download: `text/csv; charset=utf-8` with an `attachment`
+* `Content-Disposition`. Text cells that start with a formula character are
+* escaped unless `escapeFormulas` is false.
+*/
+function csvResponse(rows, options) {
+	const { filename, headers, status, ...csv } = options;
+	const response = new Response(toCsv(rows, csv), {
+		status: status ?? 200,
+		...headers ? { headers } : {}
+	});
+	response.headers.set("content-type", "text/csv; charset=utf-8");
+	response.headers.set("content-disposition", disposition(filename));
+	return response;
+}
+//#endregion
 //#region src/server/entries/upstream.ts
 /** Repository context from a `@supabase/server` context. */
 function contextFromSupabase(ctx) {
@@ -120,4 +142,4 @@ async function checkSession(sql, auth) {
 	return row?.active === true ? void 0 : revoked;
 }
 //#endregion
-export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, amrOf, authContext, authModeOf, cacheTagsOf, checkAal, checkSession, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, defineResource, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, jwtClaimsOf, parseDbStats, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, resolveToken, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withGuard, withServerTiming, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, DB_CALLS_HEADER, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, SERVER_EVENT_SOURCE, SUPPORT_COOKIE, TENANT_HEADER, aalOf, amrOf, authContext, authModeOf, cacheTagsOf, checkAal, checkSession, clearSessionCookies, clearSupportCookie, clientIp, contextFromSupabase, createServer, csvColumns, csvResponse, defineResource, deleteAccount, endSessions, extendServer, flushEvents, fromProblem, guard, handle, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, jwtClaimsOf, lastSignIns, parseDbStats, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, resolveToken, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, unexpectedResponse, userClaimsOf, withBetterDb, withBetterPostgres, withBetterSupabase, withBlock, withDbStats, withGuard, withServerTiming, withSession, writeSession };

package/dist/{server-C6DWVEVG.d.ts → server-Bh0EVSwU.d.ts}

@@ -6,8 +6,8 @@ import { m as RequestContext } from "./plugin-FGY8UhYm.js";
 import { a as EventHub } from "./events-DWDhx77e.js";
 import { t as BetterSupabaseEnv } from "./index-CLg87OBW.js";
 import { a as CookieWrite } from "./session-ChiXDZdZ.js";
-import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-KW8nCeL6.js";
-import { r as CredentialProvider } from "./provider-BH5UWZJ6.js";
+import { a as ResolveAuthOptions, r as AuthState, t as AuthResolution } from "./resolve-ChTYeTEl.js";
+import { r as CredentialProvider } from "./provider-D-UEMvSD.js";
 import { B as DbStats, H as StatsRecorder, b as Db, t as BetterSupabase } from "./define-CJJkkr1-.js";
 import { r as EventSink } from "./cloud-event-C1JCc1bH.js";
 import { s as SqlClaims, t as BetterPostgres } from "./pool-CAu2nLrL.js";
@@ -293,14 +293,38 @@ interface EndSessionsResult {
 }
 interface SuspendAccountOptions {
   readonly suspended: boolean;
+  /** A Go duration for the ban, such as `"24h"`. Defaults to 100 years. */
   readonly duration?: string;
+  /**
+   * Also end the sessions when suspending. Defaults to `false`: the sessions
+   * stay, so Auth answers refresh and `/user` with `user_banned` and the app
+   * can show why. Without the `sessions` SQL module, an access token keeps
+   * working against the Data API until it expires; set this to end the
+   * sessions at once instead.
+   */
+  readonly endSessions?: boolean;
 }
 interface SuspendAccountResult {
   readonly userId: string;
   readonly suspended: boolean;
+  /**
+   * The sessions deleted: `0` on a suspension (unless `endSessions` is set),
+   * and the user's remaining sessions when the ban is lifted.
+   */
   readonly ended: number;
 }
 declare function endSessions(sql: SqlClient, userId: string): AsyncResult<EndSessionsResult>;
+interface LastSignIn {
+  readonly userId: string;
+  /** `null` for a user who never signed in. */
+  readonly lastSignInAt: Temporal.Instant | null;
+}
+/**
+ * The last sign-in of each user, in one query (`better_supabase.last_sign_ins`
+ * from the `sessions` module, which only the service role may call). Users
+ * that don't exist are missing from the map.
+ */
+declare function lastSignIns(sql: SqlClient, userIds: readonly string[]): AsyncResult<ReadonlyMap<string, LastSignIn>>;
 declare function suspendAccount(service: SupabaseClient | (() => SupabaseClient), sql: SqlClient, userId: string, options: SuspendAccountOptions): AsyncResult<SuspendAccountResult>;
 //#endregion
 //#region src/server/server.d.ts
@@ -496,6 +520,11 @@ interface BetterServer<M extends AnyModels, F extends AnyFunctions, E, C = unkno
    */
   deleteAccount(userId: string, options?: DeleteAccountOptions): AsyncResult<DeleteAccountResult>;
   endSessions(userId: string): AsyncResult<EndSessionsResult>;
+  /**
+   * Bans the user in Auth and keeps their sessions, so Auth answers with
+   * `user_banned` (`endSessions: true` deletes them too). Lifting the ban
+   * ends the sessions first, so the user signs in again.
+   */
   suspendAccount(userId: string, options: SuspendAccountOptions): AsyncResult<SuspendAccountResult>;
   /**
    * Repositories running as a user, with RLS, over direct Postgres. With
@@ -526,4 +555,4 @@ declare function extendServer<R extends object>(server: object, extra: Omit<R, S
  */
 declare function createServer<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: ServerOptions): BetterServer<M, F, E, C, P>;
 //#endregion
-export { SupportCookieOptions as A, SupportStartInput as B, SupportAuthorizeInput as C, SupportStartRequest as D, SupportSessions as E, SupportCallerClaims as F, supportClaims as H, SupportEndedBy as I, SupportListFilter as L, supportCookie as M, supportCookieValue as N, supportSessions as O, SqlSupportStoreOptions as P, SupportSession as R, SupportApi as S, SupportPolicy as T, sqlSupportStore as V, ReplicaState as _, ServerDbOptions as a, deleteAccount as b, createServer as c, SuspendAccountOptions as d, SuspendAccountResult as f, PRIMARY_COOKIE as g, RequestIdOptions as h, ServerContext as i, clearSupportCookie as j, SUPPORT_COOKIE as k, extendServer as l, suspendAccount as m, ContextOptions as n, ServerOptions as o, endSessions as p, ForContextOptions as r, TENANT_HEADER as s, BetterServer as t, EndSessionsResult as u, DeleteAccountOptions as v, SupportOptions as w, ActiveSupport as x, DeleteAccountResult as y, SupportSessionStore as z };
+export { supportSessions as A, SupportSession as B, ActiveSupport as C, SupportPolicy as D, SupportOptions as E, supportCookieValue as F, SupportStartInput as H, SqlSupportStoreOptions as I, SupportCallerClaims as L, SupportCookieOptions as M, clearSupportCookie as N, SupportSessions as O, supportCookie as P, SupportEndedBy as R, deleteAccount as S, SupportAuthorizeInput as T, sqlSupportStore as U, SupportSessionStore as V, supportClaims as W, RequestIdOptions as _, ServerDbOptions as a, DeleteAccountOptions as b, createServer as c, LastSignIn as d, SuspendAccountOptions as f, suspendAccount as g, lastSignIns as h, ServerContext as i, SUPPORT_COOKIE as j, SupportStartRequest as k, extendServer as l, endSessions as m, ContextOptions as n, ServerOptions as o, SuspendAccountResult as p, ForContextOptions as r, TENANT_HEADER as s, BetterServer as t, EndSessionsResult as u, PRIMARY_COOKIE as v, SupportApi as w, DeleteAccountResult as x, ReplicaState as y, SupportListFilter as z };

package/dist/solid/index.d.ts

@@ -2,9 +2,9 @@ import { b as DbError } from "../result-D7y2fT87.js";
 import { it as QuerySpec } from "../define-CJJkkr1-.js";
 import { n as TemplateValues } from "../template-CwO38Do8.js";
 import { t as AuthSnapshot } from "../bind-Bu_ZNa3W.js";
-import { t as AuthSession } from "../view-DbxLNu8L.js";
+import { t as AuthSession } from "../view-CF7ihnkg.js";
 import { S as Topic, f as PresenceMember, u as EventSchemas, w as TopicHandlers, x as SubscriptionStatus } from "../index-DunNRdnT.js";
-import { t as SupportView } from "../support-view-33Oi07TT.js";
+import { t as SupportView } from "../support-view-CVOJJLpc.js";
 import { a as BroadcastOptions, c as LiveCountSource, d as PresenceTopic, f as UseActionOptions, i as ActionState, l as LiveQueryHookOptions, n as ActionInputOf, o as ClientLike, r as ActionResultOf, s as LiveCountHookOptions, t as fieldErrorsOf, u as PresenceHookOptions } from "../field-errors-BFOa7WhB.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Accessor, JSX } from "solid-js";

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-C6DWVEVG.js";
-import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
-import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-CdPDPpFs.js";
+import { t as BetterServer } from "../server-Bh0EVSwU.js";
+import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
+import { t as RefusalRedirects } from "../refusal-DhSU2Vvr.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-BmzgK32X.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/solid-start/index.d.ts
 /** The part of a SolidStart `FetchEvent` the integration reads and writes. */

package/dist/solid-start/index.js

@@ -1,7 +1,7 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-iKgjHVPx.js";
 import { t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-xjTBoyBB.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-a7aRCIqv.js";
 import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
 import { t as beforeRoute } from "../before-route-CnR0C0Jr.js";
 //#region src/solid-start/index.ts

package/dist/sql/index.d.ts

@@ -191,6 +191,8 @@ interface ModuleLayout {
   readonly policyGrants?: readonly TableGrant[];
   /** The tables the schema files create, for `sql.modules.sessions.options.policies`. */
   readonly declaredTables?: readonly string[];
+  /** The declared tables with row level security on, for tables `fromPolicies` makes service-only. */
+  readonly rlsTables?: readonly string[];
   /** `config.readSets`, compiled: the functions the `read-sets` module writes. */
   readonly readSets?: readonly {
     readonly name: string;
@@ -417,6 +419,14 @@ interface PolicyGrant {
 export declare function declaredTables(files: readonly {
   readonly text: string;
 }[], schemas: readonly string[]): string[];
+/**
+ * The tables in `schemas` that `files` leave with row level security on:
+ * `alter table ... enable row level security`, until a later `disable` or
+ * `drop table`.
+ */
+export declare function rlsTables(files: readonly {
+  readonly text: string;
+}[], schemas: readonly string[]): string[];
 /**
  * The privileges the permissive policies in `files` imply, per table and
  * role: `for all` gives the four commands, `to public` (or no `to`) counts