better-supabase 0.6.1 → 0.7.1

package/dist/sql/index.js

@@ -9,7 +9,7 @@ import { t as FINAL_RUN_STATES$1 } from "../run-state-CgBKzYMW.js";
 import { t as AI_MESSAGE_PART_TYPES } from "../message-CaKlqdsX.js";
 import { A as jwtClaim, B as replaceColumnCheck, C as canIn, D as disabledHelpersNeedLaterTables, E as disabledHelpers, F as pageSize, G as splitTable$1, H as serviceGrant, I as quotedTable, J as userGrant, K as tenantIn, L as raise$1, M as membershipDisabledAt, N as membershipSuspended, O as ensureCheck, P as organizationMissing, R as recordTrigger, S as addForeignKey, T as columnsObject, U as serviceOnly$1, V as schemaPreamble, W as sha256Hex, _ as SCHEMA, a as MODULE_PERMISSION_SCOPES, b as activeMembership, c as modulePermission, d as roleNames, f as roleScopeIs, g as NOTHING, h as EQUIVALENT_TRIGGERS, i as MODULE_PERMISSIONS, j as memberAddedRecord, k as jsonSchemaChecks, l as modulePermissionKey, m as tenantScope, n as WORKFLOW_SDK_WORLD, o as accessModel, p as rolesOf, q as updatedAt, s as hasPlatformRoles, u as providerPlatformRoles, v as SERVICE_CALLER, w as columnRef, x as addExtraColumns, y as accessDefinesDisabledHelpers, z as renameSql } from "../workflow-sdk-world-D-prir6O.js";
 import { c as templateFunctions, i as fillTemplate, o as resolveProviderSql, s as scopeProblems, t as SCOPE_ID_TYPES } from "../access-sql-B0dF-SoF.js";
-import { t as VERSION } from "../version-CQt77F3T.js";
+import { t as VERSION } from "../version-C6OfRAIn.js";
 //#region src/sql/api-schema.ts
 /** The roles PostgREST runs a request as. */
 const API_ROLES = /* @__PURE__ */ new Set([
@@ -35127,6 +35127,33 @@ function declaredTables(files, schemas) {
 	}
 	return [...found];
 }
+const RLS_TOGGLE = new RegExp(String.raw`\balter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?(${NAME}(?:\s*\.\s*${NAME})?)\s+(enable|disable)\s+row\s+level\s+security\b`, "gi");
+/**
+* The tables in `schemas` that `files` leave with row level security on:
+* `alter table ... enable row level security`, until a later `disable` or
+* `drop table`.
+*/
+function rlsTables(files, schemas) {
+	const found = /* @__PURE__ */ new Set();
+	for (const file of files) {
+		const text = withoutComments(file.text);
+		inOrder([[...text.matchAll(RLS_TOGGLE)].map((match) => ({
+			index: match.index,
+			apply: () => {
+				const table = qualified$1(match[1]);
+				if (!schemas.includes(table.slice(0, table.indexOf(".")))) return;
+				if (match[2].toLowerCase() === "enable") found.add(table);
+				else found.delete(table);
+			}
+		})), [...text.matchAll(DROP_TABLE)].map((match) => ({
+			index: match.index,
+			apply: () => {
+				for (const table of droppedTables(match[1])) found.delete(table);
+			}
+		}))]);
+	}
+	return [...found];
+}
 const TABLE_CONSTRAINT = /^(constraint|check|unique|primary|foreign|exclude|like)\b/i;
 /**
 * Columns each `create table` in `files` declares, as `schema.table` to
@@ -35509,6 +35536,23 @@ $$;
 revoke execute on function better_supabase.session_active() from public, anon;
 grant execute on function better_supabase.session_active() to authenticated;
 
+-- The last sign-in of many users in one query, for admin lists. auth.users
+-- isn't readable through the Data API, so only the service role calls this.
+create or replace function better_supabase.last_sign_ins(p_users uuid[])
+returns table (user_id uuid, last_sign_in_at timestamptz)
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select u.id, u.last_sign_in_at
+  from auth.users u
+  where u.id = any(p_users)
+$$;
+
+revoke execute on function better_supabase.last_sign_ins(uuid[]) from public, anon, authenticated;
+grant execute on function better_supabase.last_sign_ins(uuid[]) to service_role;
+
 -- Restrictive, so it applies on top of the table's other policies. Wrapped in
 -- a select, it runs one indexed lookup per statement:
 -- create policy session_required on public.invoices as restrictive
@@ -37401,17 +37445,20 @@ const keyOf = (name) => name.includes(".") ? name : `public.${name}`;
 * Each listed table's complete privilege set: everything is revoked from
 * the API roles first, then the listed privileges are granted. Policy
 * grants fill tables `expose` doesn't list, with every privilege for
-* `service_role`.
+* `service_role`. With policy grants on, a declared table that `expose`
+* doesn't list, with RLS on and no permissive policy reaching it, is service-only.
 */
 function tableGrants(layout) {
 	const listed = layout.grants ?? [];
 	const named = new Set(listed.map((grant) => keyOf(grant.table)));
 	const derived = (layout.policyGrants ?? []).filter((grant) => !named.has(keyOf(grant.table)));
 	const derivedTables = [...new Set(derived.map((grant) => grant.table))];
+	const reached = new Set((layout.policyGrants ?? []).map((grant) => keyOf(grant.table)));
+	const serviceOnly = layout.policyGrants === void 0 ? [] : (layout.declaredTables ?? []).filter((table) => (layout.rlsTables ?? []).includes(table) && !named.has(keyOf(table)) && !reached.has(keyOf(table)));
 	const grants = [
 		...listed,
 		...derived,
-		...derivedTables.map((table) => ({
+		...[...derivedTables, ...serviceOnly].map((table) => ({
 			table,
 			role: "service_role",
 			privileges: [
@@ -37429,7 +37476,7 @@ function tableGrants(layout) {
 	});
 	const all = [...statements, ...functions];
 	if (all.length === 0) return "";
-	return `\n-- config.expose${derived.length > 0 ? " and the policies (sql.modules.grants.options.fromPolicies)" : ""}\n${all.join("\n")}\n`;
+	return `\n-- config.expose${derived.length > 0 || serviceOnly.length > 0 ? " and the policies (sql.modules.grants.options.fromPolicies)" : ""}\n${all.join("\n")}\n`;
 }
 /** A jsonb column and the JSON Schema its values must match. */
 /** Users with a membership in a tenant of `customer`, from the provider's membership tables. */
@@ -38225,4 +38272,4 @@ async function compileReadSets(sets) {
 	return Promise.all(names.map((name) => compileReadSet(byName.get(name))));
 }
 //#endregion
-export { AUDIT_CATEGORIES, MODULE_ID_TYPES, SCOPE_ID_TYPES, SQL_MODULES, adoptedColumnProblems, auditRegistrations, compileReadSet, compileReadSets, contractSignature, customContracts, declaredTables, extensionSchema, isModuleIdType, migrationOptionUses, moduleBody, moduleDeprecations, moduleEventTriggers, moduleFilePaths, moduleFileVersion, moduleIdType, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, moduleVersion, policyGrants, renderModules, resolveModules, resolveProviderSql, sameModuleFile, scopeProblems, sharedRolesProblems, templateFunctions, upgradePlan };
+export { AUDIT_CATEGORIES, MODULE_ID_TYPES, SCOPE_ID_TYPES, SQL_MODULES, adoptedColumnProblems, auditRegistrations, compileReadSet, compileReadSets, contractSignature, customContracts, declaredTables, extensionSchema, isModuleIdType, migrationOptionUses, moduleBody, moduleDeprecations, moduleEventTriggers, moduleFilePaths, moduleFileVersion, moduleIdType, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, moduleVersion, policyGrants, renderModules, resolveModules, resolveProviderSql, rlsTables, sameModuleFile, scopeProblems, sharedRolesProblems, templateFunctions, upgradePlan };

package/dist/ssr/index.d.ts

@@ -1,6 +1,6 @@
 import { _ as writeSession, a as CookieWrite, c as StoredSession, d as clearSessionAtScopes, f as parseCookies, g as sessionEncoding, h as sessionCookieName, i as CookieScope, l as WriteSessionOptions, m as serializeCookie, n as CookieOptions, o as DEFAULT_SESSION_ENCODING, p as readSession, r as CookieRecord, s as SessionEncoding, t as AUTH_CACHE_HEADERS, u as applyCookieWrites } from "../session-ChiXDZdZ.js";
-import { a as ResolveAuthOptions, l as resolveAuth, n as AuthResolver, r as AuthState, s as authContext, t as AuthResolution } from "../resolve-KW8nCeL6.js";
-import { n as toSession, t as AuthSession } from "../view-DbxLNu8L.js";
-import { r as MembershipClaim } from "../entitlements-DHrY2UDZ.js";
-import { a as sessionStatus, c as refreshSession, i as clearSessionCookies, n as SessionStatus, o as RefreshOptions, r as SessionStatusOptions, s as RefreshOutcome, t as ClearSessionCookiesOptions } from "../ended-jLfvw8h-.js";
+import { a as ResolveAuthOptions, l as resolveAuth, n as AuthResolver, r as AuthState, s as authContext, t as AuthResolution } from "../resolve-ChTYeTEl.js";
+import { n as toSession, t as AuthSession } from "../view-CF7ihnkg.js";
+import { r as MembershipClaim } from "../entitlements-BKSVGtrG.js";
+import { a as sessionStatus, c as refreshSession, i as clearSessionCookies, n as SessionStatus, o as RefreshOptions, r as SessionStatusOptions, s as RefreshOutcome, t as ClearSessionCookiesOptions } from "../ended-XjeGQ5XW.js";
 export { AUTH_CACHE_HEADERS, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type ClearSessionCookiesOptions, type CookieOptions, type CookieRecord, type CookieScope, type CookieWrite, DEFAULT_SESSION_ENCODING, type MembershipClaim, type RefreshOptions, type RefreshOutcome, type ResolveAuthOptions, type SessionEncoding, type SessionStatus, type SessionStatusOptions, type StoredSession, type WriteSessionOptions, applyCookieWrites, authContext, clearSessionAtScopes, clearSessionCookies, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, sessionEncoding, sessionStatus, toSession, writeSession };

package/dist/ssr/index.js

@@ -1,3 +1,3 @@
-import { _ as writeSession, a as refreshSession, c as AUTH_CACHE_HEADERS, d as clearSessionAtScopes, f as parseCookies, g as sessionEncoding, h as sessionCookieName, i as resolveAuth, l as DEFAULT_SESSION_ENCODING, m as serializeCookie, o as clearSessionCookies, p as readSession, s as sessionStatus, t as authContext, u as applyCookieWrites } from "../resolve-D_IcnvFd.js";
+import { _ as writeSession, a as refreshSession, c as AUTH_CACHE_HEADERS, d as clearSessionAtScopes, f as parseCookies, g as sessionEncoding, h as sessionCookieName, i as resolveAuth, l as DEFAULT_SESSION_ENCODING, m as serializeCookie, o as clearSessionCookies, p as readSession, s as sessionStatus, t as authContext, u as applyCookieWrites } from "../resolve-tJZY3FEa.js";
 import { n as toSession } from "../view-BeFcRV6G.js";
 export { AUTH_CACHE_HEADERS, DEFAULT_SESSION_ENCODING, applyCookieWrites, authContext, clearSessionAtScopes, clearSessionCookies, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, sessionEncoding, sessionStatus, toSession, writeSession };

package/dist/{support-zIa1URaN.js → support-ig_K4PvS.js}

@@ -3,7 +3,7 @@ import { t as temporal } from "./temporal-required-BVvW7SYJ.js";
 import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-DzUbqgdW.js";
 import { n as validate } from "./standard-BK0cqJ7y.js";
 import { t as fromPgError } from "./executor-De1Of3m3.js";
-import { d as clearSupportCookie, f as supportCookie, m as supportCookieValue } from "./adapter-CHnPkCPd.js";
+import { d as clearSupportCookie, f as supportCookie, m as supportCookieValue } from "./adapter-iKgjHVPx.js";
 import { r as sqlIdent } from "./template--jDkl3UP.js";
 import { i as emitBlockEvent } from "./block-events-CrT8r7Fe.js";
 //#region src/auth/support.ts

package/dist/{support-view-33Oi07TT.d.ts → support-view-CVOJJLpc.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSession } from "./view-DbxLNu8L.js";
+import { t as AuthSession } from "./view-CF7ihnkg.js";
 //#region src/auth/support-view.d.ts
 /** A running support session as the target's view shows it, for a banner. */
 interface SupportView {

package/dist/svelte/index.d.ts

@@ -2,7 +2,7 @@ import { b as DbError } from "../result-D7y2fT87.js";
 import { it as QuerySpec } from "../define-CJJkkr1-.js";
 import { n as TemplateValues } from "../template-CwO38Do8.js";
 import { t as AuthSnapshot } from "../bind-Bu_ZNa3W.js";
-import { t as AuthSession } from "../view-DbxLNu8L.js";
+import { t as AuthSession } from "../view-CF7ihnkg.js";
 import { S as Topic, f as PresenceMember, u as EventSchemas, w as TopicHandlers, x as SubscriptionStatus } from "../index-DunNRdnT.js";
 import { a as BroadcastOptions, c as LiveCountSource, d as PresenceTopic, f as UseActionOptions, i as ActionState, l as LiveQueryHookOptions, n as ActionInputOf, o as ClientLike, r as ActionResultOf, s as LiveCountHookOptions, t as fieldErrorsOf, u as PresenceHookOptions } from "../field-errors-BFOa7WhB.js";
 import { SupabaseClient } from "@supabase/supabase-js";

package/dist/sveltekit/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-C6DWVEVG.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
-import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-CdPDPpFs.js";
+import { t as BetterServer } from "../server-Bh0EVSwU.js";
+import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
+import { t as RefusalRedirects } from "../refusal-DhSU2Vvr.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-BmzgK32X.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { i as tagFor } from "../tags-Cx-LnIQP.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";

package/dist/sveltekit/index.js

@@ -1,12 +1,12 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
 import { r as dbErrorOf } from "../errors-B11Duf73.js";
 import { o as toProblem } from "../problem-BreOl8b8.js";
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-iKgjHVPx.js";
 import { t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { r as tagFor } from "../tags-B99_U9Pp.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
 import { n as bufferInPlace, t as around } from "../shared-CBxosKK3.js";
-import { a as platformWaitUntil, i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-xjTBoyBB.js";
+import { a as platformWaitUntil, i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-a7aRCIqv.js";
 import { i as refusalTarget } from "../refusal-CeJWxmkH.js";
 //#region src/bridges/sveltekit.ts
 /**

package/dist/tanstack-start/index.d.ts

@@ -1,9 +1,9 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-C6DWVEVG.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
-import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-CdPDPpFs.js";
+import { t as BetterServer } from "../server-Bh0EVSwU.js";
+import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
+import { t as RefusalRedirects } from "../refusal-DhSU2Vvr.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-BmzgK32X.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/tanstack-start/index.js

@@ -1,8 +1,8 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CHnPkCPd.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-iKgjHVPx.js";
 import { t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
 import { n as bufferInPlace, t as around } from "../shared-CBxosKK3.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-xjTBoyBB.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-a7aRCIqv.js";
 import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
 //#region src/bridges/tanstack-start.ts
 /** The `response` of a request middleware's `next()` result; server function results have none. */

package/dist/{tenant-icPeuUBN.d.ts → tenant-BxNFk9bx.d.ts}

@@ -1,5 +1,5 @@
 import { t as AuthSnapshot } from "./bind-Bu_ZNa3W.js";
-import { t as AuthSession } from "./view-DbxLNu8L.js";
+import { t as AuthSession } from "./view-CF7ihnkg.js";
 //#region src/auth/tenant.d.ts
 /**
  * The active tenant of a user session: the `claim` claim (`tenant_id` by

package/dist/testing/index.d.ts

@@ -2,25 +2,25 @@ import { H as Update, L as TableKey, P as SchemaMeta, a as AnyModels, i as AnyFu
 import { r as Executor } from "../executor-DvsBbNBS.js";
 import { t as SqlClient } from "../executor-DbvExCFC.js";
 import { m as RequestContext, n as AnyPlugin } from "../plugin-FGY8UhYm.js";
-import { n as AuthResolver } from "../resolve-KW8nCeL6.js";
-import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } from "../provider-BH5UWZJ6.js";
+import { n as AuthResolver } from "../resolve-ChTYeTEl.js";
+import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } from "../provider-D-UEMvSD.js";
 import { k as QueueBackend } from "../queue-CLJurhdy.js";
 import { n as Embedder } from "../knowledge-BXBbT0Tr.js";
 import { o as StreamStore } from "../store-CGjgWu5n.js";
 import { B as DbStats, b as Db, t as BetterSupabase, u as CacheAdapter } from "../define-CJJkkr1-.js";
 import { r as EventSink, t as CloudEvent } from "../cloud-event-C1JCc1bH.js";
 import { t as BetterPostgres } from "../pool-CAu2nLrL.js";
-import { i as ServerContext, o as ServerOptions, z as SupportSessionStore } from "../server-C6DWVEVG.js";
+import { V as SupportSessionStore, i as ServerContext, o as ServerOptions } from "../server-Bh0EVSwU.js";
 import { s as Impersonator } from "../mfa-Daak8ukG.js";
 import { n as SessionActor, r as SessionDelegation } from "../actor-CQTlc1Hh.js";
-import { r as GuardOptions } from "../respond-DoBijysA.js";
+import { r as GuardOptions } from "../respond-DprrgyXX.js";
 import { i as AuthorizationProvider } from "../authorization-BFCqamMs.js";
 import { i as AiTaskRun, o as AiTaskRunner, t as AiTask } from "../ai-tasks-Cd1HMFvB.js";
 import { D as ResolvedConfig, _ as GeneratorInput, h as Generator, v as GeneratorModel } from "../config-D44Y7PAv.js";
 import { a as BlockTransportMiddleware } from "../block-hooks-plbZ0AbJ.js";
 import { t as NotificationChannel } from "../channel-_2Mx1Oyu.js";
 import { c as WebhookSecretStore, i as WebhookSigner, m as WebhookTransport } from "../signers-4y62_VIi.js";
-import { T as WorkflowGraph, i as BuilderStarter, r as BuilderStartCall, s as GraphCompiler } from "../types-BI-0Sl2v.js";
+import { T as WorkflowGraph, i as BuilderStarter, r as BuilderStartCall, s as GraphCompiler } from "../types-AYOvcyep.js";
 import { t as EveDocumentBackend } from "../eve-gT2Fpjut.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Message, StateAdapter } from "chat";

package/dist/{types-TaiEeBGA.d.ts → types-6rocye-y.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
 import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { i as CredentialRef, r as CredentialProvider } from "./provider-BH5UWZJ6.js";
+import { i as CredentialRef, r as CredentialProvider } from "./provider-D-UEMvSD.js";
 import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
 //#region src/blocks/ai-providers/types.d.ts
 /** A tenant's own key for a provider. The key itself stays in the credential provider. */

package/dist/{types-BI-0Sl2v.d.ts → types-AYOvcyep.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
 import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "./provider-BH5UWZJ6.js";
+import { i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "./provider-D-UEMvSD.js";
 import { r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
 import { a as WorkflowSchedule, u as WorkflowStarter } from "./workflows-B0j9WKPu.js";
 //#region src/blocks/workflow-builder/graph.d.ts

package/dist/{vault-CSO7ss5C.d.ts → vault-wlbBhqm7.d.ts}

@@ -1,6 +1,6 @@
 import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
 import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { c as SetCredentialOptions, i as CredentialRef, r as CredentialProvider } from "./provider-BH5UWZJ6.js";
+import { c as SetCredentialOptions, i as CredentialRef, r as CredentialProvider } from "./provider-D-UEMvSD.js";
 //#region src/credentials/vault.d.ts
 /** How a request the third party sends is signed with the stored secret. */
 type VaultInboundScheme = "standard-webhooks" | "hmac-sha256" | "shared-secret";

package/dist/vercel-connect/index.d.ts

@@ -1,4 +1,4 @@
-import { a as CredentialSubject, r as CredentialProvider } from "../provider-BH5UWZJ6.js";
+import { a as CredentialSubject, r as CredentialProvider } from "../provider-D-UEMvSD.js";
 //#region src/vercel-connect/vercel-connect.d.ts
 interface ConnectTokenParams {
   subject: CredentialSubject;

package/dist/{version-CQt77F3T.js → version-C6OfRAIn.js}

@@ -1,4 +1,4 @@
 //#region src/core/version.ts
-const VERSION = "0.6.1";
+const VERSION = "0.7.1";
 //#endregion
 export { VERSION as t };

package/dist/{view-DbxLNu8L.d.ts → view-CF7ihnkg.d.ts}

@@ -1,5 +1,5 @@
 import { b as DbError } from "./result-D7y2fT87.js";
-import { i as InvalidReason, r as AuthState } from "./resolve-KW8nCeL6.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-ChTYeTEl.js";
 import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-Daak8ukG.js";
 import { n as SessionActor, r as SessionDelegation } from "./actor-CQTlc1Hh.js";
 import { JWTClaims, UserClaims } from "@supabase/server";

package/dist/vue/index.d.ts

@@ -2,9 +2,9 @@ import { b as DbError } from "../result-D7y2fT87.js";
 import { it as QuerySpec } from "../define-CJJkkr1-.js";
 import { n as TemplateValues } from "../template-CwO38Do8.js";
 import { t as AuthSnapshot } from "../bind-Bu_ZNa3W.js";
-import { t as AuthSession } from "../view-DbxLNu8L.js";
+import { t as AuthSession } from "../view-CF7ihnkg.js";
 import { S as Topic, f as PresenceMember, u as EventSchemas, w as TopicHandlers, x as SubscriptionStatus } from "../index-DunNRdnT.js";
-import { t as SupportView } from "../support-view-33Oi07TT.js";
+import { t as SupportView } from "../support-view-CVOJJLpc.js";
 import { a as BroadcastOptions, c as LiveCountSource, d as PresenceTopic, f as UseActionOptions, i as ActionState, l as LiveQueryHookOptions, n as ActionInputOf, o as ClientLike, r as ActionResultOf, s as LiveCountHookOptions, t as fieldErrorsOf, u as PresenceHookOptions } from "../field-errors-BFOa7WhB.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { App, ComputedRef, MaybeRefOrGetter, Ref } from "vue";

package/dist/workflow-sdk/builder/index.d.ts

@@ -1,5 +1,5 @@
-import { T as WorkflowGraph, c as NodeRunRecord, i as BuilderStarter } from "../../types-BI-0Sl2v.js";
-import { i as executeGraph, n as GraphStepCall, r as approvalToken, t as GraphRuntime } from "../../executor-D14tGopJ.js";
+import { T as WorkflowGraph, c as NodeRunRecord, i as BuilderStarter } from "../../types-AYOvcyep.js";
+import { i as executeGraph, n as GraphStepCall, r as approvalToken, t as GraphRuntime } from "../../executor-BVBFM86G.js";
 import { o as WorkflowFn } from "../../workflow-sdk-B3yLD6Br.js";
 import { World } from "@workflow/world";
 //#region src/workflow-sdk/builder/builder.d.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "better-supabase",
-  "version": "0.6.1",
+  "version": "0.7.1",
   "description": "Strongly typed Supabase: generated schema, typed repositories, plugins, auth glue, framework integrations and the better-supabase CLI.",
   "keywords": [
     "cli",

package/schemas/doctor-report-v1.json

@@ -48,6 +48,8 @@
               "BS112",
               "BS113",
               "BS114",
+              "BS115",
+              "BS116",
               "BS200",
               "BS204",
               "BS205",

package/skills/better-supabase-auth/SKILL.md

@@ -115,10 +115,14 @@ A proxy or middleware with its own Supabase client calls
 Done when the irreversible action returns `SESSION_REVOKED` for a signed-out
 session in a test.
 
-To lock a user out, call `bs.suspendAccount(userId, { suspended: true })`
-(it bans the user in Auth and ends every session and refresh token), or
-`bs.endSessions(userId)` to sign them out everywhere without a ban. A ban
-alone leaves the refresh tokens, which work again once the ban is lifted. To
+To lock a user out, call `bs.suspendAccount(userId, { suspended: true })`.
+It bans the user in Auth and keeps the sessions, so Auth answers with
+`user_banned`, `sessionStatus` returns `"banned"` and the `session_active()`
+policy refuses the user's tokens. `{ suspended: false }` ends every session
+and refresh token, then lifts the ban. Without the `sessions` SQL module, pass
+`endSessions: true` to delete the sessions on suspension too (the app then
+sees `"ended"`). `bs.endSessions(userId)` signs a user out everywhere without
+a ban. To
 switch a member off in one organization only, use the organizations block's
 `suspendMember`.
 

package/dist/cli/gen-4JlOwgWG.js

@@ -1,2 +0,0 @@
-import { n as genCommand } from "./gen-DeuDgPxN.js";
-export { genCommand };