better-supabase 0.7.0 → 0.8.0

package/dist/resource-BsvzCMlX.js

@@ -1,212 +0,0 @@
-import { n as dbError } from "./errors-B11Duf73.js";
-import { a as ok, r as err } from "./result-DzUbqgdW.js";
-import { n as validate } from "./standard-BK0cqJ7y.js";
-import { a as respond } from "./respond-BUgsXNgk.js";
-//#region src/server/resource.ts
-const INTEGER = /* @__PURE__ */ new Set([
-	"int2",
-	"int4",
-	"int8"
-]);
-function keyValue(table, raw) {
-	const invalid = err(dbError("invalid_input", `${JSON.stringify(raw)} is not a valid ${table.key} key`));
-	const column = table.columns[table.primaryKey[0]];
-	if (column && INTEGER.has(column.type)) {
-		const value = typeof raw === "string" ? Number(raw) : raw;
-		return typeof value === "number" && Number.isSafeInteger(value) ? ok(value) : invalid;
-	}
-	return typeof raw === "string" && raw !== "" ? ok(raw) : invalid;
-}
-/**
-* A cross-site browser request that needed no CORS preflight: a form post
-* riding on the session cookie. Bearer requests and JSON bodies (which need a
-* preflight) pass, as do requests without an `Origin` (not a browser).
-*/
-function crossSiteSimpleRequest(request) {
-	if (request.method === "GET" || request.method === "HEAD") return false;
-	if (request.headers.has("authorization")) return false;
-	const origin = request.headers.get("origin");
-	if (!origin || origin === new URL(request.url).origin) return false;
-	if (request.headers.get("sec-fetch-site") === "same-origin") return false;
-	const type = request.headers.get("content-type") ?? "";
-	return !/^application\/(?:[\w.+-]+\+)?json\b/iu.test(type);
-}
-async function readBody(request) {
-	try {
-		const body = await request.json();
-		if (typeof body === "object" && body !== null && !Array.isArray(body)) return ok(body);
-	} catch {}
-	return err(dbError("invalid_input", "The request body must be a JSON object"));
-}
-function pageArgs(query, max, pagination) {
-	const raw = (name) => {
-		const value = query instanceof URLSearchParams ? query.get(name) : query?.[name];
-		return value === null || value === "" ? void 0 : value;
-	};
-	const read = (name, fallback) => {
-		const value = raw(name);
-		if (value === void 0) return fallback;
-		const number = Number(value);
-		return Number.isSafeInteger(number) && number >= 1 ? number : void 0;
-	};
-	const issues = [];
-	const size = read("size", 50);
-	if (size === void 0 || size > max) issues.push({
-		message: `Must be between 1 and ${max}`,
-		path: ["size"]
-	});
-	const [used, unused] = pagination === "cursor" ? ["after", "page"] : ["page", "after"];
-	if (raw(unused) !== void 0) issues.push({
-		message: `This list pages with \`${used}\``,
-		path: [unused]
-	});
-	const page = read("page", 1);
-	if (pagination === "offset" && page === void 0) issues.push({
-		message: "Must be a positive integer",
-		path: ["page"]
-	});
-	const after = raw("after");
-	if (pagination === "cursor" && after !== void 0 && typeof after !== "string") issues.push({
-		message: "Must be text",
-		path: ["after"]
-	});
-	if (issues.length > 0 || size === void 0) return err(dbError("validation", "Invalid page parameters", { issues }));
-	return pagination === "cursor" ? ok({
-		after: typeof after === "string" ? after : null,
-		size
-	}) : ok({
-		page: page ?? 1,
-		size
-	});
-}
-function asObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value) ? ok(value) : err(dbError("invalid_input", "Expected an object of column values"));
-}
-async function settled(value) {
-	return await value;
-}
-function notAllowed(allowed) {
-	return new Response(null, {
-		status: 405,
-		headers: { allow: allowed.join(", ") }
-	});
-}
-/**
-* Operations over one table, matching the paths and responses of
-* `createOpenApi`: `GET/POST /<table>` and `GET/PATCH/DELETE /<table>/{id}`.
-* Shared by the HTTP adapters and the MCP table tools.
-*/
-function defineResource(betterSupabase, table, options = {}) {
-	const meta = betterSupabase.meta.tables[table];
-	if (!meta) throw new TypeError(`Unknown table "${table}"`);
-	if (options.list && options.list.table !== table) throw new TypeError(`The list query is for "${options.list.table}", not "${table}"`);
-	const operations = options.operations ?? (meta.kind === "view" ? ["list", "get"] : [
-		"list",
-		"get",
-		"create",
-		"update",
-		"delete"
-	]);
-	const keyParam = meta.primaryKey.length === 1 ? meta.primaryKey[0] : void 0;
-	const has = (operation) => operations.includes(operation);
-	const extra = options.select === void 0 ? {} : { select: options.select };
-	const maxPageSize = options.maxPageSize ?? 200;
-	const list = options.list;
-	const pagination = list ? list.pagination ?? "offset" : options.pagination ?? "offset";
-	const execute = async (db, operation, input = {}) => {
-		const repository = db[table];
-		if (!repository) throw new TypeError(`The db has no "${table}" repository`);
-		if (!has(operation)) return err(dbError("forbidden", `${operation} is not enabled for ${table}`));
-		const key = () => keyParam ? keyValue(meta, input.id) : err(dbError("invalid_request", `${table} has no single-column key`));
-		switch (operation) {
-			case "list": {
-				if (list) {
-					const query = list.parse(input.query ?? {});
-					if (!query.ok) return err(dbError("validation", "Invalid list query", { issues: query.issues }));
-					return settled(list.run(db, query.value, extra));
-				}
-				const page = pageArgs(input.query, maxPageSize, pagination);
-				if (!page.ok) return page;
-				return settled(repository.paginate({
-					...extra,
-					...page.data,
-					..."page" in page.data ? { count: "exact" } : {}
-				}));
-			}
-			case "get": {
-				const id = key();
-				if (!id.ok) return id;
-				return settled(repository.findById(id.data, extra));
-			}
-			case "create": {
-				const body = asObject(input.data);
-				if (!body.ok) return body;
-				const data = options.input?.create ? await validate(options.input.create, body.data, "data") : body;
-				if (!data.ok) return data;
-				return settled(repository.create(data.data, extra));
-			}
-			case "update": {
-				const id = key();
-				if (!id.ok) return id;
-				const body = asObject(input.data);
-				if (!body.ok) return body;
-				const data = options.input?.update ? await validate(options.input.update, body.data, "data") : body;
-				if (!data.ok) return data;
-				return settled(repository.update(id.data, data.data, extra));
-			}
-			case "delete": {
-				const id = key();
-				if (!id.ok) return id;
-				return settled(repository.delete(id.data));
-			}
-			default: throw new TypeError(`Unknown operation ${String(operation)}`);
-		}
-	};
-	const collectionMethods = [...has("list") ? ["GET"] : [], ...has("create") ? ["POST"] : []];
-	const itemMethods = [
-		...has("get") ? ["GET"] : [],
-		...has("update") ? ["PATCH"] : [],
-		...has("delete") ? ["DELETE"] : []
-	];
-	const route = async (request, db, id) => {
-		if (crossSiteSimpleRequest(request)) return err(dbError("forbidden", "Cross-site requests need Content-Type: application/json or a bearer token", { code: "CROSS_SITE_REQUEST" }));
-		if (id === void 0) {
-			if (request.method === "GET" && has("list")) return execute(db, "list", { query: new URL(request.url).searchParams });
-			if (request.method === "POST" && has("create")) {
-				const body = await readBody(request);
-				return body.ok ? execute(db, "create", { data: body.data }) : body;
-			}
-			return notAllowed(collectionMethods);
-		}
-		if (!keyParam) return new Response(null, { status: 404 });
-		if (request.method === "GET" && has("get")) return execute(db, "get", { id });
-		if (request.method === "PATCH" && has("update")) {
-			const body = await readBody(request);
-			return body.ok ? execute(db, "update", {
-				id,
-				data: body.data
-			}) : body;
-		}
-		if (request.method === "DELETE" && has("delete")) return execute(db, "delete", { id });
-		return notAllowed(itemMethods);
-	};
-	return {
-		table,
-		meta,
-		operations,
-		keyParam,
-		list,
-		pagination,
-		maxPageSize,
-		execute,
-		handle(request, db, id, respondOptions = {}) {
-			const status = id === void 0 && request.method === "POST" ? 201 : void 0;
-			return respond(() => route(request, db, id), status === void 0 ? respondOptions : {
-				...respondOptions,
-				status
-			});
-		}
-	};
-}
-//#endregion
-export { defineResource as t };

package/dist/resource-IPS5xi9q.d.ts

@@ -1,74 +0,0 @@
-import { E as ValidationIssue, f as Result } from "./result-D7y2fT87.js";
-import { H as Update, L as TableKey, R as TableMeta, a as AnyModels, i as AnyFunctions, x as Insert } from "./types-6BdhkmZe.js";
-import { It as SelectArg, t as BetterSupabase } from "./define-CJJkkr1-.js";
-import { a as RespondOptions } from "./respond-DprrgyXX.js";
-import { i as ResourceOperation } from "./index-Bxih3l0u.js";
-import { StandardSchemaV1 } from "@standard-schema/spec";
-//#region src/server/resource.d.ts
-/** What a resource needs from `defineListQuery`. */
-interface ResourceList {
-  readonly table: string;
-  readonly pagination?: ResourcePagination;
-  readonly openapi: readonly unknown[];
-  readonly jsonSchema: Readonly<Record<string, unknown>>;
-  parse(input: never): {
-    readonly ok: true;
-    readonly value: unknown;
-  } | {
-    readonly ok: false;
-    readonly issues: readonly ValidationIssue[];
-  };
-  run(db: never, query: never, extra?: never): PromiseLike<unknown>;
-}
-interface ResourceRouteOptions<M extends AnyModels, T extends TableKey<M>> {
-  /** Defaults to every operation for tables, `list` and `get` for views. */
-  readonly operations?: readonly ResourceOperation[];
-  /** Filters, search and sorts for `list`, from `defineListQuery`. */
-  readonly list?: ResourceList;
-  /** Columns returned by every operation. */
-  readonly select?: SelectArg<M, T>;
-  /** Validates request bodies before they reach the repository. */
-  readonly input?: {
-    readonly create?: StandardSchemaV1<unknown, Insert<M, T>>;
-    readonly update?: StandardSchemaV1<unknown, Update<M, T>>;
-  };
-  /**
-   * Paging of the default list: `offset` (`page` and `size`) or `cursor`
-   * (`after` and `size`, keyset). A `list` query brings its own. Defaults
-   * to `offset`.
-   */
-  readonly pagination?: ResourcePagination;
-  /** Largest page for the default list. Defaults to 200. */
-  readonly maxPageSize?: number;
-}
-type ResourcePagination = "offset" | "cursor";
-interface ResourceInput {
-  /** Primary key value; strings are converted for integer keys. */
-  readonly id?: unknown;
-  /** Body of `create` and `update`. */
-  readonly data?: unknown;
-  /** `list` parameters: URL params or typed values. */
-  readonly query?: URLSearchParams | Readonly<Record<string, unknown>>;
-}
-interface ResourceHandler {
-  readonly table: string;
-  readonly meta: TableMeta;
-  readonly operations: readonly ResourceOperation[];
-  /** Name of the key parameter, or `undefined` for tables without a single-column key. */
-  readonly keyParam: string | undefined;
-  readonly list: ResourceList | undefined;
-  readonly pagination: ResourcePagination;
-  readonly maxPageSize: number;
-  /** Runs one operation as whoever `db` is bound to. Resolves to a `Result`. */
-  execute(db: object, operation: ResourceOperation, input?: ResourceInput): Promise<Result<unknown>>;
-  /** Serves a collection request (`id` undefined) or an item request. */
-  handle(request: Request, db: object, id: string | undefined, options?: RespondOptions): Promise<Response>;
-}
-/**
- * Operations over one table, matching the paths and responses of
- * `createOpenApi`: `GET/POST /<table>` and `GET/PATCH/DELETE /<table>/{id}`.
- * Shared by the HTTP adapters and the MCP table tools.
- */
-declare function defineResource<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(betterSupabase: BetterSupabase<M, D, F, E>, table: T, options?: ResourceRouteOptions<M, T>): ResourceHandler;
-//#endregion
-export { ResourceRouteOptions as a, ResourcePagination as i, ResourceInput as n, defineResource as o, ResourceList as r, ResourceHandler as t };

package/dist/template-CwO38Do8.d.ts

@@ -1,6 +0,0 @@
-//#region src/core/template.d.ts
-/** Placeholder names in a `{name}` template; a rest placeholder `{...name}` is `name`. */
-type TemplateParams<P extends string> = P extends `${string}{${infer K}}${infer R}` ? (K extends `...${infer N}` ? N : K) | TemplateParams<R> : never;
-type TemplateValues<P extends string> = { readonly [K in TemplateParams<P>]: string | number; };
-//#endregion
-export { TemplateValues as n, TemplateParams as t };

package/dist/verify-DL41hbvY.js

@@ -1,232 +0,0 @@
-import { n as dbError } from "./errors-B11Duf73.js";
-import { c as optionalTemporal, s as nowInstant } from "./temporal-BJGitm-h.js";
-import { n as temporalMissing } from "./temporal-required-BVvW7SYJ.js";
-import { a as ok, r as err } from "./result-DzUbqgdW.js";
-import { i as toBase64, r as fromBase64 } from "./base64-D2gsioCY.js";
-import { c as toApp } from "./shared-CxWmcyqB.js";
-//#region src/blocks/webhooks/verify.ts
-const encoder = /* @__PURE__ */ new TextEncoder();
-/** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
-function secretBytes(secret) {
-	const raw = secret.replace(/^v1,/, "").replace(/^whsec_/, "");
-	try {
-		return fromBase64(raw);
-	} catch {
-		throw new TypeError("Webhook secret is not valid base64");
-	}
-}
-/** Secrets come from configuration, so a handful of keys suffice. */
-const keys = /* @__PURE__ */ new Map();
-function keyFor(secret) {
-	let key = keys.get(secret);
-	if (!key) {
-		key = crypto.subtle.importKey("raw", secretBytes(secret), {
-			name: "HMAC",
-			hash: "SHA-256"
-		}, false, ["sign", "verify"]);
-		if (keys.size < 16) {
-			keys.set(secret, key);
-			key.catch(() => keys.delete(secret));
-		}
-	}
-	return key;
-}
-async function signature(secret, content) {
-	return toBase64(new Uint8Array(await crypto.subtle.sign("HMAC", await keyFor(secret), encoder.encode(content))));
-}
-function decodeSignature(value) {
-	try {
-		return fromBase64(value);
-	} catch {
-		return;
-	}
-}
-/** Constant-time string comparison. */
-function timingSafeEqual(a, b) {
-	const left = encoder.encode(a);
-	const right = encoder.encode(b);
-	let diff = left.length ^ right.length;
-	for (let index = 0; index < Math.max(left.length, right.length); index++) diff |= (left[index] ?? 0) ^ (right[index] ?? 0);
-	return diff === 0;
-}
-function header(headers, name) {
-	if (headers instanceof Headers) return headers.get(name);
-	return Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1] ?? null;
-}
-const unauthorized = (code, message) => dbError("unauthorized", message, { code });
-/** Headers for a signed Standard Webhooks request. */
-async function signWebhook(secret, message) {
-	const timestamp = String(Math.floor((message.timestamp ?? nowInstant()).epochMilliseconds / 1e3));
-	return {
-		"webhook-id": message.id,
-		"webhook-timestamp": timestamp,
-		"webhook-signature": `v1,${await signature(secret, `${message.id}.${timestamp}.${message.body}`)}`
-	};
-}
-/**
-* Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
-* `webhook-signature`, or the `svix-` names Svix-based senders use) and
-* parses the JSON body. Pass several secrets while rotating.
-*/
-async function verifyWebhook(input, secrets, options = {}) {
-	const headers = input.headers;
-	const prefix = header(headers, "webhook-id") === null ? "svix" : "webhook";
-	const id = header(headers, `${prefix}-id`);
-	const timestamp = header(headers, `${prefix}-timestamp`);
-	const signatures = header(headers, `${prefix}-signature`);
-	if (!id || !timestamp || !signatures) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing webhook signature headers"));
-	const seconds = Number(timestamp);
-	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
-	const namespace = optionalTemporal();
-	if (namespace === void 0) return err(temporalMissing());
-	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
-	const tolerance = options.tolerance ?? 300;
-	if (seconds < now - tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_OLD", "Webhook timestamp is too old"));
-	if (seconds > now + tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_NEW", "Webhook timestamp is in the future"));
-	const body = input instanceof Request ? await input.text() : input.body;
-	const content = encoder.encode(`${id}.${timestamp}.${body}`);
-	const offered = signatures.split(" ").map((entry) => entry.split(",")).filter(([version, value]) => version === "v1" && value).flatMap(([, value]) => decodeSignature(value) ?? []);
-	let valid = false;
-	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
-		const key = await keyFor(secret);
-		for (const candidate of offered) if (await crypto.subtle.verify("HMAC", key, candidate, content)) valid = true;
-	}
-	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
-	try {
-		return ok({
-			id,
-			timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
-			payload: JSON.parse(body),
-			body
-		});
-	} catch {
-		return err(dbError("invalid_request", "Webhook body is not JSON"));
-	}
-}
-/** Checks a shared-secret header (database webhooks), in constant time. */
-function verifySharedSecret(request, secret, headerName = "authorization") {
-	return timingSafeEqual((request.headers.get(headerName) ?? "").replace(/^Bearer\s+/i, ""), secret);
-}
-const toHex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
-/** Stripe signs with the endpoint secret's UTF-8 bytes, not its base64 decoding. */
-async function stripeSignature(secret, content) {
-	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	return toHex(new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(content))));
-}
-/** The `Stripe-Signature` header for `body`, for tests and local replays. */
-async function signStripeWebhook(secret, body, timestamp = nowInstant()) {
-	const seconds = String(Math.floor(timestamp.epochMilliseconds / 1e3));
-	return `t=${seconds},v1=${await stripeSignature(secret, `${seconds}.${body}`)}`;
-}
-/**
-* Verifies a `Stripe-Signature` header (`t=…,v1=…`) with the endpoint's
-* `whsec_…` secret and parses the event. Pass several secrets while rolling
-* the endpoint secret. Runs on WebCrypto, so it needs no `stripe` package.
-*/
-async function verifyStripeWebhook(input, secrets, options = {}) {
-	const value = header(input.headers, "stripe-signature");
-	if (!value) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing Stripe-Signature header"));
-	const parts = value.split(",").map((part) => {
-		const index = part.indexOf("=");
-		return [part.slice(0, index).trim(), part.slice(index + 1).trim()];
-	});
-	const timestamp = parts.find(([name]) => name === "t")?.[1] ?? "";
-	const offered = parts.filter(([name]) => name === "v1").map(([, sig]) => sig);
-	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
-	const namespace = optionalTemporal();
-	if (namespace === void 0) return err(temporalMissing());
-	const seconds = Number(timestamp);
-	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
-	if (Math.abs(now - seconds) > (options.tolerance ?? 300)) return err(unauthorized("WEBHOOK_TIMESTAMP_OUT_OF_RANGE", "Webhook timestamp is outside the tolerance"));
-	const body = input instanceof Request ? await input.text() : input.body;
-	let valid = false;
-	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
-		const expected = await stripeSignature(secret, `${timestamp}.${body}`);
-		for (const candidate of offered) if (timingSafeEqual(candidate, expected)) valid = true;
-	}
-	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
-	let payload;
-	try {
-		payload = JSON.parse(body);
-	} catch {
-		return err(dbError("invalid_request", "Webhook body is not JSON"));
-	}
-	const id = typeof payload === "object" && payload !== null && "id" in payload ? String(payload.id) : "";
-	return ok({
-		id,
-		timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
-		payload,
-		body
-	});
-}
-/**
-* `createWebhookInbox({ source: 'stripe', verify: stripeInboxVerify(secret) })`:
-* stores Stripe events keyed by their event id.
-*/
-function stripeInboxVerify(secrets, options = {}) {
-	return async (request, body) => {
-		const verified = await verifyStripeWebhook({
-			headers: request.headers,
-			body
-		}, secrets, options);
-		return verified.ok ? ok({
-			id: verified.data.id,
-			payload: verified.data.payload
-		}) : verified;
-	};
-}
-/** Rejects a hook with a status and message Supabase Auth passes to the client. */
-function hookError(status, message) {
-	return { error: {
-		http_code: status,
-		message
-	} };
-}
-/**
-* A `(request) => Response` handler for a Supabase Auth hook: verifies the
-* Standard Webhooks signature, types the payload and serializes the answer.
-*
-* ```ts
-* export const POST = authHook('custom_access_token', env.AUTH_HOOK_SECRET, async ({ claims, user_id }) => ({
-*   claims: { ...claims, tenant_id: await organizationFor(user_id) },
-* }));
-* ```
-*/
-function authHook(_kind, secret, handler, options) {
-	return async (request) => {
-		const verified = await verifyWebhook(request, secret, options);
-		if (!verified.ok) return Response.json(hookError(verified.error.status, verified.error.message), { status: verified.error.status });
-		try {
-			const answer = await handler(verified.data.payload, verified.data);
-			const status = "error" in answer ? answer.error.http_code : 200;
-			return Response.json(answer, { status });
-		} catch (cause) {
-			console.error("better-supabase: auth hook failed", cause);
-			return Response.json(hookError(500, "Hook failed"), { status: 500 });
-		}
-	};
-}
-function isDatabaseWebhook(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const payload = value;
-	return (payload["type"] === "INSERT" || payload["type"] === "UPDATE" || payload["type"] === "DELETE") && typeof payload["table"] === "string" && typeof payload["schema"] === "string";
-}
-/**
-* Reads a database webhook payload for `table` as an app-cased change.
-* Returns `null` for other tables or payloads that aren't database webhooks.
-*/
-function databaseChange(betterSupabase, table, payload) {
-	const meta = betterSupabase.meta.tables[table];
-	if (!meta || !isDatabaseWebhook(payload) || payload.table !== meta.name || payload.schema !== meta.schema) return null;
-	return {
-		type: payload.type,
-		table,
-		record: payload.record ? toApp(meta, payload.record) : null,
-		oldRecord: payload.old_record ? toApp(meta, payload.old_record) : null
-	};
-}
-//#endregion
-export { signStripeWebhook as a, timingSafeEqual as c, verifyWebhook as d, isDatabaseWebhook as i, verifySharedSecret as l, databaseChange as n, signWebhook as o, hookError as r, stripeInboxVerify as s, authHook as t, verifyStripeWebhook as u };

package/dist/cli/{read-sets-CETOSFx4.js → read-sets-DjJrm8Wj.js}

@@ -1,7 +1,7 @@
 import { t as importFresh } from "./fresh-import-BeYf9I3x.js";
 import { resolve } from "node:path";
-import { MODULE_ID_TYPES, compileReadSets, moduleIdType, scopeProblems, templateFunctions } from "better-supabase/sql";
 import { isReadSet } from "better-supabase";
+import { MODULE_ID_TYPES, compileReadSets, moduleIdType, scopeProblems, templateFunctions } from "better-supabase/sql";
 //#region src/cli/authorization.ts
 /** How findings name the provider. */
 const providerLabel = (provider) => `the authorization provider (${provider.name})`;