better-supabase 0.7.1 → 0.8.0

package/dist/config-DlKvtt95.js

@@ -0,0 +1,540 @@
+import { i as CONFIG_DEFAULTS } from "./modules-DksjZyMW.js";
+import { t as DEFAULT_CLAIMS } from "./claims-PqzCxaTD.js";
+import { _ as variantsFor, a as fieldSpec, c as parseImport, d as schemaName, f as siblingPath, g as variantTitle, h as temporalGuardImport, i as fieldDocs, l as propertyKey, m as tableEntries, o as fieldsFor, p as tableDocs, r as HEADER, s as optionalLine, u as rowType } from "./json-schema-CT4tvrkA.js";
+//#region src/config/names.ts
+/** The steps `better-supabase gen` runs, in the order it runs them. */
+const GEN_TASKS = [
+	"types",
+	"sql",
+	"spec",
+	"seed",
+	"scaffold",
+	"env"
+];
+/** Glue `better-supabase init` and `add` write for a framework or runtime. */
+const INTEGRATION_NAMES = [
+	"next",
+	"hono",
+	"orpc",
+	"edge",
+	"expo",
+	"mcp",
+	"client",
+	"react"
+];
+/** The agent folders `better-supabase skills install` writes to. */
+const SKILLS_AGENTS = [
+	"cursor",
+	"claude",
+	"agents"
+];
+//#endregion
+//#region src/config/authorization.ts
+/**
+* The error for a provider built for another API version, or `undefined`
+* for version 1.
+*/
+function providerApiProblem(provider) {
+	const version = provider.apiVersion;
+	if (version === 1) return void 0;
+	return `authorization "${typeof provider.name === "string" ? provider.name : "provider"}" targets authorization provider API ${String(version)}; this better-supabase supports 1. Upgrade better-supabase or use a release of the provider for API 1.`;
+}
+//#endregion
+//#region src/config/expose.ts
+const ALL_PRIVILEGES = [
+	"select",
+	"insert",
+	"update",
+	"delete"
+];
+const isFunctionKey = (key) => key.endsWith(")");
+const EXPOSE_PRIVILEGE = /^(?:select|insert|update|delete|(?:select|insert|update)\s*\(\s*[a-z_][a-z0-9_$]*(?:\s*,\s*[a-z_][a-z0-9_$]*)*\s*\))$/;
+function checkedPrivileges(key, privileges) {
+	for (const privilege of privileges) {
+		const value = privilege;
+		if (typeof value !== "string" || !EXPOSE_PRIVILEGE.test(value)) throw new TypeError(`expose.${key}: "${String(value)}" is not a privilege. Use select, insert, update or delete, or name columns such as "update(title, body)"`);
+	}
+	return privileges;
+}
+function resolveExpose(key, entry) {
+	if (Array.isArray(entry)) return {
+		anon: [],
+		authenticated: checkedPrivileges(key, entry),
+		serviceRole: ALL_PRIVILEGES
+	};
+	if ("execute" in entry) throw new TypeError(`expose.${key}: \`execute\` is for functions; key it by its signature, such as ${key}(text)`);
+	const roles = entry;
+	return {
+		anon: checkedPrivileges(key, roles.anon ?? []),
+		authenticated: checkedPrivileges(key, roles.authenticated ?? []),
+		serviceRole: checkedPrivileges(key, roles.serviceRole ?? ALL_PRIVILEGES)
+	};
+}
+function resolveExposeFunction(key, entry) {
+	if (Array.isArray(entry) || !("execute" in entry)) throw new TypeError(`expose.${key}: a function takes { execute: ["authenticated"] }, not table privileges`);
+	return [...entry.execute, ...entry.serviceRole === false ? [] : ["service_role"]];
+}
+//#endregion
+//#region src/config/resolve.ts
+function entitlementsOf(config = {}, provider) {
+	const customer = config.customer;
+	const dot = customer?.lastIndexOf(".") ?? -1;
+	if (customer !== void 0 && dot <= 0) throw new TypeError(`entitlements.customer must be "table.column", got "${customer}"`);
+	return {
+		...customer === void 0 ? {} : {
+			table: customer.slice(0, dot),
+			column: customer.slice(dot + 1)
+		},
+		key: config.key ?? "id",
+		memberships: config.memberships ?? (provider ? "provider" : "tenant"),
+		source: config.source ?? "stripe-sync",
+		...config.claim === void 0 ? {} : { claim: config.claim }
+	};
+}
+function vectorSearchOf(config = {}) {
+	return Object.entries(config).map(([table, entry]) => typeof entry === "string" ? {
+		table,
+		column: entry,
+		distance: "cosine"
+	} : {
+		table,
+		column: entry.column,
+		distance: entry.distance ?? "cosine",
+		...entry.type === void 0 ? {} : { type: entry.type },
+		...entry.key === void 0 ? {} : { key: entry.key },
+		...entry.hybrid === void 0 ? {} : { hybrid: entry.hybrid },
+		...entry.boost === void 0 ? {} : { boost: entry.boost },
+		...entry.prefilter === void 0 ? {} : { prefilter: entry.prefilter },
+		...entry.predicate === void 0 ? {} : { predicate: entry.predicate },
+		...entry.boostMode === void 0 ? {} : { boostMode: entry.boostMode },
+		...entry.order === void 0 ? {} : { order: entry.order }
+	});
+}
+function sqlModulesOf(config = []) {
+	if (isModuleList(config)) return {
+		modules: {},
+		moduleNames: config
+	};
+	return {
+		modules: config,
+		moduleNames: Object.keys(config)
+	};
+}
+function isModuleList(config) {
+	return Array.isArray(config);
+}
+const CONFIG_SCHEMA_URL = "https://unpkg.com/better-supabase/schemas/config-v1.json";
+/** Identity helper that types `better-supabase.config.ts`. */
+function defineConfig(config) {
+	return config;
+}
+function pick(value, defaults) {
+	if (value === void 0 || value === false) return void 0;
+	if (value === true) return defaults;
+	return {
+		...defaults,
+		...value
+	};
+}
+function generatorsOf(generators) {
+	for (const generator of generators ?? []) {
+		const version = generator.apiVersion;
+		if (version !== void 0 && version !== 1) throw new TypeError(`generator "${generator.name}" targets generator API ${String(version)}; this better-supabase supports 1. Upgrade better-supabase or use a release of the generator for API 1.`);
+	}
+	return generators ?? [];
+}
+function authorizationOf(provider) {
+	const problem = providerApiProblem(provider);
+	if (problem !== void 0) throw new TypeError(problem);
+	return provider;
+}
+/** Applies defaults. Paths stay relative to `root`. */
+function resolveConfig(config, root) {
+	const output = config.output ?? CONFIG_DEFAULTS.output;
+	const legacyOpenApi = config.openapi;
+	return {
+		root,
+		source: config.source ?? {},
+		schemas: config.schemas ?? CONFIG_DEFAULTS.schemas,
+		casing: config.casing ?? CONFIG_DEFAULTS.casing,
+		tables: config.tables ?? {},
+		output,
+		databaseTypesOutput: output.replace(/[^/]+$/, "database.types.ts"),
+		postgrestVersion: config.postgrestVersion ?? CONFIG_DEFAULTS.postgrestVersion,
+		json: config.json ?? {},
+		codecs: {
+			timestamptz: config.codecs?.timestamptz ?? CONFIG_DEFAULTS.codecs.timestamptz,
+			int8: config.codecs?.int8 ?? CONFIG_DEFAULTS.codecs.int8,
+			numeric: config.codecs?.numeric ?? CONFIG_DEFAULTS.codecs.numeric
+		},
+		relations: { nullableUnderRls: config.relations?.nullableUnderRls ?? false },
+		sensitive: config.sensitive ?? [],
+		storagePaths: config.storagePaths ?? {},
+		functions: config.functions ?? {},
+		expose: Object.fromEntries(Object.entries(config.expose ?? {}).filter(([key]) => !isFunctionKey(key)).map(([table, entry]) => [table, resolveExpose(table, entry)])),
+		exposeFunctions: Object.fromEntries(Object.entries(config.expose ?? {}).filter(([key]) => isFunctionKey(key)).map(([fn, entry]) => [fn, resolveExposeFunction(fn, entry)])),
+		readSets: config.readSets ?? [],
+		generators: generatorsOf(config.generators),
+		plugins: {
+			timestamps: pick(config.plugins?.timestamps, {
+				createdAt: "created_at",
+				updatedAt: "updated_at"
+			}),
+			softDelete: pick(config.plugins?.softDelete, { column: "deleted_at" }),
+			tenant: pick(config.plugins?.tenant, { column: "organization_id" }),
+			actor: pick(config.plugins?.actor, {
+				createdBy: "created_by",
+				updatedBy: "updated_by",
+				impersonatedBy: "impersonated_by"
+			})
+		},
+		claims: {
+			...DEFAULT_CLAIMS,
+			...config.claims
+		},
+		buckets: config.buckets ?? {},
+		topics: config.topics ?? {},
+		realtime: {
+			tables: config.realtime?.tables ?? [],
+			global: config.realtime?.global ?? [],
+			users: config.realtime?.users ?? {},
+			...config.realtime?.policies === void 0 ? {} : { policies: config.realtime.policies }
+		},
+		entitlements: entitlementsOf(config.entitlements, config.authorization !== void 0),
+		...config.authorization === void 0 ? {} : { authorization: authorizationOf(config.authorization) },
+		vectorSearch: vectorSearchOf(config.vectorSearch),
+		sql: {
+			dir: config.sql?.dir ?? CONFIG_DEFAULTS.sql.dir,
+			prefix: config.sql?.prefix ?? CONFIG_DEFAULTS.sql.prefix,
+			testsDir: config.sql?.testsDir ?? CONFIG_DEFAULTS.sql.testsDir,
+			...sqlModulesOf(config.sql?.modules)
+		},
+		seed: {
+			entry: config.seed?.entry ?? CONFIG_DEFAULTS.seed.entry,
+			output: config.seed?.output ?? CONFIG_DEFAULTS.seed.output
+		},
+		openapi: {
+			entry: legacyOpenApi?.entry ?? CONFIG_DEFAULTS.openapi.entry,
+			output: legacyOpenApi?.output ?? CONFIG_DEFAULTS.openapi.output
+		},
+		specs: {
+			entry: config.specs?.entry ?? legacyOpenApi?.entry ?? CONFIG_DEFAULTS.openapi.entry,
+			outputs: config.specs?.outputs ?? [{
+				format: "openapi",
+				output: legacyOpenApi?.output ?? CONFIG_DEFAULTS.openapi.output
+			}],
+			failOn: config.specs?.failOn ?? CONFIG_DEFAULTS.specs.failOn,
+			...config.specs?.manifest === void 0 ? {} : { manifest: config.specs.manifest }
+		},
+		doctor: {
+			ignore: config.doctor?.ignore ?? [],
+			only: config.doctor?.only ?? [],
+			strict: config.doctor?.strict ?? false,
+			format: config.doctor?.format ?? CONFIG_DEFAULTS.doctor.format,
+			sources: config.doctor?.sources ?? CONFIG_DEFAULTS.doctor.sources,
+			policyHelperLimit: config.doctor?.policyHelperLimit ?? CONFIG_DEFAULTS.doctor.policyHelperLimit,
+			...config.doctor?.output === void 0 ? {} : { output: config.doctor.output },
+			...config.doctor?.claimsLimit === void 0 ? {} : { claimsLimit: config.doctor.claimsLimit }
+		},
+		gen: {
+			...config.gen,
+			watchInterval: config.gen?.watchInterval ?? CONFIG_DEFAULTS.gen.watchInterval
+		},
+		env: {
+			output: config.env?.output ?? CONFIG_DEFAULTS.env.output,
+			...config.env?.prefix === void 0 ? {} : { prefix: config.env.prefix }
+		},
+		scaffold: config.scaffold ?? {},
+		integrations: config.integrations ?? [],
+		skills: config.skills ?? {},
+		keys: config.keys ?? {}
+	};
+}
+//#endregion
+//#region src/generators/standard-schema.ts
+/**
+* Standard Schemas for every table's Row, Insert and Update shape, with no
+* validation library. Each one also converts to JSON Schema (Standard JSON
+* Schema), and `validators` plugs into the validation plugin.
+*/
+function standardSchema(options = {}) {
+	return {
+		apiVersion: 1,
+		name: "standard-schema",
+		generate(input) {
+			const path = options.output ?? siblingPath(input.config.output, "standard.ts");
+			const imports = /* @__PURE__ */ new Map();
+			const jsonImports = /* @__PURE__ */ new Map();
+			const tableNames = new Map(Object.values(input.meta.tables).map((t) => [t.name, t.key]));
+			for (const [key, spec] of Object.entries(options.json ?? {})) {
+				const [tableName, column] = key.split(".");
+				const { from, name } = parseImport(spec);
+				const specifier = from.startsWith(".") ? input.importPath(path, from) : from;
+				imports.set(specifier, [...imports.get(specifier) ?? [], name]);
+				jsonImports.set(`${tableNames.get(tableName ?? "") ?? tableName}.${column}`, name);
+			}
+			const lines = [
+				HEADER,
+				`import { type TableSchema, tableSchema } from ${JSON.stringify(input.runtimeImport ?? "better-supabase")};`,
+				"",
+				`import type { InsertOf, RowOf, UpdateOf } from ${JSON.stringify(input.importPath(path, input.config.output))};`
+			];
+			for (const [from, names] of imports) lines.push(`import { ${[...new Set(names)].sort().join(", ")} } from ${JSON.stringify(from)};`);
+			const validators = [];
+			const validatorTypes = [];
+			for (const [key, table] of tableEntries(input)) {
+				const variants = variantsFor(table);
+				const docs = tableDocs(input, table);
+				for (const variant of variants) {
+					lines.push("", `export const ${schemaName(key, variant)}: TableSchema<${variant}Of<'${key}'>> = tableSchema({`);
+					if (docs) {
+						lines.push(`  title: ${JSON.stringify(variantTitle(docs, variant))},`);
+						if (docs.description !== void 0) lines.push(`  description: ${JSON.stringify(docs.description)},`);
+					}
+					lines.push("  fields: {");
+					for (const plan of fieldsFor(table, variant, input)) {
+						const imported = jsonImports.get(`${key}.${plan.column.db}`);
+						const entries = Object.entries(fieldSpec(plan, fieldDocs(docs, plan))).map(([name, value]) => `${name}: ${JSON.stringify(value)}`);
+						if (imported) entries.push(`schema: ${imported}`);
+						lines.push(`    ${propertyKey(plan.name)}: { ${entries.join(", ")} },`);
+					}
+					lines.push("  },", "});");
+				}
+				if (variants.includes("Insert")) {
+					const insert = schemaName(key, "Insert");
+					const update = schemaName(key, "Update");
+					validators.push(`  ${propertyKey(key)}: { insert: ${insert}, update: ${update} },`);
+					validatorTypes.push(`  readonly ${propertyKey(key)}: { readonly insert: typeof ${insert}; readonly update: typeof ${update} };`);
+				}
+			}
+			lines.push("", "/** Write validators for the validation plugin. */", "export const validators: {", ...validatorTypes, "} = {", ...validators, "};", "");
+			return [{
+				path,
+				contents: lines.join("\n")
+			}];
+		}
+	};
+}
+//#endregion
+//#region src/generators/valibot.ts
+function scalar$1(kind) {
+	switch (kind.kind) {
+		case "uuid": return "v.pipe(v.string(), v.uuid())";
+		case "string": return "v.string()";
+		case "integer": return "v.pipe(v.number(), v.integer())";
+		case "number": return "v.number()";
+		case "boolean": return "v.boolean()";
+		case "datetime": return "v.pipe(v.string(), v.isoTimestamp())";
+		case "date": return "v.pipe(v.string(), v.isoDate())";
+		case "instant": return "v.custom<Temporal.Instant>(isInstant)";
+		case "plainDateTime": return "v.custom<Temporal.PlainDateTime>(isPlainDateTime)";
+		case "bigint": return "v.bigint()";
+		case "json": return "json";
+		case "enum": return `v.picklist([${kind.values.map((value) => JSON.stringify(value)).join(", ")}])`;
+		case "unknown": return "v.unknown()";
+		default: return kind;
+	}
+}
+/** `expr` with `actions` appended, flattening an existing top-level `v.pipe`. */
+function piped(expr, actions) {
+	if (actions.length === 0) return expr;
+	return `v.pipe(${/^v\.pipe\((.*)\)$/s.exec(expr)?.[1] ?? expr}, ${actions.join(", ")})`;
+}
+function boundActions(docs) {
+	return [
+		docs.minimum === void 0 ? void 0 : `v.minValue(${docs.minimum})`,
+		docs.exclusiveMinimum === void 0 ? void 0 : `v.gtValue(${docs.exclusiveMinimum})`,
+		docs.maximum === void 0 ? void 0 : `v.maxValue(${docs.maximum})`,
+		docs.exclusiveMaximum === void 0 ? void 0 : `v.ltValue(${docs.exclusiveMaximum})`,
+		docs.minLength === void 0 ? void 0 : `v.minLength(${docs.minLength})`,
+		docs.maxLength === void 0 ? void 0 : `v.maxLength(${docs.maxLength})`
+	].filter((action) => action !== void 0);
+}
+function docActions(docs) {
+	return [...docs.description === void 0 ? [] : [`v.description(${JSON.stringify(docs.description)})`], ...docs.examples === void 0 ? [] : [`v.examples(${JSON.stringify(docs.examples)})`]];
+}
+function field$1(table, plan, jsonImports, docs) {
+	let expr = jsonImports.get(`${table}.${plan.column.db}`) ?? (plan.customJson ? `v.custom<NonNullable<RowOf<'${table}'>['${plan.name}']>>((value) => value !== undefined)` : plan.column.storage === void 0 ? piped(scalar$1(plan.scalar), boundActions(docs)) : `(v.string() as unknown as v.GenericSchema<${rowType(table, plan)}>)`);
+	if (plan.column.array) expr = `v.array(${expr})`;
+	if (plan.nullable) expr = `v.nullable(${expr})`;
+	expr = piped(expr, docActions(docs));
+	if (plan.optional) expr = `v.exactOptional(${expr})`;
+	return `  ${propertyKey(plan.name)}: ${expr},`;
+}
+/** Valibot schemas for every table's Row, Insert and Update shape. */
+function valibot(options = {}) {
+	return {
+		apiVersion: 1,
+		name: "valibot",
+		generate(input) {
+			const path = options.output ?? siblingPath(input.config.output, "valibot.ts");
+			const imports = /* @__PURE__ */ new Map();
+			const jsonImports = /* @__PURE__ */ new Map();
+			const tableNames = new Map(Object.values(input.meta.tables).map((t) => [t.name, t.key]));
+			for (const [key, spec] of Object.entries(options.json ?? {})) {
+				const [tableName, column] = key.split(".");
+				const { from, name } = parseImport(spec);
+				const specifier = from.startsWith(".") ? input.importPath(path, from) : from;
+				imports.set(specifier, [...imports.get(specifier) ?? [], name]);
+				jsonImports.set(`${tableNames.get(tableName ?? "") ?? tableName}.${column}`, name);
+			}
+			const lines = [
+				HEADER,
+				"import * as v from \"valibot\";",
+				...optionalLine(temporalGuardImport(input)),
+				"",
+				`import type { InsertOf, Json, RowOf, UpdateOf } from ${JSON.stringify(input.importPath(path, input.config.output))};`
+			];
+			for (const [from, names] of imports) lines.push(`import { ${[...new Set(names)].sort().join(", ")} } from ${JSON.stringify(from)};`);
+			lines.push("", "const json: v.GenericSchema<Json> = v.lazy(() =>", "  v.union([v.string(), v.number(), v.boolean(), v.null(), v.array(json), v.record(v.string(), v.optional(json))]),", ");");
+			const validators = [];
+			const validatorTypes = [];
+			for (const [key, table] of tableEntries(input)) {
+				lines.push("");
+				const variants = variantsFor(table);
+				const docs = tableDocs(input, table);
+				for (const variant of variants) {
+					const name = schemaName(key, variant);
+					const objectActions = docs ? [`v.title(${JSON.stringify(variantTitle(docs, variant))})`, ...docs.description === void 0 ? [] : [`v.description(${JSON.stringify(docs.description)})`]] : [];
+					lines.push(`export const ${name}: v.GenericSchema<${variant}Of<'${key}'>> = ${objectActions.length > 0 ? "v.pipe(" : ""}v.object({`);
+					for (const plan of fieldsFor(table, variant, input)) lines.push(field$1(key, plan, jsonImports, fieldDocs(docs, plan)));
+					lines.push(objectActions.length > 0 ? `}), ${objectActions.join(", ")});` : "});");
+				}
+				if (variants.includes("Insert")) {
+					const insert = schemaName(key, "Insert");
+					const update = schemaName(key, "Update");
+					validators.push(`  ${propertyKey(key)}: { insert: ${insert}, update: ${update} },`);
+					validatorTypes.push(`  readonly ${propertyKey(key)}: { readonly insert: typeof ${insert}; readonly update: typeof ${update} };`);
+				}
+			}
+			lines.push("", "/** Write validators for the validation plugin. */", "export const validators: {", ...validatorTypes, "} = {", ...validators, "};", "");
+			return [{
+				path,
+				contents: lines.join("\n")
+			}];
+		}
+	};
+}
+//#endregion
+//#region src/generators/zod.ts
+function scalar(kind) {
+	switch (kind.kind) {
+		case "uuid": return "z.guid()";
+		case "string": return "z.string()";
+		case "integer": return "z.int()";
+		case "number": return "z.number()";
+		case "boolean": return "z.boolean()";
+		case "datetime": return "z.iso.datetime({ offset: true })";
+		case "date": return "z.iso.date()";
+		case "instant": return "z.custom<Temporal.Instant>(isInstant)";
+		case "plainDateTime": return "z.custom<Temporal.PlainDateTime>(isPlainDateTime)";
+		case "bigint": return "z.bigint()";
+		case "json": return "z.json()";
+		case "enum": return `z.enum([${kind.values.map((value) => JSON.stringify(value)).join(", ")}])`;
+		case "unknown": return "z.unknown()";
+		default: return kind;
+	}
+}
+function bounds(docs, flavor) {
+	if (flavor === "mini") {
+		const checks = [
+			docs.minimum === void 0 ? "" : `z.gte(${docs.minimum})`,
+			docs.exclusiveMinimum === void 0 ? "" : `z.gt(${docs.exclusiveMinimum})`,
+			docs.maximum === void 0 ? "" : `z.lte(${docs.maximum})`,
+			docs.exclusiveMaximum === void 0 ? "" : `z.lt(${docs.exclusiveMaximum})`,
+			docs.minLength === void 0 ? "" : `z.minLength(${docs.minLength})`,
+			docs.maxLength === void 0 ? "" : `z.maxLength(${docs.maxLength})`
+		].filter((check) => check !== "");
+		return checks.length === 0 ? "" : `.check(${checks.join(", ")})`;
+	}
+	return [
+		docs.minimum === void 0 ? "" : `.min(${docs.minimum})`,
+		docs.exclusiveMinimum === void 0 ? "" : `.gt(${docs.exclusiveMinimum})`,
+		docs.maximum === void 0 ? "" : `.max(${docs.maximum})`,
+		docs.exclusiveMaximum === void 0 ? "" : `.lt(${docs.exclusiveMaximum})`,
+		docs.minLength === void 0 ? "" : `.min(${docs.minLength})`,
+		docs.maxLength === void 0 ? "" : `.max(${docs.maxLength})`
+	].join("");
+}
+/** `.meta({ ... })` (`.check(z.meta({ ... }))` in mini) for the entries that are set, or nothing. */
+function meta(entries, flavor) {
+	const set = Object.entries(entries).filter(([, value]) => value !== void 0);
+	if (set.length === 0) return "";
+	const object = `{ ${set.map(([key, value]) => `${key}: ${JSON.stringify(value)}`).join(", ")} }`;
+	return flavor === "mini" ? `.check(z.meta(${object}))` : `.meta(${object})`;
+}
+function field(table, plan, jsonImports, docs, flavor) {
+	const mini = flavor === "mini";
+	let expr = jsonImports.get(`${table}.${plan.column.db}`) ?? (plan.customJson ? `z.custom<NonNullable<RowOf<'${table}'>['${plan.name}']>>((value) => value !== undefined)` : plan.column.storage === void 0 ? `${scalar(plan.scalar)}${bounds(docs, flavor)}` : `(z.string() as unknown as ${typeName(flavor)}<${rowType(table, plan)}>)`);
+	if (plan.column.array) expr = `z.array(${expr})`;
+	if (plan.nullable) expr = mini ? `z.nullable(${expr})` : `${expr}.nullable()`;
+	expr += meta({
+		description: docs.description,
+		examples: docs.examples
+	}, flavor);
+	if (plan.optional) expr = mini ? `z.exactOptional(${expr})` : `${expr}.exactOptional()`;
+	return `  ${propertyKey(plan.name)}: ${expr},`;
+}
+function typeName(flavor) {
+	return flavor === "mini" ? "z.ZodMiniType" : "z.ZodType";
+}
+/**
+* Zod 4 schemas for every table's Row, Insert and Update shape, for `zod`
+* or, with `flavor: 'mini'`, `zod/mini`.
+*/
+function zod(options = {}) {
+	const flavor = options.flavor ?? "classic";
+	return {
+		apiVersion: 1,
+		name: "zod",
+		generate(input) {
+			const path = options.output ?? siblingPath(input.config.output, "zod.ts");
+			const imports = /* @__PURE__ */ new Map();
+			const jsonImports = /* @__PURE__ */ new Map();
+			const tableNames = new Map(Object.values(input.meta.tables).map((t) => [t.name, t.key]));
+			for (const [key, spec] of Object.entries(options.json ?? {})) {
+				const [tableName, column] = key.split(".");
+				const { from, name } = parseImport(spec);
+				const specifier = from.startsWith(".") ? input.importPath(path, from) : from;
+				imports.set(specifier, [...imports.get(specifier) ?? [], name]);
+				jsonImports.set(`${tableNames.get(tableName ?? "") ?? tableName}.${column}`, name);
+			}
+			const lines = [
+				HEADER,
+				flavor === "mini" ? "import { z } from \"zod/mini\";" : "import { z } from \"zod\";",
+				...optionalLine(temporalGuardImport(input)),
+				"",
+				`import type { InsertOf, RowOf, UpdateOf } from ${JSON.stringify(input.importPath(path, input.config.output))};`
+			];
+			for (const [from, names] of imports) lines.push(`import { ${[...new Set(names)].sort().join(", ")} } from ${JSON.stringify(from)};`);
+			const validators = [];
+			for (const [key, table] of tableEntries(input)) {
+				lines.push("");
+				const variants = variantsFor(table);
+				const docs = tableDocs(input, table);
+				for (const variant of variants) {
+					const name = schemaName(key, variant);
+					lines.push(`export const ${name}: ${typeName(flavor)}<${variant}Of<'${key}'>> = z.object({`);
+					for (const plan of fieldsFor(table, variant, input)) lines.push(field(key, plan, jsonImports, fieldDocs(docs, plan), flavor));
+					lines.push(`})${docs ? meta({
+						title: variantTitle(docs, variant),
+						description: docs.description
+					}, flavor) : ""};`);
+				}
+				if (variants.includes("Insert")) validators.push(`  ${propertyKey(key)}: { insert: ${schemaName(key, "Insert")}, update: ${schemaName(key, "Update")} },`);
+			}
+			lines.push("", "/** Write validators for the validation plugin. */", "export const validators: {");
+			for (const [key, table] of tableEntries(input)) {
+				if (!variantsFor(table).includes("Insert")) continue;
+				lines.push(`  readonly ${propertyKey(key)}: { readonly insert: typeof ${schemaName(key, "Insert")}; readonly update: typeof ${schemaName(key, "Update")} };`);
+			}
+			lines.push("} = {", ...validators, "};", "");
+			return [{
+				path,
+				contents: lines.join("\n")
+			}];
+		}
+	};
+}
+//#endregion
+export { defineConfig as a, GEN_TASKS as c, CONFIG_SCHEMA_URL as i, INTEGRATION_NAMES as l, valibot as n, resolveConfig as o, standardSchema as r, providerApiProblem as s, zod as t, SKILLS_AGENTS as u };

package/dist/{connector-Dv8kK0MO.d.ts → connector-CySQEFcW.d.ts}

@@ -1,4 +1,4 @@
-import { b as DbError, f as Result, x as DbErrorKind } from "./result-D7y2fT87.js";
+import { b as DbError, f as Result, x as DbErrorKind } from "./result-BchM1XZn.js";
 //#region src/powersync/connector.d.ts
 /** A queued local change: PowerSync's `CrudEntry`. */
 interface CrudEntryLike {

package/dist/{connectors-CrpknU0P.d.ts → connectors--PGhmiu0.d.ts}

@@ -1,8 +1,8 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
-import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { i as CredentialRef, r as CredentialProvider } from "./provider-D-UEMvSD.js";
-import { r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
+import { t as AsyncResult, w as ErrorMapper } from "./result-BchM1XZn.js";
+import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
+import { i as CredentialRef, r as CredentialProvider } from "./provider-ib9wzUDz.js";
+import { r as BlockTemporalOptions } from "./block-helpers-C0Xj8War.js";
 //#region src/blocks/connectors/connectors.d.ts
 type ConnectorTransport = "http" | "sse";
 /** `none`, OAuth per user (a grant each), or a header from the server's credential_ref. */

package/dist/{context-BCrWe7ow.d.ts → context-DsV2SueA.d.ts}

@@ -1,5 +1,5 @@
-import { u as ClaimsMeta } from "./types-6BdhkmZe.js";
-import { C as BlockEventMap, E as BlockEventType } from "./events-DWDhx77e.js";
+import { u as ClaimsMeta } from "./types-CoE5Zwy4.js";
+import { C as BlockEventMap, E as BlockEventType } from "./events-D1BOCll8.js";
 import { c as ResolvedModule, o as ModuleMode, s as ModulesConfig } from "./modules-DpPwzC7E.js";
 //#region src/sql/context.d.ts
 /** The scope id types SQL modules render. */
@@ -97,6 +97,15 @@ interface ModuleAudit {
   readonly metadata?: string;
   /** A `uuid` expression for the actor; defaults to the caller. */
   readonly actor?: string;
+  /**
+   * A `uuid` expression for the support session the action belongs to.
+   * Defaults to the session in the caller's `act` claim, which wins when set.
+   */
+  readonly supportSession?: string;
+  /** A `uuid` expression for the admin acting as the user; defaults to `act.sub`. */
+  readonly impersonatedBy?: string;
+  /** A `text` expression for why the admin acts as the user; defaults to `act.reason`. */
+  readonly impersonationReason?: string;
 }
 /**
  * An action a module records once: the outbox gets it as an event and the

package/dist/context-nPDvQ-Zl.js

@@ -0,0 +1,41 @@
+import { i as userContext } from "./impersonation-DcqaTBHx.js";
+//#region src/auth/context.ts
+/** The repository context (`actor`, `claims`) for an auth state. */
+function authContext(auth) {
+	switch (auth.kind) {
+		case "user": return userContext(auth.user, auth.claims);
+		case "service": return {
+			actor: {
+				id: `service:${auth.keyName}`,
+				kind: "service",
+				role: "service_role"
+			},
+			claims: { role: "service_role" }
+		};
+		case "apiKey": return {
+			actor: auth.userId ? {
+				id: auth.userId,
+				kind: "user",
+				role: "authenticated"
+			} : {
+				id: `api-key:${auth.keyId}`,
+				kind: "service",
+				role: "authenticated"
+			},
+			claims: auth.claims,
+			...auth.organizationId ? { tenant: auth.organizationId } : {}
+		};
+		case "anon":
+		case "invalid": return {
+			actor: {
+				id: "anon",
+				kind: "anon",
+				role: "anon"
+			},
+			claims: { role: "anon" }
+		};
+		default: return auth;
+	}
+}
+//#endregion
+export { authContext as t };

package/dist/credentials/index.d.ts

@@ -1,7 +1,7 @@
-import { t as AsyncResult } from "../result-D7y2fT87.js";
-import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../block-transport-DvaoPuZ9.js";
-import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-D-UEMvSD.js";
-import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-wlbBhqm7.js";
+import { t as AsyncResult } from "../result-BchM1XZn.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-inD4fFq-.js";
+import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-ib9wzUDz.js";
+import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-BpmApxxW.js";
 //#region src/credentials/compose.d.ts
 /**
  * One provider over several: each call goes to the provider whose `name`
@@ -28,4 +28,4 @@ interface RevokeIfConfiguredOptions {
  */
 export declare function revokeIfConfigured(provider: CredentialProvider | undefined, ref: CredentialRef, options: RevokeIfConfiguredOptions): AsyncResult<boolean>;
 //#endregion
-export { type BlockTransport, type CompleteAuthorizationOptions, type CredentialCapabilities, type CredentialProvider, type CredentialRef, type CredentialSubject, type CredentialToken, type GetTokenOptions, type RevokeIfConfiguredOptions, type SetCredentialOptions, type StartAuthorizationOptions, type VaultCredentialRef, type VaultCredentials, type VaultCredentialsOptions, type VaultInboundScheme, credentialRefInTenant, foreignCredentialRef, rpcTransport, sqlTransport, subjectFor, tenantCredentialRef, vaultCredentials };
+export { type BlockTransport, type CompleteAuthorizationOptions, type CredentialCapabilities, type CredentialProvider, type CredentialRef, type CredentialSubject, type CredentialToken, type GetTokenOptions, type RevokeIfConfiguredOptions, type SetCredentialOptions, type StartAuthorizationOptions, type VaultCredentialRef, type VaultCredentials, type VaultCredentialsOptions, type VaultInboundScheme, credentialRefInTenant, dbTransport, foreignCredentialRef, rpcTransport, sqlTransport, subjectFor, tenantCredentialRef, vaultCredentials };