better-supabase 0.7.1 → 0.8.0

package/dist/ttl-cache-XzZ-Q2eX.js

@@ -0,0 +1,29 @@
+//#region src/core/ttl-cache.ts
+/** A map with a size cap and per-entry expiry, oldest-inserted evicted first. `now` is injectable for tests. */
+function boundedTtlCache(options) {
+	const now = options.now ?? Date.now;
+	const entries = /* @__PURE__ */ new Map();
+	return {
+		get(key) {
+			const entry = entries.get(key);
+			if (entry && entry.until > now()) return entry.value;
+			entries.delete(key);
+		},
+		set(key, value, expiresAt) {
+			entries.delete(key);
+			if (entries.size >= options.max) {
+				const oldest = entries.keys().next();
+				if (!oldest.done) entries.delete(oldest.value);
+			}
+			entries.set(key, {
+				value,
+				until: expiresAt
+			});
+		},
+		get size() {
+			return entries.size;
+		}
+	};
+}
+//#endregion
+export { boundedTtlCache as t };

package/dist/types-BRTSpOIh.js

@@ -0,0 +1,5 @@
+//#region src/asyncapi/types.ts
+/** The file name `asyncapiFormat` writes; Arazzo source descriptions point at it. */
+const ASYNCAPI_FILE_NAME = "asyncapi.json";
+//#endregion
+export { ASYNCAPI_FILE_NAME as t };

package/dist/{types-C05bxW-W.d.ts → types-Bb_4-vdW.d.ts}

@@ -1,8 +1,8 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
-import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { a as AiMessage } from "./message-CfDoR0Y6.js";
-import { r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
+import { t as AsyncResult, w as ErrorMapper } from "./result-BchM1XZn.js";
+import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
+import { i as AiMessage } from "./message-B0fNJgq8.js";
+import { r as BlockTemporalOptions } from "./block-helpers-C0Xj8War.js";
 //#region src/blocks/ai-files/types.d.ts
 interface StorageReply<T> {
   readonly data: T | null;

package/dist/{types-AYOvcyep.d.ts → types-CD6yCDx3.d.ts}

@@ -1,9 +1,9 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
-import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "./provider-D-UEMvSD.js";
-import { r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
-import { a as WorkflowSchedule, u as WorkflowStarter } from "./workflows-B0j9WKPu.js";
+import { t as AsyncResult, w as ErrorMapper } from "./result-BchM1XZn.js";
+import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
+import { i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "./provider-ib9wzUDz.js";
+import { r as BlockTemporalOptions } from "./block-helpers-C0Xj8War.js";
+import { a as WorkflowSchedule, u as WorkflowStarter } from "./workflows-CcpCBfIe.js";
 //#region src/blocks/workflow-builder/graph.d.ts
 type WorkflowNodeKind = "trigger" | "step" | "sleep" | "approval" | "condition";
 type WorkflowConditionOperator = "equals" | "notEquals" | "exists" | "truthy" | "greaterThan" | "lessThan" | "contains";

package/dist/{types-6rocye-y.d.ts → types-CbOUc5IH.d.ts}

@@ -1,8 +1,8 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
-import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { i as CredentialRef, r as CredentialProvider } from "./provider-D-UEMvSD.js";
-import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
+import { t as AsyncResult, w as ErrorMapper } from "./result-BchM1XZn.js";
+import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
+import { i as CredentialRef, r as CredentialProvider } from "./provider-ib9wzUDz.js";
+import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-C0Xj8War.js";
 //#region src/blocks/ai-providers/types.d.ts
 /** A tenant's own key for a provider. The key itself stays in the credential provider. */
 interface AiProviderKey {

package/dist/{types-6BdhkmZe.d.ts → types-CoE5Zwy4.d.ts}

@@ -64,6 +64,10 @@ interface ColumnMeta {
   readonly sensitive?: true;
   /** Bucket id of the objects this text column points to (`config.storagePaths`). */
   readonly storage?: string;
+  /** The column's `COMMENT ON`, without its `@example` and `@deprecated` lines. */
+  readonly description?: string;
+  /** The column's comment has a `@deprecated` line. */
+  readonly deprecated?: true;
 }
 /**
  * Runtime representation for a column: `instant` decodes `timestamptz` to
@@ -120,6 +124,10 @@ interface TableMeta {
   readonly uniqueKeys: Readonly<Record<string, readonly string[]>>;
   readonly relations: Readonly<Record<string, RelationMeta>>;
   readonly flags: TableFlags;
+  /** The table's `COMMENT ON`, without its `@example` and `@deprecated` lines. */
+  readonly description?: string;
+  /** The table's comment has a `@deprecated` line. */
+  readonly deprecated?: true;
 }
 interface FunctionMeta extends FunctionSignature {
   readonly name: string;

package/dist/{types-DGs5L0VN.d.ts → types-DSJ3-m9X.d.ts}

@@ -1,8 +1,8 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
-import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
-import { n as Embedder } from "./knowledge-BXBbT0Tr.js";
+import { t as AsyncResult, w as ErrorMapper } from "./result-BchM1XZn.js";
+import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
+import { r as BlockTemporalOptions } from "./block-helpers-C0Xj8War.js";
+import { n as Embedder } from "./knowledge-CAReFpRA.js";
 //#region src/blocks/memory/types.d.ts
 type MemoryScope = "user" | "agent" | "chat" | "project" | "organization";
 type MemoryKind = "core" | "archival";

package/dist/{queue-CLJurhdy.d.ts → types-D__3EN0q.d.ts}

@@ -1,9 +1,9 @@
 /// <reference lib="esnext.temporal" />
-import { b as DbError, t as AsyncResult } from "./result-D7y2fT87.js";
-import { t as SqlClient } from "./executor-DbvExCFC.js";
-import { m as RequestContext, t as Actor } from "./plugin-FGY8UhYm.js";
-import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
-import { t as BlockProblemOptions } from "./problem-DD8LZFjc.js";
+import { b as DbError, t as AsyncResult } from "./result-BchM1XZn.js";
+import { t as SqlClient } from "./executor-ngjKL_Pe.js";
+import { m as RequestContext, t as Actor } from "./plugin-CPK2HsbY.js";
+import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-C0Xj8War.js";
+import { t as BlockProblemOptions } from "./problem-TvGdxO1t.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/blocks/jobs/backends.d.ts
 /** The body of a queued message, on pgmq and the table backend alike. */
@@ -104,9 +104,9 @@ interface QueueBackend {
 /**
  * The `jobs` SQL module over a service SQL connection. The same
  * functions back both `sql.modules.jobs.options.backend` values (pgmq and table)
- * and both schedulers.
+ * and both schedulers. `now` dates a schedule's first run.
  */
-declare function sqlQueueBackend(sql: SqlClient): QueueBackend;
+declare function sqlQueueBackend(sql: SqlClient, now?: () => Temporal.Instant): QueueBackend;
 /**
  * Supabase's `pgmq_public` RPCs (Integrations, Queues, "Expose Queues via
  * PostgREST"). No lease check on complete, no retry delay, no deduplication
@@ -114,7 +114,7 @@ declare function sqlQueueBackend(sql: SqlClient): QueueBackend;
  */
 declare function pgmqPublicBackend(client: QueueRpcClient): QueueBackend;
 //#endregion
-//#region src/blocks/jobs/queue.d.ts
+//#region src/blocks/jobs/types.d.ts
 type QueueSchemas = Readonly<Record<string, StandardSchemaV1>>;
 type PayloadIn<Q extends QueueSchemas, N extends keyof Q> = StandardSchemaV1.InferInput<Q[N]>;
 type PayloadOut<Q extends QueueSchemas, N extends keyof Q> = StandardSchemaV1.InferOutput<Q[N]>;
@@ -413,15 +413,13 @@ interface Jobs<Q extends QueueSchemas> {
   /** Polls and processes jobs until `signal` aborts. */
   work<N extends Extract<keyof Q, string>>(queue: N, handler: JobHandler<PayloadOut<Q, N>>, options?: WorkOptions): Promise<DrainResult>;
 }
-/**
- * Typed jobs on Supabase Queues (pgmq), over the `jobs` SQL module.
- *
- * Pass a service SQL connection (`postgres.admin`, `ctx.sql`) for the full
- * feature set, a service-role Supabase client to go through the
- * `pgmq_public` RPCs where no direct connection exists (edge functions), or
- * any `QueueBackend`. Queue names are lowercase letters, digits and
- * underscores.
- */
-declare function createJobs<const Q extends QueueSchemas>(source: SqlClient | QueueRpcClient | QueueBackend, queues: Q, options?: BlockTemporalOptions): Jobs<Q>;
+/** The options `createJobs` takes. */
+interface JobsOptions extends BlockTemporalOptions {
+  /**
+   * The clock for `runAt` delays and schedule runs; pass the definition's
+   * `now` option to share one clock. Defaults to `Temporal.Now.instant()`.
+   */
+  readonly now?: () => Temporal.Instant;
+}
 //#endregion
-export { QueueMessageBody as A, ScheduleInfo as C, DeadJobRow as D, createJobs as E, sqlQueueBackend as F, QueueRpcClient as M, QueueStats as N, DueSchedule as O, pgmqPublicBackend as P, ScheduleFilter as S, WorkOptions as T, QueueSchemas as _, DrainResult as a, ScheduleDefinition as b, EnqueueOptions as c, FailOptions as d, Job as f, ListDeadOptions as g, Jobs as h, DrainOptions as i, QueueMessageRow as j, QueueBackend as k, EnsureSchedulesOptions as l, JobHandler as m, DeadJob as n, DrainRouteOptions as o, JobContext as p, DrainMonitor as r, DrainRouteResult as s, ClaimOptions as t, EnsureSchedulesResult as u, RetryDeadOptions as v, ScheduleOptions as w, ScheduleDefinitions as x, RunSchedulesOptions as y };
+export { QueueMessageBody as A, ScheduleFilter as C, DeadJobRow as D, WorkOptions as E, sqlQueueBackend as F, QueueRpcClient as M, QueueStats as N, DueSchedule as O, pgmqPublicBackend as P, ScheduleDefinitions as S, ScheduleOptions as T, ListDeadOptions as _, DrainResult as a, RunSchedulesOptions as b, EnqueueOptions as c, FailOptions as d, Job as f, JobsOptions as g, Jobs as h, DrainOptions as i, QueueMessageRow as j, QueueBackend as k, EnsureSchedulesOptions as l, JobHandler as m, DeadJob as n, DrainRouteOptions as o, JobContext as p, DrainMonitor as r, DrainRouteResult as s, ClaimOptions as t, EnsureSchedulesResult as u, QueueSchemas as v, ScheduleInfo as w, ScheduleDefinition as x, RetryDeadOptions as y };

package/dist/{usage-CrvrL2vw.d.ts → usage-D0NNUFfr.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
-import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
+import { t as AsyncResult, w as ErrorMapper } from "./result-BchM1XZn.js";
+import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
+import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-C0Xj8War.js";
 import { n as StripeSource } from "./stripe-D04h-QBT.js";
 //#region src/blocks/usage/usage.d.ts
 interface UsageOptions extends BlockTemporalOptions {

package/dist/{vault-wlbBhqm7.d.ts → vault-BpmApxxW.d.ts}

@@ -1,6 +1,6 @@
-import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
-import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { c as SetCredentialOptions, i as CredentialRef, r as CredentialProvider } from "./provider-D-UEMvSD.js";
+import { t as AsyncResult, w as ErrorMapper } from "./result-BchM1XZn.js";
+import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
+import { c as SetCredentialOptions, i as CredentialRef, r as CredentialProvider } from "./provider-ib9wzUDz.js";
 //#region src/credentials/vault.d.ts
 /** How a request the third party sends is signed with the stored secret. */
 type VaultInboundScheme = "standard-webhooks" | "hmac-sha256" | "shared-secret";

package/dist/vercel-connect/index.d.ts

@@ -1,4 +1,4 @@
-import { a as CredentialSubject, r as CredentialProvider } from "../provider-D-UEMvSD.js";
+import { a as CredentialSubject, r as CredentialProvider } from "../provider-ib9wzUDz.js";
 //#region src/vercel-connect/vercel-connect.d.ts
 interface ConnectTokenParams {
   subject: CredentialSubject;

package/dist/vercel-connect/index.js

@@ -1,21 +1,15 @@
-import { n as dbError } from "../errors-B11Duf73.js";
+import { n as dbError } from "../errors-2M6CKMP4.js";
 import { c as optionalTemporal } from "../temporal-BJGitm-h.js";
-import { a as ok, r as err, t as AsyncResult } from "../result-DzUbqgdW.js";
-import { d as isRecord } from "../block-helpers-DWHxHsEQ.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-DEqHCMKP.js";
+import { n as isRecord } from "../guards-6F2bCtQR.js";
+import { t as importOptionalPeer } from "../optional-peer-D1pi-skw.js";
 //#region src/vercel-connect/vercel-connect.ts
 const isModule = (value) => isRecord(value) && typeof value["getTokenResponse"] === "function" && typeof value["revokeToken"] === "function" && typeof value["startAuthorization"] === "function";
 /**
 * Loads `@vercel/connect` on first use. The specifier is a variable so
 * bundlers leave the optional peer out of apps that don't use it.
 */
-async function loadConnect() {
-	const specifier = "@vercel/connect";
-	try {
-		return await import(specifier);
-	} catch {
-		return;
-	}
-}
+const loadConnect = () => importOptionalPeer("@vercel/connect");
 function connectRef(ref) {
 	const { connector, installationId, scopes } = ref;
 	if (ref.provider !== "vercel-connect" || typeof connector !== "string") return err(dbError("invalid_input", `vercel-connect resolves refs with a connector, not "${ref.provider}"`, { hint: "CREDENTIAL_REF_INVALID" }));

package/dist/{verify-DPuWngD4.d.ts → verify-C91Wyp40.d.ts}

@@ -1,39 +1,9 @@
 /// <reference lib="esnext.temporal" />
-import { f as Result } from "./result-D7y2fT87.js";
-import { L as TableKey, M as Row, a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
-import { t as BetterSupabase } from "./define-CJJkkr1-.js";
+import { f as Result } from "./result-BchM1XZn.js";
+import { L as TableKey, M as Row, a as AnyModels, i as AnyFunctions } from "./types-CoE5Zwy4.js";
+import { t as BetterSupabase } from "./define-DmcfoNXB.js";
+import { n as VerifyOptions, r as WebhookInput, t as VerifiedWebhook } from "./signatures-BRS_p3WD.js";
 //#region src/blocks/webhooks/verify.d.ts
-interface VerifiedWebhook<T = unknown> {
-  readonly id: string;
-  readonly timestamp: Temporal.Instant;
-  readonly payload: T;
-  readonly body: string;
-}
-interface VerifyOptions {
-  /** Allowed clock skew in seconds. Defaults to 300. */
-  readonly tolerance?: number;
-  readonly now?: () => Temporal.Instant;
-}
-type WebhookInput = Request | {
-  readonly headers: Headers | Readonly<Record<string, string>>;
-  readonly body: string;
-};
-/** Constant-time string comparison. */
-declare function timingSafeEqual(a: string, b: string): boolean;
-/** Headers for a signed Standard Webhooks request. */
-declare function signWebhook(secret: string, message: {
-  readonly id: string;
-  readonly body: string;
-  readonly timestamp?: Temporal.Instant;
-}): Promise<Record<string, string>>;
-/**
- * Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
- * `webhook-signature`, or the `svix-` names Svix-based senders use) and
- * parses the JSON body. Pass several secrets while rotating.
- */
-declare function verifyWebhook<T = unknown>(input: WebhookInput, secrets: string | readonly string[], options?: VerifyOptions): Promise<Result<VerifiedWebhook<T>>>;
-/** Checks a shared-secret header (database webhooks), in constant time. */
-declare function verifySharedSecret(request: Request, secret: string, headerName?: string): boolean;
 /** The `Stripe-Signature` header for `body`, for tests and local replays. */
 declare function signStripeWebhook(secret: string, body: string, timestamp?: Temporal.Instant): Promise<string>;
 /**
@@ -169,4 +139,4 @@ declare function isDatabaseWebhook(value: unknown): value is DatabaseWebhookPayl
  */
 declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(betterSupabase: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
 //#endregion
-export { verifySharedSecret as _, DatabaseWebhookPayload as a, WebhookInput as c, hookError as d, isDatabaseWebhook as f, timingSafeEqual as g, stripeInboxVerify as h, DatabaseChange as i, authHook as l, signWebhook as m, AuthHookKind as n, VerifiedWebhook as o, signStripeWebhook as p, AuthHooks as r, VerifyOptions as s, AuthHookError as t, databaseChange as u, verifyStripeWebhook as v, verifyWebhook as y };
+export { DatabaseWebhookPayload as a, hookError as c, stripeInboxVerify as d, verifyStripeWebhook as f, DatabaseChange as i, isDatabaseWebhook as l, AuthHookKind as n, authHook as o, AuthHooks as r, databaseChange as s, AuthHookError as t, signStripeWebhook as u };

package/dist/verify-CJbYfADA.js

@@ -0,0 +1,124 @@
+import { n as dbError } from "./errors-2M6CKMP4.js";
+import { c as optionalTemporal, s as nowInstant } from "./temporal-BJGitm-h.js";
+import { n as temporalMissing } from "./temporal-required-BtynQtM-.js";
+import { a as ok, r as err } from "./result-DEqHCMKP.js";
+import { n as hmacHex, r as timingSafeEqual } from "./hmac-DCud0myt.js";
+import { a as verifyWebhook, r as unauthorized, t as header } from "./signatures-DsWv_bYR.js";
+import { t as toApp } from "./casing-DdFWEtqr.js";
+//#region src/blocks/webhooks/verify.ts
+/** Stripe signs with the endpoint secret's UTF-8 bytes, not its base64 decoding. */
+const stripeSignature = hmacHex;
+/** The `Stripe-Signature` header for `body`, for tests and local replays. */
+async function signStripeWebhook(secret, body, timestamp = nowInstant()) {
+	const seconds = String(Math.floor(timestamp.epochMilliseconds / 1e3));
+	return `t=${seconds},v1=${await stripeSignature(secret, `${seconds}.${body}`)}`;
+}
+/**
+* Verifies a `Stripe-Signature` header (`t=…,v1=…`) with the endpoint's
+* `whsec_…` secret and parses the event. Pass several secrets while rolling
+* the endpoint secret. Runs on WebCrypto, so it needs no `stripe` package.
+*/
+async function verifyStripeWebhook(input, secrets, options = {}) {
+	const value = header(input.headers, "stripe-signature");
+	if (!value) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing Stripe-Signature header"));
+	const parts = value.split(",").map((part) => {
+		const index = part.indexOf("=");
+		return [part.slice(0, index).trim(), part.slice(index + 1).trim()];
+	});
+	const timestamp = parts.find(([name]) => name === "t")?.[1] ?? "";
+	const offered = parts.filter(([name]) => name === "v1").map(([, sig]) => sig);
+	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
+	const namespace = optionalTemporal();
+	if (namespace === void 0) return err(temporalMissing());
+	const seconds = Number(timestamp);
+	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
+	if (Math.abs(now - seconds) > (options.tolerance ?? 300)) return err(unauthorized("WEBHOOK_TIMESTAMP_OUT_OF_RANGE", "Webhook timestamp is outside the tolerance"));
+	const body = input instanceof Request ? await input.text() : input.body;
+	let valid = false;
+	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
+		const expected = await stripeSignature(secret, `${timestamp}.${body}`);
+		for (const candidate of offered) if (timingSafeEqual(candidate, expected)) valid = true;
+	}
+	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
+	let payload;
+	try {
+		payload = JSON.parse(body);
+	} catch {
+		return err(dbError("invalid_request", "Webhook body is not JSON"));
+	}
+	const id = typeof payload === "object" && payload !== null && "id" in payload ? String(payload.id) : "";
+	return ok({
+		id,
+		timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
+		payload,
+		body
+	});
+}
+/**
+* `createWebhookInbox({ source: 'stripe', verify: stripeInboxVerify(secret) })`:
+* stores Stripe events keyed by their event id.
+*/
+function stripeInboxVerify(secrets, options = {}) {
+	return async (request, body) => {
+		const verified = await verifyStripeWebhook({
+			headers: request.headers,
+			body
+		}, secrets, options);
+		return verified.ok ? ok({
+			id: verified.data.id,
+			payload: verified.data.payload
+		}) : verified;
+	};
+}
+/** Rejects a hook with a status and message Supabase Auth passes to the client. */
+function hookError(status, message) {
+	return { error: {
+		http_code: status,
+		message
+	} };
+}
+/**
+* A `(request) => Response` handler for a Supabase Auth hook: verifies the
+* Standard Webhooks signature, types the payload and serializes the answer.
+*
+* ```ts
+* export const POST = authHook('custom_access_token', env.AUTH_HOOK_SECRET, async ({ claims, user_id }) => ({
+*   claims: { ...claims, tenant_id: await organizationFor(user_id) },
+* }));
+* ```
+*/
+function authHook(_kind, secret, handler, options) {
+	return async (request) => {
+		const verified = await verifyWebhook(request, secret, options);
+		if (!verified.ok) return Response.json(hookError(verified.error.status, verified.error.message), { status: verified.error.status });
+		try {
+			const answer = await handler(verified.data.payload, verified.data);
+			const status = "error" in answer ? answer.error.http_code : 200;
+			return Response.json(answer, { status });
+		} catch (cause) {
+			console.error("better-supabase: auth hook failed", cause);
+			return Response.json(hookError(500, "Hook failed"), { status: 500 });
+		}
+	};
+}
+function isDatabaseWebhook(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const payload = value;
+	return (payload["type"] === "INSERT" || payload["type"] === "UPDATE" || payload["type"] === "DELETE") && typeof payload["table"] === "string" && typeof payload["schema"] === "string";
+}
+/**
+* Reads a database webhook payload for `table` as an app-cased change.
+* Returns `null` for other tables or payloads that aren't database webhooks.
+*/
+function databaseChange(betterSupabase, table, payload) {
+	const meta = betterSupabase.meta.tables[table];
+	if (!meta || !isDatabaseWebhook(payload) || payload.table !== meta.name || payload.schema !== meta.schema) return null;
+	return {
+		type: payload.type,
+		table,
+		record: payload.record ? toApp(meta, payload.record) : null,
+		oldRecord: payload.old_record ? toApp(meta, payload.old_record) : null
+	};
+}
+//#endregion
+export { signStripeWebhook as a, isDatabaseWebhook as i, databaseChange as n, stripeInboxVerify as o, hookError as r, verifyStripeWebhook as s, authHook as t };

package/dist/{version-C6OfRAIn.js → version-Cq8gfDbd.js}

@@ -1,4 +1,4 @@
 //#region src/core/version.ts
-const VERSION = "0.7.1";
+const VERSION = "0.8.0";
 //#endregion
 export { VERSION as t };

package/dist/{view-BeFcRV6G.js → view-D5ryq3gz.js}

@@ -1,4 +1,4 @@
-import { n as dbError } from "./errors-B11Duf73.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
 import { a as actorOf, o as delegationOf, r as impersonatorOf } from "./impersonation-DcqaTBHx.js";
 //#region src/auth/mfa.ts
 /** The session's assurance level from its claims; anything but `aal2` reads as `aal1`. */

package/dist/{view-CF7ihnkg.d.ts → view-TpXEUcVN.d.ts}

@@ -1,6 +1,6 @@
-import { b as DbError } from "./result-D7y2fT87.js";
-import { i as InvalidReason, r as AuthState } from "./resolve-ChTYeTEl.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-Daak8ukG.js";
+import { b as DbError } from "./result-BchM1XZn.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-MxXVWyhd.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-SZc9YYyb.js";
 import { n as SessionActor, r as SessionDelegation } from "./actor-CQTlc1Hh.js";
 import { JWTClaims, UserClaims } from "@supabase/server";
 //#region src/auth/view.d.ts

package/dist/vue/index.d.ts

@@ -1,14 +1,13 @@
-import { b as DbError } from "../result-D7y2fT87.js";
-import { it as QuerySpec } from "../define-CJJkkr1-.js";
-import { n as TemplateValues } from "../template-CwO38Do8.js";
-import { t as AuthSnapshot } from "../bind-Bu_ZNa3W.js";
-import { t as AuthSession } from "../view-CF7ihnkg.js";
-import { S as Topic, f as PresenceMember, u as EventSchemas, w as TopicHandlers, x as SubscriptionStatus } from "../index-DunNRdnT.js";
-import { t as SupportView } from "../support-view-CVOJJLpc.js";
-import { a as BroadcastOptions, c as LiveCountSource, d as PresenceTopic, f as UseActionOptions, i as ActionState, l as LiveQueryHookOptions, n as ActionInputOf, o as ClientLike, r as ActionResultOf, s as LiveCountHookOptions, t as fieldErrorsOf, u as PresenceHookOptions } from "../field-errors-BFOa7WhB.js";
+import { b as DbError } from "../result-BchM1XZn.js";
+import { J as TemplateValues } from "../storage-api-CB7Zl1Ci.js";
+import { at as QuerySpec } from "../define-DmcfoNXB.js";
+import { t as AuthSnapshot } from "../bind-CQ5mPyX1.js";
+import { t as AuthSession } from "../view-TpXEUcVN.js";
+import { S as Topic, f as PresenceMember, u as EventSchemas, w as TopicHandlers, x as SubscriptionStatus } from "../index-BCHR4Ucl.js";
+import { t as SupportView } from "../support-view-scqMgtOo.js";
+import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-DIe9XYWL.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { App, ComputedRef, MaybeRefOrGetter, Ref } from "vue";
-import { StandardSchemaV1 } from "@standard-schema/spec";
 import { QueryClient } from "@tanstack/query-core";
 //#region src/vue/index.d.ts
 export interface BetterSupabaseVueOptions {
@@ -39,14 +38,6 @@ export declare function provideSession(session: MaybeRefOrGetter<AuthSession>):
 export declare function useSession<C = unknown, P = unknown>(): ComputedRef<AuthSession<C, P>>;
 /** The support session the page renders in, or `undefined` for a normal session. */
 export declare function useSupportSession(): ComputedRef<SupportView | undefined>;
-/** The claims type of a client's `betterSupabase.claims(schema)`, `unknown` without one. */
-export type ClaimsOf<B extends ClientLike> = B["betterSupabase"] extends {
-  readonly claimsSchema: StandardSchemaV1<unknown, infer C> | undefined;
-} ? C : unknown;
-/** The profile type of a client's `betterSupabase.userMetadata(schema)`, `unknown` without one. */
-export type ProfileOf<B extends ClientLike> = B["betterSupabase"] extends {
-  readonly userMetadataSchema: StandardSchemaV1<unknown, infer P> | undefined;
-} ? P : unknown;
 export interface BetterComposables<B extends ClientLike> {
   /** Repositories bound to the current session. */
   readonly useDb: () => B["db"];
@@ -138,4 +129,4 @@ export interface ActionHandle<I, T> extends ActionState<I, T> {
  */
 export declare function useAction<I, T>(action: (input: I) => Promise<ActionResultOf<T>>, options?: UseActionOptions<ActionInputOf<I>, T>): ActionHandle<ActionInputOf<I>, T>;
 //#endregion
-export { type ActionInputOf, type ActionResultOf, type ActionState, type AuthSession, type AuthSnapshot, type BroadcastOptions, type ClientLike, type LiveCountHookOptions, type LiveCountSource, type LiveQueryHookOptions, type PresenceHookOptions, type PresenceTopic, type SupportView, type UseActionOptions, fieldErrorsOf };
+export { type ActionInputOf, type ActionResultOf, type ActionState, type AuthSession, type AuthSnapshot, type BroadcastOptions, type ClaimsOf, type ClientLike, type LiveCountHookOptions, type LiveCountSource, type LiveQueryHookOptions, type PresenceHookOptions, type PresenceTopic, type ProfileOf, type SupportView, type UseActionOptions, fieldErrorsOf };

package/dist/vue/index.js

@@ -1,7 +1,7 @@
 import { t as clearOnUserChange } from "../user-change-XzvgafU4.js";
+import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-wxeTQFtB.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { t as fieldErrorsOf } from "../field-errors-VF1yb8yI.js";
-import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-CI0Z2zWX.js";
+import { t as fieldErrorsOf } from "../field-errors-DZVRWRkf.js";
 import { computed, getCurrentInstance, getCurrentScope, inject, onMounted, onScopeDispose, provide, readonly, shallowRef, toValue, watch } from "vue";
 //#region src/vue/index.ts
 const CLIENT = Symbol("better-supabase");

package/dist/{watch-Xuxrvxq-.js → watch-BcvtAHOd.js}

@@ -1,5 +1,5 @@
-import { n as isPlainObject } from "./clone-BfgmLU90.js";
-import { r as err, s as toDbError } from "./result-DzUbqgdW.js";
+import { r as isPlainObject } from "./clone-dN9XOL1K.js";
+import { r as err, s as toDbError } from "./result-DEqHCMKP.js";
 //#region src/core/share.ts
 function sameValue(prev, next) {
 	if (Object.is(prev, next)) return true;

package/dist/{watch-DI34G86j.d.ts → watch-COzRWvVN.d.ts}

@@ -1,22 +1,36 @@
-import { f as Result } from "./result-D7y2fT87.js";
-import { L as TableKey, P as SchemaMeta, a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
-import { t as BetterSupabase } from "./define-CJJkkr1-.js";
-import { i as ListDefinition } from "./list-query-BRt-zDF7.js";
-import { c as SqliteCompilerOptions, p as SqlitePlan, t as PowerSyncDatabaseLike } from "./executor-CaWigTyR.js";
-import { t as Compiler } from "./compiler-DY_wkj4R.js";
+import { b as DbError, f as Result } from "./result-BchM1XZn.js";
+import { L as TableKey, P as SchemaMeta, a as AnyModels, i as AnyFunctions } from "./types-CoE5Zwy4.js";
+import { t as BetterSupabase } from "./define-DmcfoNXB.js";
+import { i as ListDefinition } from "./list-query-D3JQeEL7.js";
+import { c as SqliteCompilerOptions, p as SqlitePlan, t as PowerSyncDatabaseLike } from "./executor-DfEtf0cq.js";
+import { t as Compiler } from "./compiler-V1qvcST1.js";
 //#region src/powersync/compiler.d.ts
 declare const sqliteCompiler: Compiler<SqlitePlan>;
+interface CheckSqliteOptions extends SqliteCompilerOptions {
+  /**
+   * Return every error instead of the first, one per distinct message. With
+   * a `fallback` executor, these are the reads that run on the server.
+   */
+  readonly all?: boolean;
+}
 /**
  * Compiles every operation a list definition runs (the page, its count and
  * the facet counts) for SQLite, without a database. Returns the first
  * `unsupported` or `invalid_request` error, so a test or a dev build fails
- * before a native screen does.
+ * before a native screen does. With `all: true`, returns every error, an
+ * empty array when the whole list runs on SQLite.
  *
  * ```ts
  * expect(await checkSqlite(betterSupabase, customerList)).toEqual({ ok: true, data: undefined });
+ * expect(await checkSqlite(betterSupabase, customerList, { all: true })).toEqual([]);
  * ```
  */
-declare function checkSqlite<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>, S extends string, Fa extends string, C extends boolean, P extends "offset" | "cursor">(betterSupabase: BetterSupabase<M, D, F, E>, list: ListDefinition<M, T, E, S, Fa, C, P>, options?: SqliteCompilerOptions): Promise<Result<undefined>>;
+declare function checkSqlite<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>, S extends string, Fa extends string, C extends boolean, P extends "offset" | "cursor">(betterSupabase: BetterSupabase<M, D, F, E>, list: ListDefinition<M, T, E, S, Fa, C, P>, options: CheckSqliteOptions & {
+  readonly all: true;
+}): Promise<readonly DbError[]>;
+declare function checkSqlite<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>, S extends string, Fa extends string, C extends boolean, P extends "offset" | "cursor">(betterSupabase: BetterSupabase<M, D, F, E>, list: ListDefinition<M, T, E, S, Fa, C, P>, options?: CheckSqliteOptions & {
+  readonly all?: false;
+}): Promise<Result<undefined>>;
 //#endregion
 //#region src/powersync/watch.d.ts
 interface WatchOptions<T> {
@@ -57,4 +71,4 @@ declare function sqliteTables(betterSupabase: {
   readonly meta: SchemaMeta;
 }, keys: readonly string[], options?: SqliteCompilerOptions): string[];
 //#endregion
-export { sqliteCompiler as a, checkSqlite as i, sqliteTables as n, watch as r, WatchOptions as t };
+export { checkSqlite as a, CheckSqliteOptions as i, sqliteTables as n, sqliteCompiler as o, watch as r, WatchOptions as t };

package/dist/{wire-DtZQ4sdE.js → wire-Df3EWkG8.js}

@@ -1,7 +1,7 @@
 import { t as DbException } from "./db-exception-CnWcYPxL.js";
-import { n as dbError } from "./errors-B11Duf73.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
 import { d as temporalText } from "./temporal-BJGitm-h.js";
-import { t as temporal } from "./temporal-required-BVvW7SYJ.js";
+import { t as temporal } from "./temporal-required-BtynQtM-.js";
 //#region src/ir/wire.ts
 /** ISO text of a `Date`; an invalid date has none. */
 function dateText(value) {

package/dist/{workflow-builder-DJ1oHn8g.js → workflow-builder-CHqHpAVt.js}

@@ -1,8 +1,9 @@
-import { n as dbError } from "./errors-B11Duf73.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-DzUbqgdW.js";
-import { n as credentialRefInTenant, r as foreignCredentialRef } from "./provider-Di3sRutW.js";
-import { D as stringsOf, O as textOf, S as requiredInstant, _ as randomToken, b as recordOrEmpty, d as isRecord, h as optionalText, i as blockCall, l as injectableOf, m as optionalInstant, n as applyTemporal, s as enumOrThrow, w as seconds, x as recordsOf, y as recordOf } from "./block-helpers-DWHxHsEQ.js";
-import { t as createWorkflows } from "./workflows-wu1WWBn7.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-DEqHCMKP.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { n as credentialRefInTenant, r as foreignCredentialRef } from "./provider-DxRTex4x.js";
+import { A as stringsOf, C as recordOrEmpty, D as seconds, S as recordOf, T as requiredInstant, _ as optionalInstant, b as randomToken, c as enumOrThrow, i as blockCall, j as textOf, n as applyTemporal, u as injectableOf, v as optionalText, w as recordsOf } from "./block-helpers-Cy3pB96I.js";
+import { t as createWorkflows } from "./workflows-IvxzG2cl.js";
 import { o as graphOf, r as diffGraphs } from "./graph-BGyLLFLX.js";
 //#region src/blocks/workflow-builder/rows.ts
 const VERSION_STATUSES = [

package/dist/workflow-sdk/builder/index.d.ts

@@ -1,6 +1,6 @@
-import { T as WorkflowGraph, c as NodeRunRecord, i as BuilderStarter } from "../../types-AYOvcyep.js";
-import { i as executeGraph, n as GraphStepCall, r as approvalToken, t as GraphRuntime } from "../../executor-BVBFM86G.js";
-import { o as WorkflowFn } from "../../workflow-sdk-B3yLD6Br.js";
+import { T as WorkflowGraph, c as NodeRunRecord, i as BuilderStarter } from "../../types-CD6yCDx3.js";
+import { i as executeGraph, n as GraphStepCall, r as approvalToken, t as GraphRuntime } from "../../executor-CpxLPCiz.js";
+import { o as WorkflowFn } from "../../workflow-sdk-DTZyrvNo.js";
 import { World } from "@workflow/world";
 //#region src/workflow-sdk/builder/builder.d.ts
 /** The env flag the Workflow SDK reads before it starts or runs dynamic source. */

package/dist/workflow-sdk/index.d.ts

@@ -1,4 +1,4 @@
-import { a as StartOnEventOptions, c as contextAttributes, d as startFor, f as startOnEvent, i as StartForOptions, l as hookMetadata, m as workflowStarter, n as HookForbiddenError, o as WorkflowFn, p as workflowContext, r as ProtectWebHandlerOptions, s as authorizeHook, t as AuthorizeHookOptions, u as protectWebHandler } from "../workflow-sdk-B3yLD6Br.js";
+import { a as StartOnEventOptions, c as contextAttributes, d as startFor, f as startOnEvent, i as StartForOptions, l as hookMetadata, m as workflowStarter, n as HookForbiddenError, o as WorkflowFn, p as workflowContext, r as ProtectWebHandlerOptions, s as authorizeHook, t as AuthorizeHookOptions, u as protectWebHandler } from "../workflow-sdk-DTZyrvNo.js";
 //#region src/workflow-sdk/attributes.d.ts
 /** The attributes the Supabase World's status trigger copies into `workflow_runs`. */
 export declare const WORKFLOW_ATTRIBUTES: {