better-supabase 0.8.0 → 0.9.0

package/dist/edge/index.d.ts

@@ -1,17 +1,17 @@
-import { f as Result } from "../result-BchM1XZn.js";
-import { a as AnyModels, i as AnyFunctions } from "../types-CoE5Zwy4.js";
-import { t as StandardSchemaV1 } from "../standard-lmkbOtPB.js";
+import { f as Result } from "../result-Cj3yWhjH.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-YfwpIE-d.js";
+import { t as StandardSchemaV1 } from "../standard-C3_AAF3g.js";
 import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
-import { t as BetterSupabase } from "../define-DmcfoNXB.js";
-import { i as ServerContext, s as ServerOptions, t as BetterServer } from "../server-types-CrAmZ8jv.js";
-import { t as AuthSession } from "../view-TpXEUcVN.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-Cw-zanCm.js";
-import { s as BlockRequireOptions } from "../kit-W99LCPBS.js";
-import { t as FunctionContract } from "../function-contract-BcZenXMO.js";
+import { t as BetterSupabase } from "../define-DxHHbNEb.js";
+import { i as ServerContext, s as ServerOptions, t as BetterServer } from "../server-types-OohhIQb2.js";
+import { t as AuthSession } from "../view-Dv0A949a.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-C7I8kLK_.js";
+import { s as BlockRequireOptions } from "../kit-D5S7KNFe.js";
+import { n as FunctionContract, t as DescribedFunction } from "../function-contract-B4c0XuTU.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
-import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-CqB6GWGT.js";
-import { t as ResourceMap } from "../resources-DZSk8tXJ.js";
-import { t as defineAction } from "../resource-execute-rbKvuCsY.js";
+import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-D2vEQVXI.js";
+import { t as ResourceMap } from "../resources-BklF-rjz.js";
+import { t as defineAction } from "../resource-execute-D0yQ-8WR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { WithCorsConfig } from "@supabase/middleware/cors";
 //#region src/bridges/edge.d.ts
@@ -34,8 +34,8 @@ type EdgeHandler = (request: Request, env?: unknown, executionContext?: EdgeExec
 export declare function toEdge<const Entries extends readonly AnyEntry[]>(entries: Entries & Validated<Entries>, handler: (request: Request, ctx: Contributions<Entries>, executionContext: EdgeExecutionContext | undefined, env: unknown) => Response | Promise<Response>): EdgeHandler;
 //#endregion
 //#region src/edge/function.d.ts
-/** A fetch handler that carries its contract in its type. */
-type TypedFunction<In, Out> = EdgeHandler & {
+/** A fetch handler that carries its contract in its type and its schemas at runtime. */
+type TypedFunction<In, Out> = EdgeHandler & DescribedFunction & {
   /** Type-only: never set at runtime. */
   readonly "~contract"?: FunctionContract<In, Out>;
 };
@@ -53,6 +53,8 @@ interface FunctionDefinition<I extends StandardSchemaV1, Out, M extends AnyModel
    * answers 500, so a function never sends data its contract doesn't promise.
    */
   readonly output?: StandardSchemaV1<unknown, Out>;
+  /** A one-line summary for the operation `functionRoute` describes in `better-supabase/spec`. */
+  readonly summary?: string;
   /** Runs as the caller with the parsed input. Returns data or a `Result`. */
   readonly handler: (input: StandardSchemaV1.InferOutput<I>, ctx: ServerContext<M, F, E, C, P> & {
     readonly request: Request;

package/dist/edge/index.js

@@ -1,15 +1,16 @@
-import { n as dbError } from "../errors-2M6CKMP4.js";
-import { a as ok, r as err } from "../result-DEqHCMKP.js";
-import { n as validate } from "../standard-DkzZUneg.js";
-import { o as problemResponse } from "../problem-CJvFeGu7.js";
-import { a as unexpectedResponse, c as extendServer, o as withFlush, s as createServer } from "../adapter-CN45ibbV.js";
-import { a as respond, o as settle, t as defaultExpose } from "../respond-volM3ByS.js";
-import { t as withBetterSupabase } from "../composite-zTe0TCqj.js";
-import { r as defineAction } from "../resource-DA811u_4.js";
-import { i as requireCaller } from "../kit-BhHr9T9v.js";
+import { n as dbError } from "../errors-8i6tSICm.js";
+import { a as ok, r as err } from "../result-BlgnMB0H.js";
+import { n as validate } from "../standard-B5fe2gnW.js";
+import { o as problemResponse } from "../problem-pIiL3WbE.js";
+import { a as unexpectedResponse, c as extendServer, o as withFlush, s as createServer } from "../adapter-CEjmtazZ.js";
+import { a as respond, o as settle, t as defaultExpose } from "../respond-DdhZ9Wbn.js";
+import { t as withBetterSupabase } from "../composite-M6zPs1Xm.js";
+import { r as defineAction } from "../resource-C8r5xGqY.js";
+import { i as requireCaller } from "../kit-MUK34-ZG.js";
 import { t as withExtra } from "../extra-CGQ2_q3S.js";
-import { t as resourceRouter } from "../resources-BVYPnuLo.js";
-import { t as EVERY_CALLER } from "../framework-3ey3QmrO.js";
+import { n as resourceRouter } from "../resources-BlZdLsWQ.js";
+import { t as EVERY_CALLER } from "../framework-INbjMZX1.js";
+import { t as FUNCTION_DESCRIPTOR } from "../function-contract-DmkBg19r.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { withCors } from "@supabase/middleware/cors";
 //#region src/bridges/edge.ts
@@ -63,7 +64,7 @@ function compileRoutes(routes) {
 	return compiled.toSorted((a, b) => weight(a) - weight(b));
 }
 function paramsOf(segments, rest, parts) {
-	if (rest ? parts.length < segments.length : parts.length !== segments.length) return void 0;
+	if (rest ? parts.length < segments.length : parts.length !== segments.length) return;
 	const params = {};
 	for (const [index, segment] of segments.entries()) {
 		const part = parts[index] ?? "";
@@ -72,7 +73,7 @@ function paramsOf(segments, rest, parts) {
 		} catch {
 			return;
 		}
-		else if (segment !== part) return void 0;
+		else if (segment !== part) return;
 	}
 	if (rest) params["*"] = parts.slice(segments.length).join("/");
 	return params;
@@ -129,8 +130,8 @@ async function readInput(request) {
 * ```
 */
 function defineFunction(edge, definition) {
-	const { input, output, handler, ...options } = definition;
-	return edge.handler(async (request, ctx) => {
+	const { input, output, summary, handler, ...options } = definition;
+	const fn = edge.handler(async (request, ctx) => {
 		const body = await readInput(request);
 		if (!body.ok) return body;
 		const parsed = await validate(input, body.data, "input");
@@ -141,6 +142,13 @@ function defineFunction(edge, definition) {
 		const checked = await validate(output, settled.data, "output");
 		return checked.ok ? checked.data : err(dbError("unexpected", "The function returned data its output rejects"));
 	}, options);
+	const descriptor = {
+		input,
+		...output ? { output } : {},
+		...summary === void 0 ? {} : { summary }
+	};
+	Object.defineProperty(fn, FUNCTION_DESCRIPTOR, { value: descriptor });
+	return fn;
 }
 //#endregion
 //#region src/edge/index.ts
@@ -191,9 +199,7 @@ function createEdge(betterSupabase, options = {}) {
 		});
 		const routed = (request, env, executionContext) => Promise.resolve(early?.(request) ?? authorized(request, env, executionContext));
 		const answer = withCorsConfig ? toEdge([withCors(withCorsConfig)], (request, _ctx, executionContext, env) => routed(request, env, executionContext)) : routed;
-		return async (request, env, executionContext) => {
-			return withFlush(server, options.waitUntil ?? executionContext?.waitUntil.bind(executionContext), () => answer(request, env, executionContext));
-		};
+		return async (request, env, executionContext) => withFlush(server, options.waitUntil ?? executionContext?.waitUntil.bind(executionContext), () => answer(request, env, executionContext));
 	};
 	return extendServer(server, {
 		handler(fn, handlerOptions = {}) {

package/dist/elysia/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../refusal-CFI8-5nf.js";
+import { n as RouteGuardOptions } from "../refusal-oD3ISM9h.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 //#region src/bridges/elysia.d.ts

package/dist/elysia/index.js

@@ -1,5 +1,5 @@
-import { t as around } from "../shared-CBxosKK3.js";
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-K78A1Vmq.js";
+import { t as around } from "../shared-BmMcMoW9.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-br4Ma9Cf.js";
 import { bufferRequest } from "@supabase/middleware";
 //#region src/bridges/elysia.ts
 /**

package/dist/email-BcmbIWOX.d.ts

@@ -0,0 +1,42 @@
+import { n as NotificationMessage, t as NotificationChannel } from "./channel-D-LHCY11.js";
+import { a as DeliveryTransport, c as UnsubscribeTarget, s as MailCategory } from "./delivery-BeHgwS3k.js";
+//#region src/blocks/notifications/email.d.ts
+/** The mail for one delivery. */
+interface ComposedEmail {
+  readonly subject: string;
+  readonly text?: string;
+  readonly html?: string;
+  readonly replyTo?: string;
+  /** Defaults to `notification`. */
+  readonly category?: MailCategory;
+  /**
+   * Names the template this mail came from, e.g. `task-assigned-v2`. The
+   * delivery keeps it, so a record's sent emails show which one went out.
+   */
+  readonly templateKey?: string;
+}
+interface EmailChannelOptions {
+  readonly transport: DeliveryTransport;
+  /** `Name <address>` or an address the provider has verified. */
+  readonly from: string;
+  readonly replyTo?: string;
+  /**
+   * The mail for a delivery. Defaults to the rendered title as the subject
+   * and the rendered body (or the title) as the text, so it needs
+   * `createNotifications({ render })`.
+   */
+  readonly compose?: (message: NotificationMessage) => ComposedEmail | Promise<ComposedEmail>;
+  /**
+   * Where the reader unsubscribes from this mail, such as a signed link to
+   * your preferences route. Only `notification` mail carries it.
+   */
+  readonly unsubscribe?: (message: NotificationMessage) => UnsubscribeTarget | undefined | Promise<UnsubscribeTarget | undefined>;
+}
+/**
+ * A `NotificationChannel` named `email` that sends through `transport`,
+ * with the delivery id as the idempotency key. A recipient without an
+ * address is skipped.
+ */
+declare function emailChannel(options: EmailChannelOptions): NotificationChannel;
+//#endregion
+export { EmailChannelOptions as n, emailChannel as r, ComposedEmail as t };

package/dist/embeddings-C2S14foD.d.ts

@@ -0,0 +1,78 @@
+import { d as KnowledgeSearchOptions, n as Embedder, o as KnowledgeHit, r as Knowledge } from "./knowledge-BXQ2-V0a.js";
+import { EmbeddingModel, RerankingModel, SourceDocumentUIPart, Tool, embedMany } from "ai";
+//#region src/ai-sdk/embeddings/embeddings.d.ts
+type ProviderOptions = Parameters<typeof embedMany>[0]["providerOptions"];
+interface EmbedWithOptions {
+  /** Concurrent calls when the values need more than one. Default 4. */
+  readonly maxParallelCalls?: number;
+  readonly providerOptions?: ProviderOptions;
+  /** The name stored with each embedding; the provider and model id by default. */
+  readonly name?: string;
+}
+/** The name of an SDK model: the string itself, or `provider/modelId`. */
+declare function modelName(model: string | {
+  readonly provider: string;
+  readonly modelId: string;
+}): string;
+/** An `Embedder` for the knowledge and memory blocks over `embedMany`. */
+declare function embedWith(model: EmbeddingModel, options?: EmbedWithOptions): Embedder;
+type Reranker = (query: string, hits: readonly KnowledgeHit[], options?: {
+  readonly signal?: AbortSignal;
+}) => Promise<readonly KnowledgeHit[]>;
+/** Reorders search hits with a reranking model, keeping the best `topN`. */
+declare function rerankWith(model: RerankingModel, options?: {
+  readonly topN?: number;
+}): Reranker;
+/**
+ * Keeps the items of a search the caller may read. A tool applies it before
+ * anything else sees the items: the reranker, `onHits` and the model. A
+ * throw fails the tool call, so no items reach the model.
+ */
+type ResultsFilter<T, C = {
+  readonly query: string;
+}> = (items: readonly T[], context: C) => readonly T[] | PromiseLike<readonly T[]>;
+interface SearchToolOptions extends Omit<KnowledgeSearchOptions, "signal"> {
+  readonly description?: string;
+  /** Drops the hits the caller may not read, such as by a permission. */
+  readonly results?: ResultsFilter<KnowledgeHit>;
+  /** Reranks the hits before the model sees them. */
+  readonly rerank?: Reranker;
+  /** Called with the hits, to stream them as source parts. */
+  readonly onHits?: (hits: readonly KnowledgeHit[]) => void;
+}
+interface SearchToolResult {
+  readonly results: readonly {
+    readonly id: string;
+    readonly title: string;
+    readonly content: string;
+  }[];
+}
+/**
+ * A tool that searches the knowledge base as the caller. Each result id
+ * is `documentId#index`, the `sourceId` that `toSourceParts` gives it.
+ */
+declare function searchTool(knowledge: Knowledge, organizationId: string, options?: SearchToolOptions): Tool<{
+  query: string;
+}, SearchToolResult>;
+/** One `source-document` part per document among the hits, in hit order. */
+declare function toSourceParts(hits: readonly KnowledgeHit[]): SourceDocumentUIPart[];
+/** `Supabase.ai.Session` in Supabase Edge Functions, typed structurally. */
+interface SupabaseAiSession {
+  run(input: string, options: {
+    readonly mean_pool: boolean;
+    readonly normalize: boolean;
+  }): Promise<unknown>;
+}
+interface SupabaseEmbedOptions {
+  /** The built-in model. Default `gte-small` (384 dimensions). */
+  readonly model?: string;
+  /** A session to use instead of `new Supabase.ai.Session(model)`. */
+  readonly session?: SupabaseAiSession;
+}
+/**
+ * An `Embedder` over the model built into Supabase Edge Functions. Set the
+ * module's `dimensions` option to the model's size (384 for `gte-small`).
+ */
+declare function supabaseEmbed(options?: SupabaseEmbedOptions): Embedder;
+//#endregion
+export { SearchToolResult as a, embedWith as c, searchTool as d, supabaseEmbed as f, SearchToolOptions as i, modelName as l, Reranker as n, SupabaseAiSession as o, toSourceParts as p, ResultsFilter as r, SupabaseEmbedOptions as s, EmbedWithOptions as t, rerankWith as u };

package/dist/embeddings-CVeOoufZ.js

@@ -0,0 +1,128 @@
+import { t as DbException } from "./db-exception-CnWcYPxL.js";
+import { embedMany, jsonSchema, rerank, tool } from "ai";
+//#region src/ai-sdk/embeddings/embeddings.ts
+/** The name of an SDK model: the string itself, or `provider/modelId`. */
+function modelName(model) {
+	return typeof model === "string" ? model : `${model.provider}/${model.modelId}`;
+}
+/** An `Embedder` for the knowledge and memory blocks over `embedMany`. */
+function embedWith(model, options = {}) {
+	return {
+		apiVersion: 1,
+		model: options.name ?? modelName(model),
+		embed: async (values, embedOptions) => {
+			if (values.length === 0) return [];
+			const { embeddings } = await embedMany({
+				model,
+				values: [...values],
+				maxParallelCalls: options.maxParallelCalls ?? 4,
+				...options.providerOptions === void 0 ? {} : { providerOptions: options.providerOptions },
+				...embedOptions?.signal === void 0 ? {} : { abortSignal: embedOptions.signal }
+			});
+			return embeddings;
+		}
+	};
+}
+/** Reorders search hits with a reranking model, keeping the best `topN`. */
+function rerankWith(model, options = {}) {
+	return async (query, hits, rerankOptions) => {
+		if (hits.length <= 1) return hits;
+		const { ranking } = await rerank({
+			model,
+			query,
+			documents: hits.map((hit) => hit.content),
+			...options.topN === void 0 ? {} : { topN: options.topN },
+			...rerankOptions?.signal === void 0 ? {} : { abortSignal: rerankOptions.signal }
+		});
+		return ranking.flatMap((entry) => {
+			const hit = hits[entry.originalIndex];
+			return hit === void 0 ? [] : [{
+				...hit,
+				score: entry.score
+			}];
+		});
+	};
+}
+/**
+* A tool that searches the knowledge base as the caller. Each result id
+* is `documentId#index`, the `sourceId` that `toSourceParts` gives it.
+*/
+function searchTool(knowledge, organizationId, options = {}) {
+	const { description, results, rerank: reorder, onHits, ...search } = options;
+	return tool({
+		description: description ?? "Search the knowledge base for passages relevant to a query. Cite results by their id.",
+		inputSchema: jsonSchema({
+			type: "object",
+			properties: { query: {
+				type: "string",
+				description: "What to look for"
+			} },
+			required: ["query"],
+			additionalProperties: false
+		}),
+		execute: async ({ query }, { abortSignal }) => {
+			const found = await knowledge.search(organizationId, query, {
+				...search,
+				...abortSignal === void 0 ? {} : { signal: abortSignal }
+			});
+			if (!found.ok) throw new DbException(found.error);
+			const readable = results ? await results(found.data, { query }) : found.data;
+			const hits = reorder ? await reorder(query, readable, abortSignal === void 0 ? void 0 : { signal: abortSignal }) : readable;
+			onHits?.(hits);
+			return { results: hits.map((hit) => ({
+				id: sourceId(hit),
+				title: hit.title,
+				content: hit.content
+			})) };
+		}
+	});
+}
+const sourceId = (hit) => `${hit.documentId}#${String(hit.index)}`;
+/** One `source-document` part per document among the hits, in hit order. */
+function toSourceParts(hits) {
+	const seen = /* @__PURE__ */ new Set();
+	const parts = [];
+	for (const hit of hits) {
+		if (seen.has(hit.documentId)) continue;
+		seen.add(hit.documentId);
+		parts.push({
+			type: "source-document",
+			sourceId: sourceId(hit),
+			mediaType: "text/plain",
+			title: hit.title
+		});
+	}
+	return parts;
+}
+function supabaseSession(model) {
+	const Session = globalThis.Supabase?.ai?.Session;
+	if (typeof Session !== "function") throw new TypeError("supabaseEmbed runs in Supabase Edge Functions, where Supabase.ai.Session exists; pass session elsewhere");
+	return new Session(model);
+}
+/**
+* An `Embedder` over the model built into Supabase Edge Functions. Set the
+* module's `dimensions` option to the model's size (384 for `gte-small`).
+*/
+function supabaseEmbed(options = {}) {
+	const name = options.model ?? "gte-small";
+	let session = options.session;
+	return {
+		apiVersion: 1,
+		model: `supabase/${name}`,
+		embed: async (values) => {
+			session ??= supabaseSession(name);
+			const vectors = [];
+			for (const value of values) {
+				const output = await session.run(value, {
+					mean_pool: true,
+					normalize: true
+				});
+				if (!Array.isArray(output) || !output.every((x) => typeof x === "number")) throw new TypeError(`Supabase.ai.Session returned no vector for ${name}`);
+				vectors.push(output);
+			}
+			return vectors;
+		}
+	};
+}
+//#endregion
+export { supabaseEmbed as a, searchTool as i, modelName as n, toSourceParts as o, rerankWith as r, embedWith as t };

package/dist/ended-nIdGCHxk.d.ts

@@ -0,0 +1,70 @@
+import { m as RequestContext } from "./plugin-CDLJRFFg.js";
+import { g as StoredSession, r as AuthState, u as CookieOptions } from "./resolve-w9EpHzuM.js";
+//#region src/auth/refresh.d.ts
+interface RefreshOptions {
+  readonly url: string;
+  readonly publishableKey: string;
+  /**
+   * Sends `Sb-Forwarded-For: ip` with the secret key, so Auth rate-limits the
+   * refresh by the user's IP (when IP forwarding is on for the project).
+   */
+  readonly forwardedFor?: {
+    readonly ip: string;
+    readonly secretKey: string;
+  };
+  readonly fetch?: typeof fetch;
+  /**
+   * Milliseconds before a refresh counts as a network failure (the session is
+   * kept). 5000 by default.
+   */
+  readonly timeoutMs?: number;
+  /** Epoch milliseconds, the unit JWT `exp` and `iat` math needs. */
+  readonly now?: () => number;
+}
+type RefreshOutcome = {
+  readonly ok: true;
+  readonly session: StoredSession;
+  /** Served from a concurrent or just-finished refresh of the same token. */
+  readonly shared?: boolean;
+} | {
+  readonly ok: false;
+  /** `rejected`: the refresh token is dead, sign the user out. `network`: keep the session and retry later. */
+  readonly reason: "rejected" | "network";
+  /** For `network`: the fetch failed, timed out, or Auth answered 5xx or 429. */
+  readonly cause?: "fetch" | "timeout" | "status";
+  readonly status?: number;
+  /** The Auth server's `error_code`, such as `user_banned` or `refresh_token_not_found`. */
+  readonly code?: string;
+  readonly message: string;
+};
+/**
+ * Exchanges a refresh token for a new session. Concurrent calls with the same
+ * token share one request, and a successful result is reused for a short
+ * window so parallel requests carrying the old cookie converge on one session.
+ */
+declare function refreshSession(refreshToken: string, options: RefreshOptions): Promise<RefreshOutcome>;
+//#endregion
+//#region src/auth/context.d.ts
+/** The repository context (`actor`, `claims`) for an auth state. */
+declare function authContext(auth: AuthState): RequestContext;
+//#endregion
+//#region src/auth/ended.d.ts
+/** `banned`: Auth rejected the token with `error_code: "user_banned"`. */
+type SessionStatus = "active" | "ended" | "banned" | "unknown";
+interface SessionStatusOptions {
+  readonly url: string;
+  readonly publishableKey: string;
+  readonly cookieName?: string;
+  readonly fetch?: typeof fetch;
+  readonly timeoutMs?: number;
+  readonly now?: () => number;
+}
+interface ClearSessionCookiesOptions {
+  readonly url: string;
+  readonly cookieName?: string;
+  readonly cookie?: CookieOptions;
+}
+declare function sessionStatus(input: Request | string, options: SessionStatusOptions): Promise<SessionStatus>;
+declare function clearSessionCookies<R extends Response>(request: Request, response: R, options: ClearSessionCookiesOptions): R;
+//#endregion
+export { sessionStatus as a, RefreshOutcome as c, clearSessionCookies as i, refreshSession as l, SessionStatus as n, authContext as o, SessionStatusOptions as r, RefreshOptions as s, ClearSessionCookiesOptions as t };

package/dist/entitlements-BvU5dLpW.js

@@ -0,0 +1,45 @@
+import { t as AsyncResult } from "./result-BlgnMB0H.js";
+import { j as run, o as blockCall } from "./block-helpers-CfG_MvDR.js";
+import { r as withBlockHooks } from "./block-hooks-BsXncUlZ.js";
+//#region src/blocks/entitlements/entitlements.ts
+/** The Stripe event sent when a customer's active entitlements change. */
+const ENTITLEMENTS_UPDATED = "entitlements.active_entitlement_summary.updated";
+function stripeCustomerOf(payload) {
+	if (typeof payload !== "object" || payload === null) return;
+	const customer = (payload.data?.object)?.customer;
+	if (typeof customer === "string") return customer;
+	const id = customer?.id;
+	return typeof id === "string" ? id : void 0;
+}
+/**
+* Users whose `memberships` claim carries the entitlements of the Stripe
+* customer in an `entitlements.active_entitlement_summary.updated` event, so
+* a job can invalidate their sessions. Empty for other payloads.
+*/
+function entitlementMembers(sql, payload) {
+	const customer = stripeCustomerOf(payload);
+	if (customer === void 0) return AsyncResult.ok([]);
+	return run(() => sql.queryRaw("select user_id from better_supabase.entitlement_members($1) as user_id", [customer])).map((rows) => rows.map((row) => row.user_id));
+}
+/**
+* Reads the caller's entitlements through the `entitlements` module's
+* `has_entitlement` and `entitlement_value`, which check membership.
+*/
+function createEntitlements(options) {
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	return withBlockHooks({
+		has: (organizationId, key) => call("has_entitlement", {
+			tenant: organizationId,
+			key
+		}, (value) => value === true),
+		value: (organizationId, key) => call("entitlement_value", {
+			tenant: organizationId,
+			key
+		}, (value) => value === null ? void 0 : value)
+	}, options.hooks, {
+		block: "entitlements",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+//#endregion
+export { createEntitlements as n, entitlementMembers as r, ENTITLEMENTS_UPDATED as t };

package/dist/entitlements-CbzCKalR.d.ts

@@ -0,0 +1,53 @@
+import { t as AuthSnapshot } from "./bind-a7sUgvf4.js";
+import { t as AuthSession } from "./view-Dv0A949a.js";
+//#region src/auth/entitlements.d.ts
+/**
+ * One entry of the `memberships` claim when a hook writes it as a list.
+ * Hooks strip `null`s, so optional fields are absent rather than `null`.
+ */
+interface MembershipClaim {
+  /** The scope the membership is in, e.g. `tenant` or `organization`. */
+  readonly scope: string;
+  readonly id: string;
+  /** Parent scopes, e.g. `{ organization: '...' }` for a project membership. */
+  readonly within?: Readonly<Record<string, string>>;
+  readonly roles: readonly string[];
+  readonly via?: string;
+  /** Unix seconds. */
+  readonly expiresAt?: number;
+  readonly grantedBy?: string;
+  readonly reason?: string;
+  readonly member?: {
+    readonly group: string;
+  };
+  readonly managedBy?: "idp";
+  /** Seats, not plan features: those are in the `features` claim. */
+  readonly entitlements?: readonly string[];
+}
+/**
+ * Entitlement keys of the `features` claim: the literal union when
+ * `betterSupabase.claims(schema)` declares one (`z.enum([...])`), otherwise `string`.
+ */
+type EntitlementKey<C> = C extends {
+  readonly features?: infer F;
+} ? NonNullable<F> extends Readonly<Record<string, readonly (infer K)[]>> ? K extends string ? K : string : string : string;
+/** Where `hasEntitlement` reads the features claim, and its short codes. */
+interface EntitlementClaimOptions {
+  /** `config.claims.features`, default `features`. */
+  readonly claim?: string;
+  /** `entitlements.claim.keys`: the short code written for each feature key. */
+  readonly keys?: Readonly<Record<string, string>>;
+}
+/**
+ * Whether the session's plan-features claim grants `key` in `tenantId`.
+ * `claim` is `config.claims.features` (default `features`), the claim
+ * `better_supabase.feature_claims()` fills, or `{ claim, keys }` when
+ * `entitlements.claim.keys` writes short codes. The claim is as fresh as the
+ * token: enforce it in RLS with `better_supabase.has_entitlement()`, and
+ * refresh the session after checkout. A tenant left out by
+ * `entitlements.claim.maxTenants` reads as not granted. Takes a server
+ * session or the client's `useAuth()` snapshot.
+ */
+declare function hasEntitlement<C>(session: AuthSession<C> | AuthSnapshot, tenantId: string, key: EntitlementKey<C>, claim?: string | EntitlementClaimOptions): boolean;
+//#endregion
+export { hasEntitlement as i, EntitlementKey as n, MembershipClaim as r, EntitlementClaimOptions as t };

package/dist/env/index.d.ts

@@ -1,2 +1,2 @@
-import { a as EnvResult, c as InlineJwks, d as loadEnv, f as parseEnv, i as EnvOptions, l as PublicEnv, m as toServerEnv, n as ENV_VARIABLES, o as EnvSource, p as publicEnv, r as EnvIssue, s as EnvValidationError, t as BetterSupabaseEnv, u as envSchema } from "../index-BUK7jUzR.js";
+import { a as EnvResult, c as InlineJwks, d as loadEnv, f as parseEnv, i as EnvOptions, l as PublicEnv, m as toServerEnv, n as ENV_VARIABLES, o as EnvSource, p as publicEnv, r as EnvIssue, s as EnvValidationError, t as BetterSupabaseEnv, u as envSchema } from "../index-CETRk4YO.js";
 export { BetterSupabaseEnv, ENV_VARIABLES, EnvIssue, EnvOptions, EnvResult, EnvSource, EnvValidationError, InlineJwks, PublicEnv, envSchema, loadEnv, parseEnv, publicEnv, toServerEnv };

package/dist/env/index.js

@@ -36,7 +36,7 @@ function first(source, names) {
 /** `SUPABASE_*_KEYS` JSON objects, as `@supabase/server` reads them. */
 function keySet(source, name, kind, issues) {
 	const raw = source[name];
-	if (!raw) return void 0;
+	if (!raw) return;
 	let parsed;
 	try {
 		parsed = JSON.parse(raw);
@@ -56,7 +56,7 @@ function keySet(source, name, kind, issues) {
 	return keys;
 }
 function preferred(keys) {
-	if (!keys) return void 0;
+	if (!keys) return;
 	return keys["default"] ?? Object.values(keys)[0];
 }
 function isJwk(value) {
@@ -129,7 +129,7 @@ function checkKey(value, kind, variables, issues) {
 */
 function parseEnv(source, options = {}) {
 	const issues = [];
-	const required = new Set(options.require ?? []);
+	const required = new Set(options.require);
 	const rawUrl = first(source, ENV_VARIABLES.url);
 	const url = rawUrl ? checkUrl(rawUrl, ENV_VARIABLES.url, issues) : void 0;
 	if (!rawUrl) issues.push({