better-supabase 0.9.0 → 0.10.0

package/dist/create/lite/index.d.ts

@@ -0,0 +1,85 @@
+import { t as PresetMigrationFile } from "../../types-DGHfTW8_.js";
+//#region src/lite/runtime.d.ts
+/**
+ * The parts of `@supabase/lite` that `liteStack()` uses, typed
+ * structurally so the optional peer stays out of the published types.
+ */
+interface LiteConnection {
+  createMigrator(sql: string): {
+    migrate(): Promise<unknown>;
+  };
+  translateDdl(sql: string): Promise<unknown>;
+  transaction(statements: string[]): Promise<void>;
+  close(): Promise<void>;
+}
+interface PgliteConnection extends LiteConnection {
+  /** The PGlite instance: `exec` runs several statements, `query` returns `{ rows }`. */
+  readonly driver: {
+    exec(sql: string): Promise<unknown>;
+    query(sql: string): Promise<{
+      rows: unknown[];
+    }>;
+  };
+}
+interface LiteAppConfig {
+  readonly connection: LiteConnection;
+  readonly auth: {
+    readonly enabled: boolean;
+    readonly jwt_secret: string;
+    readonly publishable_key?: string;
+    readonly secret_key?: string;
+  };
+}
+interface LiteApp {
+  init(): Promise<unknown>;
+  fetch(request: Request): Promise<Response>;
+}
+interface LiteRuntime {
+  readonly App: new (config: LiteAppConfig) => LiteApp;
+  createPgliteConnection(): Promise<PgliteConnection>;
+  createSqliteConnection(url: string): Promise<LiteConnection>;
+}
+//#endregion
+//#region src/create/lite/prelude.d.ts
+/**
+ * What a Supabase project already has before the first migration runs: the
+ * API roles, the `auth` schema with `auth.users` and the JWT helpers, and a
+ * `storage.buckets` table. PGlite starts without them, so validation creates
+ * a minimal copy. It covers the columns the block SQL reads, not the full
+ * GoTrue or Storage schemas.
+ */
+export declare const SUPABASE_PRELUDE: string;
+//#endregion
+//#region src/create/lite/index.d.ts
+/** One file that failed to apply in Postgres. */
+export interface DesignIssue {
+  readonly module: string;
+  readonly path: string;
+  readonly message: string;
+}
+/** A module PGlite can't run, such as one that needs an extension it doesn't ship. */
+export interface SkippedModule {
+  readonly module: string;
+  readonly reason: string;
+}
+export interface DesignValidation {
+  /** `true` when every file that could run applied cleanly. */
+  readonly ok: boolean;
+  readonly issues: readonly DesignIssue[];
+  readonly skipped: readonly SkippedModule[];
+  /** Tables in `public` after the files applied. */
+  readonly tables: number;
+}
+export interface ValidateDesignOptions {
+  /** A loaded `@supabase/lite`; loaded on demand when left out. */
+  readonly runtime?: LiteRuntime;
+}
+/**
+ * Applies the files `previewFiles` returns to an in-memory PGlite database
+ * and reports what Postgres rejects. A module that needs an extension PGlite
+ * doesn't ship (`pgmq`, `btree_gist`) is skipped, not failed, along with its
+ * other files. pgTAP test files are left out, as in `deployQuery`. Throws when `@supabase/lite` isn't installed.
+ */
+export declare function validateDesign(files: readonly PresetMigrationFile[], options?: ValidateDesignOptions): Promise<DesignValidation>;
+//#endregion
+export {};

package/dist/create/lite/index.js

@@ -0,0 +1,126 @@
+import { n as loadLite, t as LITE_INSTALL } from "../../runtime-BOXURhEW.js";
+//#region src/create/lite/prelude.ts
+/**
+* What a Supabase project already has before the first migration runs: the
+* API roles, the `auth` schema with `auth.users` and the JWT helpers, and a
+* `storage.buckets` table. PGlite starts without them, so validation creates
+* a minimal copy. It covers the columns the block SQL reads, not the full
+* GoTrue or Storage schemas.
+*/
+const SUPABASE_PRELUDE = `
+do $$
+declare
+  role_name text;
+begin
+  foreach role_name in array array['anon', 'authenticated', 'supabase_auth_admin'] loop
+    if not exists (select 1 from pg_roles where rolname = role_name) then
+      execute format('create role %I nologin', role_name);
+    end if;
+  end loop;
+
+  if not exists (select 1 from pg_roles where rolname = 'service_role') then
+    create role service_role nologin bypassrls;
+  end if;
+end $$;
+
+create schema if not exists auth;
+create schema if not exists extensions;
+create schema if not exists storage;
+
+create table if not exists auth.users (
+  id uuid primary key default gen_random_uuid(),
+  email text,
+  phone text,
+  raw_app_meta_data jsonb default '{}',
+  raw_user_meta_data jsonb default '{}',
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  last_sign_in_at timestamptz,
+  confirmed_at timestamptz,
+  email_confirmed_at timestamptz,
+  banned_until timestamptz,
+  deleted_at timestamptz,
+  is_anonymous boolean default false,
+  role text,
+  aud text,
+  encrypted_password text
+);
+
+create or replace function auth.uid() returns uuid language sql stable as
+  $$ select nullif(current_setting('request.jwt.claim.sub', true), '')::uuid $$;
+
+create or replace function auth.jwt() returns jsonb language sql stable as
+  $$ select coalesce(nullif(current_setting('request.jwt.claims', true), ''), '{}')::jsonb $$;
+
+create or replace function auth.role() returns text language sql stable as
+  $$ select nullif(current_setting('request.jwt.claim.role', true), '') $$;
+
+create table if not exists storage.buckets (
+  id text primary key,
+  name text,
+  public boolean default false,
+  file_size_limit bigint,
+  allowed_mime_types text[]
+);
+
+create table if not exists storage.objects (
+  id uuid primary key default gen_random_uuid(),
+  bucket_id text,
+  name text,
+  owner uuid
+);
+`;
+//#endregion
+//#region src/create/lite/index.ts
+const MISSING_EXTENSION = /extension "([^"]+)" is not available/u;
+function messageOf(error) {
+	return (error instanceof Error ? error.message : String(error)).replaceAll(/\s+/gu, " ").slice(0, 300);
+}
+/**
+* Applies the files `previewFiles` returns to an in-memory PGlite database
+* and reports what Postgres rejects. A module that needs an extension PGlite
+* doesn't ship (`pgmq`, `btree_gist`) is skipped, not failed, along with its
+* other files. pgTAP test files are left out, as in `deployQuery`. Throws when `@supabase/lite` isn't installed.
+*/
+async function validateDesign(files, options = {}) {
+	const runtime = options.runtime ?? await loadLite();
+	if (runtime === void 0) throw new Error(LITE_INSTALL);
+	const connection = await runtime.createPgliteConnection();
+	try {
+		const { driver } = connection;
+		await driver.exec(SUPABASE_PRELUDE);
+		const issues = [];
+		const skipped = /* @__PURE__ */ new Map();
+		for (const file of files) {
+			if (file.path.includes("/tests/") || skipped.has(file.module)) continue;
+			try {
+				await driver.exec(file.contents);
+			} catch (error) {
+				const message = messageOf(error);
+				const extension = MISSING_EXTENSION.exec(message)?.[1];
+				if (extension === void 0) issues.push({
+					module: file.module,
+					path: file.path,
+					message
+				});
+				else skipped.set(file.module, `Needs the ${extension} extension, which PGlite doesn't ship.`);
+			}
+		}
+		const { rows } = await driver.query("select count(*)::int as count from pg_tables where schemaname = 'public'");
+		const [row] = rows;
+		const tables = typeof row === "object" && row !== null && "count" in row ? Number(row.count) : 0;
+		return {
+			ok: issues.length === 0,
+			issues,
+			skipped: [...skipped].map(([module, reason]) => ({
+				module,
+				reason
+			})),
+			tables
+		};
+	} finally {
+		await connection.close();
+	}
+}
+//#endregion
+export { SUPABASE_PRELUDE, validateDesign };

package/dist/create/supabase/index.d.ts

@@ -0,0 +1,68 @@
+import { a as SupabaseLint, c as isProjectRef, i as SmartRegion, l as managementClient, n as ManagementError, o as SupabaseOrganization, r as SMART_REGIONS, s as SupabaseProject, t as ManagementClient } from "../../management-D1gG89z2.js";
+//#region src/create/supabase/oauth.d.ts
+export declare const SUPABASE_API: string;
+/** Where the session and the in-flight authorization live. */
+export declare const COOKIE_PATH: string;
+export declare const SESSION_COOKIE = "bs_supabase";
+export declare const FLOW_COOKIE = "bs_supabase_flow";
+/** A flow cookie older than this is ignored, so a stale tab can't finish one. */
+export declare const FLOW_MAX_AGE = 600;
+/** The session cookie outlives the access token; the refresh token renews it. */
+export declare const SESSION_MAX_AGE: number;
+export interface OAuthConfig {
+  readonly clientId: string;
+  readonly clientSecret: string;
+  readonly cookieSecret: string;
+}
+export interface SupabaseSession {
+  readonly accessToken: string;
+  readonly refreshToken?: string | undefined;
+  /** Epoch milliseconds. */
+  readonly expiresAt: number;
+}
+export declare function isSession(value: unknown): value is SupabaseSession;
+export interface OAuthFlow {
+  readonly state: string;
+  readonly verifier: string;
+  readonly returnTo: string;
+}
+export declare function isFlow(value: unknown): value is OAuthFlow;
+/** `length` random bytes as base64url. */
+export declare function randomToken(length?: number): string;
+/** A PKCE verifier and its S256 challenge (RFC 7636). */
+export declare function pkcePair(): Promise<{
+  verifier: string;
+  challenge: string;
+}>;
+/** Encrypts `value` as JSON with AES-GCM: base64url of the IV, then the ciphertext. */
+export declare function seal(value: SupabaseSession | OAuthFlow, secret: string): Promise<string>;
+/** The value `seal` wrote, or `undefined` when it is missing, tampered with or another shape. */
+export declare function unseal<TValue>(sealed: string | undefined, secret: string, guard: (value: unknown) => value is TValue): Promise<TValue | undefined>;
+/**
+ * A same-site path under `/create` to return to after the consent screen,
+ * or `/create` for anything else, so the callback never redirects off site.
+ */
+export declare function returnPath(value: string | null): string;
+/** Adds `deploy=1`, which opens the deploy dialog again after the redirect. */
+export declare function withDeployFlag(path: string): string;
+export declare function authorizeUrl({ clientId, redirectUri, state, challenge }: {
+  clientId: string;
+  redirectUri: string;
+  state: string;
+  challenge: string;
+}): string;
+export declare class OAuthError extends Error {
+  override readonly name = "OAuthError";
+}
+/** Exchanges the authorization code from the callback for a session. */
+export declare function exchangeCode(config: OAuthConfig, { code, verifier, redirectUri }: {
+  code: string;
+  verifier: string;
+  redirectUri: string;
+}, fetchImpl?: typeof fetch, now?: number): Promise<SupabaseSession>;
+/** Whether the access token expires within a minute. */
+export declare function needsRefresh(session: SupabaseSession, now: number): boolean;
+/** A new session from the refresh token; it keeps the old refresh token when Supabase sends none. */
+export declare function refreshSession(config: OAuthConfig, session: SupabaseSession, fetchImpl?: typeof fetch, now?: number): Promise<SupabaseSession>;
+//#endregion
+export { ManagementClient, ManagementError, SMART_REGIONS, SmartRegion, SupabaseLint, SupabaseOrganization, SupabaseProject, isProjectRef, managementClient };

package/dist/create/supabase/index.js

@@ -0,0 +1,312 @@
+//#region src/create/supabase/guards.ts
+/** A plain JSON object. */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function arrayOf(read) {
+	return (value) => {
+		if (!Array.isArray(value)) return;
+		const items = [];
+		for (const item of value) {
+			const parsed = read(item);
+			if (parsed === void 0) return;
+			items.push(parsed);
+		}
+		return items;
+	};
+}
+//#endregion
+//#region src/create/supabase/oauth.ts
+const SUPABASE_API = "https://api.supabase.com";
+/** Where the session and the in-flight authorization live. */
+const COOKIE_PATH = "/create/supabase";
+const SESSION_COOKIE = "bs_supabase";
+const FLOW_COOKIE = "bs_supabase_flow";
+/** A flow cookie older than this is ignored, so a stale tab can't finish one. */
+const FLOW_MAX_AGE = 600;
+/** The session cookie outlives the access token; the refresh token renews it. */
+const SESSION_MAX_AGE = 604800;
+function isSession(value) {
+	return isRecord(value) && typeof value["accessToken"] === "string" && (value["refreshToken"] === void 0 || typeof value["refreshToken"] === "string") && typeof value["expiresAt"] === "number";
+}
+function isFlow(value) {
+	return isRecord(value) && typeof value["state"] === "string" && typeof value["verifier"] === "string" && typeof value["returnTo"] === "string";
+}
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+function fromBase64url(value) {
+	const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/"));
+	const bytes = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
+	return bytes;
+}
+/** `length` random bytes as base64url. */
+function randomToken(length = 32) {
+	return base64url(crypto.getRandomValues(new Uint8Array(length)));
+}
+/** A PKCE verifier and its S256 challenge (RFC 7636). */
+async function pkcePair() {
+	const verifier = randomToken(32);
+	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(verifier));
+	return {
+		verifier,
+		challenge: base64url(new Uint8Array(digest))
+	};
+}
+async function cookieKey(secret) {
+	const material = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: /* @__PURE__ */ new Uint8Array(0),
+		info: encoder.encode("better-supabase create session")
+	}, material, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+/** Encrypts `value` as JSON with AES-GCM: base64url of the IV, then the ciphertext. */
+async function seal(value, secret) {
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const cipher = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, await cookieKey(secret), encoder.encode(JSON.stringify(value)));
+	const sealed = new Uint8Array(iv.length + cipher.byteLength);
+	sealed.set(iv);
+	sealed.set(new Uint8Array(cipher), iv.length);
+	return base64url(sealed);
+}
+/** The value `seal` wrote, or `undefined` when it is missing, tampered with or another shape. */
+async function unseal(sealed, secret, guard) {
+	if (sealed === void 0 || sealed === "") return;
+	try {
+		const bytes = fromBase64url(sealed);
+		const plain = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: bytes.slice(0, 12)
+		}, await cookieKey(secret), bytes.slice(12));
+		const parsed = JSON.parse(decoder.decode(plain));
+		return guard(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* A same-site path under `/create` to return to after the consent screen,
+* or `/create` for anything else, so the callback never redirects off site.
+*/
+function returnPath(value) {
+	if (value === null) return "/create";
+	try {
+		const url = new URL(value, "https://create.invalid");
+		if (url.origin !== "https://create.invalid" || url.pathname !== "/create" && !url.pathname.startsWith("/create/")) return "/create";
+		return `${url.pathname}${url.search}`;
+	} catch {
+		return "/create";
+	}
+}
+/** Adds `deploy=1`, which opens the deploy dialog again after the redirect. */
+function withDeployFlag(path) {
+	const url = new URL(path, "https://create.invalid");
+	url.searchParams.set("deploy", "1");
+	return `${url.pathname}${url.search}`;
+}
+function authorizeUrl({ clientId, redirectUri, state, challenge }) {
+	const url = new URL("/v1/oauth/authorize", SUPABASE_API);
+	url.search = new URLSearchParams({
+		client_id: clientId,
+		redirect_uri: redirectUri,
+		response_type: "code",
+		state,
+		code_challenge: challenge,
+		code_challenge_method: "S256"
+	}).toString();
+	return url.toString();
+}
+var OAuthError = class extends Error {
+	name = "OAuthError";
+};
+async function tokenRequest(config, body, fetchImpl, now) {
+	const response = await fetchImpl(new URL("/v1/oauth/token", SUPABASE_API), {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			Accept: "application/json",
+			Authorization: `Basic ${btoa(`${config.clientId}:${config.clientSecret}`)}`
+		},
+		body: new URLSearchParams(body)
+	});
+	if (!response.ok) throw new OAuthError(`Supabase refused the token request (${String(response.status)}).`);
+	const payload = await response.json();
+	if (!isRecord(payload) || typeof payload["access_token"] !== "string" || typeof payload["expires_in"] !== "number" || payload["refresh_token"] !== void 0 && typeof payload["refresh_token"] !== "string") throw new OAuthError("Supabase sent a token response without a token.");
+	return {
+		accessToken: payload["access_token"],
+		refreshToken: payload["refresh_token"],
+		expiresAt: now + payload["expires_in"] * 1e3
+	};
+}
+/** Exchanges the authorization code from the callback for a session. */
+function exchangeCode(config, { code, verifier, redirectUri }, fetchImpl = fetch, now = Date.now()) {
+	return tokenRequest(config, {
+		grant_type: "authorization_code",
+		code,
+		code_verifier: verifier,
+		redirect_uri: redirectUri
+	}, fetchImpl, now);
+}
+/** Whether the access token expires within a minute. */
+function needsRefresh(session, now) {
+	return session.expiresAt - 6e4 <= now;
+}
+/** A new session from the refresh token; it keeps the old refresh token when Supabase sends none. */
+async function refreshSession(config, session, fetchImpl = fetch, now = Date.now()) {
+	if (session.refreshToken === void 0) throw new OAuthError("The Supabase session expired. Connect again.");
+	const next = await tokenRequest(config, {
+		grant_type: "refresh_token",
+		refresh_token: session.refreshToken
+	}, fetchImpl, now);
+	return {
+		...next,
+		refreshToken: next.refreshToken ?? session.refreshToken
+	};
+}
+//#endregion
+//#region src/create/supabase/management.ts
+const SMART_REGIONS = [
+	"americas",
+	"emea",
+	"apac"
+];
+/** A Supabase project ref: lowercase letters and digits, never a path. */
+function isProjectRef(value) {
+	return /^[a-z0-9]{1,64}$/u.test(value);
+}
+function text(record, key) {
+	const value = record[key];
+	return typeof value === "string" ? value : void 0;
+}
+const readOrganization = (value) => {
+	if (!isRecord(value)) return;
+	const id = text(value, "id");
+	const slug = text(value, "slug");
+	const name = text(value, "name");
+	return id === void 0 || slug === void 0 || name === void 0 ? void 0 : {
+		id,
+		slug,
+		name
+	};
+};
+const readProject = (value) => {
+	if (!isRecord(value)) return;
+	const ref = text(value, "ref");
+	const name = text(value, "name");
+	const organization_slug = text(value, "organization_slug");
+	const region = text(value, "region");
+	const status = text(value, "status");
+	return ref === void 0 || name === void 0 || organization_slug === void 0 || region === void 0 || status === void 0 ? void 0 : {
+		ref,
+		name,
+		organization_slug,
+		region,
+		status
+	};
+};
+const readHealthy = (value) => Array.isArray(value) ? value.some((service) => isRecord(service) && service["name"] === "db" && service["healthy"] === true) : void 0;
+const readLint = (value) => {
+	if (!isRecord(value)) return;
+	const name = text(value, "name");
+	const title = text(value, "title");
+	const level = value["level"];
+	if (name === void 0 || title === void 0 || level !== "ERROR" && level !== "WARN" && level !== "INFO") return;
+	return {
+		name,
+		title,
+		level,
+		detail: text(value, "detail"),
+		remediation: text(value, "remediation")
+	};
+};
+const readLints = (value) => isRecord(value) ? arrayOf(readLint)(value["lints"]) : void 0;
+const readTableCount = (value) => {
+	if (!Array.isArray(value)) return;
+	const first = value[0];
+	if (first === void 0) return 0;
+	if (!isRecord(first)) return;
+	const count = Number(first["count"]);
+	return Number.isNaN(count) ? void 0 : count;
+};
+const readAny = () => true;
+/** A Management API call that failed; `status` is the HTTP status, 0 for a bad response. */
+var ManagementError = class extends Error {
+	name = "ManagementError";
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+const PUBLIC_TABLES = `select count(*) as count
+from pg_catalog.pg_tables
+where schemaname = 'public'`;
+/**
+* The Management API calls the deploy dialog makes, with the user's OAuth
+* access token. Responses are parsed, and every failure is a `ManagementError`.
+*/
+function managementClient(accessToken, fetchImpl = fetch) {
+	async function call(path, read, init = {}) {
+		const response = await fetchImpl(new URL(path, SUPABASE_API), {
+			method: init.method ?? "GET",
+			headers: {
+				Authorization: `Bearer ${accessToken}`,
+				Accept: "application/json",
+				"Content-Type": "application/json"
+			},
+			body: init.body === void 0 ? null : JSON.stringify(init.body)
+		});
+		const json = await response.json().catch(() => null);
+		if (!response.ok) throw new ManagementError((isRecord(json) ? text(json, "message") : void 0) ?? `Supabase answered ${String(response.status)}.`, response.status);
+		const parsed = read(json);
+		if (parsed === void 0) throw new ManagementError(`Supabase sent an unexpected response for ${path}.`, 0);
+		return parsed;
+	}
+	return {
+		organizations: () => call("/v1/organizations", arrayOf(readOrganization)),
+		projects: () => call("/v1/projects", arrayOf(readProject)),
+		createProject: (input) => call("/v1/projects", readProject, {
+			method: "POST",
+			body: {
+				name: input.name,
+				organization_slug: input.organizationSlug,
+				db_pass: input.dbPass,
+				region_selection: {
+					type: "smartGroup",
+					code: input.region
+				}
+			}
+		}),
+		project: (ref) => call(`/v1/projects/${encodeURIComponent(ref)}`, readProject),
+		databaseHealthy: async (ref) => call(`/v1/projects/${encodeURIComponent(ref)}/health?services=db`, readHealthy),
+		publicTableCount: async (ref) => call(`/v1/projects/${encodeURIComponent(ref)}/database/query/read-only`, readTableCount, {
+			method: "POST",
+			body: { query: PUBLIC_TABLES }
+		}),
+		applyMigration: async (ref, name, query) => {
+			await call(`/v1/projects/${encodeURIComponent(ref)}/database/migrations`, readAny, {
+				method: "POST",
+				body: {
+					name,
+					query
+				}
+			});
+		},
+		securityLints: async (ref) => call(`/v1/projects/${encodeURIComponent(ref)}/advisors/security`, readLints)
+	};
+}
+//#endregion
+export { COOKIE_PATH, FLOW_COOKIE, FLOW_MAX_AGE, ManagementError, OAuthError, SESSION_COOKIE, SESSION_MAX_AGE, SMART_REGIONS, SUPABASE_API, authorizeUrl, exchangeCode, isFlow, isProjectRef, isSession, managementClient, needsRefresh, pkcePair, randomToken, refreshSession, returnPath, seal, unseal, withDeployFlag };

package/dist/credentials/index.d.ts

@@ -1,8 +1,8 @@
 import { t as AsyncResult } from "../result-Cj3yWhjH.js";
-import { F as CredentialEventData, wt as Events } from "../events-CTreRrgP.js";
-import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-9gBq9W6k.js";
-import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-DaGGXjIw.js";
-import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-tOkPLnMB.js";
+import { F as CredentialEventData, wt as Events } from "../events-CtAHxPal.js";
+import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-CQ1SrhLa.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-NbUJygA7.js";
+import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-EnOQJWjn.js";
 //#region src/credentials/compose.d.ts
 /**
  * One provider over several: each call goes to the provider whose `name`

package/dist/credentials/index.js

@@ -1,12 +1,12 @@
 import { n as dbError } from "../errors-8i6tSICm.js";
-import { a as ok, r as err, t as AsyncResult } from "../result-BlgnMB0H.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-COkvI9t5.js";
 import { a as tenantCredentialRef, i as subjectFor, n as credentialRefInTenant, r as foreignCredentialRef } from "../provider-DKh2xFZb.js";
 import { n as event, t as defineEvents } from "../event-map-Dy2vKHai.js";
 import { n as hmacHex, r as timingSafeEqual } from "../hmac-DCud0myt.js";
-import { o as verifySharedSecret, s as verifyWebhook } from "../signatures-B41ApWXA.js";
+import { o as verifySharedSecret, s as verifyWebhook } from "../signatures-C9CGYZS1.js";
 import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-G4t1umrR.js";
-import { o as blockCall } from "../block-helpers-CfG_MvDR.js";
-import { n as revokeIfConfigured, t as credentialRouter } from "../compose-Djntdacs.js";
+import { o as blockCall } from "../block-helpers-BfVCR5Fc.js";
+import { n as revokeIfConfigured, t as credentialRouter } from "../compose-CO_cljl3.js";
 //#region src/credentials/vault.ts
 const MAX_CACHED = 256;
 const invalidRef = (message) => err(dbError("invalid_input", message, { hint: "CREDENTIAL_REF_INVALID" }));

package/dist/{cron-route-CoL-By8Z.js → cron-route-BsgbJ-g4.js}

@@ -1,6 +1,6 @@
 import { n as dbError } from "./errors-8i6tSICm.js";
 import { a as methodNotAllowed, o as problemResponse } from "./problem-pIiL3WbE.js";
-import { o as verifySharedSecret } from "./signatures-B41ApWXA.js";
+import { o as verifySharedSecret } from "./signatures-C9CGYZS1.js";
 //#region src/core/cron-route.ts
 /**
 * A `GET` or `POST` handler for a cron caller such as Vercel Cron. It throws

package/dist/{define-B2ln373W.js → define-CMcokcZz.js}

@@ -1,12 +1,12 @@
 import { r as isPlainObject, t as cloneValue } from "./clone-dN9XOL1K.js";
 import { t as DbException } from "./db-exception-CnWcYPxL.js";
 import { n as dbError } from "./errors-8i6tSICm.js";
-import { n as invalidRequest, t as builderFor } from "./build-Cx08LOT7.js";
+import { n as invalidRequest, t as builderFor } from "./build-6jmaPAgx.js";
 import { t as lookupOf } from "./lookup-BaP5bI27.js";
 import { i as or, n as column, r as not, t as and } from "./types-R6syp1el.js";
 import { c as optionalTemporal, l as provideTemporal, s as nowInstant, u as providedTemporal } from "./temporal-CB5Fpo5d.js";
 import { i as encodeValue, n as decodeScalar, r as decodeValue } from "./wire-DEY0ajW9.js";
-import { a as ok, c as withErrorMapper, r as err, s as toDbError, t as AsyncResult } from "./result-BlgnMB0H.js";
+import { a as ok, c as withErrorMapper, r as err, s as toDbError, t as AsyncResult } from "./result-COkvI9t5.js";
 import { t as invalidationTargets } from "./tables-Cb-3_VWc.js";
 import { t as vectorLiteral } from "./search-BtoWY6n_.js";
 import { t as consoleLogger } from "./logger-glM28NVN.js";
@@ -14,10 +14,10 @@ import { n as errorEvent, t as EventHub } from "./events-xbpHkcK9.js";
 import { n as isRecord, t as isList } from "./guards-6F2bCtQR.js";
 import { i as orderPlugins } from "./plugin-tfXW1-qO.js";
 import { t as simplify } from "./simplify-DDO0j0LI.js";
-import { a as postgrestExecutor, c as invalidTuning, l as tuningOf, n as StatsRecorder, o as NO_TUNING, r as recordStats, s as deadline } from "./stats-D6vkb89f.js";
-import { d as isQuerySpec, f as specTables, n as checkParams, o as isReadSet, r as containsPlaceholder, t as bindParams, u as createSpecs } from "./read-set-GEb-i0On.js";
+import { a as postgrestExecutor, c as invalidTuning, l as tuningOf, n as StatsRecorder, o as NO_TUNING, r as recordStats, s as deadline } from "./stats-CUhqw6Ev.js";
+import { d as isQuerySpec, f as specTables, n as checkParams, o as isReadSet, r as containsPlaceholder, t as bindParams, u as createSpecs } from "./read-set-PWiJfv6S.js";
 import { a as toBase64Url, t as base64ToText } from "./base64-BmeCBgGo.js";
-import { n as validate } from "./standard-B5fe2gnW.js";
+import { n as validate } from "./standard-DZmwmIhV.js";
 //#region src/core/batch.ts
 /**
 * A signal that aborts once every reader's signal has, so one reader giving