better-supabase 0.11.0 → 0.13.0

package/dist/create/lite/index.d.ts

@@ -1,8 +1,8 @@
 import { t as PresetMigrationFile } from "../../types-DGHfTW8_.js";
 //#region src/lite/runtime.d.ts
 /**
- * The parts of `@supabase/lite` that `liteStack()` uses, typed
- * structurally so the optional peer stays out of the published types.
+ * The parts of `@supabase/lite` that `liteStack()` uses, typed structurally so
+ * the optional peer stays out of the published types.
  */
 interface LiteConnection {
   createMigrator(sql: string): {
@@ -13,7 +13,10 @@ interface LiteConnection {
   close(): Promise<void>;
 }
 interface PgliteConnection extends LiteConnection {
-  /** The PGlite instance: `exec` runs several statements, `query` returns `{ rows }`. */
+  /**
+   * The PGlite instance: `exec` runs several statements, `query` returns `{
+   * rows }`.
+   */
   readonly driver: {
     exec(sql: string): Promise<unknown>;
     query(sql: string): Promise<{
@@ -42,11 +45,11 @@ interface LiteRuntime {
 //#endregion
 //#region src/create/lite/prelude.d.ts
 /**
- * What a Supabase project already has before the first migration runs: the
- * API roles, the `auth` schema with `auth.users` and the JWT helpers, and a
- * `storage.buckets` table. PGlite starts without them, so validation creates
- * a minimal copy. It covers the columns the block SQL reads, not the full
- * GoTrue or Storage schemas.
+ * What a Supabase project already has before the first migration runs: the API
+ * roles, the `auth` schema with `auth.users` and the JWT helpers, and a
+ * `storage.buckets` table. PGlite starts without them, so validation creates a
+ * minimal copy. It covers the columns the block SQL reads, not the full GoTrue
+ * or Storage schemas.
  */
 export declare const SUPABASE_PRELUDE: string;
 //#endregion
@@ -57,7 +60,10 @@ export interface DesignIssue {
   readonly path: string;
   readonly message: string;
 }
-/** A module PGlite can't run, such as one that needs an extension it doesn't ship. */
+/**
+ * A module PGlite can't run, such as one that needs an extension it doesn't
+ * ship.
+ */
 export interface SkippedModule {
   readonly module: string;
   readonly reason: string;
@@ -75,10 +81,11 @@ export interface ValidateDesignOptions {
   readonly runtime?: LiteRuntime;
 }
 /**
- * Applies the files `previewFiles` returns to an in-memory PGlite database
- * and reports what Postgres rejects. A module that needs an extension PGlite
+ * Applies the files `previewFiles` returns to an in-memory PGlite database and
+ * reports what Postgres rejects. A module that needs an extension PGlite
  * doesn't ship (`pgmq`, `btree_gist`) is skipped, not failed, along with its
- * other files. pgTAP test files are left out, as in `deployQuery`. Throws when `@supabase/lite` isn't installed.
+ * other files. pgTAP test files are left out, as in `deployQuery`. Throws when
+ * `@supabase/lite` isn't installed.
  */
 export declare function validateDesign(files: readonly PresetMigrationFile[], options?: ValidateDesignOptions): Promise<DesignValidation>;
 //#endregion

package/dist/create/lite/index.js

@@ -1,11 +1,11 @@
-import { n as loadLite, t as LITE_INSTALL } from "../../runtime-BOXURhEW.js";
+import { n as loadLite, t as LITE_INSTALL } from "../../runtime-CoKxZibd.js";
 //#region src/create/lite/prelude.ts
 /**
-* What a Supabase project already has before the first migration runs: the
-* API roles, the `auth` schema with `auth.users` and the JWT helpers, and a
-* `storage.buckets` table. PGlite starts without them, so validation creates
-* a minimal copy. It covers the columns the block SQL reads, not the full
-* GoTrue or Storage schemas.
+* What a Supabase project already has before the first migration runs: the API
+* roles, the `auth` schema with `auth.users` and the JWT helpers, and a
+* `storage.buckets` table. PGlite starts without them, so validation creates a
+* minimal copy. It covers the columns the block SQL reads, not the full GoTrue
+* or Storage schemas.
 */
 const SUPABASE_PRELUDE = `
 do $$
@@ -77,10 +77,11 @@ function messageOf(error) {
 	return (error instanceof Error ? error.message : String(error)).replaceAll(/\s+/gu, " ").slice(0, 300);
 }
 /**
-* Applies the files `previewFiles` returns to an in-memory PGlite database
-* and reports what Postgres rejects. A module that needs an extension PGlite
+* Applies the files `previewFiles` returns to an in-memory PGlite database and
+* reports what Postgres rejects. A module that needs an extension PGlite
 * doesn't ship (`pgmq`, `btree_gist`) is skipped, not failed, along with its
-* other files. pgTAP test files are left out, as in `deployQuery`. Throws when `@supabase/lite` isn't installed.
+* other files. pgTAP test files are left out, as in `deployQuery`. Throws when
+* `@supabase/lite` isn't installed.
 */
 async function validateDesign(files, options = {}) {
 	const runtime = options.runtime ?? await loadLite();

package/dist/create/oauth/index.d.ts

@@ -0,0 +1,2 @@
+import { a as isFlow, c as pkcePair, d as unseal, i as OAuthSession, l as randomToken, n as OAuthError, o as isOAuthSession, r as OAuthFlow, s as needsRefresh, t as DEFAULT_SEAL_INFO, u as seal } from "../../index-X2fkPUwb.js";
+export { DEFAULT_SEAL_INFO, OAuthError, OAuthFlow, OAuthSession, isFlow, isOAuthSession, needsRefresh, pkcePair, randomToken, seal, unseal };

package/dist/create/oauth/index.js

@@ -0,0 +1,101 @@
+//#region src/create/oauth/index.ts
+/**
+* OAuth helpers for any provider: PKCE, sealed cookies and a session shape, on
+* WebCrypto only. `better-supabase/create/supabase` builds the Supabase flow on
+* them; another provider, such as a deploy target, can reuse them.
+*/
+/**
+* The HKDF info `seal` and `unseal` use when none is given; cookies sealed with
+* it keep opening.
+*/
+const DEFAULT_SEAL_INFO = "better-supabase create session";
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isOAuthSession(value) {
+	return isRecord(value) && typeof value["accessToken"] === "string" && (value["refreshToken"] === void 0 || typeof value["refreshToken"] === "string") && typeof value["expiresAt"] === "number";
+}
+function isFlow(value) {
+	return isRecord(value) && typeof value["state"] === "string" && typeof value["verifier"] === "string" && typeof value["returnTo"] === "string";
+}
+var OAuthError = class extends Error {
+	name = "OAuthError";
+};
+/** Whether the access token expires within a minute. */
+function needsRefresh(session, now) {
+	return session.expiresAt - 6e4 <= now;
+}
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/[=]+$/u, "");
+}
+function fromBase64url(value) {
+	const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/"));
+	const bytes = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
+	return bytes;
+}
+/** `length` random bytes as base64url. */
+function randomToken(length = 32) {
+	return base64url(crypto.getRandomValues(new Uint8Array(length)));
+}
+/** A PKCE verifier and its S256 challenge (RFC 7636). */
+async function pkcePair() {
+	const verifier = randomToken(32);
+	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(verifier));
+	return {
+		verifier,
+		challenge: base64url(new Uint8Array(digest))
+	};
+}
+async function cookieKey(secret, info) {
+	const material = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: /* @__PURE__ */ new Uint8Array(0),
+		info: encoder.encode(info)
+	}, material, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+/**
+* Encrypts `value` as JSON with AES-GCM: base64url of the IV, then the
+* ciphertext. The key comes from `secret` through HKDF with `info`; give each
+* cookie its own `info` so one can't be swapped for another.
+*/
+async function seal(value, secret, info = DEFAULT_SEAL_INFO) {
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const cipher = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, await cookieKey(secret, info), encoder.encode(JSON.stringify(value)));
+	const sealed = new Uint8Array(iv.length + cipher.byteLength);
+	sealed.set(iv);
+	sealed.set(new Uint8Array(cipher), iv.length);
+	return base64url(sealed);
+}
+/**
+* The value `seal` wrote with the same `secret` and `info`, or `undefined` when
+* it is missing, tampered with or another shape.
+*/
+async function unseal(sealed, secret, guard, info = DEFAULT_SEAL_INFO) {
+	if (sealed === void 0 || sealed === "") return;
+	try {
+		const bytes = fromBase64url(sealed);
+		const plain = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: bytes.slice(0, 12)
+		}, await cookieKey(secret, info), bytes.slice(12));
+		const parsed = JSON.parse(decoder.decode(plain));
+		return guard(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { DEFAULT_SEAL_INFO, OAuthError, isFlow, isOAuthSession, needsRefresh, pkcePair, randomToken, seal, unseal };

package/dist/create/supabase/index.d.ts

@@ -1,4 +1,5 @@
-import { a as SupabaseLint, c as isProjectRef, i as SmartRegion, l as managementClient, n as ManagementError, o as SupabaseOrganization, r as SMART_REGIONS, s as SupabaseProject, t as ManagementClient } from "../../management-D1gG89z2.js";
+import { a as SupabaseLint, c as isProjectRef, i as SmartRegion, l as managementClient, n as ManagementError, o as SupabaseOrganization, r as SMART_REGIONS, s as SupabaseProject, t as ManagementClient } from "../../management-wtecfrNf.js";
+import { a as isFlow, c as pkcePair, d as unseal, i as OAuthSession, l as randomToken, n as OAuthError, o as isOAuthSession, r as OAuthFlow, s as needsRefresh, t as DEFAULT_SEAL_INFO, u as seal } from "../../index-X2fkPUwb.js";
 //#region src/create/supabase/oauth.d.ts
 export declare const SUPABASE_API: string;
 /** Where the session and the in-flight authorization live. */
@@ -14,33 +15,13 @@ export interface OAuthConfig {
   readonly clientSecret: string;
   readonly cookieSecret: string;
 }
-export interface SupabaseSession {
-  readonly accessToken: string;
-  readonly refreshToken?: string | undefined;
-  /** Epoch milliseconds. */
-  readonly expiresAt: number;
-}
-export declare function isSession(value: unknown): value is SupabaseSession;
-export interface OAuthFlow {
-  readonly state: string;
-  readonly verifier: string;
-  readonly returnTo: string;
-}
-export declare function isFlow(value: unknown): value is OAuthFlow;
-/** `length` random bytes as base64url. */
-export declare function randomToken(length?: number): string;
-/** A PKCE verifier and its S256 challenge (RFC 7636). */
-export declare function pkcePair(): Promise<{
-  verifier: string;
-  challenge: string;
-}>;
-/** Encrypts `value` as JSON with AES-GCM: base64url of the IV, then the ciphertext. */
-export declare function seal(value: object, secret: string): Promise<string>;
-/** The value `seal` wrote, or `undefined` when it is missing, tampered with or another shape. */
-export declare function unseal<TValue>(sealed: string | undefined, secret: string, guard: (value: unknown) => value is TValue): Promise<TValue | undefined>;
+/** A Supabase OAuth session; the same shape as `OAuthSession`. */
+export type SupabaseSession = OAuthSession;
+/** `isOAuthSession`, under its Supabase name. */
+export declare const isSession: (value: unknown) => value is SupabaseSession;
 /**
- * A same-site path under `/create` to return to after the consent screen,
- * or `/create` for anything else, so the callback never redirects off site.
+ * A same-site path under `/create` to return to after the consent screen, or
+ * `/create` for anything else, so the callback never redirects off site.
  */
 export declare function returnPath(value: string | null): string;
 /** Adds `deploy=1`, which opens the deploy dialog again after the redirect. */
@@ -51,18 +32,16 @@ export declare function authorizeUrl({ clientId, redirectUri, state, challenge }
   state: string;
   challenge: string;
 }): string;
-export declare class OAuthError extends Error {
-  override readonly name = "OAuthError";
-}
 /** Exchanges the authorization code from the callback for a session. */
 export declare function exchangeCode(config: OAuthConfig, { code, verifier, redirectUri }: {
   code: string;
   verifier: string;
   redirectUri: string;
 }, fetchImpl?: typeof fetch, now?: number): Promise<SupabaseSession>;
-/** Whether the access token expires within a minute. */
-export declare function needsRefresh(session: SupabaseSession, now: number): boolean;
-/** A new session from the refresh token; it keeps the old refresh token when Supabase sends none. */
+/**
+ * A new session from the refresh token; it keeps the old refresh token when
+ * Supabase sends none.
+ */
 export declare function refreshSession(config: OAuthConfig, session: SupabaseSession, fetchImpl?: typeof fetch, now?: number): Promise<SupabaseSession>;
 //#endregion
-export { ManagementClient, ManagementError, SMART_REGIONS, SmartRegion, SupabaseLint, SupabaseOrganization, SupabaseProject, isProjectRef, managementClient };
+export { DEFAULT_SEAL_INFO, ManagementClient, ManagementError, OAuthError, type OAuthFlow, type OAuthSession, SMART_REGIONS, SmartRegion, SupabaseLint, SupabaseOrganization, SupabaseProject, isFlow, isOAuthSession, isProjectRef, managementClient, needsRefresh, pkcePair, randomToken, seal, unseal };

package/dist/create/supabase/index.js

@@ -1,3 +1,4 @@
+import { DEFAULT_SEAL_INFO, OAuthError, isFlow, isOAuthSession, needsRefresh, pkcePair, randomToken, seal, unseal } from "../oauth/index.js";
 //#region src/create/supabase/guards.ts
 /** A plain JSON object. */
 function isRecord(value) {
@@ -26,80 +27,11 @@ const FLOW_COOKIE = "bs_supabase_flow";
 const FLOW_MAX_AGE = 600;
 /** The session cookie outlives the access token; the refresh token renews it. */
 const SESSION_MAX_AGE = 604800;
-function isSession(value) {
-	return isRecord(value) && typeof value["accessToken"] === "string" && (value["refreshToken"] === void 0 || typeof value["refreshToken"] === "string") && typeof value["expiresAt"] === "number";
-}
-function isFlow(value) {
-	return isRecord(value) && typeof value["state"] === "string" && typeof value["verifier"] === "string" && typeof value["returnTo"] === "string";
-}
-const encoder = new TextEncoder();
-const decoder = new TextDecoder();
-function base64url(bytes) {
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCodePoint(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
-}
-function fromBase64url(value) {
-	const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/"));
-	const bytes = new Uint8Array(binary.length);
-	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
-	return bytes;
-}
-/** `length` random bytes as base64url. */
-function randomToken(length = 32) {
-	return base64url(crypto.getRandomValues(new Uint8Array(length)));
-}
-/** A PKCE verifier and its S256 challenge (RFC 7636). */
-async function pkcePair() {
-	const verifier = randomToken(32);
-	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(verifier));
-	return {
-		verifier,
-		challenge: base64url(new Uint8Array(digest))
-	};
-}
-async function cookieKey(secret) {
-	const material = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveKey"]);
-	return crypto.subtle.deriveKey({
-		name: "HKDF",
-		hash: "SHA-256",
-		salt: /* @__PURE__ */ new Uint8Array(0),
-		info: encoder.encode("better-supabase create session")
-	}, material, {
-		name: "AES-GCM",
-		length: 256
-	}, false, ["encrypt", "decrypt"]);
-}
-/** Encrypts `value` as JSON with AES-GCM: base64url of the IV, then the ciphertext. */
-async function seal(value, secret) {
-	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
-	const cipher = await crypto.subtle.encrypt({
-		name: "AES-GCM",
-		iv
-	}, await cookieKey(secret), encoder.encode(JSON.stringify(value)));
-	const sealed = new Uint8Array(iv.length + cipher.byteLength);
-	sealed.set(iv);
-	sealed.set(new Uint8Array(cipher), iv.length);
-	return base64url(sealed);
-}
-/** The value `seal` wrote, or `undefined` when it is missing, tampered with or another shape. */
-async function unseal(sealed, secret, guard) {
-	if (sealed === void 0 || sealed === "") return;
-	try {
-		const bytes = fromBase64url(sealed);
-		const plain = await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv: bytes.slice(0, 12)
-		}, await cookieKey(secret), bytes.slice(12));
-		const parsed = JSON.parse(decoder.decode(plain));
-		return guard(parsed) ? parsed : void 0;
-	} catch {
-		return;
-	}
-}
+/** `isOAuthSession`, under its Supabase name. */
+const isSession = isOAuthSession;
 /**
-* A same-site path under `/create` to return to after the consent screen,
-* or `/create` for anything else, so the callback never redirects off site.
+* A same-site path under `/create` to return to after the consent screen, or
+* `/create` for anything else, so the callback never redirects off site.
 */
 function returnPath(value) {
 	if (value === null) return "/create";
@@ -129,9 +61,6 @@ function authorizeUrl({ clientId, redirectUri, state, challenge }) {
 	}).toString();
 	return url.toString();
 }
-var OAuthError = class extends Error {
-	name = "OAuthError";
-};
 async function tokenRequest(config, body, fetchImpl, now) {
 	const response = await fetchImpl(new URL("/v1/oauth/token", SUPABASE_API), {
 		method: "POST",
@@ -160,11 +89,10 @@ function exchangeCode(config, { code, verifier, redirectUri }, fetchImpl = fetch
 		redirect_uri: redirectUri
 	}, fetchImpl, now);
 }
-/** Whether the access token expires within a minute. */
-function needsRefresh(session, now) {
-	return session.expiresAt - 6e4 <= now;
-}
-/** A new session from the refresh token; it keeps the old refresh token when Supabase sends none. */
+/**
+* A new session from the refresh token; it keeps the old refresh token when
+* Supabase sends none.
+*/
 async function refreshSession(config, session, fetchImpl = fetch, now = Date.now()) {
 	if (session.refreshToken === void 0) throw new OAuthError("The Supabase session expired. Connect again.");
 	const next = await tokenRequest(config, {
@@ -242,7 +170,10 @@ const readTableCount = (value) => {
 	return Number.isNaN(count) ? void 0 : count;
 };
 const readAny = () => true;
-/** A Management API call that failed; `status` is the HTTP status, 0 for a bad response. */
+/**
+* A Management API call that failed; `status` is the HTTP status, 0 for a bad
+* response.
+*/
 var ManagementError = class extends Error {
 	name = "ManagementError";
 	status;
@@ -256,7 +187,8 @@ from pg_catalog.pg_tables
 where schemaname = 'public'`;
 /**
 * The Management API calls the deploy dialog makes, with the user's OAuth
-* access token. Responses are parsed, and every failure is a `ManagementError`.
+* access token. Responses are parsed, and every failure is a
+* `ManagementError`.
 */
 function managementClient(accessToken, fetchImpl = fetch) {
 	async function call(path, read, init = {}) {
@@ -309,4 +241,4 @@ function managementClient(accessToken, fetchImpl = fetch) {
 	};
 }
 //#endregion
-export { COOKIE_PATH, FLOW_COOKIE, FLOW_MAX_AGE, ManagementError, OAuthError, SESSION_COOKIE, SESSION_MAX_AGE, SMART_REGIONS, SUPABASE_API, authorizeUrl, exchangeCode, isFlow, isProjectRef, isSession, managementClient, needsRefresh, pkcePair, randomToken, refreshSession, returnPath, seal, unseal, withDeployFlag };
+export { COOKIE_PATH, DEFAULT_SEAL_INFO, FLOW_COOKIE, FLOW_MAX_AGE, ManagementError, OAuthError, SESSION_COOKIE, SESSION_MAX_AGE, SMART_REGIONS, SUPABASE_API, authorizeUrl, exchangeCode, isFlow, isOAuthSession, isProjectRef, isSession, managementClient, needsRefresh, pkcePair, randomToken, refreshSession, returnPath, seal, unseal, withDeployFlag };

package/dist/credentials/index.d.ts

@@ -1,14 +1,14 @@
-import { t as AsyncResult } from "../result-BREt7qOh.js";
-import { F as CredentialEventData, wt as Events } from "../events-P3raDX2E.js";
-import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-CNs0Jx0I.js";
-import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-DezJPPA0.js";
-import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-DR2-zOjz.js";
+import { t as AsyncResult } from "../result-mijqfoJN.js";
+import { F as CredentialEventData, wt as Events } from "../events-DhGgwqQA.js";
+import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-Dmsbl8ug.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-DBPhgF3W.js";
+import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-BQThkbws.js";
 //#region src/credentials/compose.d.ts
 /**
- * One provider over several: each call goes to the provider whose `name`
- * is the ref's `provider`. A ref no provider handles fails with
- * `invalid_input` (`CREDENTIAL_PROVIDER_UNKNOWN`), and an optional method
- * the chosen provider lacks with `unsupported`.
+ * One provider over several: each call goes to the provider whose `name` is the
+ * ref's `provider`. A ref no provider handles fails with `invalid_input`
+ * (`CREDENTIAL_PROVIDER_UNKNOWN`), and an optional method the chosen provider
+ * lacks with `unsupported`.
  */
 export declare function credentialRouter(providers: readonly CredentialProvider[], options?: {
   readonly name?: string;
@@ -16,9 +16,9 @@ export declare function credentialRouter(providers: readonly CredentialProvider[
 interface RevokeIfConfiguredOptions {
   readonly subject: CredentialSubject;
   /**
-   * The tenant of the row that holds the ref, or `undefined` for an
-   * app-level row. When the key is present, a ref outside that tenant is
-   * left alone, so a row can never revoke another tenant's credential.
+   * The tenant of the row that holds the ref, or `undefined` for an app-level
+   * row. When the key is present, a ref outside that tenant is left alone, so a
+   * row can never revoke another tenant's credential.
    */
   readonly tenant?: string | undefined;
 }

package/dist/credentials/index.js

@@ -1,12 +1,12 @@
-import { n as dbError } from "../errors-BV1SKTVs.js";
-import { a as ok, r as err, t as AsyncResult } from "../result-DIeYscA3.js";
-import { a as tenantCredentialRef, i as subjectFor, n as credentialRefInTenant, r as foreignCredentialRef } from "../provider-C-Ti38J6.js";
-import { n as event, t as defineEvents } from "../event-map-Dy2vKHai.js";
-import { n as hmacHex, r as timingSafeEqual } from "../hmac-BgpThYQW.js";
-import { o as verifySharedSecret, s as verifyWebhook } from "../signatures-CeIoAelK.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-J7ZepTq2.js";
-import { o as blockCall } from "../block-helpers-DkVZNDrj.js";
-import { n as revokeIfConfigured, t as credentialRouter } from "../compose-CP0ss-cQ.js";
+import { n as dbError } from "../errors-D7u24ZJH.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-DIT_qp4G.js";
+import { a as tenantCredentialRef, i as subjectFor, n as credentialRefInTenant, r as foreignCredentialRef } from "../provider-BhIkKBOh.js";
+import { n as event, t as defineEvents } from "../event-map-CtPFhcOp.js";
+import { n as hmacHex, r as timingSafeEqual } from "../hmac-B3CTTlfv.js";
+import { o as verifySharedSecret, s as verifyWebhook } from "../signatures-D8IoN3Rw.js";
+import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-Ds0C2mUf.js";
+import { o as blockCall } from "../block-helpers-DwE32_gT.js";
+import { n as revokeIfConfigured, t as credentialRouter } from "../compose-VBQL7zIO.js";
 //#region src/credentials/vault.ts
 const MAX_CACHED = 256;
 const invalidRef = (message) => err(dbError("invalid_input", message, { hint: "CREDENTIAL_REF_INVALID" }));
@@ -68,10 +68,10 @@ async function verifyWith(ref, scheme, request, secret) {
 	}
 }
 /**
-* A `CredentialProvider` over the `credentials` SQL module: tokens and API
-* keys in Supabase Vault, read through security definer functions only the
-* service role may call. Static secrets only; OAuth connections come from
-* a provider such as `better-supabase/vercel-connect`.
+* A `CredentialProvider` over the `credentials` SQL module: tokens and API keys
+* in Supabase Vault, read through security definer functions only the service
+* role may call. Static secrets only; OAuth connections come from a provider
+* such as `better-supabase/vercel-connect`.
 */
 function vaultCredentials(options) {
 	const call = blockCall(options.transport, options.schema ?? "better_supabase", options.mappers);

package/dist/cron-CI1kP-t5.js

@@ -0,0 +1,148 @@
+import { t as temporal } from "./temporal-required-Dt4mcPsi.js";
+//#region src/blocks/jobs/cron.ts
+const MACROS = {
+	"@yearly": "0 0 1 1 *",
+	"@annually": "0 0 1 1 *",
+	"@monthly": "0 0 1 * *",
+	"@weekly": "0 0 * * 0",
+	"@daily": "0 0 * * *",
+	"@midnight": "0 0 * * *",
+	"@hourly": "0 * * * *"
+};
+const MONTHS = [
+	"jan",
+	"feb",
+	"mar",
+	"apr",
+	"may",
+	"jun",
+	"jul",
+	"aug",
+	"sep",
+	"oct",
+	"nov",
+	"dec"
+];
+const WEEKDAYS = [
+	"sun",
+	"mon",
+	"tue",
+	"wed",
+	"thu",
+	"fri",
+	"sat"
+];
+/** Replaces `JAN` or `MON` style names with their numbers. */
+function named(text, names, first) {
+	return text.replaceAll(/[a-z]{3}/gi, (name) => {
+		const index = names.indexOf(name.toLowerCase());
+		return index === -1 ? name : String(index + first);
+	});
+}
+const INTERVAL = /^(\d+)\s+(second|minute|hour)s?$/i;
+/** Gives up when no minute matches within this many days (`0 0 30 2 *`). */
+const SEARCH_DAYS = 1830;
+function invalid(expression, reason) {
+	return /* @__PURE__ */ new TypeError(`Invalid cron "${expression}": ${reason}`);
+}
+function field(expression, text, min, max) {
+	const values = /* @__PURE__ */ new Set();
+	for (const part of text.split(",")) {
+		const match = /^(\*|\d+(?:-\d+)?)(?:\/(\d+))?$/.exec(part);
+		if (!match) throw invalid(expression, `"${part}" is not a cron field`);
+		const [, range = "", stepText] = match;
+		const step = stepText === void 0 ? 1 : Number(stepText);
+		let from = min;
+		let to = max;
+		if (range !== "*") {
+			const [start = "", end] = range.split("-");
+			from = Number(start);
+			to = end === void 0 ? stepText === void 0 ? from : max : Number(end);
+		}
+		if (step < 1 || from < min || to > max || from > to) throw invalid(expression, `"${part}" is outside ${String(min)}-${String(max)}`);
+		for (let value = from; value <= to; value += step) values.add(value);
+	}
+	return [...values].toSorted((a, b) => a - b);
+}
+function parse(expression) {
+	const parts = (MACROS[expression.trim().toLowerCase()] ?? expression).trim().split(/\s+/);
+	if (parts.length !== 5) throw invalid(expression, "expected 5 fields (minute hour day month weekday)");
+	const [minute = "", hour = "", day = "", monthText = "", weekdayText = ""] = parts;
+	const month = named(monthText, MONTHS, 1);
+	const weekday = named(weekdayText, WEEKDAYS, 0);
+	return {
+		minutes: field(expression, minute, 0, 59),
+		hours: field(expression, hour, 0, 23),
+		days: new Set(field(expression, day, 1, 31)),
+		months: new Set(field(expression, month, 1, 12)),
+		weekdays: new Set(field(expression, weekday, 0, 7).map((value) => value === 0 ? 7 : value)),
+		daysRestricted: day !== "*",
+		weekdaysRestricted: weekday !== "*"
+	};
+}
+function dayMatches(fields, date) {
+	if (!fields.months.has(date.month)) return false;
+	const day = fields.days.has(date.day);
+	const weekday = fields.weekdays.has(date.dayOfWeek);
+	if (fields.daysRestricted && fields.weekdaysRestricted) return day || weekday;
+	if (fields.daysRestricted) return day;
+	if (fields.weekdaysRestricted) return weekday;
+	return true;
+}
+/**
+* The first matching minute of `date` after `after`, from `start` on its first
+* day.
+*/
+function firstRunOn(fields, date, start, timeZone, after) {
+	for (const hour of fields.hours) {
+		if (start && hour < start.hour) continue;
+		for (const minute of fields.minutes) {
+			if (hour === start?.hour && minute < start.minute) continue;
+			const instant = date.toPlainDateTime({
+				hour,
+				minute
+			}).toZonedDateTime(timeZone, { disambiguation: "compatible" }).toInstant();
+			if (temporal().Instant.compare(instant, after) > 0) return instant;
+		}
+	}
+}
+/**
+* Throws a `TypeError` unless `expression` is a schedule `nextCronRun`
+* understands: five cron fields, a macro such as `@daily`, or an interval such
+* as `30 seconds`.
+*/
+function assertCron(expression) {
+	if (!INTERVAL.test(expression.trim())) parse(expression);
+}
+/**
+* The first run of `expression` after `after`, in `timeZone`.
+*
+* Accepts five cron fields (lists, ranges and steps; a restricted day of month
+* and day of week match either, as in cron), the macros `@hourly`, `@daily`,
+* `@weekly`, `@monthly` and `@yearly`, and intervals such as `30 seconds`, `5
+* minutes` or `2 hours`, counted from `after`. A local time that a DST change
+* skips runs at the same offset after the gap.
+*/
+function nextCronRun(expression, timeZone, after) {
+	const interval = INTERVAL.exec(expression.trim());
+	if (interval) {
+		const amount = Number(interval[1]);
+		if (amount < 1) throw invalid(expression, "the interval must be positive");
+		const unit = interval[2].toLowerCase();
+		return after.add(unit === "second" ? { seconds: amount } : unit === "minute" ? { minutes: amount } : { hours: amount });
+	}
+	const fields = parse(expression);
+	const start = after.toZonedDateTimeISO(timeZone).toPlainDateTime().round({
+		smallestUnit: "minute",
+		roundingMode: "floor"
+	}).add({ minutes: 1 });
+	let date = start.toPlainDate();
+	for (let offset = 0; offset < SEARCH_DAYS; offset += 1) {
+		const found = dayMatches(fields, date) && firstRunOn(fields, date, offset === 0 ? start : void 0, timeZone, after);
+		if (found) return found;
+		date = date.add({ days: 1 });
+	}
+	throw invalid(expression, "it never matches a date");
+}
+//#endregion
+export { nextCronRun as n, assertCron as t };