better-supabase 0.11.0 → 0.13.0

package/dist/astro/index.d.ts

@@ -1,19 +1,25 @@
-import { a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
-import { t as BetterSupabase } from "../define-M_r1d2AT.js";
-import { j as StorageImageOptions } from "../index-DHReeV74.js";
-import { n as BetterServer } from "../server-types-BKN_R4Ws.js";
-import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-BeZX2pR_.js";
-import { t as RefusalRedirects } from "../refusal-CufncwaN.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-D6IFkuAg.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-DmshMaXz.js";
+import { t as BetterSupabase } from "../define-D0LSXmUP.js";
+import { M as StorageImageOptions } from "../index-CrAKHNJF.js";
+import { n as BetterServer } from "../server-types-D_cQ6OxZ.js";
+import { a as AuthorizedContext, l as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-LeQGMzLH.js";
+import { t as RefusalRedirects } from "../refusal-BEyNVFy7.js";
+import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-CMeAuJts.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/astro/index.d.ts
-/** The part of Astro's `APIContext` (middleware, pages, endpoints, actions) the integration uses. */
+/**
+ * The part of Astro's `APIContext` (middleware, pages, endpoints, actions) the
+ * integration uses.
+ */
 export interface AstroContextLike {
   readonly request: Request;
   readonly locals: object;
 }
 export interface AstroOptions extends FrameworkOptions {
-  /** The host's env object for `getEnv`; defaults to `locals.runtime.env` (Cloudflare). */
+  /**
+   * The host's env object for `getEnv`; defaults to `locals.runtime.env`
+   * (Cloudflare).
+   */
   readonly platformEnv?: (context: AstroContextLike) => unknown;
 }
 export interface BetterAstro<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> extends BetterServer<M, F, E, C, P, B> {
@@ -22,8 +28,9 @@ export interface BetterAstro<M extends AnyModels, F extends AnyFunctions, E, C =
    * navigations and form posts, and puts `db`, `bs`, `auth`, `tenant` and
    * `session` on `locals`. Response-phase entries see the page's response.
    *
-   * ```ts title="src/middleware.ts"
-   * export const onRequest = bs.onRequest
+   * ```ts
+   * // src/middleware.ts
+   * export const onRequest = bs.onRequest;
    * ```
    */
   readonly onRequest: (context: AstroContextLike, next: () => Promise<Response>) => Promise<Response>;
@@ -41,22 +48,28 @@ export interface BetterAstro<M extends AnyModels, F extends AnyFunctions, E, C =
    * ---
    * ```
    */
-  guard(context: AstroContextLike, options?: BlockRequireOptions<C, P>): Promise<Response | undefined>;
+  guard(context: AstroContextLike, options?: BlockRequireOptions<C, P, boolean, unknown, LocalsResource<M, F, E, C, P, B>>): Promise<Response | undefined>;
   /**
    * The caller, or a thrown refusal `Response`, for endpoints that return
    * whatever is thrown.
    */
-  require<R extends boolean = false>(context: AstroContextLike, options?: BlockRequireOptions<C, P, R>): Promise<FrameworkLocals<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>;
+  require<R extends boolean = false>(context: AstroContextLike, options?: BlockRequireOptions<C, P, R, unknown, LocalsResource<M, F, E, C, P, B>>): Promise<FrameworkLocals<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>;
   /**
    * The `handler` of `defineAction`, returning an `ActionResult`:
    *
-   * ```ts title="src/actions/index.ts"
+   * ```ts
+   * // src/actions/index.ts
    * export const server = {
-   *   addNote: defineAction({ accept: 'form', handler: bs.action({ input: NoteInput }, (input, { db }) => db.notes.create(input)) }),
-   * }
+   *   addNote: defineAction({
+   *     accept: "form",
+   *     handler: bs.action({ input: NoteInput }, (input, { db }) =>
+   *       db.notes.create(input),
+   *     ),
+   *   }),
+   * };
    * ```
    */
-  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: BlockActionOptions<S, C, P, R>, fn: (input: ActionParsed<S>, ctx: FrameworkLocals<M, F, E, C, P, B> & AuthorizedContext<C, P, R>) => T): (input: unknown, context: AstroContextLike) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: BlockActionOptions<S, C, P, R, unknown, LocalsResource<M, F, E, C, P, B>>, fn: (input: ActionParsed<S>, ctx: FrameworkLocals<M, F, E, C, P, B> & AuthorizedContext<C, P, R>) => T): (input: unknown, context: AstroContextLike) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
 }
 /** Astro integration: middleware, page guards and Actions. */
 export declare function createAstro<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, options?: AstroOptions): BetterAstro<M, F, E, C, P, B>;
@@ -67,7 +80,10 @@ export interface AstroImageTransform {
   };
   readonly width?: number | undefined;
   readonly height?: number | undefined;
-  /** A number, or a preset: `low`, `mid`, `high` or `max`. Other strings use the default quality. */
+  /**
+   * A number, or a preset: `low`, `mid`, `high` or `max`. Other strings use the
+   * default quality.
+   */
   readonly quality?: number | string | undefined;
 }
 /** An Astro external image service, typed structurally. */
@@ -78,8 +94,11 @@ export interface AstroImageService {
  * An external image service that renders public Storage objects through
  * Supabase image transformations; other sources pass through.
  *
- * ```ts title="src/image-service.ts"
- * export default createImageService({ url: import.meta.env.PUBLIC_SUPABASE_URL })
+ * ```ts
+ * // src/image-service.ts
+ * export default createImageService({
+ *   url: import.meta.env.PUBLIC_SUPABASE_URL,
+ * });
  * ```
  */
 export declare function createImageService(options: StorageImageOptions): AstroImageService;

package/dist/astro/index.js

@@ -1,10 +1,10 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-B2WRsRIg.js";
-import { t as defaultExpose } from "../respond-Bhp3G__q.js";
-import { i as requireCaller, o as runAction } from "../kit-LTbHrWWD.js";
-import { t as storageImageUrl } from "../image-url-pIVlO6R1.js";
-import { t as around } from "../shared-BmMcMoW9.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-Ch8bMmQY.js";
-import { r as refusalResponse } from "../refusal-CFpfmjcS.js";
+import { i as storageImageUrl } from "../image-url-_d7xYsXK.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-D8dW6p2A.js";
+import { t as defaultExpose } from "../respond-DjEmE_DN.js";
+import { i as requireCaller, o as runAction } from "../kit-BeXTrlZn.js";
+import { t as around } from "../shared-Bf-I13Ht.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-BpEnOfAo.js";
+import { r as refusalResponse } from "../refusal-Ce2p81VW.js";
 //#region src/astro/index.ts
 function runtimeEnv(locals) {
 	const runtime = "runtime" in locals ? locals.runtime : void 0;
@@ -23,7 +23,7 @@ function createAstro(betterSupabase, options = {}) {
 		const scope = scopeOf(context);
 		return {
 			scope,
-			caller: await requireCaller(scope.bs.auth, requireOptions, scope.tenant, options.authorizer)
+			caller: await requireCaller(scope.bs.auth, requireOptions, scope.tenant, options.authorizer, scope)
 		};
 	};
 	return extendServer(server, {
@@ -57,7 +57,7 @@ function createAstro(betterSupabase, options = {}) {
 				return await runAction(scope.bs.auth, actionOptions, input, scope.tenant, (parsed, caller) => fn(parsed, {
 					...scope,
 					...caller
-				}), options.authorizer);
+				}), options.authorizer, scope);
 			};
 		}
 	});
@@ -75,8 +75,11 @@ function isQualityPreset(quality) {
 * An external image service that renders public Storage objects through
 * Supabase image transformations; other sources pass through.
 *
-* ```ts title="src/image-service.ts"
-* export default createImageService({ url: import.meta.env.PUBLIC_SUPABASE_URL })
+* ```ts
+* // src/image-service.ts
+* export default createImageService({
+*   url: import.meta.env.PUBLIC_SUPABASE_URL,
+* });
 * ```
 */
 function createImageService(options) {

package/dist/asyncapi/index.d.ts

@@ -1,11 +1,14 @@
-import { c as SpecDiagnostic, r as DocumentFormat } from "../format-CNwSjXUU.js";
-import { C as ApiSource, F as EventsOptions, I as TopicInput, L as topicsFrom, M as BlockEventSchemas, N as CLOUD_EVENT_TRAIT, P as CloudEventsInput, j as BlockEventSchema, n as DefineApiOptions } from "../api-DoWK3dTw.js";
-import { t as SPEC_PINS } from "../spec-pins-Dqpml2dZ.js";
+import { t as SPEC_PINS } from "../spec-pins-CZ2CL8YZ.js";
+import { C as TopicInput, S as EventsOptions, b as CLOUD_EVENT_TRAIT, n as DefineApiOptions, u as ApiSource, v as BlockEventSchema, w as topicsFrom, x as CloudEventsInput, y as BlockEventSchemas } from "../api-DwLhJS1j.js";
+import { c as SpecDiagnostic, r as DocumentFormat } from "../format-AYHceC2m.js";
 //#region src/asyncapi/types.d.ts
 type Json = Record<string, unknown>;
 /** The AsyncAPI versions `asyncapiFormat` renders. */
 type AsyncApiVersion = "3.0" | "3.1";
-/** The file name `asyncapiFormat` writes; Arazzo source descriptions point at it. */
+/**
+ * The file name `asyncapiFormat` writes; Arazzo source descriptions point at
+ * it.
+ */
 export declare const ASYNCAPI_FILE_NAME = "asyncapi.json";
 interface AsyncApiInfo {
   readonly title: string;
@@ -62,11 +65,11 @@ type RenderedAsyncApi = { readonly [V in AsyncApiVersion]: {
 //#region src/asyncapi/format.d.ts
 /**
  * AsyncAPI as a `DocumentFormat`, for the events the API model describes:
- * Realtime table change signals and broadcast topics on the Supabase
- * Realtime websocket (`ws` bindings), CloudEvents (headers as the
- * `cloudEvent` message trait), outgoing webhooks over HTTP and the events
- * HTTP operations emit. 3.0 is the default; 3.1 only adds `ros2` bindings,
- * so the two documents differ in the `asyncapi` field.
+ * Realtime table change signals and broadcast topics on the Supabase Realtime
+ * websocket (`ws` bindings), CloudEvents (headers as the `cloudEvent` message
+ * trait), outgoing webhooks over HTTP and the events HTTP operations emit. 3.0
+ * is the default; 3.1 only adds `ros2` bindings, so the two documents differ in
+ * the `asyncapi` field.
  */
 export declare const asyncapiFormat: DocumentFormat<"asyncapi", AsyncApiVersion, AnyAsyncApiDocument, AsyncApiDocuments>;
 //#endregion
@@ -83,18 +86,21 @@ export interface AsyncApiOptions<V extends AsyncApiVersion = "3.0", Ref = string
   readonly onDiagnostic?: (diagnostic: SpecDiagnostic) => void;
 }
 /**
- * An AsyncAPI document for the app's events: Realtime table change signals
- * and broadcast topics, CloudEvents for row and block events, outgoing
- * webhooks and the events HTTP operations emit. Pass `events` (and
- * `realtimeUrl` for the websocket server). Throws when building or checking
- * the document finds an error; use `defineApi(...).render(asyncapiFormat)`
- * to read every finding instead.
+ * An AsyncAPI document for the app's events: Realtime table change signals and
+ * broadcast topics, CloudEvents for row and block events, outgoing webhooks and
+ * the events HTTP operations emit. Pass `events` (and `realtimeUrl` for the
+ * websocket server). Throws when building or checking the document finds an
+ * error; use `defineApi(...).render(asyncapiFormat)` to read every finding
+ * instead.
  *
  * ```ts
  * const doc = createAsyncApi(betterSupabase, {
  *   info: { title: "CRM events", version: "1.0.0" },
  *   realtimeUrl: "wss://example.supabase.co/realtime/v1/websocket",
- *   events: { tables: ["customers"], cloudEvents: { source: "/crm", blocks: { "support.started": true } } },
+ *   events: {
+ *     tables: ["customers"],
+ *     cloudEvents: { source: "/crm", blocks: { "support.started": true } },
+ *   },
  * });
  * ```
  */

package/dist/asyncapi/index.js

@@ -1,8 +1,8 @@
-import { r as isPlainObject } from "../clone-dN9XOL1K.js";
-import { t as SPEC_PINS } from "../spec-pins-S4PymRxp.js";
-import { o as defineDocumentFormat, t as defineApi } from "../api-C43_FYDp.js";
-import { c as pascal, i as topicsFrom, n as CLOUD_EVENT_TRAIT, r as safeKey, u as pointerToken } from "../build-CT6SPZkI.js";
-import { t as ASYNCAPI_FILE_NAME } from "../types-BRTSpOIh.js";
+import { r as isPlainObject } from "../clone-CkG0-hlI.js";
+import { t as SPEC_PINS } from "../spec-pins-D3Tm6HJi.js";
+import { o as defineDocumentFormat, t as defineApi } from "../api-CmcTYuFT.js";
+import { c as pascal, i as topicsFrom, n as CLOUD_EVENT_TRAIT, r as safeKey, u as pointerToken } from "../build-DxzJf79X.js";
+import { t as ASYNCAPI_FILE_NAME } from "../types-BTK75521.js";
 //#region src/asyncapi/format.ts
 const ASYNCAPI_FIELD = {
 	"3.0": SPEC_PINS.asyncapi30,
@@ -264,13 +264,13 @@ function lowerAsyncApi(model, version, ctx) {
 		message: "Realtime channels are described without a server; set realtimeUrl to add the Realtime websocket",
 		pointer: "/servers"
 	});
-	if (hasHttp) model.servers.forEach((entry, index) => {
+	if (hasHttp) for (const [index, entry] of model.servers.entries()) {
 		const key = safeKey(entry.name ?? (index === 0 ? "api" : `api${String(index + 1)}`));
 		const server = serverFrom(entry.url, omitUndefined({ description: entry.description }), false);
-		if (!server || key in servers) return;
+		if (!server || key in servers) continue;
 		servers[key] = server;
 		httpServers.push({ $ref: `#/servers/${key}` });
-	});
+	}
 	const messageKeys = /* @__PURE__ */ new Map();
 	const messages = {};
 	for (const [id, message] of Object.entries(allMessages)) {
@@ -512,11 +512,11 @@ function lintAsyncApi(document) {
 }
 /**
 * AsyncAPI as a `DocumentFormat`, for the events the API model describes:
-* Realtime table change signals and broadcast topics on the Supabase
-* Realtime websocket (`ws` bindings), CloudEvents (headers as the
-* `cloudEvent` message trait), outgoing webhooks over HTTP and the events
-* HTTP operations emit. 3.0 is the default; 3.1 only adds `ros2` bindings,
-* so the two documents differ in the `asyncapi` field.
+* Realtime table change signals and broadcast topics on the Supabase Realtime
+* websocket (`ws` bindings), CloudEvents (headers as the `cloudEvent` message
+* trait), outgoing webhooks over HTTP and the events HTTP operations emit. 3.0
+* is the default; 3.1 only adds `ros2` bindings, so the two documents differ in
+* the `asyncapi` field.
 */
 const asyncapiFormat = defineDocumentFormat({
 	id: "asyncapi",
@@ -538,18 +538,21 @@ const asyncapiFormat = defineDocumentFormat({
 //#endregion
 //#region src/asyncapi/index.ts
 /**
-* An AsyncAPI document for the app's events: Realtime table change signals
-* and broadcast topics, CloudEvents for row and block events, outgoing
-* webhooks and the events HTTP operations emit. Pass `events` (and
-* `realtimeUrl` for the websocket server). Throws when building or checking
-* the document finds an error; use `defineApi(...).render(asyncapiFormat)`
-* to read every finding instead.
+* An AsyncAPI document for the app's events: Realtime table change signals and
+* broadcast topics, CloudEvents for row and block events, outgoing webhooks and
+* the events HTTP operations emit. Pass `events` (and `realtimeUrl` for the
+* websocket server). Throws when building or checking the document finds an
+* error; use `defineApi(...).render(asyncapiFormat)` to read every finding
+* instead.
 *
 * ```ts
 * const doc = createAsyncApi(betterSupabase, {
 *   info: { title: "CRM events", version: "1.0.0" },
 *   realtimeUrl: "wss://example.supabase.co/realtime/v1/websocket",
-*   events: { tables: ["customers"], cloudEvents: { source: "/crm", blocks: { "support.started": true } } },
+*   events: {
+*     tables: ["customers"],
+*     cloudEvents: { source: "/crm", blocks: { "support.started": true } },
+*   },
 * });
 * ```
 */

package/dist/attachments-CPkGJVfk.js

@@ -0,0 +1,270 @@
+import { n as dbError } from "./errors-D7u24ZJH.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-DIT_qp4G.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { t as fromStorageError } from "./errors-Cq72lONT.js";
+import { C as optionalText, D as recordOf, I as textOf, R as toInstant, S as optionalInstant, f as errorText, k as recordsOf, n as applyTemporal, o as blockCall } from "./block-helpers-DwE32_gT.js";
+import { r as withBlockHooks } from "./block-hooks-C1r-R2r0.js";
+import { c as withFields, i as extraOf, n as blockFields, r as extraFieldsArg, t as allWithFields } from "./block-fields-Cwd4c8m-.js";
+import { n as claimsUploads, t as claimUpload } from "./upload-claim-DCuklVyh.js";
+//#region src/blocks/attachments/attachments.ts
+const STATUSES = [
+	"pending",
+	"clean",
+	"infected",
+	"failed"
+];
+function statusOf(value) {
+	const status = STATUSES.find((candidate) => candidate === value);
+	if (status === void 0) throw new TypeError(`Unknown attachment status ${JSON.stringify(value)}`);
+	return status;
+}
+/** An attachments row, as `get_attachment` and `create_attachment` return it. */
+function attachmentOf(value) {
+	const row = recordOf(value, "attachments");
+	return {
+		id: textOf(row["id"]),
+		organizationId: optionalText(row["organization_id"]),
+		subjectType: optionalText(row["subject_type"]),
+		subjectId: optionalText(row["subject_id"]),
+		bucket: textOf(row["bucket"]),
+		path: textOf(row["object_path"]),
+		name: textOf(row["name"]),
+		mimeType: textOf(row["mime_type"]),
+		size: Number(row["size"]),
+		status: statusOf(row["status"]),
+		scanDetail: optionalText(row["scan_detail"]),
+		metadata: isRecord(row["metadata"]) ? row["metadata"] : {},
+		uploadedBy: optionalText(row["uploaded_by"]),
+		createdAt: toInstant(textOf(row["created_at"])),
+		uploadedAt: optionalInstant(row["uploaded_at"]),
+		scannedAt: optionalInstant(row["scanned_at"])
+	};
+}
+const CLAIM_HINTS = {
+	notUploaded: "ATTACHMENT_NOT_UPLOADED",
+	forbidden: "ATTACHMENT_FORBIDDEN"
+};
+const notFound = () => dbError("not_found", "No attachment you can see has this id", { hint: "ATTACHMENT_NOT_FOUND" });
+/** A Storage reply as a result, its error mapped to a `DbError`. */
+function stored(reply) {
+	return AsyncResult.from(async () => {
+		try {
+			const { data, error } = await reply;
+			if (error) return err(fromStorageError(error, "storage.objects"));
+			if (data === null || data === void 0) return err(dbError("network", "Storage returned no data"));
+			return ok(data);
+		} catch (cause) {
+			return err(fromStorageError(cause, "storage.objects"));
+		}
+	});
+}
+/**
+* Waits for a scan from a job or an event. A scan whose target is gone (the
+* attachment row, or for an object the stored object) is done, not a failure,
+* so the job or event is not retried; every other error throws.
+*/
+async function settle(scanned, gone) {
+	const result = await scanned;
+	if (result.ok || gone(result.error)) return;
+	await scanned.orThrow();
+}
+const attachmentGone = (error) => error.kind === "not_found" && error.hint === "ATTACHMENT_NOT_FOUND";
+const objectGone = (error) => error.kind === "not_found" && error.code === "NoSuchKey";
+function lookup(call, id) {
+	return call("get_attachment", { id }, (value) => value).andThen((value) => Promise.resolve(isRecord(value) ? ok(attachmentOf(value)) : err(notFound())));
+}
+/** Attachments as the caller: the table's and the bucket's policies apply. */
+const NEW_ATTACHMENT = /* @__PURE__ */ new Set([
+	"organizationId",
+	"name",
+	"mimeType",
+	"size",
+	"subjectType",
+	"subjectId",
+	"metadata"
+]);
+function createAttachments(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const fields = blockFields(options.fields, "attachment fields");
+	const typed = (value) => AsyncResult.from(() => withFields(fields, value, attachmentOf(value)));
+	const find = (id) => call("get_attachment", { id }, (value) => value).andThen((value) => isRecord(value) ? typed(value) : AsyncResult.err(notFound()));
+	const confirmed = (id) => call("confirm_attachment", { id }, (value) => value).andThen(typed);
+	const confirm = (id) => claimsUploads(options.storage) ? lookup(call, id).andThen((attachment) => attachment.uploadedAt === void 0 ? claimUpload(options.storage, attachment, CLAIM_HINTS).andThen(() => confirmed(id)) : confirmed(id)) : confirmed(id);
+	const requireScan = options.requireScan ?? true;
+	const ttl = options.downloadTtl ?? 300;
+	const bucket = (attachment) => options.storage.from(attachment.bucket);
+	/** Why a file can't be read yet, or `undefined` once it can. */
+	const gate = (attachment) => {
+		return attachment.status === "clean" || !requireScan && attachment.status !== "infected" && attachment.uploadedAt !== void 0 ? void 0 : dbError("invalid_request", attachment.status === "infected" ? "The file failed the malware scan" : "The file is not scanned yet", { hint: "ATTACHMENT_NOT_SCANNED" });
+	};
+	const discard = async (created, error) => {
+		await call("delete_attachment", { id: created.id }, (value) => value);
+		return err(error);
+	};
+	const create = (attachment) => AsyncResult.from(() => extraFieldsArg(fields, extraOf(attachment, NEW_ATTACHMENT))).andThen((more) => call("create_attachment", {
+		tenant: attachment.organizationId,
+		name: attachment.name,
+		mime_type: attachment.mimeType,
+		size: attachment.size,
+		subject_type: attachment.subjectType,
+		subject_id: attachment.subjectId,
+		metadata: attachment.metadata,
+		...more
+	}, (value) => value)).andThen(typed);
+	const upload = (attachment) => create(attachment).andThen(async (created) => {
+		const url = await stored(bucket(created).createSignedUploadUrl(created.path));
+		if (!url.ok) return discard(created, url.error);
+		return ok({
+			attachment: created,
+			signedUrl: url.data.signedUrl,
+			token: url.data.token
+		});
+	});
+	return withBlockHooks({
+		upload,
+		confirm,
+		get: find,
+		list: (organizationId, subject) => call("list_attachments", {
+			tenant: organizationId,
+			subject_type: subject?.type,
+			subject_id: subject?.id
+		}, (value) => recordsOf(value, "list_attachments").map((raw) => [raw, attachmentOf(raw)])).andThen((rows) => allWithFields(fields, rows)),
+		download: (id, download = {}) => find(id).andThen((attachment) => {
+			const blocked = gate(attachment);
+			if (blocked) return Promise.resolve(err(blocked));
+			return stored(bucket(attachment).createSignedUrl(attachment.path, ttl, download.as === void 0 ? void 0 : { download: download.as })).map((url) => ({
+				attachment,
+				signedUrl: url.signedUrl
+			}));
+		}),
+		put: (attachment, file) => create(attachment).andThen(async (created) => {
+			const target = bucket(created);
+			if (!target.upload) return discard(created, dbError("invalid_request", "The storage client has no upload", { hint: "ATTACHMENT_STORAGE_CLIENT" }));
+			const sent = await stored(target.upload(created.path, file, {
+				contentType: created.mimeType,
+				upsert: false
+			}));
+			if (!sent.ok) return discard(created, sent.error);
+			return confirmed(created.id);
+		}),
+		read: (id) => find(id).andThen((attachment) => {
+			const blocked = gate(attachment);
+			if (blocked) return Promise.resolve(err(blocked));
+			return stored(bucket(attachment).download(attachment.path)).map((file) => ({
+				attachment,
+				file
+			}));
+		}),
+		remove: (id) => find(id).andThen((attachment) => stored(bucket(attachment).remove([attachment.path]))).andThen(() => call("delete_attachment", { id }, (value) => value === true))
+	}, options.hooks, {
+		block: "attachments",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+/**
+* Scans uploaded files with the app's `scan` function and records `clean`,
+* `infected` or `failed`. A file already clean or infected is not scanned
+* again, so replayed events and retried jobs are safe.
+*/
+function createAttachmentScanner(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema);
+	const prefix = `${options.typePrefix ?? "dev.better-supabase"}.`;
+	const record = (id, status, detail) => call("set_attachment_status", {
+		id,
+		status,
+		detail
+	}, (value) => value).andThen((value) => Promise.resolve(isRecord(value) ? ok(attachmentOf(value)) : err(notFound())));
+	const scan = (id, signal) => lookup(call, id).andThen((attachment) => {
+		if (attachment.status === "clean" || attachment.status === "infected") return Promise.resolve(ok(attachment));
+		if (attachment.uploadedAt === void 0) return Promise.resolve(err(dbError("invalid_request", "The file was not uploaded yet", { hint: "ATTACHMENT_NOT_UPLOADED" })));
+		return stored(options.storage.from(attachment.bucket).download(attachment.path)).andThen(async (file) => {
+			let verdict;
+			try {
+				verdict = await options.scan(file, attachment, signal);
+			} catch (cause) {
+				const failed = await record(id, "failed", errorText(cause));
+				return failed.ok ? err(dbError("raised", `The scan failed: ${errorText(cause)}`, { hint: "ATTACHMENT_SCAN_FAILED" })) : failed;
+			}
+			return record(id, verdict.status, verdict.detail);
+		});
+	});
+	return {
+		scan,
+		job: async (payload, _job, signal) => {
+			await settle(scan(payload.attachmentId, signal), attachmentGone);
+		},
+		sink: () => ({ async send(events) {
+			for (const event of events) {
+				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "attachment.uploaded" || !isRecord(event.data)) continue;
+				const id = optionalText(event.data["attachmentId"]);
+				if (id !== void 0) await settle(scan(id), attachmentGone);
+			}
+		} })
+	};
+}
+function scannedOf(value) {
+	const row = recordOf(value, "scanned_objects");
+	const status = textOf(row["status"]);
+	return {
+		bucket: textOf(row["bucket"]),
+		path: textOf(row["object_path"]),
+		status: status === "clean" || status === "infected" || status === "failed" ? status : "pending",
+		detail: optionalText(row["scan_detail"]),
+		scannedAt: optionalInstant(row["scanned_at"])
+	};
+}
+/**
+* The scan gate for objects outside the attachments table, such as a file drive
+* or avatars: scans an object with the app's `scan` function and records the
+* verdict in `scanned_objects`, which storage policies read with
+* `object_clean(bucket_id, name)`. With `options.scanBuckets`, new objects in
+* those buckets get a pending row and an `object.uploaded` event.
+*/
+function createObjectScanner(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema);
+	const prefix = `${options.typePrefix ?? "dev.better-supabase"}.`;
+	const record = (bucket, path, status, detail) => call("set_object_scan", {
+		bucket,
+		path,
+		status,
+		detail
+	}, scannedOf);
+	const scan = (bucket, path, signal) => call("object_scan", {
+		bucket,
+		path
+	}, (value) => isRecord(value) ? scannedOf(value) : void 0).andThen((current) => {
+		if (current?.status === "clean" || current?.status === "infected") return Promise.resolve(ok(current));
+		return stored(options.storage.from(bucket).download(path)).andThen(async (file) => {
+			let verdict;
+			try {
+				verdict = await options.scan(file, {
+					bucket,
+					path
+				}, signal);
+			} catch (cause) {
+				const failed = await record(bucket, path, "failed", errorText(cause));
+				return failed.ok ? err(dbError("raised", `The scan failed: ${errorText(cause)}`, { hint: "ATTACHMENT_SCAN_FAILED" })) : failed;
+			}
+			return record(bucket, path, verdict.status, verdict.detail);
+		});
+	});
+	return {
+		scan,
+		job: async (payload, _job, signal) => {
+			await settle(scan(payload.bucket, payload.path, signal), objectGone);
+		},
+		sink: () => ({ async send(events) {
+			for (const event of events) {
+				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "object.uploaded" || !isRecord(event.data)) continue;
+				const bucket = optionalText(event.data["bucket"]);
+				const path = optionalText(event.data["path"]);
+				if (bucket !== void 0 && path !== void 0) await settle(scan(bucket, path), objectGone);
+			}
+		} })
+	};
+}
+//#endregion
+export { stored as a, createObjectScanner as i, createAttachmentScanner as n, createAttachments as r, attachmentOf as t };

package/dist/attributes-BOFl922R.js

@@ -0,0 +1,44 @@
+//#region src/workflow-sdk/attributes.ts
+/**
+* The attributes the Supabase World's status trigger copies into
+* `workflow_runs`.
+*/
+const WORKFLOW_ATTRIBUTES = {
+	tenant: "bs.tenant",
+	actor: "bs.actor",
+	key: "bs.key",
+	/** The builder definition a run started from; its alerts match on it. */
+	definition: "bs.definition",
+	/** The builder version number a run started from. */
+	version: "bs.version",
+	/** The opaque ticket `bs.forContext` resolves into the context a step runs as. */
+	ticket: "bs.ticket",
+	/** The user an event or schedule start runs as (`runAs`). */
+	publisher: "bs.publisher",
+	/** The event actor or schedule creator behind a `runAs` start, for audit only. */
+	trigger: "bs.trigger",
+	/** The record a run belongs to, as `<type>/<id>`. */
+	subject: "bs.subject",
+	/**
+	* What a `runAs` run's steps run as: `user`, `service_principal`, `system` or
+	* `external`.
+	*/
+	principalKind: "bs.principal_kind",
+	/** The id of that principal, when it has one. */
+	principal: "bs.principal",
+	/** `test` for a builder test run; anything else records `live`. */
+	mode: "bs.mode",
+	/** The trigger node a builder run started at. */
+	triggerNode: "bs.trigger_node"
+};
+/**
+* The `bs.subject` value for a record: `<type>/<id>`. Throws a `TypeError` for
+* a type with a slash or an empty type or id, which the mirror can't split
+* back.
+*/
+function subjectAttribute(subject) {
+	if (subject.type === "" || subject.type.includes("/") || subject.type.length > 100 || subject.id === "" || subject.id.length > 200) throw new TypeError("better-supabase: a workflow subject has a type of 1 to 100 characters without a slash and an id of 1 to 200");
+	return `${subject.type}/${subject.id}`;
+}
+//#endregion
+export { subjectAttribute as n, WORKFLOW_ATTRIBUTES as t };