better-supabase 0.11.0 → 0.13.0

package/dist/next/index.js

@@ -1,23 +1,23 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../errors-BV1SKTVs.js";
-import { r as err } from "../result-DIeYscA3.js";
+import { n as dbError } from "../errors-D7u24ZJH.js";
+import { r as err } from "../result-DIT_qp4G.js";
 import { t as isList } from "../guards-6F2bCtQR.js";
-import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-Di5VAsYU.js";
-import { o as isReadSet } from "../read-set-DeesfeL_.js";
-import { n as validate } from "../standard-B1BigegP.js";
-import { o as problemResponse } from "../problem-JRCohp1j.js";
-import { i as claimsOf } from "../claims-PqzCxaTD.js";
+import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-Bt1RyT-F.js";
+import { o as isReadSet } from "../read-set-DP6fm21F.js";
+import { n as validate } from "../standard-l10kE0yS.js";
+import { o as problemResponse } from "../problem-D0KDiYPk.js";
+import { i as claimsOf } from "../claims-Bp9My7XP.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { t as tenantOf } from "../tenant-B-fiItlJ.js";
-import { T as serverCore, b as isPrefetch, c as extendServer, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as outageResponse } from "../adapter-B2WRsRIg.js";
-import { a as checkAal, n as toSession } from "../view-CYX1wsgp.js";
-import { o as settle, r as guard, t as defaultExpose } from "../respond-Bhp3G__q.js";
-import { t as supportSessions } from "../support-BAhTqI7y.js";
-import { r as defineAction } from "../resource-Bdkqi8jo.js";
-import { r as tagFor, t as cacheTagsOf } from "../tags-B99_U9Pp.js";
-import { i as requireCaller, n as formDataObject, t as authorizeCaller } from "../kit-LTbHrWWD.js";
+import { t as tenantOf } from "../tenant-DnMqeNIM.js";
+import { T as serverCore, b as isPrefetch, c as extendServer, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as outageResponse } from "../adapter-D8dW6p2A.js";
+import { a as checkAal, n as toSession } from "../view-CfUd5vI9.js";
+import { o as settle, r as guard, t as defaultExpose } from "../respond-DjEmE_DN.js";
+import { t as supportSessions } from "../support-CWVTM2AB.js";
+import { r as defineAction } from "../resource-BVvIiuX_.js";
+import { r as tagFor, t as cacheTagsOf } from "../tags-C_ym1yDM.js";
+import { i as requireCaller, n as formDataObject, t as authorizeCaller } from "../kit-BeXTrlZn.js";
 import { t as withExtra } from "../extra-CGQ2_q3S.js";
-import { n as resourceRouter } from "../resources-Ck7itNeX.js";
+import { n as resourceRouter } from "../resources-CIi7sw1T.js";
 import { cache } from "react";
 import { cacheLife, cacheTag, io, revalidateTag, updateTag } from "next/cache.js";
 import { cookies, headers } from "next/headers.js";
@@ -35,9 +35,9 @@ const MIN_CLIENT_STALE = 30;
 /**
 * `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
 * the token's expiry, and 0 once fewer than `min` seconds are left. A
-* signed-out view that a refresh would change (an `expired` or
-* `refresh_failed` cookie, or an `invalid` token) is 0 as well, so it never
-* joins the App Shell.
+* signed-out view that a refresh would change (an `expired` or `refresh_failed`
+* cookie, or an `invalid` token) is 0 as well, so it never joins the App
+* Shell.
 */
 function sessionStale(session, options = {}, now = Date.now()) {
 	const min = Math.max(MIN_CLIENT_STALE, options.min ?? MIN_CLIENT_STALE);
@@ -60,9 +60,9 @@ function sessionTag(userId) {
 	return `bs:session:${userId}`;
 }
 /**
-* The table tags of a read: the tenant's and every tenant's, or the table's.
-* A read across tenants (`"*"`) also carries the table's, which every
-* mutation invalidates, including one scoped to a single tenant.
+* The table tags of a read: the tenant's and every tenant's, or the table's. A
+* read across tenants (`"*"`) also carries the table's, which every mutation
+* invalidates, including one scoped to a single tenant.
 */
 function tableTags(table, options) {
 	if (options.tenant === "*") return [tagFor(table), tagFor(table, void 0, options)];
@@ -72,23 +72,23 @@ function tableTags(table, options) {
 const EXPIRE_NOW = { expire: 0 };
 /**
 * Invalidates tags with `updateTag` (Server Actions), else `revalidateTag`
-* (Route Handlers), else not at all (jobs, scripts). The first tag decides
-* for the rest, so a mutation outside an action throws once, not per tag.
+* (Route Handlers), else not at all (jobs, scripts). The first tag decides for
+* the rest, so a mutation outside an action throws once, not per tag.
 */
 function invalidateAll(tags, profile = EXPIRE_NOW) {
 	let index = 0;
 	try {
-		for (; index < tags.length; index++) updateTag(tags[index]);
+		for (; index < tags.length; index += 1) updateTag(tags[index]);
 		return;
 	} catch {}
 	try {
-		for (; index < tags.length; index++) revalidateTag(tags[index], profile);
+		for (; index < tags.length; index += 1) revalidateTag(tags[index], profile);
 	} catch {}
 }
 /**
 * Invalidates `bs:<table>` for every table in the target, the tenant's
-* `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has
-* no tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
+* `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has no
+* tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
 * tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
 */
 function nextCache(options = {}) {
@@ -181,9 +181,9 @@ var StatsCollector = class {
 const SHARED = Symbol.for("better-supabase.next.stats-collector");
 /**
 * One store of request totals per process. Next.js can load the proxy, pages
-* and route handlers as separate module instances, and they must see the
-* same totals. Each caller's budget and logger apply to the requests it
-* starts, so a second app in the process keeps its own.
+* and route handlers as separate module instances, and they must see the same
+* totals. Each caller's budget and logger apply to the requests it starts, so a
+* second app in the process keeps its own.
 */
 function sharedCollector(options) {
 	const scope = globalThis;
@@ -206,7 +206,10 @@ function formatStats(stats) {
 }
 //#endregion
 //#region src/next/control-flow.ts
-/** Whether `cause` is one of Next's own control-flow errors (they carry a `digest`). */
+/**
+* Whether `cause` is one of Next's own control-flow errors (they carry a
+* `digest`).
+*/
 function isNextInterrupt(cause) {
 	return cause instanceof Error && "digest" in cause && typeof cause.digest === "string";
 }
@@ -319,7 +322,10 @@ function shouldCheckSession(request, options = {}) {
 	if (request.headers.get("sec-fetch-dest") === "document") return true;
 	return options.paths?.includes(request.nextUrl.pathname) ?? false;
 }
-/** Page loads, client navigations and server actions; never prefetches or assets. */
+/**
+* Page loads, client navigations and server actions; never prefetches or
+* assets.
+*/
 function shouldRefresh(request) {
 	const h = request.headers;
 	if (request.method !== "GET" && request.method !== "HEAD") return h.has("next-action");
@@ -332,12 +338,15 @@ function shouldRefresh(request) {
 /**
 * A `proxy` `protect` that keeps signed-in users below `level` out of the
 * matched paths. The JWT carries no factor list, so this also sends users
-* without a factor to `redirect` to enroll one. Anonymous callers pass;
-* combine it with your sign-in redirect.
+* without a factor to `redirect` to enroll one. Anonymous callers pass; combine
+* it with your sign-in redirect.
 *
 * ```ts
 * bs.proxy(request, {
-*   protect: requireAal('aal2', { redirect: '/mfa', match: (path) => path.startsWith('/settings') }),
+*   protect: requireAal("aal2", {
+*     redirect: "/mfa",
+*     match: (path) => path.startsWith("/settings"),
+*   }),
 * });
 * ```
 */
@@ -357,8 +366,8 @@ function requireAal(level, options = {}) {
 //#endregion
 //#region src/next/create.ts
 /**
-* The Next.js adapter: proxy, Server Components, route handlers, server
-* actions and cache tags, on top of `createServer`.
+* The Next.js adapter: proxy, Server Components, route handlers, server actions
+* and cache tags, on top of `createServer`.
 *
 * ```ts
 * export const bs = createNext(betterSupabase);
@@ -404,7 +413,10 @@ function createNext(betterSupabase, options = {}) {
 		for (const write of writes) jar.set(write.name, write.value, write.options);
 	};
 	const incomingRequest = async () => new Request("http://next.local/", { headers: new Headers(await headers()) });
-	/** One token verification per render scope backs `context()`, `session()` and `cached()`. */
+	/**
+	* One token verification per render scope backs `context()`, `session()` and
+	* `cached()`.
+	*/
 	const incoming = cache(async () => {
 		await io();
 		const request = await incomingRequest();
@@ -417,8 +429,11 @@ function createNext(betterSupabase, options = {}) {
 	/** The tenant `scoped` resolved for a context, when it wasn't the claim. */
 	const scopedTenants = /* @__PURE__ */ new WeakMap();
 	const tenantFor = (ctx, view) => scopedTenants.get(ctx) ?? tenantOf(view, tenantClaim);
-	/** `requireTenant`, `roles`, `permission` and `authorize`, for the context's tenant. */
-	const authorizeCaller$1 = (ctx, checks, input) => authorizeCaller(ctx.auth, checks, input, tenantFor(ctx, toSession(ctx.auth)), options.authorizer);
+	/**
+	* `requireTenant`, `roles`, `permission` and `authorize`, for the context's
+	* tenant.
+	*/
+	const authorizeCaller$1 = (ctx, checks, input) => authorizeCaller(ctx.auth, checks, input, tenantFor(ctx, toSession(ctx.auth)), options.authorizer, ctx);
 	/** `null` runs `NextOptions.tenant`; a string is the caller's explicit tenant. */
 	const scoped = cache(async (explicit) => {
 		const { request, resolution } = await incoming();
@@ -663,7 +678,7 @@ function createNext(betterSupabase, options = {}) {
 		},
 		require: async (requireOptions = {}) => {
 			const ctx = await current(requireOptions.tenant);
-			const caller = await requireCaller(ctx.auth, requireOptions, tenantFor(ctx, toSession(ctx.auth)), options.authorizer);
+			const caller = await requireCaller(ctx.auth, requireOptions, tenantFor(ctx, toSession(ctx.auth)), options.authorizer, ctx);
 			if ("kind" in caller) interrupt(caller);
 			return withExtra(ctx, caller);
 		},

package/dist/node/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../refusal-CufncwaN.js";
-import { i as toWebHeaders, r as applyWebHeaders, t as NodeHeaderTarget } from "../node-headers-AO06VhqH.js";
-import { _ as toNodeHandler, a as FastifyReplyLike, b as toWebRequest, c as KoaMiddleware, d as guard, f as koaGuard, g as toKoa, h as toFastify, i as FastifyHook, l as ToNodeOptions, m as toExpress, n as ExpressMiddleware, o as FastifyRequestLike, p as problemErrorHandler, r as ExpressResponse, s as KoaContextLike, t as ExpressErrorHandler, u as fastifyGuard, v as WebRequestOptions, y as sendWebResponse } from "../index-Bq409YZn.js";
+import { n as RouteGuardOptions } from "../refusal-BEyNVFy7.js";
+import { i as toWebHeaders, r as applyWebHeaders, t as NodeHeaderTarget } from "../node-headers-BPtMP4_V.js";
+import { _ as toNodeHandler, a as FastifyReplyLike, b as toWebRequest, c as KoaMiddleware, d as guard, f as koaGuard, g as toKoa, h as toFastify, i as FastifyHook, l as ToNodeOptions, m as toExpress, n as ExpressMiddleware, o as FastifyRequestLike, p as problemErrorHandler, r as ExpressResponse, s as KoaContextLike, t as ExpressErrorHandler, u as fastifyGuard, v as WebRequestOptions, y as sendWebResponse } from "../index-CcpGT2GI.js";
 export { ExpressErrorHandler, ExpressMiddleware, ExpressResponse, FastifyHook, FastifyReplyLike, FastifyRequestLike, KoaContextLike, KoaMiddleware, type NodeHeaderTarget, type RouteGuardOptions, ToNodeOptions, type WebRequestOptions, applyWebHeaders, fastifyGuard, guard, koaGuard, problemErrorHandler, sendWebResponse, toExpress, toFastify, toKoa, toNodeHandler, toWebHeaders, toWebRequest };

package/dist/node/index.js

@@ -1,16 +1,20 @@
-import { a as toResponse, t as around } from "../shared-BmMcMoW9.js";
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-CFpfmjcS.js";
-import { t as beforeRoute } from "../before-route-B98js9m_.js";
+import { a as toResponse, t as around } from "../shared-Bf-I13Ht.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-Ce2p81VW.js";
+import { t as beforeRoute } from "../before-route-B23K2zYU.js";
 import { i as toWebHeaders, t as applyWebHeaders } from "../node-headers-C71zNQHe.js";
-import { n as toWebRequest, t as sendWebResponse } from "../http-Cv4T29xh.js";
+import { n as toWebRequest, t as sendWebResponse } from "../http-BjjojWg3.js";
 //#region src/node/index.ts
 /**
 * A `node:http` request listener running the entries around `handler`.
-* Response-phase entries see the handler's response, so refreshed cookies
-* and `withDbStats` totals reach the client.
+* Response-phase entries see the handler's response, so refreshed cookies and
+* `withDbStats` totals reach the client.
 *
 * ```ts
-* createServer(toNodeHandler([withBetterSupabase(server)], (request, { db }) => db.notes.findMany()))
+* createServer(
+*   toNodeHandler([withBetterSupabase(server)], (request, { db }) =>
+*     db.notes.findMany(),
+*   ),
+* );
 * ```
 */
 function toNodeHandler(entries, handler, options = {}) {
@@ -37,8 +41,10 @@ async function continueWith(step, next) {
 * (`res.locals.db`, `res.locals.bs`). Mount it before the routes.
 *
 * ```ts
-* app.use(toExpress([withBetterSupabase(server)]))
-* app.get('/notes', async (req, res) => res.json(await res.locals.db.notes.findMany().orThrow()))
+* app.use(toExpress([withBetterSupabase(server)]));
+* app.get("/notes", async (req, res) =>
+*   res.json(await res.locals.db.notes.findMany().orThrow()),
+* );
 * ```
 */
 function toExpress(entries, options = {}) {
@@ -61,11 +67,11 @@ function toExpress(entries, options = {}) {
 	};
 }
 /**
-* Express route middleware that refuses callers outside `options`:
-* Problem Details, or a redirect to `signIn` or `mfa`. Runs after `toExpress`.
+* Express route middleware that refuses callers outside `options`: Problem
+* Details, or a redirect to `signIn` or `mfa`. Runs after `toExpress`.
 *
 * ```ts
-* app.get('/admin', guard({ roles: ['admin'] }), handler)
+* app.get("/admin", guard({ roles: ["admin"] }), handler);
 * ```
 */
 function guard(options = {}) {
@@ -81,8 +87,8 @@ function guard(options = {}) {
 }
 /**
 * An Express error handler that answers thrown `DbException`s (from
-* `.orThrow()`) with Problem Details and passes every other error on.
-* Register it after the routes.
+* `.orThrow()`) with Problem Details and passes every other error on. Register
+* it after the routes.
 */
 function problemErrorHandler(options = {}) {
 	return (error, req, res, next) => {
@@ -109,13 +115,15 @@ async function sendReply(reply, response) {
 	reply.send(body);
 }
 /**
-* A Fastify `onRequest` hook that puts every contribution on
-* `request.locals`. Declare `locals` with `app.decorateRequest('locals', null)`.
+* A Fastify `onRequest` hook that puts every contribution on `request.locals`.
+* Declare `locals` with `app.decorateRequest('locals', null)`.
 *
 * ```ts
-* app.decorateRequest('locals', null)
-* app.addHook('onRequest', toFastify([withBetterSupabase(server)]))
-* app.get('/notes', (request) => request.locals.db.notes.findMany().orThrow())
+* app.decorateRequest("locals", null);
+* app.addHook("onRequest", toFastify([withBetterSupabase(server)]));
+* app.get("/notes", (request) =>
+*   request.locals.db.notes.findMany().orThrow(),
+* );
 * ```
 */
 function toFastify(entries, options = {}) {
@@ -164,12 +172,14 @@ async function sendKoa(ctx, response) {
 	ctx.body = response.body ? Buffer.from(await response.arrayBuffer()) : null;
 }
 /**
-* Koa middleware that puts every contribution on `ctx.state`, then awaits
-* the rest of the chain. Thrown `DbException`s become Problem Details.
+* Koa middleware that puts every contribution on `ctx.state`, then awaits the
+* rest of the chain. Thrown `DbException`s become Problem Details.
 *
 * ```ts
-* app.use(toKoa([withBetterSupabase(server)]))
-* app.use(async (ctx) => { ctx.body = await ctx.state.db.notes.findMany().orThrow() })
+* app.use(toKoa([withBetterSupabase(server)]));
+* app.use(async (ctx) => {
+*   ctx.body = await ctx.state.db.notes.findMany().orThrow();
+* });
 * ```
 */
 function toKoa(entries, options = {}) {

package/dist/node-headers-BPtMP4_V.d.ts

@@ -0,0 +1,27 @@
+//#region src/bridges/node-headers.d.ts
+/** Node's request headers: a string, an array of strings, or absent. */
+type NodeIncomingHeaders = Readonly<Record<string, string | readonly string[] | undefined>>;
+/**
+ * The part of a Node `IncomingMessage` a URL and headers need; no stream is
+ * read.
+ */
+interface NodeRequestHead {
+  readonly method?: string | undefined;
+  readonly url?: string | undefined;
+  readonly headers: NodeIncomingHeaders;
+  readonly socket?: object | undefined;
+}
+/** Node's headers as `Headers`; HTTP/2 pseudo-headers (`:path`) are dropped. */
+declare function toWebHeaders(incoming: NodeIncomingHeaders): Headers;
+/** The part of a Node `ServerResponse` header writes need. */
+interface NodeHeaderTarget {
+  getHeader(name: string): number | string | readonly string[] | undefined;
+  setHeader(name: string, value: number | string | readonly string[]): unknown;
+}
+/**
+ * Copies a `Response`'s headers onto a Node response: `set-cookie` and
+ * `server-timing` are appended to what is already there, the rest replaced.
+ */
+declare function applyWebHeaders(target: NodeHeaderTarget, headers: Headers): void;
+//#endregion
+export { toWebHeaders as i, NodeRequestHead as n, applyWebHeaders as r, NodeHeaderTarget as t };

package/dist/nuxt/index.d.ts

@@ -45,14 +45,15 @@ export interface BetterSupabaseNuxtModule {
   }>;
 }
 /**
- * Registers the app's entries as Nitro server middleware (every
- * contribution on `event.context`) and auto-imports the Vue composables.
+ * Registers the app's entries as Nitro server middleware (every contribution on
+ * `event.context`) and auto-imports the Vue composables.
  *
- * ```ts title="nuxt.config.ts"
+ * ```ts
+ * // nuxt.config.ts
  * export default defineNuxtConfig({
- *   modules: ['better-supabase/nuxt'],
- *   betterSupabase: { server: '~~/server/better-supabase' },
- * })
+ *   modules: ["better-supabase/nuxt"],
+ *   betterSupabase: { server: "~~/server/better-supabase" },
+ * });
  * ```
  */
 declare const betterSupabaseNuxt: BetterSupabaseNuxtModule;

package/dist/nuxt/index.js

@@ -47,14 +47,15 @@ function setup(inline, nuxt) {
 	});
 }
 /**
-* Registers the app's entries as Nitro server middleware (every
-* contribution on `event.context`) and auto-imports the Vue composables.
+* Registers the app's entries as Nitro server middleware (every contribution on
+* `event.context`) and auto-imports the Vue composables.
 *
-* ```ts title="nuxt.config.ts"
+* ```ts
+* // nuxt.config.ts
 * export default defineNuxtConfig({
-*   modules: ['better-supabase/nuxt'],
-*   betterSupabase: { server: '~~/server/better-supabase' },
-* })
+*   modules: ["better-supabase/nuxt"],
+*   betterSupabase: { server: "~~/server/better-supabase" },
+* });
 * ```
 */
 const betterSupabaseNuxt = Object.assign(setup, { getMeta: () => Promise.resolve({

package/dist/onboarding-DjXV4rgO.js

@@ -0,0 +1,68 @@
+import { C as optionalText, I as textOf, S as optionalInstant, k as recordsOf, n as applyTemporal, o as blockCall } from "./block-helpers-DwE32_gT.js";
+import { r as withBlockHooks } from "./block-hooks-C1r-R2r0.js";
+//#region src/blocks/onboarding/onboarding.ts
+const ID = /^[a-z][a-z0-9_.-]{0,63}$/;
+/**
+* Declares an onboarding checklist. Pass the result to
+* `blocks.onboarding.options.checklists` so the database knows its steps, and
+* to the methods of `createOnboarding` to read and complete them.
+*/
+function defineChecklist(spec) {
+	if (!ID.test(spec.id)) throw new TypeError(`defineChecklist: "${spec.id}" is not a checklist id`);
+	const seen = /* @__PURE__ */ new Set();
+	for (const step of spec.steps) {
+		if (!ID.test(step.id) || seen.has(step.id)) throw new TypeError(`defineChecklist(${spec.id}): step "${step.id}" is not a unique step id`);
+		seen.add(step.id);
+	}
+	return spec;
+}
+/**
+* The onboarding block: reads and completes the steps of the checklists in
+* `blocks.onboarding.options.checklists`, for the caller or an organization.
+*/
+function createOnboarding(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const tenantOf = (subject) => ({ tenant: subject[0] ?? null });
+	return withBlockHooks({
+		progress: (checklist, ...subject) => call("onboarding_progress", {
+			checklist: checklist.id,
+			...tenantOf(subject)
+		}, (value) => progressOf(checklist.steps, value)),
+		complete: (checklist, step, ...subject) => call("complete_onboarding_step", {
+			checklist: checklist.id,
+			step,
+			...tenantOf(subject)
+		}, (value) => value === true),
+		reset: (checklist, step, ...subject) => call("reset_onboarding_step", {
+			checklist: checklist.id,
+			step,
+			...tenantOf(subject)
+		}, (value) => value === true)
+	}, options.hooks, {
+		block: "onboarding",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+function progressOf(steps, value) {
+	const rows = new Map(recordsOf(value, "onboarding_progress").map((row) => [textOf(row["step"]), row]));
+	const list = steps.map((step) => {
+		const row = rows.get(step.id);
+		return {
+			...step,
+			completed: row !== void 0,
+			completedAt: optionalInstant(row?.["completedAt"]),
+			completedBy: optionalText(row?.["completedBy"])
+		};
+	});
+	const completed = list.filter((step) => step.completed).length;
+	return {
+		steps: list,
+		completed,
+		total: list.length,
+		done: completed === list.length,
+		next: list.find((step) => !step.completed)
+	};
+}
+//#endregion
+export { defineChecklist as n, createOnboarding as t };

package/dist/openapi/index.d.ts

@@ -1,4 +1,4 @@
-import { D as ResourceOperation } from "../model-lUafmeBQ.js";
-import { V as PROBLEM_SCHEMA, _ as OpenApiDocuments, b as OpenApiVersion, d as OpenApi30Document, f as OpenApi31Document, g as OpenApiDocument, h as OpenApiComponents, l as AnyOpenApiDocument, m as OpenApi33PreviewDocument, p as OpenApi32Document, u as OPENAPI_33_PREVIEW_VERSION, v as OpenApiInfo, x as RenderedOpenApi, y as OpenApiSecurityRequirement } from "../api-DoWK3dTw.js";
-import { a as openapiFormat, i as toOpenApi30Schema, n as ResourceOptions, r as createOpenApi, t as OpenApiOptions } from "../index-wTnPJUhv.js";
+import { A as AnyOpenApiDocument, B as OpenApiSecurityRequirement, F as OpenApi33PreviewDocument, H as RenderedOpenApi, I as OpenApiComponents, L as OpenApiDocument, M as OpenApi30Document, N as OpenApi31Document, O as PROBLEM_SCHEMA, P as OpenApi32Document, R as OpenApiDocuments, V as OpenApiVersion, j as OPENAPI_33_PREVIEW_VERSION, z as OpenApiInfo } from "../api-DwLhJS1j.js";
+import { D as ResourceOperation } from "../model-Btl8X9cs.js";
+import { a as openapiFormat, i as toOpenApi30Schema, n as ResourceOptions, r as createOpenApi, t as OpenApiOptions } from "../index-Dh5ZFCtu.js";
 export { type AnyOpenApiDocument, OPENAPI_33_PREVIEW_VERSION, type OpenApi30Document, type OpenApi31Document, type OpenApi32Document, type OpenApi33PreviewDocument, type OpenApiComponents, type OpenApiDocument, type OpenApiDocuments, type OpenApiInfo, OpenApiOptions, type OpenApiSecurityRequirement, type OpenApiVersion, PROBLEM_SCHEMA, type RenderedOpenApi, type ResourceOperation, ResourceOptions, createOpenApi, openapiFormat, toOpenApi30Schema };

package/dist/openapi/index.js

@@ -1,16 +1,19 @@
-import { a as toOpenApi30Schema, n as openapiFormat, r as OPENAPI_33_PREVIEW_VERSION, t as defineApi } from "../api-C43_FYDp.js";
-import { o as PROBLEM_SCHEMA } from "../build-CT6SPZkI.js";
+import { a as toOpenApi30Schema, n as openapiFormat, r as OPENAPI_33_PREVIEW_VERSION, t as defineApi } from "../api-CmcTYuFT.js";
+import { o as PROBLEM_SCHEMA } from "../build-DxzJf79X.js";
 //#region src/openapi/index.ts
 /**
-* An OpenAPI document for REST resources over your tables, with schemas
-* from the generated metadata, list-query parameters, Supabase security
-* schemes and Problem Details errors. Throws when building or checking the
-* document finds an error; use `defineApi` to read every finding instead.
+* An OpenAPI document for REST resources over your tables, with schemas from
+* the generated metadata, list-query parameters, Supabase security schemes and
+* Problem Details errors. Throws when building or checking the document finds
+* an error; use `defineApi` to read every finding instead.
 *
 * ```ts
 * const doc = createOpenApi(betterSupabase, {
 *   info: { title: "CRM API", version: "1.0.0" },
-*   resources: { customers: { list: customerList }, notes: { operations: ["list", "get"] } },
+*   resources: {
+*     customers: { list: customerList },
+*     notes: { operations: ["list", "get"] },
+*   },
 * });
 * ```
 */

package/dist/operations-Cc27HkTG.d.ts

@@ -0,0 +1,6 @@
+import { r as AuthorizationOperation } from "./authorization-CB69cvnA.js";
+//#region src/core/operations.d.ts
+/** Operations by name, as `authorization.operations` or a module's own defaults. */
+type OperationTable = Readonly<Record<string, AuthorizationOperation>>;
+//#endregion
+export { OperationTable as t };

package/dist/operations-DVHRHvv6.js

@@ -0,0 +1,29 @@
+//#region src/core/operations.ts
+/** The prefixes each module looks its operations up under. */
+const OPERATION_PREFIXES = {
+	workflowNode: "workflow.node.",
+	mcpTool: "mcp.tool.",
+	aiTool: "ai.tool.",
+	inboxCommand: "inbox.command."
+};
+/**
+* The permission operation `name` needs: the provider's entry first, then
+* `fallback` (the module's own key, already renamed through
+* `blocks.<module>.permissions`). `undefined` when neither names one, which a
+* caller treats as "no permission declared" and refuses unless the operation is
+* public by design.
+*/
+function operationPermission(operations, name, fallback) {
+	if (operations !== void 0 && Object.hasOwn(operations, name)) {
+		const permission = operations[name]?.permission;
+		if (typeof permission === "string" && permission !== "") return permission;
+	}
+	return fallback;
+}
+/** The operation `name`'s `meta`, from the provider's table. */
+function operationMeta(operations, name) {
+	if (operations === void 0 || !Object.hasOwn(operations, name)) return;
+	return operations[name]?.meta;
+}
+//#endregion
+export { operationMeta as n, operationPermission as r, OPERATION_PREFIXES as t };

package/dist/optional-peer-C1NbBRJm.js

@@ -0,0 +1,32 @@
+//#region src/core/optional-peer.ts
+/**
+* Imports an optional peer package on first use, or resolves `undefined` when
+* it is not installed so the caller can say how to add it. The specifier is a
+* variable on purpose, and the bundler-ignore comments keep it a native import
+* in bundled apps: bundlers leave the peer out of apps that never reach this
+* call, and an app that externalizes the package resolves it at runtime.
+*/
+async function importOptionalPeer(specifier) {
+	try {
+		return await import(
+			/* webpackIgnore: true */
+			/* @vite-ignore */
+			specifier
+);
+	} catch {
+		return;
+	}
+}
+/**
+* Runs `load` once and shares the promise. A rejection is not kept, so the next
+* call tries again.
+*/
+function memoized(load) {
+	let promise;
+	return () => promise ??= load().catch((cause) => {
+		promise = void 0;
+		throw cause;
+	});
+}
+//#endregion
+export { memoized as n, importOptionalPeer as t };

package/dist/options-CIf3xni7.d.ts

@@ -0,0 +1,52 @@
+import { t as StandardSchemaV1 } from "./standard-16AIDny5.js";
+//#region src/blocks/options.d.ts
+/**
+ * What a SQL module option holds. `unknown` is an object or a value the module
+ * checks itself; the JSON Schema leaves it open.
+ */
+type OptionKind = "string" | "boolean" | "number" | "strings" | "unknown";
+/** One option of a SQL module (`blocks.<module>.options.<key>`). */
+interface OptionSpec<T = unknown> {
+  readonly kind: OptionKind;
+  /** The value the module uses when the config leaves the option out. */
+  readonly default?: T;
+  /**
+   * The TypeScript side reads it too, such as `attachments.requireScan` or a
+   * realtime topic: `gen` writes its resolved value to `blocks.generated.ts`,
+   * and `defineBlocks` passes it to the block's creator.
+   */
+  readonly client: boolean;
+}
+/** What an option builder takes. */
+interface OptionInput<T> {
+  readonly default?: T;
+  /** See `OptionSpec.client`. */
+  readonly client?: boolean;
+}
+/** The option builders a block's `options.ts` describes its SQL options with. */
+interface OptionBuilders {
+  string(input?: OptionInput<string>): OptionSpec<string>;
+  boolean(input?: OptionInput<boolean>): OptionSpec<boolean>;
+  number(input?: OptionInput<number>): OptionSpec<number>;
+  strings(input?: OptionInput<readonly string[]>): OptionSpec<readonly string[]>;
+  unknown<T = unknown>(input?: OptionInput<T>): OptionSpec<T>;
+}
+declare const option: OptionBuilders;
+/** One `OptionSpec` per key of a module's options type. */
+type OptionSpecs<T> = { readonly [K in keyof T]-?: OptionSpec<Exclude<T[K], undefined>>; };
+/**
+ * A SQL module's options: a Standard Schema typed `T` that refuses unknown keys
+ * and values of the wrong kind, plus the option specs `gen` and the JSON Schema
+ * read.
+ */
+interface BlockOptionsSchema<T extends object = object> extends StandardSchemaV1<unknown, T> {
+  readonly specs: Readonly<Record<string, OptionSpec>>;
+}
+/** Describes a SQL module's options, typed by `T` (`blocks.<module>.options`). */
+declare function blockOptions<T extends object>(options: OptionSpecs<T>): BlockOptionsSchema<T>;
+/** The options of a module that has none. */
+declare const NO_OPTIONS: BlockOptionsSchema<Record<never, never>>;
+/** The JSON Schema of a module's options, for `schemas/config-v1.json`. */
+declare function optionsJsonSchema(schema: BlockOptionsSchema): Readonly<Record<string, unknown>>;
+//#endregion
+export { OptionKind as a, blockOptions as c, OptionInput as i, option as l, NO_OPTIONS as n, OptionSpec as o, OptionBuilders as r, OptionSpecs as s, BlockOptionsSchema as t, optionsJsonSchema as u };