better-supabase 0.11.0 → 0.13.0

package/dist/client-Dft5Vq6m.d.ts

@@ -1,388 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { D as ValidationIssue, T as ErrorMapper, b as DbError, f as Result, t as AsyncResult } from "./result-BREt7qOh.js";
-import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
-import { r as BlockTemporalOptions } from "./block-helpers-CjcQM1yA.js";
-import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
-import { c as FilterFieldLabels, d as FilterLimits, h as FilterQuery, i as FilterCombinator, l as FilterFieldType, o as FilterField, r as FilterClock, s as FilterFieldInfo } from "./filter-query-Bc_Qa8V_.js";
-import { n as Controller, t as AuthPort } from "./controller-BBXX1RMw.js";
-import { n as FilterRecordField, t as FilterEvaluation } from "./filter-evaluate-BJcaL3o1.js";
-//#region src/blocks/rules/fields.d.ts
-/** One field of `defineRuleFields`: a value rules on the subject type may test. */
-interface RuleFieldDefinition {
-  readonly type: FilterFieldType;
-  readonly label?: string;
-  readonly description?: string;
-  /** The subject record key the value is read from, dotted for a nested value. Defaults to the field id. */
-  readonly column?: string;
-  /**
-   * The Postgres type, which decides how dates compare: `date`, `timestamp`
-   * or `timestamptz` (the default for date fields).
-   */
-  readonly columnType?: string;
-  /** Whether the value may be missing, so "is not" also matches it. Default `true`. */
-  readonly nullable?: boolean;
-  /** Allowed values for `select` and `multiselect`. */
-  readonly options?: readonly (string | {
-    readonly value: string;
-    readonly label?: string;
-  })[];
-  /** A subset of the type's operators. */
-  readonly operators?: readonly string[];
-}
-/** A catalog field as `rule_fields_list` returns it. */
-interface RuleField {
-  readonly subjectType: string;
-  readonly id: string;
-  readonly label: string;
-  readonly description: string | undefined;
-  readonly type: FilterFieldType;
-  readonly column: string;
-  readonly columnType: string;
-  readonly nullable: boolean;
-  readonly options: readonly {
-    readonly value: string;
-    readonly label: string;
-  }[] | undefined;
-  readonly operators: readonly string[] | undefined;
-}
-/** The fields of one subject type, for `RulesAdmin.syncFields` and the editor. */
-interface RuleFieldCatalog<S extends string = string> {
-  readonly subjectType: S;
-  readonly fields: readonly RuleField[];
-}
-/**
- * Declares the fields rules on `subjectType` may test. Sync the catalog with
- * `createRulesAdmin(...).syncFields(catalog)` so the database checks and
- * evaluates trees against the same fields.
- */
-declare function defineRuleFields<const S extends string>(subjectType: S, fields: Readonly<Record<string, RuleFieldDefinition>>): RuleFieldCatalog<S>;
-/** Catalog fields as list filter fields, for `evaluateFilterQuery` and `checkFilterQuery`. */
-declare function ruleFilterFieldInfo(fields: readonly RuleField[]): FilterFieldInfo[];
-/** The `fields` prop of ReUI's Filters for a rule editor. */
-declare function ruleFilterFields(fields: readonly RuleField[], labels?: FilterFieldLabels): FilterField[];
-/** The defaults of `blocks.rules.options`. */
-declare const RULE_LIMITS: FilterLimits;
-/**
- * The problems `save` would report for a tree, checked in the browser: an
- * empty list when the database will accept it. Unfinished conditions are
- * allowed; they take no part until they have an operator.
- */
-declare function checkRuleConditions(conditions: FilterQuery, fields: readonly RuleField[], limits?: FilterLimits): readonly ValidationIssue[];
-//#endregion
-//#region src/blocks/rules/rules.d.ts
-/** What a rule runs when it matches: a kind the app handles and its settings. */
-interface RuleAction {
-  /** Such as `approvals.request` or `notifications.send`. */
-  readonly kind: string;
-  readonly config?: Readonly<Record<string, unknown>>;
-}
-interface Rule {
-  readonly id: string;
-  readonly organizationId: string;
-  readonly subjectType: string;
-  /** The event type the rule is tested on, such as `expense.submitted`. */
-  readonly trigger: string;
-  readonly name: string;
-  readonly description: string | undefined;
-  readonly conditions: FilterQuery;
-  readonly actions: readonly RuleAction[];
-  readonly enabled: boolean;
-  /** A match ends the evaluation, so later rules for the trigger don't run. */
-  readonly stopProcessing: boolean;
-  /** The rank key rules are tested in. */
-  readonly rank: string;
-  readonly version: number;
-  readonly createdBy: string | undefined;
-  readonly updatedBy: string | undefined;
-  readonly createdAt: Temporal.Instant;
-  readonly updatedAt: Temporal.Instant;
-}
-/** `save`'s input: left-out keys keep their value on an existing rule. */
-interface RuleInput {
-  readonly id?: string;
-  /** The version the editor read; a newer stored one fails with `RULE_CONFLICT`. */
-  readonly version?: number;
-  /** Required for a new rule; it can't change later. */
-  readonly subjectType?: string;
-  readonly trigger?: string;
-  readonly name?: string;
-  readonly description?: string | null;
-  readonly conditions?: FilterQuery;
-  readonly actions?: readonly RuleAction[];
-  /** Turning a rule on takes `rules.publish`. */
-  readonly enabled?: boolean;
-  readonly stopProcessing?: boolean;
-}
-interface RuleVersion {
-  readonly ruleId: string;
-  readonly version: number;
-  readonly name: string;
-  readonly conditions: FilterQuery;
-  readonly actions: readonly RuleAction[];
-  readonly savedBy: string | undefined;
-  readonly savedAt: Temporal.Instant;
-}
-/** A rule that matched, with the truth of every condition and group by node id. */
-interface RuleMatch {
-  readonly rule: Rule;
-  readonly results: Readonly<Record<string, boolean | null>>;
-}
-/** One entry of a rule's evaluation log. */
-interface RuleEvaluationEntry {
-  readonly id: string;
-  readonly organizationId: string;
-  readonly ruleId: string;
-  readonly version: number;
-  readonly subjectType: string;
-  readonly subjectId: string | undefined;
-  readonly trigger: string;
-  readonly matched: boolean;
-  readonly results: Readonly<Record<string, boolean | null>>;
-  readonly mode: "live" | "test";
-  readonly evaluatedBy: string | undefined;
-  readonly evaluatedAt: Temporal.Instant;
-}
-interface RuleListOptions {
-  readonly subjectType?: string;
-  readonly trigger?: string;
-  readonly enabled?: boolean;
-}
-/** What `matching` and `run` test: one subject, as the trigger event saw it. */
-interface RuleSubject {
-  readonly subjectType: string;
-  readonly trigger: string;
-  /** The record the field catalog's columns read, such as the expense row with its submitter. */
-  readonly subject: Readonly<Record<string, unknown>>;
-  /** The IANA zone relative dates ("today") resolve in. Default `UTC`. */
-  readonly timeZone?: string;
-}
-interface RulesOptions extends BlockTemporalOptions {
-  /** The caller's transport (`rpcTransport(supabase)`). */
-  readonly transport: BlockTransport;
-  /** The module schema, or its API schema. Default `better_supabase`. */
-  readonly schema?: string;
-  readonly mappers?: readonly ErrorMapper[];
-  /** `withBlockHooks` hooks around the client's methods. */
-  readonly hooks?: BlockHooks<Rules>;
-  /** Receives the errors `after` hooks throw. Default: `console`. */
-  readonly logger?: Logger;
-}
-interface Rules {
-  /** The field catalog, for one subject type or all of them. */
-  fields(subjectType?: string): AsyncResult<readonly RuleField[]>;
-  /** The organization's rules in evaluation order (needs `rules.read`). */
-  list(organizationId: string, options?: RuleListOptions): AsyncResult<readonly Rule[]>;
-  /** `undefined` when the caller can't read a rule with this id. */
-  get(id: string): AsyncResult<Rule | undefined>;
-  /**
-   * Creates or changes a rule. `rules.edit` covers disabled rules;
-   * enabling a rule or changing an enabled one takes `rules.publish`.
-   */
-  save(organizationId: string, input: RuleInput): AsyncResult<Rule>;
-  /** Turns a rule on or off (needs `rules.publish`). */
-  setEnabled(id: string, enabled: boolean): AsyncResult<Rule>;
-  /** Moves a rule to a rank key from `rankBetween` over its neighbours. */
-  move(id: string, rank: string): AsyncResult<Rule>;
-  /** Removes a rule with its history (needs `rules.admin`); `false` when there is none to remove. */
-  remove(id: string): AsyncResult<boolean>;
-  /** Saved versions, newest first. */
-  versions(id: string): AsyncResult<readonly RuleVersion[]>;
-  /** The evaluation log, newest first. */
-  evaluations(id: string, options?: {
-    readonly before?: Temporal.Instant;
-    readonly pageSize?: number;
-  }): AsyncResult<readonly RuleEvaluationEntry[]>;
-  /** The enabled rules for the trigger that match, evaluated in the database. */
-  matching(organizationId: string, input: RuleSubject): AsyncResult<readonly RuleMatch[]>;
-  /**
-   * Runs a rule's stored conditions on a sample record and logs it as a test
-   * (needs `rules.edit`). Nothing runs; the result says what would match.
-   */
-  test(rule: Rule, subject: Readonly<Record<string, unknown>>, options?: {
-    readonly fields?: readonly RuleField[];
-    readonly subjectId?: string;
-    readonly clock?: FilterClock;
-  }): AsyncResult<FilterEvaluation>;
-}
-/** A rule row from the module's functions. */
-declare function ruleOf(value: unknown): Rule;
-/** Catalog fields in the shape `evaluateFilterQuery` reads. */
-declare function ruleRecordFields(fields: readonly RuleField[]): readonly FilterRecordField[];
-/**
- * Tests a rule's conditions on one record in memory, the same way the
- * database's `rule_evaluate` does. `fields` is the subject type's catalog.
- */
-declare function evaluateRule(rule: Pick<Rule, "conditions">, subject: unknown, fields: readonly RuleField[], clock?: FilterClock): FilterEvaluation;
-/** Tenant rules as the caller: the catalog, the rules, their history and tests. */
-declare function createRules(options: RulesOptions): Rules;
-interface RulesAdminOptions extends BlockTemporalOptions {
-  /** A service-role transport: `sync_rule_fields` and `run_rules` are granted to `service_role` only. */
-  readonly transport: BlockTransport;
-  readonly schema?: string;
-  readonly mappers?: readonly ErrorMapper[];
-}
-interface RulesAdmin {
-  /** Replaces the subject type's field catalog; returns how many fields it has. */
-  syncFields(catalog: RuleFieldCatalog): AsyncResult<number>;
-  /** Evaluates the enabled rules for the trigger, logs each one live and returns the matches. */
-  run(organizationId: string, input: RuleSubject & {
-    readonly subjectId?: string;
-  }): AsyncResult<readonly RuleMatch[]>;
-}
-/** The field sync and live evaluation, with a service-role client. */
-declare function createRulesAdmin(options: RulesAdminOptions): RulesAdmin;
-/** What a handler receives: the action, the rule it belongs to and the dispatch context. */
-interface RuleActionCall<C = unknown> {
-  readonly action: RuleAction;
-  readonly rule: Rule;
-  readonly results: Readonly<Record<string, boolean | null>>;
-  readonly context: C;
-}
-/** Runs one action kind. Return a `Result`; a throw becomes an `unexpected` error. */
-type RuleActionHandler<C = unknown> = (call: RuleActionCall<C>) => Result<unknown> | PromiseLike<Result<unknown>>;
-/** The outcome of one action: its value, or the error its handler returned. */
-type RuleActionOutcome = {
-  readonly ruleId: string;
-  readonly kind: string;
-  readonly ok: true;
-  readonly value: unknown;
-} | {
-  readonly ruleId: string;
-  readonly kind: string;
-  readonly ok: false;
-  readonly error: DbError;
-};
-interface RuleDispatcherOptions<C> {
-  /** A handler per action kind, such as `approvals.request`. */
-  readonly handlers: Readonly<Record<string, RuleActionHandler<C>>>;
-}
-interface RuleDispatcher<C = unknown> {
-  /**
-   * Runs the actions of `matches` in order. A failed action doesn't stop the
-   * others; each one's outcome comes back. A kind without a handler is an
-   * `invalid_request` outcome with the hint `RULE_ACTION_UNKNOWN`.
-   */
-  dispatch(matches: readonly RuleMatch[], context: C): AsyncResult<readonly RuleActionOutcome[]>;
-}
-/** Runs matched rules' actions with the app's handlers. */
-declare function createRuleDispatcher<C = unknown>(options: RuleDispatcherOptions<C>): RuleDispatcher<C>;
-/** An outbox event as the rule sink reads it; an `OutboxEvent` fits. */
-interface RuleSinkEvent {
-  readonly id: string;
-  readonly type: string;
-  readonly payload?: unknown;
-  readonly tenant?: string | null;
-}
-/** What `load` returns for an event the rules should see: the subject and the dispatch context. */
-interface RuleSinkTarget<C> {
-  readonly organizationId: string;
-  readonly subjectType: string;
-  readonly subjectId?: string;
-  /** The record the field catalog's columns read. */
-  readonly subject: Readonly<Record<string, unknown>>;
-  readonly timeZone?: string;
-  readonly context: C;
-}
-interface RuleSinkOptions<C> {
-  /** `rules.run` from `createRulesAdmin`, which logs each evaluation live. */
-  readonly rules: Pick<RulesAdmin, "run">;
-  readonly dispatcher: RuleDispatcher<C>;
-  /**
-   * Reads the subject an event is about, such as the app table row named by
-   * `payload.id`. `undefined` skips the event.
-   */
-  readonly load: (event: RuleSinkEvent) => RuleSinkTarget<C> | undefined | PromiseLike<RuleSinkTarget<C> | undefined>;
-  /** Receives each event's action outcomes, failed ones included. */
-  readonly onOutcomes?: (event: RuleSinkEvent, outcomes: readonly RuleActionOutcome[]) => void;
-}
-/**
- * An outbox consumer handler that tests the rules whose trigger is the
- * event's type and runs the actions of the ones that match, for
- * `outbox.consume("rules", createRuleSink(...))`. It throws
- * when the evaluation fails, so the outbox retries the event; a failed
- * action goes to `onOutcomes` instead, since a retry would run the others
- * again.
- */
-declare function createRuleSink<C = unknown>(options: RuleSinkOptions<C>): (events: readonly RuleSinkEvent[]) => Promise<void>;
-//#endregion
-//#region src/blocks/rules/client.d.ts
-interface RuleBuilderControllerOptions {
-  readonly client: Pick<Rules, "fields" | "get" | "save">;
-  readonly auth: AuthPort;
-  readonly organizationId: string;
-  /** The rule to edit; `null` edits a new one. */
-  readonly rule: string | null;
-  /** The record type whose fields the rules test. */
-  readonly subjectType: string;
-  /** A new rule's trigger, such as `expense.submitted`. */
-  readonly trigger?: string;
-  /** The tree a new rule starts with, such as a fixed first condition. */
-  readonly initial?: FilterQuery;
-  /**
-   * Node ids the editor may not change, move or remove, such as the fixed
-   * first condition. Only the editor knows them; the stored rule doesn't.
-   */
-  readonly locked?: readonly string[];
-  /** Defaults to `RULE_LIMITS`. */
-  readonly limits?: FilterLimits;
-  /** Makes node ids. Defaults to `crypto.randomUUID()`. */
-  readonly newId?: () => string;
-}
-interface RuleBuilderSnapshot {
-  /** The stored rule; `undefined` for a new one or before the first load. */
-  readonly rule: Rule | undefined;
-  /** The subject type's field catalog; `undefined` until loaded. */
-  readonly fields: readonly RuleField[] | undefined;
-  readonly name: string;
-  readonly conditions: FilterQuery;
-  readonly actions: readonly RuleAction[];
-  readonly stopProcessing: boolean;
-  readonly locked: readonly string[];
-  /** Problems in the tree, checked against the fields once they load. */
-  readonly issues: readonly ValidationIssue[];
-  /** Whether the name, tree, actions or `stopProcessing` differ from the stored rule. */
-  readonly dirty: boolean;
-  readonly loading: boolean;
-  readonly saving: boolean;
-  readonly error: DbError | undefined;
-}
-interface RuleBuilderActions {
-  /** Loads the fields and the rule again, dropping unsaved edits. */
-  readonly refresh: () => Promise<void>;
-  /** Adds a condition to `group` (the root by default) and returns its id. */
-  readonly addRule: (group?: string, field?: string) => string;
-  /** Adds an empty group to `group` (the root by default) and returns its id. */
-  readonly addGroup: (group?: string, combinator?: FilterCombinator) => string;
-  readonly remove: (id: string) => void;
-  /** Moves a node into `group`, where it ends up at `index`. */
-  readonly move: (id: string, group: string, index: number) => void;
-  readonly setField: (id: string, field: string) => void;
-  /** Keeps the value when the operator takes the same kind of value. */
-  readonly setOperator: (id: string, operator: string) => void;
-  readonly setValue: (id: string, value: unknown) => void;
-  readonly setNegated: (id: string, negated: boolean) => void;
-  readonly setCombinator: (group: string, combinator: FilterCombinator) => void;
-  readonly setName: (name: string) => void;
-  readonly setActions: (actions: readonly RuleAction[]) => void;
-  readonly setStopProcessing: (stop: boolean) => void;
-  readonly lock: (id: string) => void;
-  readonly unlock: (id: string) => void;
-  /** Drops unsaved edits. */
-  readonly reset: () => void;
-  /**
-   * Saves the rule, `enabled` turning it on or off with it. The saved rule,
-   * or `undefined` with `error` set.
-   */
-  readonly save: (options?: {
-    readonly enabled?: boolean;
-  }) => Promise<Rule | undefined>;
-}
-type RuleBuilderController = Controller<RuleBuilderSnapshot, RuleBuilderActions>;
-/**
- * The editor state of one rule: the field catalog, the condition tree and
- * the edits to it, with validation, dirty state and save.
- */
-declare function createRuleBuilderController(options: RuleBuilderControllerOptions): RuleBuilderController;
-//#endregion
-export { evaluateRule as A, ruleFilterFields as B, RulesAdmin as C, createRuleSink as D, createRuleDispatcher as E, RuleFieldCatalog as F, RuleFieldDefinition as I, checkRuleConditions as L, ruleRecordFields as M, RULE_LIMITS as N, createRules as O, RuleField as P, defineRuleFields as R, Rules as S, RulesOptions as T, RuleSinkEvent as _, createRuleBuilderController as a, RuleSubject as b, RuleActionCall as c, RuleDispatcher as d, RuleDispatcherOptions as f, RuleMatch as g, RuleListOptions as h, RuleBuilderSnapshot as i, ruleOf as j, createRulesAdmin as k, RuleActionHandler as l, RuleInput as m, RuleBuilderController as n, Rule as o, RuleEvaluationEntry as p, RuleBuilderControllerOptions as r, RuleAction as s, RuleBuilderActions as t, RuleActionOutcome as u, RuleSinkOptions as v, RulesAdminOptions as w, RuleVersion as x, RuleSinkTarget as y, ruleFilterFieldInfo as z };

package/dist/client-DyfWYU8S.js

@@ -1,84 +0,0 @@
-import { n as dbError } from "./errors-BV1SKTVs.js";
-import { r as err } from "./result-DIeYscA3.js";
-import { n as whileSignedIn, t as defineController } from "./controller-D6NyNrlZ.js";
-//#region src/blocks/comments/client.ts
-/**
-* One subject's comment thread for the signed-in user: loads it, keeps it
-* current after `add`, `edit` and `remove`, and loads it again for each
-* message on `topic`.
-*/
-function createCommentsController(options) {
-	const { client, organizationId, subjectType, subjectId } = options;
-	const topic = options.topic ?? null;
-	return defineController({
-		comments: void 0,
-		status: "closed",
-		error: void 0
-	}, (state) => {
-		let ticket = 0;
-		const refresh = async () => {
-			if (organizationId === null) return;
-			const request = ++ticket;
-			const result = await client.list(organizationId, subjectType, subjectId, options.limit === void 0 ? {} : { limit: options.limit });
-			if (request !== ticket) return;
-			state.set(result.ok ? {
-				comments: result.data,
-				error: void 0
-			} : { error: result.error });
-		};
-		const replace = (comment) => {
-			ticket += 1;
-			state.set((current) => {
-				const comments = current.comments ?? [];
-				return {
-					error: void 0,
-					comments: comments.some((each) => each.id === comment.id) ? comments.map((each) => each.id === comment.id ? comment : each) : [...comments, comment]
-				};
-			});
-		};
-		return {
-			actions: {
-				refresh,
-				add: async (body, draft = {}) => {
-					if (organizationId === null) return err(dbError("invalid_input", "No organization is active"));
-					const result = await client.create({
-						...draft,
-						organizationId,
-						subjectType,
-						subjectId,
-						body
-					});
-					if (result.ok) replace(result.data);
-					else state.set({ error: result.error });
-					return result;
-				},
-				edit: async (id, edit) => {
-					const result = await client.edit(id, edit);
-					if (result.ok) replace(result.data);
-					else state.set({ error: result.error });
-					return result;
-				},
-				remove: async (id) => {
-					const result = await client.remove(id);
-					if (result.ok) await refresh();
-					else state.set({ error: result.error });
-					return result;
-				}
-			},
-			start: () => organizationId === null ? void 0 : whileSignedIn(options.auth, () => {
-				refresh();
-				if (topic === null) return;
-				const { leave } = options.ports.topic(topic, {
-					onMessage: () => void refresh(),
-					onRejoin: () => void refresh(),
-					onStatus: (status) => {
-						state.set({ status });
-					}
-				});
-				return leave;
-			})
-		};
-	});
-}
-//#endregion
-export { createCommentsController as t };

package/dist/client-Dz1jWDA2.js

@@ -1,209 +0,0 @@
-import { n as dbError } from "./errors-BV1SKTVs.js";
-import { a as ok, r as err } from "./result-DIeYscA3.js";
-import { n as whileSignedIn, t as defineController } from "./controller-D6NyNrlZ.js";
-import { t as authResult } from "./auth-reply-Daq72lY4.js";
-//#region src/blocks/mfa/client.ts
-const toAal = (level) => level === "aal2" ? "aal2" : level === "aal1" ? "aal1" : void 0;
-const toFactor = (raw) => ({
-	id: raw.id,
-	name: raw.friendly_name === "" ? void 0 : raw.friendly_name,
-	type: raw.factor_type,
-	verified: raw.status === "verified"
-});
-async function readAssurance(mfa) {
-	const result = await authResult(() => mfa.getAuthenticatorAssuranceLevel());
-	return result.ok ? ok({
-		level: toAal(result.data.currentLevel),
-		nextLevel: toAal(result.data.nextLevel)
-	}) : result;
-}
-async function readFactors(mfa) {
-	const result = await authResult(() => mfa.listFactors());
-	return result.ok ? ok(result.data.all.map(toFactor)) : result;
-}
-/** Whether `error` is the `INSUFFICIENT_AAL` refusal that asks for a step-up. */
-function needsStepUp(error) {
-	return error?.kind === "forbidden" && error.code === "INSUFFICIENT_AAL";
-}
-/**
-* A user's MFA factors for a security settings page: `enroll` shows a QR
-* code, `verify` confirms it with the first code, and `unenroll` removes a
-* factor. The assurance level is read again after each change.
-*/
-function createMfaController(options) {
-	const { mfa } = options;
-	return defineController({
-		factors: void 0,
-		level: void 0,
-		nextLevel: void 0,
-		enrollment: void 0,
-		pending: false,
-		error: void 0
-	}, (state) => {
-		let ticket = 0;
-		const refresh = async () => {
-			const request = ++ticket;
-			const [factors, assurance] = await Promise.all([readFactors(mfa), readAssurance(mfa)]);
-			if (request !== ticket) return;
-			if (!factors.ok) {
-				state.set({ error: factors.error });
-				return;
-			}
-			if (!assurance.ok) {
-				state.set({ error: assurance.error });
-				return;
-			}
-			state.set({
-				factors: factors.data,
-				...assurance.data
-			});
-		};
-		const settle = async (result) => {
-			state.set(result.ok ? { pending: false } : {
-				pending: false,
-				error: result.error
-			});
-			if (result.ok) await refresh();
-			return result;
-		};
-		return {
-			actions: {
-				refresh,
-				dismiss: () => {
-					state.set({ error: void 0 });
-				},
-				enroll: async (input) => {
-					state.set({
-						pending: true,
-						error: void 0
-					});
-					const result = await authResult(() => mfa.enroll({
-						factorType: "totp",
-						...input?.name === void 0 ? {} : { friendlyName: input.name },
-						...options.issuer === void 0 ? {} : { issuer: options.issuer }
-					}));
-					const enrolled = result.ok ? ok({
-						factorId: result.data.id,
-						qrCode: result.data.totp.qr_code,
-						secret: result.data.totp.secret,
-						uri: result.data.totp.uri
-					}) : result;
-					if (enrolled.ok) state.set({ enrollment: enrolled.data });
-					return settle(enrolled);
-				},
-				verify: async (code) => {
-					const enrollment = state.get().enrollment;
-					if (enrollment === void 0) return err(dbError("invalid_input", "Enrol a factor before verifying it"));
-					state.set({
-						pending: true,
-						error: void 0
-					});
-					const verified = await authResult(() => mfa.challengeAndVerify({
-						factorId: enrollment.factorId,
-						code
-					}));
-					if (!verified.ok) return settle(err(verified.error));
-					state.set({ enrollment: void 0 });
-					return settle(await readAssurance(mfa));
-				},
-				cancel: async () => {
-					const enrollment = state.get().enrollment;
-					if (enrollment === void 0) return;
-					state.set({
-						enrollment: void 0,
-						pending: true
-					});
-					await settle(await authResult(() => mfa.unenroll({ factorId: enrollment.factorId })));
-				},
-				unenroll: async (factorId) => {
-					state.set({
-						pending: true,
-						error: void 0
-					});
-					const result = await authResult(() => mfa.unenroll({ factorId }));
-					return settle(result.ok ? ok(true) : result);
-				}
-			},
-			start: () => whileSignedIn(options.auth, () => {
-				refresh();
-			})
-		};
-	});
-}
-/**
-* Raises the session to `aal2` before a call that `checkAal` guards: show
-* it when an error passes `needsStepUp`, then retry the call once
-* `satisfied` is true.
-*/
-function createStepUpController(options) {
-	const { mfa } = options;
-	return defineController({
-		factors: void 0,
-		level: void 0,
-		nextLevel: void 0,
-		satisfied: false,
-		verifying: false,
-		error: void 0
-	}, (state) => {
-		let ticket = 0;
-		const assured = (assurance) => ({
-			...assurance,
-			satisfied: assurance.level === "aal2"
-		});
-		const refresh = async () => {
-			const request = ++ticket;
-			const [factors, assurance] = await Promise.all([readFactors(mfa), readAssurance(mfa)]);
-			if (request !== ticket) return;
-			if (!factors.ok) {
-				state.set({ error: factors.error });
-				return;
-			}
-			if (!assurance.ok) {
-				state.set({ error: assurance.error });
-				return;
-			}
-			state.set({
-				factors: factors.data.filter((factor) => factor.verified),
-				...assured(assurance.data)
-			});
-		};
-		return {
-			actions: {
-				refresh,
-				dismiss: () => {
-					state.set({ error: void 0 });
-				},
-				verify: async (code, factorId) => {
-					const id = factorId ?? state.get().factors?.[0]?.id;
-					if (id === void 0) {
-						const missing = dbError("invalid_input", "No verified factor to challenge");
-						state.set({ error: missing });
-						return err(missing);
-					}
-					state.set({
-						verifying: true,
-						error: void 0
-					});
-					const verified = await authResult(() => mfa.challengeAndVerify({
-						factorId: id,
-						code
-					}));
-					const result = verified.ok ? await readAssurance(mfa) : verified;
-					state.set(result.ok ? {
-						verifying: false,
-						...assured(result.data)
-					} : {
-						verifying: false,
-						error: result.error
-					});
-					return result;
-				}
-			},
-			start: () => whileSignedIn(options.auth, () => {
-				refresh();
-			})
-		};
-	});
-}
-//#endregion
-export { createStepUpController as n, needsStepUp as r, createMfaController as t };