better-supabase 0.11.0 → 0.13.0

package/dist/jws-CwBB5QAT.js

@@ -1,193 +0,0 @@
-import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { a as toBase64Url, r as fromBase64 } from "./base64-D4aqdnDR.js";
-//#region src/core/jws.ts
-let encoderInstance;
-let decoderInstance;
-const encoder = { encode: (text) => (encoderInstance ??= new TextEncoder()).encode(text) };
-const decoder = { decode: (bytes) => (decoderInstance ??= new TextDecoder()).decode(bytes) };
-const EC = {
-	name: "ECDSA",
-	namedCurve: "P-256"
-};
-/** The members WebCrypto imports, without `kid`, `alg` and other extras. */
-function keyMaterial(jwk, alg, withPrivate) {
-	const key = publicJwk(jwk);
-	return {
-		kty: key.kty,
-		crv: String(key.crv),
-		x: String(key.x),
-		...alg === "ES256" ? { y: String(key.y) } : {},
-		...withPrivate ? { d: String(jwk.d) } : {}
-	};
-}
-const importParams = (alg) => alg === "Ed25519" ? { name: "Ed25519" } : EC;
-const signParams = (alg) => alg === "Ed25519" ? { name: "Ed25519" } : {
-	name: "ECDSA",
-	hash: "SHA-256"
-};
-/** The key type behind a JWS `alg`, or undefined for one this module doesn't verify. */
-function keyAlgorithmOf(alg) {
-	if (alg === "ES256" || alg === "RS256" || alg === "PS256") return alg;
-	if (alg === "EdDSA" || alg === "Ed25519") return "Ed25519";
-}
-/** RFC 7518 section 3.3: an RSA key for RS256 or PS256 has at least 2048 bits. */
-const RSA_MIN_BYTES = 256;
-function isRsaKey(jwk) {
-	if (jwk.kty !== "RSA" || typeof jwk.n !== "string") return false;
-	try {
-		const modulus = fromBase64(jwk.n);
-		const leadingZero = modulus[0] === 0 ? 1 : 0;
-		return typeof jwk.e === "string" && modulus.length - leadingZero >= RSA_MIN_BYTES;
-	} catch {
-		return false;
-	}
-}
-/** Whether `jwk` can verify a JWS of key type `alg`. */
-function verifiesWith(jwk, alg, name) {
-	if (alg === "RS256" || alg === "PS256") return isRsaKey(jwk) && (jwk.alg === void 0 || jwk.alg === name);
-	return jwkAlgorithm(jwk) === alg;
-}
-const RSA_PARAMS = {
-	RS256: {
-		name: "RSASSA-PKCS1-v1_5",
-		hash: "SHA-256"
-	},
-	PS256: {
-		name: "RSA-PSS",
-		hash: "SHA-256"
-	}
-};
-const verifyParams = (alg) => {
-	switch (alg) {
-		case "RS256": return { name: "RSASSA-PKCS1-v1_5" };
-		case "PS256": return {
-			name: "RSA-PSS",
-			saltLength: 32
-		};
-		case "Ed25519":
-		case "ES256": return signParams(alg);
-		default: return alg;
-	}
-};
-/** The key type of a JWK: `OKP`/`Ed25519` or `EC`/`P-256`. */
-function jwkAlgorithm(jwk) {
-	if (jwk.kty === "OKP" && jwk.crv === "Ed25519") return "Ed25519";
-	if (jwk.kty === "EC" && jwk.crv === "P-256") return "ES256";
-}
-/** The public members of `jwk`, without `d` and other private parts. */
-function publicJwk(jwk) {
-	const alg = jwkAlgorithm(jwk);
-	if (alg === "Ed25519") return {
-		kty: "OKP",
-		crv: "Ed25519",
-		x: String(jwk.x)
-	};
-	if (alg === "ES256") return {
-		kty: "EC",
-		crv: "P-256",
-		x: String(jwk.x),
-		y: String(jwk.y)
-	};
-	throw new TypeError("Only Ed25519 and P-256 keys are supported");
-}
-/** The RFC 7638 SHA-256 thumbprint of a key, base64url: a stable `kid`. */
-async function jwkThumbprint(jwk) {
-	const key = publicJwk(jwk);
-	const canonical = key.kty === "OKP" ? `{"crv":"${key.crv}","kty":"OKP","x":"${key.x}"}` : `{"crv":"${key.crv}","kty":"EC","x":"${key.x}","y":"${key.y}"}`;
-	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(canonical));
-	return toBase64Url(new Uint8Array(digest));
-}
-/** A new key pair as JWKs, with the RFC 7638 thumbprint as `kid`. */
-async function generateSigningKey(alg) {
-	const pair = await crypto.subtle.generateKey(importParams(alg), true, ["sign", "verify"]);
-	if (!("privateKey" in pair)) throw new TypeError("WebCrypto returned a single key, not a key pair");
-	const privateKey = await crypto.subtle.exportKey("jwk", pair.privateKey);
-	return {
-		kid: await jwkThumbprint(privateKey),
-		publicKey: publicJwk(privateKey),
-		privateKey
-	};
-}
-/** Imports the private JWK of an Ed25519 or P-256 key for signing. */
-function importSigningKey(jwk) {
-	const alg = jwkAlgorithm(jwk);
-	if (alg === void 0 || typeof jwk.d !== "string") throw new TypeError("A signing key is a private Ed25519 or P-256 JWK");
-	return crypto.subtle.importKey("jwk", keyMaterial(jwk, alg, true), importParams(alg), false, ["sign"]);
-}
-/** Imports the public JWK of a key whose type `verifiesWith` already matched to `alg`. */
-function importVerifyKey(jwk, alg) {
-	if (alg === "RS256" || alg === "PS256") return crypto.subtle.importKey("jwk", {
-		kty: "RSA",
-		n: String(jwk.n),
-		e: String(jwk.e)
-	}, RSA_PARAMS[alg], false, ["verify"]);
-	return crypto.subtle.importKey("jwk", keyMaterial(jwk, alg, false), importParams(alg), false, ["verify"]);
-}
-/** The raw signature of `data`: 64 bytes for Ed25519, `r || s` for ES256 (as JWS needs). */
-async function signBytes(key, alg, data) {
-	return new Uint8Array(await crypto.subtle.sign(signParams(alg), key, data.slice()));
-}
-/** A compact JWS (RFC 7515) over the JSON `payload`. */
-async function signCompact(key, alg, header, payload) {
-	const input = `${toBase64Url(JSON.stringify(header))}.${toBase64Url(JSON.stringify(payload))}`;
-	const signature = await signBytes(key, alg, encoder.encode(input));
-	return `${input}.${toBase64Url(signature)}`;
-}
-/** Why a token failed `verifyCompact`. */
-var JwsError = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.name = "JwsError";
-		this.code = code;
-	}
-};
-function part(text) {
-	if (text === void 0) throw new JwsError("JWS_MALFORMED", "Not a JWS");
-	let value;
-	try {
-		value = JSON.parse(decoder.decode(fromBase64(text)));
-	} catch {
-		throw new JwsError("JWS_MALFORMED", "A JWS part is not base64url JSON");
-	}
-	if (!isRecord(value)) throw new JwsError("JWS_MALFORMED", "A JWS part is not a JSON object");
-	return value;
-}
-/**
-* Verifies a compact JWS against `jwks`: the header's `kid` picks the key
-* (or the only key of the matching type when there is no `kid`). Throws a
-* `JwsError`; checks no claims, which are the caller's to read.
-*/
-async function verifyCompact(token, jwks, options = {}) {
-	const pieces = token.split(".");
-	if (pieces.length !== 3) throw new JwsError("JWS_MALFORMED", "A compact JWS has three parts");
-	const header = part(pieces[0]);
-	const payload = part(pieces[1]);
-	const alg = typeof header["alg"] === "string" ? header["alg"] : "";
-	const allowed = options.algorithms ?? [
-		"EdDSA",
-		"Ed25519",
-		"ES256"
-	];
-	const keyAlg = keyAlgorithmOf(alg);
-	if (keyAlg === void 0 || !allowed.some((name) => name === alg)) throw new JwsError("JWS_ALG", `The alg ${alg || "(none)"} is not accepted`);
-	if (options.typ !== void 0 && (typeof header["typ"] !== "string" || header["typ"].toLowerCase() !== options.typ.toLowerCase())) throw new JwsError("JWS_TYP", `The typ must be ${options.typ}`);
-	const kid = typeof header["kid"] === "string" ? header["kid"] : void 0;
-	const candidates = jwks.keys.filter((jwk) => verifiesWith(jwk, keyAlg, alg) && (kid === void 0 || jwk.kid === kid));
-	const jwk = candidates.length === 1 ? candidates[0] : void 0;
-	if (jwk === void 0) throw new JwsError("JWS_KEY", `No key matches kid ${kid ?? "(none)"}`);
-	if (!await crypto.subtle.verify(verifyParams(keyAlg), await importVerifyKey(jwk, keyAlg), fromBase64(pieces[2] ?? ""), encoder.encode(`${pieces[0]}.${pieces[1]}`))) throw new JwsError("JWS_SIGNATURE", "The signature is invalid");
-	return {
-		header,
-		payload
-	};
-}
-function isJwkCandidate(value) {
-	return isRecord(value) && typeof value["kty"] === "string";
-}
-/** Parses a JWK Set, keeping only the Ed25519 and P-256 keys (and RSA keys with `rsa`). */
-function jwksOf(value, options = {}) {
-	return { keys: (isRecord(value) && Array.isArray(value["keys"]) ? value["keys"] : []).filter((key) => isJwkCandidate(key) && (jwkAlgorithm(key) !== void 0 || options.rsa === true && isRsaKey(key))) };
-}
-//#endregion
-export { jwksOf as a, verifyCompact as c, jwkThumbprint as i, generateSigningKey as n, signBytes as o, importSigningKey as r, signCompact as s, JwsError as t };

package/dist/kit-BeZX2pR_.d.ts

@@ -1,66 +0,0 @@
-import { b as DbError } from "./result-BREt7qOh.js";
-import { r as AuthState } from "./resolve-Bqb8TMTt.js";
-import { t as AuthSession } from "./view-Bf7e07rQ.js";
-import { r as GuardOptions } from "./respond-CEBC6KUX.js";
-import { StandardSchemaV1 } from "@standard-schema/spec";
-//#region src/server/kit.d.ts
-/** What a server action returns: plain data, safe across any serialization boundary. */
-type ActionResult<T> = {
-  readonly ok: true;
-  readonly data: T;
-  readonly error: null;
-} | {
-  readonly ok: false;
-  readonly data: null;
-  readonly error: DbError;
-};
-/**
- * Checks after `allow`, `aal` and `scopes`. A caller who fails one gets
- * `forbidden`: an `ActionResult` error, a 403, or the framework's refusal.
- */
-interface AuthorizeOptions<I, C, P, R extends boolean, Ref = unknown> {
-  /** Refuse callers without an active tenant, so `ctx.tenant` is a string. */
-  readonly requireTenant?: R;
-  /** Admit only users holding one of these roles at `roleClaim`. */
-  readonly roles?: readonly string[];
-  /** The dotted claim path `roles` reads: one string or an array. Defaults to `app_metadata.role`. */
-  readonly roleClaim?: string;
-  /**
-   * The permission the server's `authorizer` must grant. Without an
-   * authorizer, or on any outcome but `granted`, the caller is refused;
-   * `approval-required` refuses with `code: "APPROVAL_REQUIRED"`.
-   */
-  readonly permission?: Ref;
-  /** Return `false` to refuse the caller, e.g. `(session, input) => input.ownerId === session.user.id`. */
-  readonly authorize?: (session: AuthSession<C, P>, input: I) => boolean | Promise<boolean>;
-}
-/** What `requireTenant` and `authorize` add to the context. */
-interface AuthorizedContext<C, P, R extends boolean> {
-  readonly session: AuthSession<C, P>;
-  /**
-   * The active tenant: the action's `tenant`, then the server's `tenant`
-   * option, then the tenant claim (`tenantOf(session)`).
-   */
-  readonly tenant: R extends true ? string : string | undefined;
-}
-type ActionInput<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferInput<S> | FormData : unknown;
-type ActionParsed<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<S> : unknown;
-type Unwrapped<T> = T extends {
-  readonly ok: true;
-  readonly data: infer D;
-} ? D : T extends {
-  readonly ok: false;
-} ? never : T;
-/** Guard, authorize and validate options of a framework-neutral action. */
-interface BlockActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R, Ref> {
-  /** Validates the input (plain object or `FormData`) with any Standard Schema. */
-  readonly input?: S;
-}
-/** The guard and authorize checks of a loader, page or route. */
-interface BlockRequireOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<undefined, C, P, R, Ref> {}
-/** The strings at a dotted claim path: one string, or every string in an array. */
-declare function rolesAt(claims: Readonly<Record<string, unknown>> | undefined, path: string): readonly string[];
-/** Whether a signed-in caller holds one of `roles` at the claim `path`. */
-declare function hasRole(auth: AuthState, roles: readonly string[], path?: string): boolean;
-//#endregion
-export { AuthorizedContext as a, Unwrapped as c, AuthorizeOptions as i, hasRole as l, ActionParsed as n, BlockActionOptions as o, ActionResult as r, BlockRequireOptions as s, ActionInput as t, rolesAt as u };

package/dist/kit-LTbHrWWD.js

@@ -1,104 +0,0 @@
-import { n as dbError } from "./errors-BV1SKTVs.js";
-import { n as validate } from "./standard-B1BigegP.js";
-import { n as claimAt } from "./claims-PqzCxaTD.js";
-import { t as authContext } from "./context-BiwgsycK.js";
-import { n as toSession } from "./view-CYX1wsgp.js";
-import { o as settle, r as guard } from "./respond-Bhp3G__q.js";
-import { n as checkPermission } from "./authorizer-B3yyCVUF.js";
-//#region src/server/kit.ts
-/** `FormData` as a plain object; repeated keys become arrays. */
-function formDataObject(form) {
-	const out = {};
-	for (const key of new Set(form.keys())) {
-		const values = form.getAll(key);
-		out[key] = values.length > 1 ? values : values[0];
-	}
-	return out;
-}
-/** A failed `ActionResult`. */
-function actionError(error) {
-	return {
-		ok: false,
-		data: null,
-		error
-	};
-}
-/** What a `permission` on an action or route is checked against. */
-function callerResource(input) {
-	if (input === void 0 || input instanceof Request) return { type: "route" };
-	if (typeof input !== "object" || input === null || Array.isArray(input) || input instanceof FormData) return { type: "action" };
-	return {
-		type: "action",
-		properties: input
-	};
-}
-/**
-* `requireTenant`, `roles`, `permission` and `authorize`, in that order: the
-* session and tenant, or why the caller is refused.
-*/
-async function authorizeCaller(auth, checks, input, tenant, authorizer) {
-	const session = toSession(auth);
-	if (checks.requireTenant && tenant === void 0) return dbError("forbidden", "Choose an organization first", { code: "NO_TENANT" });
-	if (checks.roles && !hasRole(auth, checks.roles, checks.roleClaim)) return dbError("forbidden", "You do not have the role this needs", { code: "MISSING_ROLE" });
-	if (checks.permission !== void 0) {
-		const permitted = await checkPermission({
-			authorizer,
-			permission: checks.permission,
-			resource: callerResource(input),
-			context: {
-				...authContext(auth),
-				...tenant === void 0 ? {} : { tenant }
-			}
-		});
-		if (!permitted.ok) return permitted.error;
-	}
-	if (checks.authorize && !await checks.authorize(session, input)) return dbError("forbidden", "You are not allowed to do this", { code: "NOT_AUTHORIZED" });
-	return {
-		session,
-		tenant
-	};
-}
-/** `guard`, then `authorizeCaller`: the caller, or the refusal. */
-async function requireCaller(auth, options, tenant, authorizer) {
-	return guard(auth, options.allow, options.aal, options.scopes) ?? authorizeCaller(auth, options, void 0, tenant, authorizer);
-}
-/**
-* Runs an action body with the guard, input validation and authorize checks
-* every adapter shares, and settles it into an `ActionResult`: `Result`s
-* unwrap, thrown `DbException`s become errors, other throws propagate (so
-* framework redirects keep working).
-*/
-async function runAction(auth, options, input, tenant, body, authorizer) {
-	const denied = guard(auth, options.allow, options.aal, options.scopes);
-	if (denied) return actionError(denied);
-	let parsed = input instanceof FormData ? formDataObject(input) : input;
-	if (options.input) {
-		const checked = await validate(options.input, parsed, "input");
-		if (!checked.ok) return actionError(checked.error);
-		parsed = checked.data;
-	}
-	const caller = await authorizeCaller(auth, options, parsed, tenant, authorizer);
-	if ("kind" in caller) return actionError(caller);
-	const settled = await settle(() => body(parsed, caller));
-	return settled.ok ? {
-		ok: true,
-		data: settled.data,
-		error: null
-	} : actionError(settled.error);
-}
-/** The strings at a dotted claim path: one string, or every string in an array. */
-function rolesAt(claims, path) {
-	const single = claimAt(claims, path);
-	if (single !== void 0) return [single];
-	let value = claims;
-	for (const segment of path.split(".")) value = typeof value === "object" && value !== null ? value[segment] : void 0;
-	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
-}
-/** Whether a signed-in caller holds one of `roles` at the claim `path`. */
-function hasRole(auth, roles, path = "app_metadata.role") {
-	if (auth.kind !== "user") return false;
-	const held = rolesAt(auth.claims, path);
-	return roles.some((role) => held.includes(role));
-}
-//#endregion
-export { rolesAt as a, requireCaller as i, formDataObject as n, runAction as o, hasRole as r, authorizeCaller as t };

package/dist/knowledge-BbdXOJvY.js

@@ -1,272 +0,0 @@
-import { t as DbException } from "./db-exception-CnWcYPxL.js";
-import { n as dbError } from "./errors-BV1SKTVs.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-DIeYscA3.js";
-import { t as vectorLiteral } from "./search-BtoWY6n_.js";
-import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { C as optionalText, D as recordOf, I as textOf, O as recordOrEmpty, f as errorText, h as instantOf, j as run, k as recordsOf, n as applyTemporal, o as blockCall, p as injectableOf } from "./block-helpers-DkVZNDrj.js";
-import { r as withBlockHooks } from "./block-hooks-C22vuIUd.js";
-//#region src/blocks/knowledge/knowledge.ts
-const SCOPES = /* @__PURE__ */ new Set([
-	"organization",
-	"agent",
-	"project",
-	"chat",
-	"user"
-]);
-const STATUSES = /* @__PURE__ */ new Set([
-	"pending",
-	"ready",
-	"failed"
-]);
-const BREAKS = [
-	"\n\n",
-	"\n",
-	". ",
-	" "
-];
-const TEXT_TYPES = /^(text\/|application\/(json|xml|yaml|x-yaml|ld\+json|x-ndjson)\b)/;
-/**
-* Splits text into chunks of at most `size` characters, preferring a
-* paragraph, line, sentence or word break in the second half of each
-* chunk, and repeating `overlap` characters of the previous one.
-*/
-function chunk(text, options = {}) {
-	const size = options.size ?? 2e3;
-	const overlap = options.overlap ?? Math.min(200, Math.floor(size / 10));
-	if (!Number.isInteger(size) || size < 1) throw new RangeError("chunk size must be a positive whole number");
-	if (!Number.isInteger(overlap) || overlap < 0 || overlap >= size) throw new RangeError("chunk overlap must be at least 0 and below size");
-	const clean = text.replaceAll(/\r\n?/g, "\n").trim();
-	const chunks = [];
-	let start = 0;
-	while (start < clean.length) {
-		let end = Math.min(start + size, clean.length);
-		if (end < clean.length) {
-			const window = clean.slice(start, end);
-			for (const mark of BREAKS) {
-				const at = window.lastIndexOf(mark);
-				if (at >= window.length / 2) {
-					end = start + at + mark.length;
-					break;
-				}
-			}
-		}
-		const content = clean.slice(start, end).trim();
-		if (content !== "") chunks.push({
-			content,
-			tokens: Math.ceil(content.length / 4)
-		});
-		if (end >= clean.length) break;
-		const back = Math.max(end - overlap, start + 1);
-		const word = /\s/.test(clean.charAt(back - 1)) ? back - 1 : clean.indexOf(" ", back);
-		start = overlap > 0 && word >= back - 1 && word < end ? word + 1 : back;
-	}
-	return chunks;
-}
-/**
-* An `invalid_input` error unless the embedder returned `count` vectors of
-* one non-zero length with finite numbers.
-*/
-function checkVectors(vectors, count) {
-	const invalid = (message) => dbError("invalid_input", message, { hint: "EMBEDDING_INVALID" });
-	if (vectors.length !== count) return invalid(`The embedder returned ${vectors.length} vectors for ${count} values`);
-	const size = vectors[0]?.length ?? 0;
-	for (const vector of vectors) {
-		if (vector.length === 0 || vector.length !== size) return invalid("The embedder returned vectors of different or zero length");
-		if (!vector.every(Number.isFinite)) return invalid("The embedder returned a vector with a non-finite number");
-	}
-}
-const scopeOf = (value) => {
-	const text = textOf(value);
-	return SCOPES.has(text) ? text : "user";
-};
-const statusOf = (value) => {
-	const text = textOf(value);
-	return STATUSES.has(text) ? text : "failed";
-};
-function documentOf(value) {
-	const row = recordOf(value, "knowledge_documents");
-	return {
-		id: textOf(row["id"]),
-		organizationId: textOf(row["organization_id"]),
-		ownerId: textOf(row["owner_id"]),
-		scope: scopeOf(row["scope"]),
-		scopeId: optionalText(row["scope_id"]),
-		fileId: optionalText(row["file_id"]),
-		title: textOf(row["title"]),
-		source: optionalText(row["source"]),
-		metadata: recordOrEmpty(row["metadata"]),
-		status: statusOf(row["status"]),
-		error: optionalText(row["error"]),
-		chunkCount: Number(row["chunk_count"] ?? 0),
-		embeddingModel: optionalText(row["embedding_model"]),
-		createdAt: instantOf(row["created_at"]),
-		updatedAt: instantOf(row["updated_at"])
-	};
-}
-function hitOf(value) {
-	const row = recordOf(value, "knowledge_search");
-	return {
-		documentId: textOf(row["document_id"]),
-		index: Number(row["idx"]),
-		content: textOf(row["content"]),
-		metadata: recordOrEmpty(row["metadata"]),
-		title: textOf(row["title"]),
-		score: Number(row["score"])
-	};
-}
-const notFound = () => dbError("not_found", "No knowledge document you can see has this id", { hint: "KNOWLEDGE_NOT_FOUND" });
-const decoder = /* @__PURE__ */ new TextDecoder("utf-8", { fatal: true });
-function defaultExtract(file, data) {
-	if (!TEXT_TYPES.test(file.mediaType)) return Promise.reject(/* @__PURE__ */ new TypeError(`No text extractor for ${file.mediaType}; pass extract to createKnowledge`));
-	return Promise.resolve(decoder.decode(data));
-}
-const unsupported = (cause) => dbError("invalid_request", errorText(cause), { hint: "KNOWLEDGE_UNSUPPORTED" });
-/** Documents, chunks and hybrid search for retrieval. */
-function createKnowledge(options) {
-	applyTemporal(options);
-	const call = blockCall(options.transport, options.schema, options.mappers);
-	const service = blockCall(options.service ?? options.transport, options.schema, options.mappers);
-	const batchSize = options.batchSize ?? 64;
-	const extract = options.extract ?? defaultExtract;
-	const embedder = injectableOf("embedder", options.embedder);
-	const found = (value) => isRecord(value) ? AsyncResult.ok(documentOf(value)) : AsyncResult.err(notFound());
-	const create = (organizationId, document) => call("create_knowledge_document", {
-		tenant: organizationId,
-		title: document.title,
-		scope: document.scope,
-		scope_id: document.scopeId,
-		file_id: document.fileId,
-		source: document.source,
-		metadata: document.metadata,
-		owner: document.ownerId
-	}, documentOf);
-	const write = (documentId, chunks) => call("write_knowledge_chunks", {
-		document_id: documentId,
-		chunks: { items: chunks },
-		model: embedder?.model
-	}, (value) => value).andThen(found);
-	const fromText = (organizationId, document, text) => run(() => Promise.resolve(chunk(text, options.chunking))).andThen((chunks) => create(organizationId, document).andThen((created) => write(created.id, chunks)));
-	const embed = (values, signal) => embedder ? run(() => embedder.embed(values, signal === void 0 ? void 0 : { signal })) : AsyncResult.err(dbError("invalid_request", "createKnowledge has no embedder", { hint: "KNOWLEDGE_NO_EMBEDDER" }));
-	const process = (documentId, processOptions = {}) => AsyncResult.from(async () => {
-		let before = Number.POSITIVE_INFINITY;
-		for (;;) {
-			const pending = await service("pending_knowledge_chunks", {
-				document_id: documentId,
-				batch: batchSize
-			}, (value) => recordsOf(value, "pending_knowledge_chunks"));
-			if (!pending.ok) return pending;
-			if (pending.data.length === 0) return ok(0);
-			const vectors = await embed(pending.data.map((row) => textOf(row["content"])), processOptions.signal);
-			if (!vectors.ok) return vectors;
-			const invalid = checkVectors(vectors.data, pending.data.length);
-			if (invalid) return err(invalid);
-			const remaining = await service("set_knowledge_embeddings", {
-				document_id: documentId,
-				embeddings: { items: pending.data.map((row, index) => ({
-					idx: Number(row["idx"]),
-					hash: row["hash"],
-					embedding: vectorLiteral(vectors.data[index] ?? [])
-				})) },
-				model: embedder?.model
-			}, Number);
-			if (!remaining.ok || remaining.data === 0) return remaining;
-			if (processOptions.signal?.aborted) return ok(remaining.data);
-			if (remaining.data >= before) return ok(remaining.data);
-			before = remaining.data;
-		}
-	});
-	const client = {
-		documents: {
-			create,
-			get: (documentId) => call("get_knowledge_document", { document_id: documentId }, (value) => value).andThen(found),
-			list: (organizationId, listOptions = {}) => call("list_knowledge_documents", {
-				tenant: organizationId,
-				scope: listOptions.scope,
-				scope_id: listOptions.scopeId,
-				max_rows: listOptions.limit
-			}, (value) => recordsOf(value, "list_knowledge_documents").map(documentOf)),
-			write,
-			remove: (documentId) => call("delete_knowledge_document", { document_id: documentId }, (value) => value === true)
-		},
-		ingest: {
-			text: (organizationId, { text, ...document }) => fromText(organizationId, document, text),
-			file: (organizationId, fileId, document = {}) => {
-				const files = options.files;
-				if (!files) return AsyncResult.err(dbError("invalid_request", "createKnowledge has no files block", { hint: "KNOWLEDGE_NO_FILES" }));
-				return files.files.read(fileId).andThen(({ file, data }) => AsyncResult.from(async () => {
-					try {
-						return ok(await extract(file, data));
-					} catch (cause) {
-						return err(unsupported(cause));
-					}
-				}).andThen((text) => fromText(organizationId, {
-					...document,
-					title: document.title ?? file.filename,
-					fileId: file.id,
-					source: document.source ?? file.filename
-				}, text)));
-			}
-		},
-		process,
-		embedJob: () => async (payload, job, signal) => {
-			const result = await process(payload.document_id, { signal });
-			if (result.ok) return;
-			if (job.attempts >= job.maxAttempts) await service("fail_knowledge_document", {
-				document_id: payload.document_id,
-				error: result.error.message
-			}, (value) => value);
-			throw new DbException(result.error);
-		},
-		drain: (drainOptions = {}) => service("pending_knowledge_documents", { batch: drainOptions.batch }, (value) => Array.isArray(value) ? value.map(textOf) : []).andThen((ids) => AsyncResult.from(async () => {
-			const attempts = Math.max(1, drainOptions.attempts ?? 3);
-			let done = 0;
-			for (const id of ids) {
-				if (drainOptions.signal?.aborted) break;
-				let result = await process(id, drainOptions);
-				for (let attempt = 1; !result.ok && attempt < attempts && !drainOptions.signal?.aborted; attempt += 1) result = await process(id, drainOptions);
-				if (result.ok) done += 1;
-				else if (!drainOptions.signal?.aborted) await service("fail_knowledge_document", {
-					document_id: id,
-					error: result.error.message
-				}, (value) => value);
-			}
-			return ok(done);
-		})),
-		search: (organizationId, query, searchOptions = {}) => {
-			const { text, embedding } = typeof query === "string" ? {
-				text: query,
-				embedding: void 0
-			} : query;
-			return (embedding === void 0 && embedder !== void 0 && text !== void 0 && text !== "" ? embed([text], searchOptions.signal).map((vectors) => vectors[0]) : AsyncResult.ok(embedding)).andThen((value) => call("knowledge_search", {
-				tenant: organizationId,
-				query_embedding: value === void 0 ? void 0 : vectorLiteral(value),
-				query_text: text === "" ? void 0 : text,
-				scopes: searchOptions.scopes === void 0 ? void 0 : { items: searchOptions.scopes },
-				k: searchOptions.k,
-				filter: searchOptions.filter
-			}, (rows) => recordsOf(rows, "knowledge_search").map(hitOf)));
-		},
-		reembed: (reembedOptions = {}) => service("reembed_knowledge", {
-			tenant: reembedOptions.organizationId,
-			model: reembedOptions.model
-		}, Number)
-	};
-	const { documents, ingest, ...hooks } = options.hooks ?? {};
-	const logger = options.logger ? { logger: options.logger } : {};
-	return withBlockHooks({
-		...client,
-		documents: withBlockHooks(client.documents, documents, {
-			block: "knowledge.documents",
-			...logger
-		}),
-		ingest: withBlockHooks(client.ingest, ingest, {
-			block: "knowledge.ingest",
-			...logger
-		})
-	}, hooks, {
-		block: "knowledge",
-		...logger
-	});
-}
-//#endregion
-export { chunk as n, createKnowledge as r, checkVectors as t };