better-supabase 0.11.0 → 0.13.0

package/dist/ports-DGe1vzF2.d.ts

@@ -1,285 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { T as ErrorMapper, t as AsyncResult } from "./result-BREt7qOh.js";
-import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as StandardSchemaV1 } from "./standard-BcUQuUgu.js";
-import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
-import { r as BlockTemporalOptions } from "./block-helpers-CjcQM1yA.js";
-import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
-import { r as FieldsOf } from "./block-fields-DnaDbgZS.js";
-import { f as AiFiles } from "./types-DO9xWsGC.js";
-import { g as JobHandler } from "./types-BEEFkNFY.js";
-import { i as EventSink } from "./cloud-event-DXkNoI6v.js";
-import { g as Workflows } from "./workflows-DQBCzrHC.js";
-//#region src/blocks/attachments/attachments.d.ts
-interface StorageReply<T> {
-  readonly data: T | null;
-  readonly error: unknown;
-}
-/** The `supabase.storage.from(bucket)` methods attachments use. */
-interface AttachmentBucket {
-  createSignedUploadUrl(path: string): PromiseLike<StorageReply<{
-    readonly signedUrl: string;
-    readonly token: string;
-  }>>;
-  createSignedUrl(path: string, expiresIn: number, options?: {
-    download?: string | boolean;
-  }): PromiseLike<StorageReply<{
-    readonly signedUrl: string;
-  }>>;
-  download(path: string): PromiseLike<StorageReply<Blob>>;
-  remove(paths: string[]): PromiseLike<StorageReply<unknown>>;
-  /** Used by `put`, which uploads from the server. */
-  upload?(path: string, body: Blob | ArrayBuffer | Uint8Array, options?: {
-    readonly contentType?: string;
-    readonly upsert?: boolean;
-  }): PromiseLike<StorageReply<unknown>>;
-}
-/** `supabase.storage`, typed structurally. */
-interface AttachmentStorage {
-  from(bucket: string): AttachmentBucket;
-}
-interface AttachmentsOptions<S extends StandardSchemaV1 | undefined = undefined> extends BlockTemporalOptions {
-  /**
-   * A Standard Schema for the attachment columns the app adds
-   * (`blocks.attachments.options.extraColumns`), keyed by column name. It
-   * types and parses them on every read, and validates them on `upload`
-   * and `put`, which return a `validation` error for a bad value.
-   */
-  readonly fields?: S;
-  /** `withBlockHooks` hooks around the client's methods. */
-  readonly hooks?: NoInfer<BlockHooks<Attachments<FieldsOf<S>>>>;
-  /** Receives the errors `after` hooks throw. Default: `console`. */
-  readonly logger?: Logger;
-  /** The caller's transport (`rpcTransport(supabase)`). */
-  readonly transport: BlockTransport;
-  /** The caller's `supabase.storage`, so the bucket policies apply. */
-  readonly storage: AttachmentStorage;
-  /** The module schema, or its API schema: `defineBlocks` passes it from `blocks.generated.ts`. Default `better_supabase`. */
-  readonly schema?: string;
-  readonly mappers?: readonly ErrorMapper[];
-  /**
-   * `blocks.attachments.options.requireScan`, which `defineBlocks` passes
-   * from `blocks.generated.ts`. Default `true`.
-   */
-  readonly requireScan?: boolean;
-  /** Lifetime of a signed download URL in seconds. Default 300. */
-  readonly downloadTtl?: number;
-}
-type AttachmentStatus = "pending" | "clean" | "infected" | "failed";
-interface Attachment {
-  readonly id: string;
-  /** `undefined` for a file of a subject without a tenant (`tenant: false`). */
-  readonly organizationId: string | undefined;
-  readonly subjectType: string | undefined;
-  readonly subjectId: string | undefined;
-  readonly bucket: string;
-  /** The object path in the bucket, `{organizationId}/attachments/{id}` unless `options.path` says otherwise. */
-  readonly path: string;
-  readonly name: string;
-  readonly mimeType: string;
-  readonly size: number;
-  readonly status: AttachmentStatus;
-  /** What the scanner reported, such as the signature it matched. */
-  readonly scanDetail: string | undefined;
-  /** What `upload` stored with the file; `{}` without any. */
-  readonly metadata: Readonly<Record<string, unknown>>;
-  readonly uploadedBy: string | undefined;
-  readonly createdAt: Temporal.Instant;
-  /** Set by `confirm()` once the object exists. */
-  readonly uploadedAt: Temporal.Instant | undefined;
-  readonly scannedAt: Temporal.Instant | undefined;
-}
-interface NewAttachment {
-  /** `null` for a subject type configured with `tenant: false`. */
-  readonly organizationId: string | null;
-  readonly name: string;
-  readonly mimeType: string;
-  /** Bytes; `confirm()` replaces it with the stored size. */
-  readonly size: number;
-  readonly subjectType?: string;
-  readonly subjectId?: string;
-  /** App data about the file, such as a caption or its source, kept with the record. */
-  readonly metadata?: Readonly<Record<string, unknown>>;
-}
-interface AttachmentUpload<F extends object = Record<never, never>> {
-  readonly attachment: Attachment & F;
-  /** PUT the file here, or pass `token` to `uploadToSignedUrl(path, token, file)`. */
-  readonly signedUrl: string;
-  readonly token: string;
-}
-interface AttachmentDownload<F extends object = Record<never, never>> {
-  readonly attachment: Attachment & F;
-  readonly signedUrl: string;
-}
-/** `F` is the extra attachment fields `options.fields` describes. */
-interface Attachments<F extends object = Record<never, never>> {
-  /**
-   * Creates the pending record and a signed upload URL for its path. When
-   * Storage refuses the URL, the record is deleted again.
-   */
-  upload(attachment: NewAttachment & Partial<F>): AsyncResult<AttachmentUpload<F>>;
-  /** Marks the upload done after the file is stored; emits `attachment.uploaded`. */
-  confirm(id: string): AsyncResult<Attachment & F>;
-  get(id: string): AsyncResult<Attachment & F>;
-  list(organizationId: string | null, subject?: {
-    readonly type: string;
-    readonly id: string;
-  }): AsyncResult<readonly (Attachment & F)[]>;
-  /**
-   * A signed URL for a file the scanner passed. `invalid_request` with hint
-   * `ATTACHMENT_NOT_SCANNED` until then, and for an infected file.
-   */
-  download(id: string, options?: {
-    readonly as?: string | boolean;
-  }): AsyncResult<AttachmentDownload<F>>;
-  /** Deletes the file, then the record (the uploader, or `attachments.manage`). */
-  remove(id: string): AsyncResult<boolean>;
-  /**
-   * Creates the record, uploads `file` from the server and confirms it, for
-   * files the server makes or fetches (an export, a generated PDF, an
-   * import). Returns the confirmed attachment, which still waits for the
-   * scan when the module requires one. When Storage refuses the upload,
-   * the record is deleted again, so no pending record is left behind.
-   */
-  put(attachment: NewAttachment & Partial<F>, file: Blob | ArrayBuffer | Uint8Array): AsyncResult<Attachment & F>;
-  /**
-   * The file's bytes, for server-side processing, behind the same scan gate
-   * as `download`: `ATTACHMENT_NOT_SCANNED` until the scan passes.
-   */
-  read(id: string): AsyncResult<{
-    readonly attachment: Attachment & F;
-    readonly file: Blob;
-  }>;
-}
-declare function createAttachments<S extends StandardSchemaV1 | undefined = undefined>(options: AttachmentsOptions<S>): Attachments<FieldsOf<S>>;
-/** A scanner's verdict on one file. */
-interface ScanVerdict {
-  readonly status: "clean" | "infected";
-  /** Stored as `scan_detail`, such as the matched signature. */
-  readonly detail?: string;
-}
-interface AttachmentScannerOptions extends BlockTemporalOptions {
-  /** A service-role transport: `set_attachment_status()` is granted to `service_role` only. */
-  readonly transport: BlockTransport;
-  /** A service-role `supabase.storage`, to read pending files. */
-  readonly storage: AttachmentStorage;
-  readonly schema?: string;
-  /** Scans the file (ClamAV, a scanning API). A throw records `failed` and rethrows. */
-  readonly scan: (file: Blob, attachment: Attachment, signal?: AbortSignal) => ScanVerdict | Promise<ScanVerdict>;
-  /** The outbox `typePrefix`. Default `dev.better-supabase`. */
-  readonly typePrefix?: string;
-}
-/** The payload `job` expects. */
-interface AttachmentScanJob {
-  readonly attachmentId: string;
-}
-interface AttachmentScanner {
-  /** Scans one uploaded file and records the verdict. */
-  scan(id: string, signal?: AbortSignal): AsyncResult<Attachment>;
-  /**
-   * A jobs handler: `queue.work('attachment-scans', scanner.job)`. A deleted
-   * attachment completes the job; other errors throw so the queue retries.
-   */
-  readonly job: JobHandler<AttachmentScanJob>;
-  /**
-   * An outbox sink that scans each `attachment.uploaded` event's file. An
-   * event for a deleted attachment is skipped, so it never holds up the
-   * events behind it; other errors throw so the relay retries the batch.
-   */
-  sink(): EventSink;
-}
-/**
- * Scans uploaded files with the app's `scan` function and records `clean`,
- * `infected` or `failed`. A file already clean or infected is not scanned
- * again, so replayed events and retried jobs are safe.
- */
-declare function createAttachmentScanner(options: AttachmentScannerOptions): AttachmentScanner;
-/** A scanned object in any bucket (`scanned_objects`). */
-interface ScannedObject {
-  readonly bucket: string;
-  readonly path: string;
-  readonly status: AttachmentStatus;
-  readonly detail: string | undefined;
-  readonly scannedAt: Temporal.Instant | undefined;
-}
-interface ObjectScannerOptions extends BlockTemporalOptions {
-  /** A service-role transport: `set_object_scan()` is granted to `service_role` only. */
-  readonly transport: BlockTransport;
-  /** A service-role `supabase.storage`, to read the objects. */
-  readonly storage: AttachmentStorage;
-  readonly schema?: string;
-  /** Scans the file. A throw records `failed` and rethrows. */
-  readonly scan: (file: Blob, object: {
-    readonly bucket: string;
-    readonly path: string;
-  }, signal?: AbortSignal) => ScanVerdict | Promise<ScanVerdict>;
-  /** The outbox `typePrefix`. Default `dev.better-supabase`. */
-  readonly typePrefix?: string;
-}
-/** The payload `ObjectScanner.job` expects. */
-interface ObjectScanJob {
-  readonly bucket: string;
-  readonly path: string;
-}
-interface ObjectScanner {
-  /** Scans one object and records the verdict; a clean or infected object is not scanned again. */
-  scan(bucket: string, path: string, signal?: AbortSignal): AsyncResult<ScannedObject>;
-  /**
-   * A jobs handler: `queue.work('object-scans', scanner.job)`. An object
-   * deleted from storage completes the job; other errors throw.
-   */
-  readonly job: JobHandler<ObjectScanJob>;
-  /**
-   * An outbox sink that scans each `object.uploaded` event's object. An
-   * event for an object deleted from storage is skipped; other errors throw
-   * so the relay retries the batch.
-   */
-  sink(): EventSink;
-}
-/**
- * The scan gate for objects outside the attachments table, such as a file
- * drive or avatars: scans an object with the app's `scan` function and
- * records the verdict in `scanned_objects`, which storage policies read with
- * `object_clean(bucket_id, name)`. With `options.scanBuckets`, new objects in
- * those buckets get a pending row and an `object.uploaded` event.
- */
-declare function createObjectScanner(options: ObjectScannerOptions): ObjectScanner;
-//#endregion
-//#region src/blocks/ports.d.ts
-/** What a `notifier` port sends: one notification to its recipients. */
-interface NotifierInput {
-  readonly recipients: readonly string[];
-  readonly tenant: string;
-  /** Deduplicates retries of the same send. */
-  readonly key: string;
-  readonly subject?: {
-    readonly type: string;
-    readonly id: string;
-  };
-  readonly data: Readonly<Record<string, unknown>>;
-}
-/** Sends notifications for a block that consumes `notifier`. */
-interface Notifier {
-  send(type: string, input: NotifierInput): unknown;
-}
-/**
- * The ports blocks provide and consume, by name. A manifest's `provides`
- * builds a port from its client, and `createBlocks` hands it to the blocks
- * whose `consumes` name it. Every port has one provider in a set of blocks,
- * except `sink`: each block that provides one adds an outbox sink.
- */
-interface BlockPorts {
-  /** The `notifications` block. */
-  readonly notifier: Notifier;
-  /** The `ai-files` block, for knowledge. */
-  readonly files: AiFiles;
-  /** The `attachments` block, for the drive's files. */
-  readonly attachments: Attachments;
-  /** The `workflows` block, for the workflow builder's schedules. */
-  readonly workflows: Workflows;
-  /** An outbox sink, for `outbox.relayRoute({ consumers: blocks.sinks })`. */
-  readonly sink: EventSink;
-}
-type PortName = keyof BlockPorts;
-//#endregion
-export { createAttachments as C, createAttachmentScanner as S, ObjectScanJob as _, Attachment as a, ScanVerdict as b, AttachmentScanJob as c, AttachmentStatus as d, AttachmentStorage as f, NewAttachment as g, AttachmentsOptions as h, PortName as i, AttachmentScanner as l, Attachments as m, Notifier as n, AttachmentBucket as o, AttachmentUpload as p, NotifierInput as r, AttachmentDownload as s, BlockPorts as t, AttachmentScannerOptions as u, ObjectScanner as v, createObjectScanner as w, ScannedObject as x, ObjectScannerOptions as y };

package/dist/ports-aALjot-D.js

@@ -1,137 +0,0 @@
-import { a as ok, r as err, t as AsyncResult } from "./result-DIeYscA3.js";
-import { n as decodeJwtPayload } from "./base64-D4aqdnDR.js";
-import { i as userContext } from "./impersonation-DxU6yHJV.js";
-import { t as hasAuthModule } from "./auth-module-DbZv2WrR.js";
-import { n as identityKey } from "./user-change-XzvgafU4.js";
-import { n as createQueries } from "./query-Ctz-qKRx.js";
-import { t as fromStorageError } from "./errors-D3BR8iUk.js";
-//#region src/client/bind.ts
-const LOADING = {
-	status: "loading",
-	user: null,
-	claims: null
-};
-const SIGNED_OUT = {
-	status: "signed-out",
-	user: null,
-	claims: null
-};
-/**
-* `session.user`, or `undefined` when auth-js put its placeholder there: with
-* `tokens-only` cookies and no user in `userStorage`, reading `id` throws.
-*/
-function storedUser(session) {
-	try {
-		return typeof session.user.id === "string" ? session.user : void 0;
-	} catch {
-		return;
-	}
-}
-const text = (value) => typeof value === "string" && value !== "" ? value : void 0;
-function snapshotOf(session) {
-	if (!session) return SIGNED_OUT;
-	const claims = decodeJwtPayload(session.access_token) ?? {};
-	const stored = storedUser(session);
-	const id = text(claims["sub"]) ?? stored?.id;
-	if (id === void 0) return SIGNED_OUT;
-	const email = text(claims["email"]) ?? text(stored?.email);
-	const role = text(claims["role"]) ?? text(stored?.role);
-	return {
-		status: "signed-in",
-		user: {
-			id,
-			...email ? { email } : {},
-			...role ? { role } : {}
-		},
-		claims
-	};
-}
-function contextOf(snapshot) {
-	if (snapshot.status !== "signed-in") return {
-		actor: {
-			id: "anon",
-			kind: "anon",
-			role: "anon"
-		},
-		claims: { role: "anon" }
-	};
-	return userContext(snapshot.user, snapshot.claims);
-}
-/**
-* Repositories that follow `supabase`'s session, TanStack Query options and
-* an auth store, for a supabase-js client you created yourself.
-*/
-function bindClient(betterSupabase, supabase, options = {}) {
-	let snapshot = LOADING;
-	let db;
-	const listeners = /* @__PURE__ */ new Set();
-	const followsAuth = hasAuthModule(supabase);
-	if (!followsAuth) snapshot = snapshotOf(null);
-	const onChange = (_event, session) => {
-		const next = snapshotOf(session);
-		if (next.status === snapshot.status && identityKey(next) === identityKey(snapshot)) return;
-		snapshot = next;
-		db = void 0;
-		for (const listener of listeners) listener();
-	};
-	const subscription = followsAuth ? supabase.auth.onAuthStateChange(onChange) : void 0;
-	const client = {
-		betterSupabase,
-		supabase,
-		ports: options.ports ?? {},
-		get db() {
-			db ??= betterSupabase.connect(supabase, contextOf(snapshot));
-			return db;
-		},
-		queries: createQueries(betterSupabase, () => client.db, options.staleTime === void 0 ? {} : { staleTime: options.staleTime }),
-		dispose: () => {
-			subscription?.data.subscription.unsubscribe();
-			listeners.clear();
-		},
-		auth: {
-			current: () => snapshot,
-			subscribe: (listener) => {
-				listeners.add(listener);
-				return () => {
-					listeners.delete(listener);
-				};
-			}
-		}
-	};
-	return client;
-}
-//#endregion
-//#region src/client/ports.ts
-/** A storage port that keeps values in memory, for tests and server renders. */
-function memoryStorage(initial = {}) {
-	const values = new Map(Object.entries(initial));
-	return {
-		get: (key) => Promise.resolve(values.get(key) ?? null),
-		set: (key, value) => {
-			values.set(key, value);
-			return Promise.resolve();
-		},
-		remove: (key) => {
-			values.delete(key);
-			return Promise.resolve();
-		}
-	};
-}
-/** The upload port over Supabase Storage, for web and native picked files alike. */
-function storageUpload(supabase) {
-	return (file, to) => AsyncResult.from(async () => {
-		try {
-			const body = await file.read();
-			const { data, error } = await supabase.storage.from(to.bucket).upload(to.path, body, {
-				...file.type === void 0 ? {} : { contentType: file.type },
-				...to.upsert === void 0 ? {} : { upsert: to.upsert }
-			});
-			if (error) return err(fromStorageError(error, to.bucket));
-			return ok({ path: data.path });
-		} catch (cause) {
-			return err(fromStorageError(cause, to.bucket));
-		}
-	});
-}
-//#endregion
-export { storageUpload as n, bindClient as r, memoryStorage as t };

package/dist/postgrest-CjnO1hbr.d.ts

@@ -1,53 +0,0 @@
-import { v as Operation } from "./executor-BnMC0lj3.js";
-//#region src/compile/postgrest.d.ts
-/**
- * A compiled PostgREST request, expressed as calls on the public
- * postgrest-js builder so it works with any supabase-js client.
- */
-interface PostgrestPlan {
-  /** `select` parameter, or `undefined` for mutations without returning. */
-  readonly select: string | undefined;
-  readonly filters: readonly PlanFilter[];
-  readonly orders: readonly PlanOrder[];
-  readonly limits: readonly PlanLimit[];
-  readonly range: {
-    readonly from: number;
-    readonly to: number;
-  } | undefined;
-  /** The condition can never match; skip the request. */
-  readonly never: boolean;
-  /** `Prefer: max-affected` on an update or delete (PostgREST 13 and later). */
-  readonly maxAffected?: number;
-}
-interface PostgrestCompileOptions {
-  /**
-   * The PostgREST version the request goes to, from `postgrestVersion` in
-   * the config. `maxAffected` needs 13 or later; older versions fail with
-   * `invalid_request` before any request. Defaults to `"13"`.
-   */
-  readonly postgrestVersion?: string;
-}
-type PlanFilter = {
-  readonly kind: "filter";
-  readonly path: string;
-  readonly operator: string;
-  readonly value: string;
-} | {
-  readonly kind: "or";
-  readonly expression: string;
-  readonly referencedTable: string | undefined;
-};
-interface PlanOrder {
-  readonly column: string;
-  readonly ascending: boolean;
-  readonly nullsFirst: boolean | undefined;
-  readonly referencedTable: string | undefined;
-}
-interface PlanLimit {
-  readonly count: number;
-  readonly referencedTable: string | undefined;
-}
-/** Compiles an operation into a PostgREST plan. */
-declare function compilePostgrest(op: Operation, options?: PostgrestCompileOptions): PostgrestPlan;
-//#endregion
-export { PostgrestPlan as a, PostgrestCompileOptions as i, PlanLimit as n, compilePostgrest as o, PlanOrder as r, PlanFilter as t };