better-supabase 0.12.0 → 0.13.0

package/dist/embeddings-CKhygw4C.d.ts

@@ -1,78 +0,0 @@
-import { d as KnowledgeSearchOptions, n as Embedder, o as KnowledgeHit, r as Knowledge } from "./knowledge-B5zdpDD-.js";
-import { EmbeddingModel, RerankingModel, SourceDocumentUIPart, Tool, embedMany } from "ai";
-//#region src/ai-sdk/embeddings/embeddings.d.ts
-type ProviderOptions = Parameters<typeof embedMany>[0]["providerOptions"];
-interface EmbedWithOptions {
-  /** Concurrent calls when the values need more than one. Default 4. */
-  readonly maxParallelCalls?: number;
-  readonly providerOptions?: ProviderOptions;
-  /** The name stored with each embedding; the provider and model id by default. */
-  readonly name?: string;
-}
-/** The name of an SDK model: the string itself, or `provider/modelId`. */
-declare function modelName(model: string | {
-  readonly provider: string;
-  readonly modelId: string;
-}): string;
-/** An `Embedder` for the knowledge and memory blocks over `embedMany`. */
-declare function embedWith(model: EmbeddingModel, options?: EmbedWithOptions): Embedder;
-type Reranker = (query: string, hits: readonly KnowledgeHit[], options?: {
-  readonly signal?: AbortSignal;
-}) => Promise<readonly KnowledgeHit[]>;
-/** Reorders search hits with a reranking model, keeping the best `topN`. */
-declare function rerankWith(model: RerankingModel, options?: {
-  readonly topN?: number;
-}): Reranker;
-/**
- * Keeps the items of a search the caller may read. A tool applies it before
- * anything else sees the items: the reranker, `onHits` and the model. A
- * throw fails the tool call, so no items reach the model.
- */
-type ResultsFilter<T, C = {
-  readonly query: string;
-}> = (items: readonly T[], context: C) => readonly T[] | PromiseLike<readonly T[]>;
-interface SearchToolOptions extends Omit<KnowledgeSearchOptions, "signal"> {
-  readonly description?: string;
-  /** Drops the hits the caller may not read, such as by a permission. */
-  readonly results?: ResultsFilter<KnowledgeHit>;
-  /** Reranks the hits before the model sees them. */
-  readonly rerank?: Reranker;
-  /** Called with the hits, to stream them as source parts. */
-  readonly onHits?: (hits: readonly KnowledgeHit[]) => void;
-}
-interface SearchToolResult {
-  readonly results: readonly {
-    readonly id: string;
-    readonly title: string;
-    readonly content: string;
-  }[];
-}
-/**
- * A tool that searches the knowledge base as the caller. Each result id
- * is `documentId#index`, the `sourceId` that `toSourceParts` gives it.
- */
-declare function searchTool(knowledge: Knowledge, organizationId: string, options?: SearchToolOptions): Tool<{
-  query: string;
-}, SearchToolResult>;
-/** One `source-document` part per document among the hits, in hit order. */
-declare function toSourceParts(hits: readonly KnowledgeHit[]): SourceDocumentUIPart[];
-/** `Supabase.ai.Session` in Supabase Edge Functions, typed structurally. */
-interface SupabaseAiSession {
-  run(input: string, options: {
-    readonly mean_pool: boolean;
-    readonly normalize: boolean;
-  }): Promise<unknown>;
-}
-interface SupabaseEmbedOptions {
-  /** The built-in model. Default `gte-small` (384 dimensions). */
-  readonly model?: string;
-  /** A session to use instead of `new Supabase.ai.Session(model)`. */
-  readonly session?: SupabaseAiSession;
-}
-/**
- * An `Embedder` over the model built into Supabase Edge Functions. Set the
- * module's `dimensions` option to the model's size (384 for `gte-small`).
- */
-declare function supabaseEmbed(options?: SupabaseEmbedOptions): Embedder;
-//#endregion
-export { SearchToolResult as a, embedWith as c, searchTool as d, supabaseEmbed as f, SearchToolOptions as i, modelName as l, Reranker as n, SupabaseAiSession as o, toSourceParts as p, ResultsFilter as r, SupabaseEmbedOptions as s, EmbedWithOptions as t, rerankWith as u };

package/dist/embeddings-CVeOoufZ.js

@@ -1,128 +0,0 @@
-import { t as DbException } from "./db-exception-CnWcYPxL.js";
-import { embedMany, jsonSchema, rerank, tool } from "ai";
-//#region src/ai-sdk/embeddings/embeddings.ts
-/** The name of an SDK model: the string itself, or `provider/modelId`. */
-function modelName(model) {
-	return typeof model === "string" ? model : `${model.provider}/${model.modelId}`;
-}
-/** An `Embedder` for the knowledge and memory blocks over `embedMany`. */
-function embedWith(model, options = {}) {
-	return {
-		apiVersion: 1,
-		model: options.name ?? modelName(model),
-		embed: async (values, embedOptions) => {
-			if (values.length === 0) return [];
-			const { embeddings } = await embedMany({
-				model,
-				values: [...values],
-				maxParallelCalls: options.maxParallelCalls ?? 4,
-				...options.providerOptions === void 0 ? {} : { providerOptions: options.providerOptions },
-				...embedOptions?.signal === void 0 ? {} : { abortSignal: embedOptions.signal }
-			});
-			return embeddings;
-		}
-	};
-}
-/** Reorders search hits with a reranking model, keeping the best `topN`. */
-function rerankWith(model, options = {}) {
-	return async (query, hits, rerankOptions) => {
-		if (hits.length <= 1) return hits;
-		const { ranking } = await rerank({
-			model,
-			query,
-			documents: hits.map((hit) => hit.content),
-			...options.topN === void 0 ? {} : { topN: options.topN },
-			...rerankOptions?.signal === void 0 ? {} : { abortSignal: rerankOptions.signal }
-		});
-		return ranking.flatMap((entry) => {
-			const hit = hits[entry.originalIndex];
-			return hit === void 0 ? [] : [{
-				...hit,
-				score: entry.score
-			}];
-		});
-	};
-}
-/**
-* A tool that searches the knowledge base as the caller. Each result id
-* is `documentId#index`, the `sourceId` that `toSourceParts` gives it.
-*/
-function searchTool(knowledge, organizationId, options = {}) {
-	const { description, results, rerank: reorder, onHits, ...search } = options;
-	return tool({
-		description: description ?? "Search the knowledge base for passages relevant to a query. Cite results by their id.",
-		inputSchema: jsonSchema({
-			type: "object",
-			properties: { query: {
-				type: "string",
-				description: "What to look for"
-			} },
-			required: ["query"],
-			additionalProperties: false
-		}),
-		execute: async ({ query }, { abortSignal }) => {
-			const found = await knowledge.search(organizationId, query, {
-				...search,
-				...abortSignal === void 0 ? {} : { signal: abortSignal }
-			});
-			if (!found.ok) throw new DbException(found.error);
-			const readable = results ? await results(found.data, { query }) : found.data;
-			const hits = reorder ? await reorder(query, readable, abortSignal === void 0 ? void 0 : { signal: abortSignal }) : readable;
-			onHits?.(hits);
-			return { results: hits.map((hit) => ({
-				id: sourceId(hit),
-				title: hit.title,
-				content: hit.content
-			})) };
-		}
-	});
-}
-const sourceId = (hit) => `${hit.documentId}#${String(hit.index)}`;
-/** One `source-document` part per document among the hits, in hit order. */
-function toSourceParts(hits) {
-	const seen = /* @__PURE__ */ new Set();
-	const parts = [];
-	for (const hit of hits) {
-		if (seen.has(hit.documentId)) continue;
-		seen.add(hit.documentId);
-		parts.push({
-			type: "source-document",
-			sourceId: sourceId(hit),
-			mediaType: "text/plain",
-			title: hit.title
-		});
-	}
-	return parts;
-}
-function supabaseSession(model) {
-	const Session = globalThis.Supabase?.ai?.Session;
-	if (typeof Session !== "function") throw new TypeError("supabaseEmbed runs in Supabase Edge Functions, where Supabase.ai.Session exists; pass session elsewhere");
-	return new Session(model);
-}
-/**
-* An `Embedder` over the model built into Supabase Edge Functions. Set the
-* module's `dimensions` option to the model's size (384 for `gte-small`).
-*/
-function supabaseEmbed(options = {}) {
-	const name = options.model ?? "gte-small";
-	let session = options.session;
-	return {
-		apiVersion: 1,
-		model: `supabase/${name}`,
-		embed: async (values) => {
-			session ??= supabaseSession(name);
-			const vectors = [];
-			for (const value of values) {
-				const output = await session.run(value, {
-					mean_pool: true,
-					normalize: true
-				});
-				if (!Array.isArray(output) || !output.every((x) => typeof x === "number")) throw new TypeError(`Supabase.ai.Session returned no vector for ${name}`);
-				vectors.push(output);
-			}
-			return vectors;
-		}
-	};
-}
-//#endregion
-export { supabaseEmbed as a, searchTool as i, modelName as n, toSourceParts as o, rerankWith as r, embedWith as t };

package/dist/ended-De6H52nX.d.ts

@@ -1,70 +0,0 @@
-import { m as RequestContext } from "./plugin-D-95Q0w0.js";
-import { g as StoredSession, r as AuthState, u as CookieOptions } from "./resolve-Ceft-18-.js";
-//#region src/auth/refresh.d.ts
-interface RefreshOptions {
-  readonly url: string;
-  readonly publishableKey: string;
-  /**
-   * Sends `Sb-Forwarded-For: ip` with the secret key, so Auth rate-limits the
-   * refresh by the user's IP (when IP forwarding is on for the project).
-   */
-  readonly forwardedFor?: {
-    readonly ip: string;
-    readonly secretKey: string;
-  };
-  readonly fetch?: typeof fetch;
-  /**
-   * Milliseconds before a refresh counts as a network failure (the session is
-   * kept). 5000 by default.
-   */
-  readonly timeoutMs?: number;
-  /** Epoch milliseconds, the unit JWT `exp` and `iat` math needs. */
-  readonly now?: () => number;
-}
-type RefreshOutcome = {
-  readonly ok: true;
-  readonly session: StoredSession;
-  /** Served from a concurrent or just-finished refresh of the same token. */
-  readonly shared?: boolean;
-} | {
-  readonly ok: false;
-  /** `rejected`: the refresh token is dead, sign the user out. `network`: keep the session and retry later. */
-  readonly reason: "rejected" | "network";
-  /** For `network`: the fetch failed, timed out, or Auth answered 5xx or 429. */
-  readonly cause?: "fetch" | "timeout" | "status";
-  readonly status?: number;
-  /** The Auth server's `error_code`, such as `user_banned` or `refresh_token_not_found`. */
-  readonly code?: string;
-  readonly message: string;
-};
-/**
- * Exchanges a refresh token for a new session. Concurrent calls with the same
- * token share one request, and a successful result is reused for a short
- * window so parallel requests carrying the old cookie converge on one session.
- */
-declare function refreshSession(refreshToken: string, options: RefreshOptions): Promise<RefreshOutcome>;
-//#endregion
-//#region src/auth/context.d.ts
-/** The repository context (`actor`, `claims`) for an auth state. */
-declare function authContext(auth: AuthState): RequestContext;
-//#endregion
-//#region src/auth/ended.d.ts
-/** `banned`: Auth rejected the token with `error_code: "user_banned"`. */
-type SessionStatus = "active" | "ended" | "banned" | "unknown";
-interface SessionStatusOptions {
-  readonly url: string;
-  readonly publishableKey: string;
-  readonly cookieName?: string;
-  readonly fetch?: typeof fetch;
-  readonly timeoutMs?: number;
-  readonly now?: () => number;
-}
-interface ClearSessionCookiesOptions {
-  readonly url: string;
-  readonly cookieName?: string;
-  readonly cookie?: CookieOptions;
-}
-declare function sessionStatus(input: Request | string, options: SessionStatusOptions): Promise<SessionStatus>;
-declare function clearSessionCookies<R extends Response>(request: Request, response: R, options: ClearSessionCookiesOptions): R;
-//#endregion
-export { sessionStatus as a, RefreshOutcome as c, clearSessionCookies as i, refreshSession as l, SessionStatus as n, authContext as o, SessionStatusOptions as r, RefreshOptions as s, ClearSessionCookiesOptions as t };

package/dist/entitlements-C8UvF1Rz.js

@@ -1,45 +0,0 @@
-import { t as AsyncResult } from "./result-DIeYscA3.js";
-import { j as run, o as blockCall } from "./block-helpers-DkVZNDrj.js";
-import { r as withBlockHooks } from "./block-hooks-C22vuIUd.js";
-//#region src/blocks/entitlements/entitlements.ts
-/** The Stripe event sent when a customer's active entitlements change. */
-const ENTITLEMENTS_UPDATED = "entitlements.active_entitlement_summary.updated";
-function stripeCustomerOf(payload) {
-	if (typeof payload !== "object" || payload === null) return;
-	const customer = (payload.data?.object)?.customer;
-	if (typeof customer === "string") return customer;
-	const id = customer?.id;
-	return typeof id === "string" ? id : void 0;
-}
-/**
-* Users whose `memberships` claim carries the entitlements of the Stripe
-* customer in an `entitlements.active_entitlement_summary.updated` event, so
-* a job can invalidate their sessions. Empty for other payloads.
-*/
-function entitlementMembers(sql, payload) {
-	const customer = stripeCustomerOf(payload);
-	if (customer === void 0) return AsyncResult.ok([]);
-	return run(() => sql.queryRaw("select user_id from better_supabase.entitlement_members($1) as user_id", [customer])).map((rows) => rows.map((row) => row.user_id));
-}
-/**
-* Reads the caller's entitlements through the `entitlements` module's
-* `has_entitlement` and `entitlement_value`, which check membership.
-*/
-function createEntitlements(options) {
-	const call = blockCall(options.transport, options.schema, options.mappers);
-	return withBlockHooks({
-		has: (organizationId, key) => call("has_entitlement", {
-			tenant: organizationId,
-			key
-		}, (value) => value === true),
-		value: (organizationId, key) => call("entitlement_value", {
-			tenant: organizationId,
-			key
-		}, (value) => value === null ? void 0 : value)
-	}, options.hooks, {
-		block: "entitlements",
-		...options.logger ? { logger: options.logger } : {}
-	});
-}
-//#endregion
-export { createEntitlements as n, entitlementMembers as r, ENTITLEMENTS_UPDATED as t };

package/dist/entitlements-CtBGXb3B.d.ts

@@ -1,53 +0,0 @@
-import { t as AuthSnapshot } from "./bind-Bfo40o63.js";
-import { t as AuthSession } from "./view-KQhe6eNc.js";
-//#region src/auth/entitlements.d.ts
-/**
- * One entry of the `memberships` claim when a hook writes it as a list.
- * Hooks strip `null`s, so optional fields are absent rather than `null`.
- */
-interface MembershipClaim {
-  /** The scope the membership is in, e.g. `tenant` or `organization`. */
-  readonly scope: string;
-  readonly id: string;
-  /** Parent scopes, e.g. `{ organization: '...' }` for a project membership. */
-  readonly within?: Readonly<Record<string, string>>;
-  readonly roles: readonly string[];
-  readonly via?: string;
-  /** Unix seconds. */
-  readonly expiresAt?: number;
-  readonly grantedBy?: string;
-  readonly reason?: string;
-  readonly member?: {
-    readonly group: string;
-  };
-  readonly managedBy?: "idp";
-  /** Seats, not plan features: those are in the `features` claim. */
-  readonly entitlements?: readonly string[];
-}
-/**
- * Entitlement keys of the `features` claim: the literal union when
- * `betterSupabase.claims(schema)` declares one (`z.enum([...])`), otherwise `string`.
- */
-type EntitlementKey<C> = C extends {
-  readonly features?: infer F;
-} ? NonNullable<F> extends Readonly<Record<string, readonly (infer K)[]>> ? K extends string ? K : string : string : string;
-/** Where `hasEntitlement` reads the features claim, and its short codes. */
-interface EntitlementClaimOptions {
-  /** `config.claims.features`, default `features`. */
-  readonly claim?: string;
-  /** `entitlements.claim.keys`: the short code written for each feature key. */
-  readonly keys?: Readonly<Record<string, string>>;
-}
-/**
- * Whether the session's plan-features claim grants `key` in `tenantId`.
- * `claim` is `config.claims.features` (default `features`), the claim
- * `better_supabase.feature_claims()` fills, or `{ claim, keys }` when
- * `entitlements.claim.keys` writes short codes. The claim is as fresh as the
- * token: enforce it in RLS with `better_supabase.has_entitlement()`, and
- * refresh the session after checkout. A tenant left out by
- * `entitlements.claim.maxTenants` reads as not granted. Takes a server
- * session or the client's `useAuth()` snapshot.
- */
-declare function hasEntitlement<C>(session: AuthSession<C> | AuthSnapshot, tenantId: string, key: EntitlementKey<C>, claim?: string | EntitlementClaimOptions): boolean;
-//#endregion
-export { hasEntitlement as i, EntitlementKey as n, MembershipClaim as r, EntitlementClaimOptions as t };

package/dist/envelope-C4Z55LKW.js

@@ -1,90 +0,0 @@
-import { n as dbError } from "./errors-BV1SKTVs.js";
-import { a as ok, r as err } from "./result-DIeYscA3.js";
-import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { o as tenantFrom, s as tenantPathsFor } from "./claims-PqzCxaTD.js";
-import { n as impersonatorClaim, r as impersonatorOf } from "./impersonation-DxU6yHJV.js";
-import { i as delegatedClaims, n as PERMISSION_CAP_CLAIM, o as permissionCapOf, t as DELEGATION_CLAIMS } from "./delegation-B7uNnz6z.js";
-//#region src/blocks/jobs/envelope.ts
-/** Marks a payload that carries a job context; pgmq stores it as the payload. */
-const ENVELOPE = "$bs";
-function ticketOf(context, options) {
-	const ticket = options.ticket ?? context?.["ticket"];
-	if (ticket === void 0) return ok(void 0);
-	if (typeof ticket === "string" && ticket !== "") return ok(ticket);
-	return err(dbError("validation", "A job ticket is a non-empty string", { issues: [{
-		message: "Expected a non-empty string",
-		path: ["ticket"]
-	}] }));
-}
-/**
-* The context a job records: the actor, the tenant, the ticket, and the
-* `act` chain and delegation of the token, so a job an OAuth or MCP client
-* queued runs with that client's scopes, never the user's full rights.
-* An invalid `act` chain or malformed delegation is `forbidden`.
-*/
-function recordContext(context, options = {}) {
-	const ticket = ticketOf(context, options);
-	if (!ticket.ok) return ticket;
-	if (!context) return ok(ticket.data === void 0 ? void 0 : { ticket: ticket.data });
-	const claims = context.claims ?? {};
-	const delegated = delegatedClaims(claims);
-	if (!delegated.ok) return err(dbError("forbidden", delegated.reason === "invalid-chain" ? "The job context has an invalid act claim" : "The job context has invalid delegation claims"));
-	const cap = permissionCapOf(claims);
-	if (cap === false) return err(dbError("forbidden", "The job context has an invalid permission cap"));
-	const tenant = tenantFrom(context, tenantPathsFor(void 0));
-	const impersonator = impersonatorOf(claims);
-	const recorded = {
-		...context.actor ? { actor: context.actor } : {},
-		...tenant === void 0 ? {} : { tenant },
-		...ticket.data === void 0 ? {} : { ticket: ticket.data },
-		...delegated.delegation,
-		...cap === void 0 ? {} : { [PERMISSION_CAP_CLAIM]: cap },
-		...impersonator ? { act: impersonatorClaim(impersonator) } : {}
-	};
-	if (!recorded.actor && recorded.tenant === void 0 && recorded.ticket === void 0) return ok(void 0);
-	return ok(recorded);
-}
-/** Wraps a payload with the recorded context of `context`, when there is one. */
-function wrapPayload(payload, context, options = {}) {
-	const recorded = recordContext(context, options);
-	if (!recorded.ok) return recorded;
-	return ok(recorded.data === void 0 ? payload : {
-		[ENVELOPE]: 1,
-		context: recorded.data,
-		payload
-	});
-}
-/** `wrapPayload` that throws a `TypeError` for a context it refuses. */
-function withContext(payload, context, options = {}) {
-	const wrapped = wrapPayload(payload, context, options);
-	if (!wrapped.ok) throw new TypeError(wrapped.error.message);
-	return wrapped.data;
-}
-function isActor(value) {
-	return isRecord(value) && typeof value["id"] === "string" && (value["kind"] === "user" || value["kind"] === "service" || value["kind"] === "anon");
-}
-/**
-* Splits a stored payload into the payload and its recorded context. The
-* recorded `act` and delegation claims come back as they were stored, so
-* `forContext` checks them again and refuses a malformed one.
-*/
-function unwrap(stored) {
-	if (!isRecord(stored) || stored[ENVELOPE] !== 1 || !Object.hasOwn(stored, "payload")) return {
-		payload: stored,
-		context: {}
-	};
-	const recorded = isRecord(stored["context"]) ? stored["context"] : {};
-	const { actor, tenant, ticket } = recorded;
-	const claims = Object.fromEntries(DELEGATION_CLAIMS.filter((key) => Object.hasOwn(recorded, key) && recorded[key] !== void 0).map((key) => [key, recorded[key]]));
-	return {
-		payload: stored["payload"],
-		context: {
-			...isActor(actor) ? { actor } : {},
-			...typeof tenant === "string" && tenant.length > 0 ? { tenant } : {},
-			...ticket === void 0 ? {} : { ticket },
-			...Object.keys(claims).length > 0 ? { claims } : {}
-		}
-	};
-}
-//#endregion
-export { withContext as n, wrapPayload as r, unwrap as t };