better-supabase 0.12.0 → 0.13.0

package/dist/signers-BwKV-9S6.d.ts

@@ -1,385 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { T as ErrorMapper, f as Result, t as AsyncResult } from "./result-BREt7qOh.js";
-import { n as Logger } from "./logger-DWVYUmwi.js";
-import { n as SqlClient } from "./executor-D1hECPGG.js";
-import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
-import { r as BlockTemporalOptions } from "./block-helpers-CjcQM1yA.js";
-import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
-import { t as BlockProblemOptions } from "./problem-DCDIQiTA.js";
-//#region src/blocks/webhooks/incoming-types.d.ts
-/** How a delivery proves it came from the sender. */
-type IncomingVerify = "none" | "standard-webhooks" | "hmac-sha256" | "shared-secret";
-interface IncomingWebhooksOptions extends BlockProblemOptions, BlockTemporalOptions {
-  /**
-   * A service SQL connection (`postgres.admin`): `receive` looks endpoints
-   * up by token, counts the rate limit and stores deliveries with it.
-   */
-  readonly sql: SqlClient;
-  /**
-   * The caller's transport for `create`, `list`, `update` and the other
-   * management calls, so `webhooks.manage` is checked for them. Defaults
-   * to `sqlTransport(sql)`.
-   */
-  readonly transport?: BlockTransport;
-  readonly mappers?: readonly ErrorMapper[];
-  /** `withBlockHooks` hooks around the management methods. */
-  readonly hooks?: BlockHooks<IncomingWebhooks>;
-  /** Receives the errors `after` hooks throw. */
-  readonly logger?: Logger;
-  /** The schema of the `webhooks-in` module. Defaults to `better_supabase`. */
-  readonly schema?: string;
-  /** The webhook inbox source deliveries are stored under. Defaults to `webhook-in`. */
-  readonly source?: string;
-  /**
-   * Deliveries per endpoint and period, counted with the `rate-limit`
-   * module's `hit_rate_limit`. Unset: no limit.
-   */
-  readonly rateLimit?: {
-    readonly max: number;
-    /** Seconds, or a Postgres interval such as `1 minute`. */
-    readonly period: number | string;
-  };
-  /** Request headers stored with each delivery. Defaults to none. */
-  readonly keepHeaders?: readonly string[];
-  /**
-   * Where verified deliveries go. Defaults to `inboxDestination(sql, {
-   * source })`, the webhook inbox; `jobsDestination(jobs, { queue })` sends
-   * them to a jobs queue. A destination can route on the endpoint's
-   * metadata.
-   */
-  readonly destination?: IncomingDestination;
-}
-/** A verified delivery, handed to the destination. */
-interface IncomingDelivery {
-  readonly endpoint: {
-    readonly id: string;
-    readonly tenant: string;
-    readonly metadata: Readonly<Record<string, unknown>>;
-  };
-  /** `options.source`. */
-  readonly source: string;
-  /**
-   * Unique per endpoint and delivery: the signed `webhook-id`, the HMAC, the
-   * `webhook-id` header or a random id. A repeated delivery repeats it.
-   */
-  readonly messageId: string;
-  /** The payload's `type` when it is a string. */
-  readonly type: string | null;
-  /** The parsed JSON body, or `{ body }` when it isn't JSON. */
-  readonly payload: unknown;
-  /** `options.keepHeaders` and the endpoint id header, lowercased. */
-  readonly headers: Readonly<Record<string, string>>;
-}
-interface IncomingDestinationResult {
-  readonly id: string | number;
-  /** True when the destination had the delivery already; `receive` answers 200. */
-  readonly duplicate: boolean;
-}
-/**
- * Stores or forwards verified deliveries. It must detect a repeated
- * `endpoint.id` and `messageId` and report it as a duplicate. Versioned:
- * `apiVersion: 1`.
- */
-interface IncomingDestination {
-  readonly apiVersion: 1;
-  readonly name: string;
-  deliver(delivery: IncomingDelivery): Promise<IncomingDestinationResult>;
-}
-interface CreateIncomingWebhookInput {
-  readonly tenant: string;
-  readonly name: string;
-  /** Defaults to `none`: the token in the URL is the only credential. */
-  readonly verify?: IncomingVerify;
-  readonly metadata?: Readonly<Record<string, unknown>>;
-  /** The header that carries the HMAC for `hmac-sha256`. Defaults to `x-signature`. */
-  readonly signatureHeader?: string;
-  /** The record the endpoint belongs to, a type from `options.subjects`. */
-  readonly subject?: {
-    readonly type: string;
-    readonly id: string;
-  };
-}
-/** An endpoint as members see it: everything but the token and secret. */
-interface IncomingWebhook {
-  readonly id: string;
-  readonly tenant: string;
-  readonly name: string;
-  readonly verify: IncomingVerify;
-  readonly signatureHeader: string | null;
-  readonly enabled: boolean;
-  readonly maxBodyBytes: number;
-  readonly receiveCount: number;
-  readonly lastReceivedAt: string | null;
-  readonly lastStatus: number | null;
-  readonly metadata: Readonly<Record<string, unknown>>;
-  readonly subject: {
-    readonly type: string;
-    readonly id: string;
-  } | null;
-  readonly createdBy: string | null;
-  readonly createdAt: string;
-}
-/** A new endpoint: its token (for the URL) and secret are shown once. */
-interface CreatedIncomingWebhook {
-  readonly id: string;
-  readonly tenant: string;
-  readonly name: string;
-  readonly verify: IncomingVerify;
-  readonly token: string;
-  readonly secret: string | null;
-  readonly signatureHeader: string | null;
-  readonly subject: {
-    readonly type: string;
-    readonly id: string;
-  } | null;
-}
-interface UpdateIncomingWebhookInput {
-  readonly name?: string;
-  readonly metadata?: Readonly<Record<string, unknown>>;
-  readonly verify?: IncomingVerify;
-  readonly signatureHeader?: string;
-}
-interface UpdatedIncomingWebhook {
-  readonly id: string;
-  readonly tenant: string;
-  readonly name: string;
-  readonly verify: IncomingVerify;
-  readonly secret: string | null;
-  readonly signatureHeader: string | null;
-  readonly metadata: Readonly<Record<string, unknown>>;
-}
-interface RotatedIncomingSecret {
-  readonly secret: string;
-  readonly previousSecretExpiresAt: Temporal.Instant | null;
-}
-interface IncomingWebhooks {
-  /**
-   * The route for `/hooks/<token>`: finds the endpoint, checks the body
-   * size, the rate limit and the signature, stores the delivery in the
-   * webhook inbox with the endpoint's tenant and answers 202 (200 for a
-   * repeated delivery). A delivery repeats when its signed `webhook-id`
-   * does (`standard-webhooks`), when its body does (`hmac-sha256`, whose
-   * signature covers only the body), or when its `webhook-id` header does
-   * (`none`). Needs a service connection.
-   */
-  receive(request: Request, token: string): Promise<Response>;
-  /** Creates an endpoint for a tenant; the caller needs `webhooks.manage`. */
-  create(input: CreateIncomingWebhookInput): AsyncResult<CreatedIncomingWebhook>;
-  /** A new token, and with `rotateSecret` a new secret. */
-  rotate(id: string, options?: {
-    readonly rotateSecret?: boolean;
-  }): AsyncResult<{
-    readonly token: string;
-    readonly secret: string | null;
-  }>;
-  rotateSecret(id: string, options?: {
-    readonly grace?: Temporal.Duration | string;
-  }): AsyncResult<RotatedIncomingSecret>;
-  update(id: string, input: UpdateIncomingWebhookInput): AsyncResult<UpdatedIncomingWebhook>;
-  setEnabled(id: string, enabled: boolean): AsyncResult<boolean>;
-  remove(id: string): AsyncResult<boolean>;
-  /**
-   * A tenant's endpoints, or one subject's, as the caller sees them (the
-   * read policy hides endpoints whose subject they can't read).
-   */
-  list(tenant: string, subject?: {
-    readonly type: string;
-    readonly id?: string;
-  }): AsyncResult<readonly IncomingWebhook[]>;
-}
-//#endregion
-//#region src/blocks/webhooks/url-policy.d.ts
-/**
- * Decides whether a webhook may be sent to `url`. Throwing means the check
- * itself failed (a DNS lookup error): deliveries retry it, and `safeFetch`
- * throws `UrlCheckError`.
- */
-type AllowUrl = (url: URL) => boolean | Promise<boolean>;
-/** The addresses a host name resolves to. */
-type ResolveHost = (hostname: string) => Promise<readonly string[]>;
-interface PublicUrlOptions {
-  /**
-   * Resolves host names so each address can be checked. Defaults to
-   * `node:dns` where the runtime has it (Node, Bun, Deno); pass one on other
-   * runtimes, or `false` to check only the URL.
-   */
-  readonly resolve?: ResolveHost | false;
-  /** Allow `http:` URLs, e.g. for local development. */
-  readonly allowHttp?: boolean;
-  /** Host names that skip every check, e.g. an internal receiver you trust. */
-  readonly allowHosts?: readonly string[];
-}
-/**
- * Whether an IP address is reachable on the public internet: not loopback,
- * private, link-local (cloud metadata), carrier-grade NAT, multicast or
- * reserved. Returns `false` for anything that isn't an IP address.
- */
-declare function isPublicAddress(address: string): boolean;
-/**
- * The default `allowUrl`: HTTPS only, no credentials in the URL, no local
- * host names, and every address the host resolves to must be public. The
- * delivery transport calls it again for each redirect.
- *
- * DNS can change between this check and the connection. Route webhooks
- * through an egress proxy when that matters.
- */
-declare function publicUrl(options?: PublicUrlOptions): AllowUrl;
-//#endregion
-//#region src/blocks/webhooks/http.d.ts
-interface WebhookRequest {
-  readonly url: string;
-  readonly headers: Readonly<Record<string, string>>;
-  readonly body: string;
-  readonly signal?: AbortSignal;
-}
-interface WebhookResponse {
-  readonly status: number;
-  readonly body: string;
-  /** Seconds from the `Retry-After` header, when the receiver sent one. */
-  readonly retryAfter?: number;
-}
-/**
- * Sends one signed webhook request. Throw `WebhookPolicyError` when the
- * request must never be retried (a blocked URL); any other error retries.
- */
-interface WebhookTransport {
-  readonly apiVersion: 1;
-  readonly name: string;
-  send(request: WebhookRequest): Promise<WebhookResponse>;
-}
-/** A delivery that must not be retried, e.g. a URL `allowUrl` rejected. */
-declare class WebhookPolicyError extends Error {
-  override readonly name = "WebhookPolicyError";
-}
-interface FetchTransportOptions {
-  readonly fetch?: typeof fetch;
-  /** Checked before the first request and before each redirect. */
-  readonly allowUrl?: AllowUrl;
-  /**
-   * Defaults to 0: a redirect fails the delivery without a retry. Each hop
-   * you allow is checked with `allowUrl` first.
-   */
-  readonly maxRedirects?: number;
-  /** Per request. Defaults to 10 seconds. */
-  readonly timeoutMs?: number;
-  /** The response body bytes kept; the rest is not read. Defaults to 64 KiB. */
-  readonly maxResponseBytes?: number;
-}
-/** Sends webhooks with `fetch`, following redirects only to allowed URLs. */
-declare function fetchTransport(options?: FetchTransportOptions): WebhookTransport;
-//#endregion
-//#region src/blocks/webhooks/secrets.d.ts
-interface RotateSecretOptions {
-  /** How long older secrets keep signing, e.g. `'24 hours'` (the default). */
-  readonly overlap?: string;
-  /** Use this secret instead of a generated one, e.g. when migrating. */
-  readonly secret?: string;
-}
-/**
- * Where endpoint signing secrets live. `sqlSecretStore` (Vault or a
- * column, set in `blocks.webhooks-out.options.secretStorage`) is the default;
- * implement it for a KMS or a secrets manager.
- */
-interface WebhookSecretStore {
-  readonly apiVersion: 1;
-  /** The live secrets of an endpoint, newest first. */
-  secrets(endpointId: string): Promise<readonly string[]>;
-  /** Creates a new secret and returns it once. */
-  rotate?(endpointId: string, options?: RotateSecretOptions): Promise<string>;
-}
-/** The module's `webhook_secrets` and `rotate_webhook_secret` functions. */
-declare function sqlSecretStore(transport: BlockTransport, options?: {
-  readonly schema?: string;
-}): WebhookSecretStore;
-//#endregion
-//#region src/blocks/webhooks/signers.d.ts
-interface WebhookSignInput {
-  /** The delivery id, the same on every retry so receivers can deduplicate. */
-  readonly id: string;
-  readonly body: string;
-  readonly timestamp: Temporal.Instant;
-  /** The endpoint's live secrets, newest first. Sign with each while rotating. */
-  readonly secrets: readonly string[];
-}
-/**
- * Adds the signature headers to an outgoing webhook. `standardWebhooks()`
- * is the default; `hmacSigner()` covers custom header and payload formats.
- */
-interface WebhookSigner {
-  readonly apiVersion: 1;
-  readonly name: string;
-  sign(input: WebhookSignInput): Readonly<Record<string, string>> | Promise<Readonly<Record<string, string>>>;
-}
-interface StandardWebhooksOptions {
-  /** Header names, for receivers that expect a prefix such as `svix-`. */
-  readonly headers?: {
-    readonly id?: string;
-    readonly timestamp?: string;
-    readonly signature?: string;
-  };
-}
-/**
- * Signs with the [Standard Webhooks](https://www.standardwebhooks.com/)
- * scheme: `webhook-id`, `webhook-timestamp` and one `v1,` signature per
- * secret in `webhook-signature`. `verifyWebhook` checks it.
- */
-declare function standardWebhooks(options?: StandardWebhooksOptions): WebhookSigner;
-/**
- * Signs raw bytes with an Ed25519 key, such as
- * `createSigningKeys(options).signer(owner)` from `better-supabase/blocks/signing-keys`.
- */
-interface RawSigner {
-  sign(data: Uint8Array): PromiseLike<Result<{
-    readonly alg: string;
-    readonly signature: Uint8Array;
-  }>>;
-}
-interface AsymmetricWebhooksOptions extends StandardWebhooksOptions {
-  readonly signer: RawSigner;
-  /**
-   * Also sends a `v1,` HMAC signature per endpoint secret, for receivers
-   * that move from secrets to the public key. Default: false.
-   */
-  readonly hmac?: boolean;
-}
-/**
- * Signs with the Standard Webhooks asymmetric scheme: one `v1a,` Ed25519
- * signature over `id.timestamp.body` in `webhook-signature`. Receivers
- * verify it with the `whpk_` key `webhookPublicKey` returns, through
- * `verifyWebhook`. Endpoints opt in with `signing = 'v1a'`.
- */
-declare function standardWebhooksAsymmetric(options: AsymmetricWebhooksOptions): WebhookSigner;
-/** The `whpk_` public key of an Ed25519 JWK, for receivers of `v1a` signatures. */
-declare function webhookPublicKey(jwk: {
-  readonly kty: string;
-  readonly crv?: string;
-  readonly x?: string;
-}): string;
-interface HmacSignerOptions {
-  readonly name?: string;
-  /** e.g. `x-acme-signature`. */
-  readonly signatureHeader: string;
-  /** Sends the epoch-seconds timestamp in this header. */
-  readonly timestampHeader?: string;
-  /** Sends the delivery id in this header. */
-  readonly idHeader?: string;
-  /** The signed text. Defaults to `${timestamp}.${body}`. */
-  readonly content?: (input: {
-    readonly id: string;
-    readonly timestamp: string;
-    readonly body: string;
-  }) => string;
-  /** Defaults to `hex`. */
-  readonly encoding?: "hex" | "base64";
-  /** Written before each signature. Defaults to `v1=`. */
-  readonly prefix?: string;
-  /** Joins the signatures of several secrets. Defaults to `,`. */
-  readonly separator?: string;
-}
-/**
- * HMAC-SHA256 with the secret's UTF-8 bytes as the key, for receivers that
- * verify an existing format, e.g. `v1=<hex>` over `timestamp.body`.
- */
-declare function hmacSigner(options: HmacSignerOptions): WebhookSigner;
-//#endregion
-export { IncomingVerify as A, isPublicAddress as C, IncomingDelivery as D, CreatedIncomingWebhook as E, UpdateIncomingWebhookInput as F, UpdatedIncomingWebhook as I, IncomingWebhooks as M, IncomingWebhooksOptions as N, IncomingDestination as O, RotatedIncomingSecret as P, ResolveHost as S, CreateIncomingWebhookInput as T, WebhookResponse as _, WebhookSignInput as a, AllowUrl as b, standardWebhooks as c, RotateSecretOptions as d, WebhookSecretStore as f, WebhookRequest as g, WebhookPolicyError as h, StandardWebhooksOptions as i, IncomingWebhook as j, IncomingDestinationResult as k, standardWebhooksAsymmetric as l, FetchTransportOptions as m, HmacSignerOptions as n, WebhookSigner as o, sqlSecretStore as p, RawSigner as r, hmacSigner as s, AsymmetricWebhooksOptions as t, webhookPublicKey as u, WebhookTransport as v, publicUrl as w, PublicUrlOptions as x, fetchTransport as y };

package/dist/signing-keys-v2MRYkDF.d.ts

@@ -1,105 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { t as AsyncResult } from "./result-BREt7qOh.js";
-import { n as Logger } from "./logger-DWVYUmwi.js";
-import { n as BlockOptions } from "./block-helpers-CjcQM1yA.js";
-import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
-import { i as JwsAlgorithm, n as Jwks, o as SigningAlgorithm, t as Jwk } from "./jws-35a8VhFV.js";
-//#region src/blocks/signing-keys/signing-keys.d.ts
-interface SigningKeysOptions extends BlockOptions {
-  /**
-   * The JWS `alg` an Ed25519 key signs with: `EdDSA` (RFC 8037), which most
-   * verifiers read, or the fully specified `Ed25519` (RFC 9864). Default: `EdDSA`.
-   */
-  readonly ed25519Alg?: "EdDSA" | "Ed25519";
-  /** How long a signer keeps the imported private key, in seconds. Default: 300. */
-  readonly cacheSeconds?: number;
-  /** `withBlockHooks` hooks around the client's methods. */
-  readonly hooks?: NoInfer<BlockHooks<SigningKeys>>;
-  /** Receives the errors `after` hooks throw. Default: `console`. */
-  readonly logger?: Logger;
-}
-/** Who a key belongs to: an organization, an app, a stream. */
-interface SigningKeyOwner {
-  /** Lowercase letters, digits, `-` and `_`, such as `organization`. */
-  readonly type: string;
-  readonly id: string;
-}
-/**
- * The owner of the platform's own keys, for a single authorization server
- * that signs for every tenant. A key per tenant uses `{ type, id }` of the
- * tenant instead, such as `{ type: "environment", id: environment.id }`.
- */
-declare const PLATFORM_OWNER: SigningKeyOwner;
-/**
- * The `typ` header for a token kind of your own: `jwtType("invite")` is
- * `vnd.invite+jwt`. Sign with `{ typ }` and verify with `verifyCompact(...,
- * { typ })` so a token of one kind can't be replayed as another (RFC 8725
- * section 3.11). Throws a `TypeError` for a name outside lower-case letters,
- * digits and `-`.
- */
-declare function jwtType(name: string): string;
-/** What `create` and `rotate` return. The private key never leaves Vault again. */
-interface CreatedSigningKey {
-  readonly kid: string;
-  readonly alg: SigningAlgorithm;
-  readonly publicKey: Jwk;
-  /** The kid the new key replaced, which stays in the JWKS until its tokens expire. */
-  readonly retired: string | null;
-}
-/** What `sign` returns. */
-interface Signature {
-  readonly kid: string;
-  readonly alg: JwsAlgorithm;
-  readonly signature: Uint8Array;
-}
-/** Signs with an owner's active key. */
-interface Signer {
-  readonly owner: SigningKeyOwner;
-  /** The raw signature of `data` with the active key. */
-  sign(data: Uint8Array): AsyncResult<Signature>;
-  /**
-   * A compact JWS over `claims`, with `alg`, `kid` and `typ: "JWT"` in the
-   * header unless `header` sets them. A custom `typ` has to be `JWT` or end in
-   * `+jwt` (see `jwtType`); anything else fails with `SIGNING_TYP_INVALID`. A numeric `exp` keeps the key in the
-   * JWKS until then (`note_signing_key_exp`), so a rotation can't strand the token.
-   */
-  signJwt(claims: Readonly<Record<string, unknown>>, header?: Readonly<Record<string, unknown>>): AsyncResult<string>;
-}
-interface JwksOptions {
-  /** How long a retired key stays published past its last `exp`. Default: `blocks.signing-keys.options.jwksGrace`. */
-  readonly grace?: Temporal.Duration;
-}
-interface JwksResponseOptions extends JwksOptions {
-  /** The `Cache-Control` max-age, in seconds. Default: 300. */
-  readonly maxAge?: number;
-}
-interface SignerOptions {
-  /** Creates a key of this type when the owner has none, instead of failing with `SIGNING_KEY_MISSING`. */
-  readonly create?: SigningAlgorithm;
-}
-interface SigningKeys {
-  /** Generates a key for the owner and makes it active; the previous key is retired. */
-  create(owner: SigningKeyOwner, alg?: SigningAlgorithm): AsyncResult<CreatedSigningKey>;
-  /** `create` with the active key's type, or `alg` when given. */
-  rotate(owner: SigningKeyOwner, alg?: SigningAlgorithm): AsyncResult<CreatedSigningKey>;
-  /** Retires a key without a replacement. `false` when it was not active. */
-  retire(kid: string): AsyncResult<boolean>;
-  /** Keeps a key published until at least `exp`. `false` for an unknown kid. */
-  noteExp(kid: string, exp: Temporal.Instant): AsyncResult<boolean>;
-  /** The owner's public keys still in use, as a JWK Set. */
-  jwks(owner: SigningKeyOwner, options?: JwksOptions): AsyncResult<Jwks>;
-  /** `jwks` as an `application/jwk-set+json` response with `Cache-Control`. */
-  jwksResponse(owner: SigningKeyOwner, options?: JwksResponseOptions): Promise<Response>;
-  /** Deletes every key of the owner. */
-  remove(owner: SigningKeyOwner): AsyncResult<number>;
-  /** Deletes retired keys no token can still need. */
-  purge(options?: JwksOptions): AsyncResult<number>;
-  signer(owner: SigningKeyOwner, options?: SignerOptions): Signer;
-}
-/**
- * The `signing-keys` SQL module as typed calls: keys are generated and used
- * with WebCrypto here, kept in Supabase Vault there. Service role only.
- */
-declare function createSigningKeys(options: SigningKeysOptions): SigningKeys;
-//#endregion
-export { Signature as a, SigningKeyOwner as c, createSigningKeys as d, jwtType as f, PLATFORM_OWNER as i, SigningKeys as l, JwksOptions as n, Signer as o, JwksResponseOptions as r, SignerOptions as s, CreatedSigningKey as t, SigningKeysOptions as u };

package/dist/solid-controller-CWotGxcG.d.ts

@@ -1,11 +0,0 @@
-import { n as Controller } from "./controller-BZhiIb-N.js";
-import { Accessor } from "solid-js";
-//#region src/blocks/solid-controller.d.ts
-/** A block controller in a Solid component: `state` follows the controller. */
-interface SolidController<S, A> {
-  readonly state: Accessor<S>;
-  readonly actions: A;
-  readonly controller: Controller<S, A>;
-}
-//#endregion
-export { SolidController as t };

package/dist/solid-controller-DLsmrczT.js

@@ -1,33 +0,0 @@
-import { n as useContext$1 } from "./context-B8_p3MXo.js";
-import { n as withEnv, t as blockEnv } from "./block-env-CBd_SoL5.js";
-import { from, onCleanup, onMount } from "solid-js";
-//#region src/blocks/solid-controller.ts
-/**
-* Makes a controller once and reads it through `from`. Its work starts on
-* mount (never during server rendering), and the controller is disposed
-* with the owner.
-*/
-function useBlockController(create, options, usesEnv = true) {
-	const controller = create(withEnv(options, usesEnv ? () => blockEnv(useContext$1().client) : void 0));
-	const state = from({ subscribe: (next) => {
-		next(controller.getSnapshot());
-		let stop;
-		onMount(() => {
-			stop = controller.subscribe(() => {
-				next(controller.getSnapshot());
-			});
-			next(controller.getSnapshot());
-		});
-		return () => stop?.();
-	} }, controller.getSnapshot());
-	onCleanup(() => {
-		controller.dispose();
-	});
-	return {
-		state,
-		actions: controller.actions,
-		controller
-	};
-}
-//#endregion
-export { useBlockController as t };

package/dist/spec-pins-Dqpml2dZ.d.ts

@@ -1,84 +0,0 @@
-//#region src/core/spec-pins.d.ts
-/**
- * Versions of evolving specs and conventions the code follows. Moving a pin
- * is a minor release with a changeset (see the standards docs page).
- */
-declare const SPEC_PINS: {
-  readonly otelSemconv: "1.37.0";
-  /** OTLP/HTTP JSON that the webhooks block's `otlpLogs()` encoder writes. */
-  readonly otlp: "1.7.0";
-  readonly mcp: "2026-07-28";
-  /** The default OpenAPI version `createOpenApi` emits. */
-  readonly openapi: "3.1.2";
-  readonly openapi30: "3.0.4";
-  readonly openapi31: "3.1.2";
-  readonly openapi32: "3.2.1";
-  /** `src/oas.md` on the `v3.3-dev` branch of OAI/OpenAPI-Specification. */
-  readonly openapi33Preview: "aa2f6c0";
-  /** OAI sig-security discussion #50, as of this date. */
-  readonly securityProfiles: "sig-security#50@2026-05-05";
-  readonly overlay10: "1.0.0";
-  readonly overlay11: "1.1.0";
-  readonly overlay12: "1.2.0";
-  readonly arazzo10: "1.0.1";
-  readonly arazzo11: "1.1.0";
-  readonly asyncapi30: "3.0.0";
-  readonly asyncapi31: "3.1.0";
-  /** OpenID AuthZEN Authorization API, the vocabulary of `Authorizer`. */
-  readonly authzen: "1.0";
-  readonly cloudevents: "1.0.2";
-  readonly standardWebhooks: "1.0.0";
-  readonly sarif: "2.1.0";
-  readonly jsonSchema: "2020-12";
-  readonly postgrestAggregates: "12";
-  readonly serverTiming: "WD-20260407";
-  readonly stripeSyncEngine: "0.48.5";
-  readonly pgvector: "0.8";
-  readonly ocsf: "1.9.0";
-  readonly openfeature: "0.9.0";
-  readonly scim: "2.0";
-  readonly supabaseSdkCapabilities: "1.14.0";
-  readonly aiMessage: "1";
-  readonly aiSdkUiMessageStream: "v1";
-  readonly anthropicMemoryTool: "20250818";
-  /** RFC 5545 recurrence rules expanded by the reminders block. */
-  readonly rfc5545: "2009-09";
-  /** RFC 4180 CSV read by `parseCsv` and written by `toCsv`. */
-  readonly rfc4180: "2005-10";
-  /** ISO 4217 List One publication behind `better-supabase/commerce` minor units. */
-  readonly iso4217: "2026-09-17";
-  /** RFC 6902 JSON Patch that the versions block's `createPatch` writes and `applyPatch` applies. */
-  readonly rfc6902: "2013-04";
-  /** RFC 9396 `authorization_details` that delegated tokens and job envelopes carry. */
-  readonly rfc9396: "2023-05";
-  /** RFC 9864 fully specified JOSE algorithms; `Ed25519` is the alg the signing-keys block can write instead of `EdDSA`. */
-  readonly rfc9864: "2025-10";
-  /** RFC 8417 Security Event Tokens that the shared-signals block mints and verifies. */
-  readonly rfc8417: "2018-07";
-  /** RFC 8935 push delivery of SETs: the `set` webhook format and the receiver's push endpoint. */
-  readonly rfc8935: "2020-11";
-  /** RFC 8936 poll delivery of SETs that the transmitter serves and the receiver runs. */
-  readonly rfc8936: "2020-11";
-  /** OpenID Shared Signals Framework: metadata, streams, status and verification. */
-  readonly ssf: "1.0";
-  /** OpenID CAEP event types in `CAEP_EVENTS`. */
-  readonly caep: "1.0";
-  /** OpenID RISC event types in `RISC_EVENTS`. */
-  readonly risc: "1.0";
-  /** RFC 9068 JWT access tokens that `accessTokenResolver` verifies. */
-  readonly rfc9068: "2021-10";
-  /** RFC 7591 client registration metadata the oauth-server block stores. */
-  readonly rfc7591: "2015-07";
-  /** RFC 7636 PKCE; the oauth-server block accepts only the S256 method. */
-  readonly rfc7636: "2015-09";
-  /** RFC 8628 device authorization that the oauth-server block's device codes follow. */
-  readonly rfc8628: "2019-08";
-  /** RFC 9700 OAuth security best current practice behind code reuse and redirect URI rules. */
-  readonly rfc9700: "2025-01";
-  /** draft-ietf-httpapi-ratelimit-headers revision behind `rateLimitHeader` and the Hono and oRPC `rateLimit()`. */
-  readonly ratelimitHeaders: "draft-11";
-  /** The shadcn release whose registry schemas the `@better-supabase` items follow. */
-  readonly shadcnRegistry: "4.21.4";
-};
-//#endregion
-export { SPEC_PINS as t };

package/dist/spec-pins-S4PymRxp.js

@@ -1,60 +0,0 @@
-//#region src/core/spec-pins.ts
-/**
-* Versions of evolving specs and conventions the code follows. Moving a pin
-* is a minor release with a changeset (see the standards docs page).
-*/
-const SPEC_PINS = {
-	otelSemconv: "1.37.0",
-	otlp: "1.7.0",
-	mcp: "2026-07-28",
-	openapi: "3.1.2",
-	openapi30: "3.0.4",
-	openapi31: "3.1.2",
-	openapi32: "3.2.1",
-	openapi33Preview: "aa2f6c0",
-	securityProfiles: "sig-security#50@2026-05-05",
-	overlay10: "1.0.0",
-	overlay11: "1.1.0",
-	overlay12: "1.2.0",
-	arazzo10: "1.0.1",
-	arazzo11: "1.1.0",
-	asyncapi30: "3.0.0",
-	asyncapi31: "3.1.0",
-	authzen: "1.0",
-	cloudevents: "1.0.2",
-	standardWebhooks: "1.0.0",
-	sarif: "2.1.0",
-	jsonSchema: "2020-12",
-	postgrestAggregates: "12",
-	serverTiming: "WD-20260407",
-	stripeSyncEngine: "0.48.5",
-	pgvector: "0.8",
-	ocsf: "1.9.0",
-	openfeature: "0.9.0",
-	scim: "2.0",
-	supabaseSdkCapabilities: "1.14.0",
-	aiMessage: "1",
-	aiSdkUiMessageStream: "v1",
-	anthropicMemoryTool: "20250818",
-	rfc5545: "2009-09",
-	rfc4180: "2005-10",
-	iso4217: "2026-09-17",
-	rfc6902: "2013-04",
-	rfc9396: "2023-05",
-	rfc9864: "2025-10",
-	rfc8417: "2018-07",
-	rfc8935: "2020-11",
-	rfc8936: "2020-11",
-	ssf: "1.0",
-	caep: "1.0",
-	risc: "1.0",
-	rfc9068: "2021-10",
-	rfc7591: "2015-07",
-	rfc7636: "2015-09",
-	rfc8628: "2019-08",
-	rfc9700: "2025-01",
-	ratelimitHeaders: "draft-11",
-	shadcnRegistry: "4.21.4"
-};
-//#endregion
-export { SPEC_PINS as t };