better-supabase 0.12.0 → 0.14.0

package/dist/create/lite/index.d.ts

@@ -1,8 +1,8 @@
 import { t as PresetMigrationFile } from "../../types-DGHfTW8_.js";
 //#region src/lite/runtime.d.ts
 /**
- * The parts of `@supabase/lite` that `liteStack()` uses, typed
- * structurally so the optional peer stays out of the published types.
+ * The parts of `@supabase/lite` that `liteStack()` uses, typed structurally so
+ * the optional peer stays out of the published types.
  */
 interface LiteConnection {
   createMigrator(sql: string): {
@@ -13,7 +13,10 @@ interface LiteConnection {
   close(): Promise<void>;
 }
 interface PgliteConnection extends LiteConnection {
-  /** The PGlite instance: `exec` runs several statements, `query` returns `{ rows }`. */
+  /**
+   * The PGlite instance: `exec` runs several statements, `query` returns `{
+   * rows }`.
+   */
   readonly driver: {
     exec(sql: string): Promise<unknown>;
     query(sql: string): Promise<{
@@ -42,11 +45,11 @@ interface LiteRuntime {
 //#endregion
 //#region src/create/lite/prelude.d.ts
 /**
- * What a Supabase project already has before the first migration runs: the
- * API roles, the `auth` schema with `auth.users` and the JWT helpers, and a
- * `storage.buckets` table. PGlite starts without them, so validation creates
- * a minimal copy. It covers the columns the block SQL reads, not the full
- * GoTrue or Storage schemas.
+ * What a Supabase project already has before the first migration runs: the API
+ * roles, the `auth` schema with `auth.users` and the JWT helpers, and a
+ * `storage.buckets` table. PGlite starts without them, so validation creates a
+ * minimal copy. It covers the columns the block SQL reads, not the full GoTrue
+ * or Storage schemas.
  */
 export declare const SUPABASE_PRELUDE: string;
 //#endregion
@@ -57,7 +60,10 @@ export interface DesignIssue {
   readonly path: string;
   readonly message: string;
 }
-/** A module PGlite can't run, such as one that needs an extension it doesn't ship. */
+/**
+ * A module PGlite can't run, such as one that needs an extension it doesn't
+ * ship.
+ */
 export interface SkippedModule {
   readonly module: string;
   readonly reason: string;
@@ -75,10 +81,11 @@ export interface ValidateDesignOptions {
   readonly runtime?: LiteRuntime;
 }
 /**
- * Applies the files `previewFiles` returns to an in-memory PGlite database
- * and reports what Postgres rejects. A module that needs an extension PGlite
+ * Applies the files `previewFiles` returns to an in-memory PGlite database and
+ * reports what Postgres rejects. A module that needs an extension PGlite
  * doesn't ship (`pgmq`, `btree_gist`) is skipped, not failed, along with its
- * other files. pgTAP test files are left out, as in `deployQuery`. Throws when `@supabase/lite` isn't installed.
+ * other files. pgTAP test files are left out, as in `deployQuery`. Throws when
+ * `@supabase/lite` isn't installed.
  */
 export declare function validateDesign(files: readonly PresetMigrationFile[], options?: ValidateDesignOptions): Promise<DesignValidation>;
 //#endregion

package/dist/create/lite/index.js

@@ -1,11 +1,11 @@
-import { n as loadLite, t as LITE_INSTALL } from "../../runtime-BOXURhEW.js";
+import { n as loadLite, t as LITE_INSTALL } from "../../runtime-CoKxZibd.js";
 //#region src/create/lite/prelude.ts
 /**
-* What a Supabase project already has before the first migration runs: the
-* API roles, the `auth` schema with `auth.users` and the JWT helpers, and a
-* `storage.buckets` table. PGlite starts without them, so validation creates
-* a minimal copy. It covers the columns the block SQL reads, not the full
-* GoTrue or Storage schemas.
+* What a Supabase project already has before the first migration runs: the API
+* roles, the `auth` schema with `auth.users` and the JWT helpers, and a
+* `storage.buckets` table. PGlite starts without them, so validation creates a
+* minimal copy. It covers the columns the block SQL reads, not the full GoTrue
+* or Storage schemas.
 */
 const SUPABASE_PRELUDE = `
 do $$
@@ -77,10 +77,11 @@ function messageOf(error) {
 	return (error instanceof Error ? error.message : String(error)).replaceAll(/\s+/gu, " ").slice(0, 300);
 }
 /**
-* Applies the files `previewFiles` returns to an in-memory PGlite database
-* and reports what Postgres rejects. A module that needs an extension PGlite
+* Applies the files `previewFiles` returns to an in-memory PGlite database and
+* reports what Postgres rejects. A module that needs an extension PGlite
 * doesn't ship (`pgmq`, `btree_gist`) is skipped, not failed, along with its
-* other files. pgTAP test files are left out, as in `deployQuery`. Throws when `@supabase/lite` isn't installed.
+* other files. pgTAP test files are left out, as in `deployQuery`. Throws when
+* `@supabase/lite` isn't installed.
 */
 async function validateDesign(files, options = {}) {
 	const runtime = options.runtime ?? await loadLite();

package/dist/create/oauth/index.d.ts

@@ -0,0 +1,2 @@
+import { a as isFlow, c as pkcePair, d as unseal, i as OAuthSession, l as randomToken, n as OAuthError, o as isOAuthSession, r as OAuthFlow, s as needsRefresh, t as DEFAULT_SEAL_INFO, u as seal } from "../../index-X2fkPUwb.js";
+export { DEFAULT_SEAL_INFO, OAuthError, OAuthFlow, OAuthSession, isFlow, isOAuthSession, needsRefresh, pkcePair, randomToken, seal, unseal };

package/dist/create/oauth/index.js

@@ -0,0 +1,101 @@
+//#region src/create/oauth/index.ts
+/**
+* OAuth helpers for any provider: PKCE, sealed cookies and a session shape, on
+* WebCrypto only. `better-supabase/create/supabase` builds the Supabase flow on
+* them; another provider, such as a deploy target, can reuse them.
+*/
+/**
+* The HKDF info `seal` and `unseal` use when none is given; cookies sealed with
+* it keep opening.
+*/
+const DEFAULT_SEAL_INFO = "better-supabase create session";
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isOAuthSession(value) {
+	return isRecord(value) && typeof value["accessToken"] === "string" && (value["refreshToken"] === void 0 || typeof value["refreshToken"] === "string") && typeof value["expiresAt"] === "number";
+}
+function isFlow(value) {
+	return isRecord(value) && typeof value["state"] === "string" && typeof value["verifier"] === "string" && typeof value["returnTo"] === "string";
+}
+var OAuthError = class extends Error {
+	name = "OAuthError";
+};
+/** Whether the access token expires within a minute. */
+function needsRefresh(session, now) {
+	return session.expiresAt - 6e4 <= now;
+}
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/[=]+$/u, "");
+}
+function fromBase64url(value) {
+	const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/"));
+	const bytes = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
+	return bytes;
+}
+/** `length` random bytes as base64url. */
+function randomToken(length = 32) {
+	return base64url(crypto.getRandomValues(new Uint8Array(length)));
+}
+/** A PKCE verifier and its S256 challenge (RFC 7636). */
+async function pkcePair() {
+	const verifier = randomToken(32);
+	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(verifier));
+	return {
+		verifier,
+		challenge: base64url(new Uint8Array(digest))
+	};
+}
+async function cookieKey(secret, info) {
+	const material = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: /* @__PURE__ */ new Uint8Array(0),
+		info: encoder.encode(info)
+	}, material, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+/**
+* Encrypts `value` as JSON with AES-GCM: base64url of the IV, then the
+* ciphertext. The key comes from `secret` through HKDF with `info`; give each
+* cookie its own `info` so one can't be swapped for another.
+*/
+async function seal(value, secret, info = DEFAULT_SEAL_INFO) {
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const cipher = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, await cookieKey(secret, info), encoder.encode(JSON.stringify(value)));
+	const sealed = new Uint8Array(iv.length + cipher.byteLength);
+	sealed.set(iv);
+	sealed.set(new Uint8Array(cipher), iv.length);
+	return base64url(sealed);
+}
+/**
+* The value `seal` wrote with the same `secret` and `info`, or `undefined` when
+* it is missing, tampered with or another shape.
+*/
+async function unseal(sealed, secret, guard, info = DEFAULT_SEAL_INFO) {
+	if (sealed === void 0 || sealed === "") return;
+	try {
+		const bytes = fromBase64url(sealed);
+		const plain = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: bytes.slice(0, 12)
+		}, await cookieKey(secret, info), bytes.slice(12));
+		const parsed = JSON.parse(decoder.decode(plain));
+		return guard(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { DEFAULT_SEAL_INFO, OAuthError, isFlow, isOAuthSession, needsRefresh, pkcePair, randomToken, seal, unseal };

package/dist/create/supabase/index.d.ts

@@ -1,4 +1,5 @@
-import { a as SupabaseLint, c as isProjectRef, i as SmartRegion, l as managementClient, n as ManagementError, o as SupabaseOrganization, r as SMART_REGIONS, s as SupabaseProject, t as ManagementClient } from "../../management-D1gG89z2.js";
+import { a as SupabaseLint, c as isProjectRef, i as SmartRegion, l as managementClient, n as ManagementError, o as SupabaseOrganization, r as SMART_REGIONS, s as SupabaseProject, t as ManagementClient } from "../../management-wtecfrNf.js";
+import { a as isFlow, c as pkcePair, d as unseal, i as OAuthSession, l as randomToken, n as OAuthError, o as isOAuthSession, r as OAuthFlow, s as needsRefresh, t as DEFAULT_SEAL_INFO, u as seal } from "../../index-X2fkPUwb.js";
 //#region src/create/supabase/oauth.d.ts
 export declare const SUPABASE_API: string;
 /** Where the session and the in-flight authorization live. */
@@ -14,33 +15,13 @@ export interface OAuthConfig {
   readonly clientSecret: string;
   readonly cookieSecret: string;
 }
-export interface SupabaseSession {
-  readonly accessToken: string;
-  readonly refreshToken?: string | undefined;
-  /** Epoch milliseconds. */
-  readonly expiresAt: number;
-}
-export declare function isSession(value: unknown): value is SupabaseSession;
-export interface OAuthFlow {
-  readonly state: string;
-  readonly verifier: string;
-  readonly returnTo: string;
-}
-export declare function isFlow(value: unknown): value is OAuthFlow;
-/** `length` random bytes as base64url. */
-export declare function randomToken(length?: number): string;
-/** A PKCE verifier and its S256 challenge (RFC 7636). */
-export declare function pkcePair(): Promise<{
-  verifier: string;
-  challenge: string;
-}>;
-/** Encrypts `value` as JSON with AES-GCM: base64url of the IV, then the ciphertext. */
-export declare function seal(value: object, secret: string): Promise<string>;
-/** The value `seal` wrote, or `undefined` when it is missing, tampered with or another shape. */
-export declare function unseal<TValue>(sealed: string | undefined, secret: string, guard: (value: unknown) => value is TValue): Promise<TValue | undefined>;
+/** A Supabase OAuth session; the same shape as `OAuthSession`. */
+export type SupabaseSession = OAuthSession;
+/** `isOAuthSession`, under its Supabase name. */
+export declare const isSession: (value: unknown) => value is SupabaseSession;
 /**
- * A same-site path under `/create` to return to after the consent screen,
- * or `/create` for anything else, so the callback never redirects off site.
+ * A same-site path under `/create` to return to after the consent screen, or
+ * `/create` for anything else, so the callback never redirects off site.
  */
 export declare function returnPath(value: string | null): string;
 /** Adds `deploy=1`, which opens the deploy dialog again after the redirect. */
@@ -51,18 +32,16 @@ export declare function authorizeUrl({ clientId, redirectUri, state, challenge }
   state: string;
   challenge: string;
 }): string;
-export declare class OAuthError extends Error {
-  override readonly name = "OAuthError";
-}
 /** Exchanges the authorization code from the callback for a session. */
 export declare function exchangeCode(config: OAuthConfig, { code, verifier, redirectUri }: {
   code: string;
   verifier: string;
   redirectUri: string;
 }, fetchImpl?: typeof fetch, now?: number): Promise<SupabaseSession>;
-/** Whether the access token expires within a minute. */
-export declare function needsRefresh(session: SupabaseSession, now: number): boolean;
-/** A new session from the refresh token; it keeps the old refresh token when Supabase sends none. */
+/**
+ * A new session from the refresh token; it keeps the old refresh token when
+ * Supabase sends none.
+ */
 export declare function refreshSession(config: OAuthConfig, session: SupabaseSession, fetchImpl?: typeof fetch, now?: number): Promise<SupabaseSession>;
 //#endregion
-export { ManagementClient, ManagementError, SMART_REGIONS, SmartRegion, SupabaseLint, SupabaseOrganization, SupabaseProject, isProjectRef, managementClient };
+export { DEFAULT_SEAL_INFO, ManagementClient, ManagementError, OAuthError, type OAuthFlow, type OAuthSession, SMART_REGIONS, SmartRegion, SupabaseLint, SupabaseOrganization, SupabaseProject, isFlow, isOAuthSession, isProjectRef, managementClient, needsRefresh, pkcePair, randomToken, seal, unseal };

package/dist/create/supabase/index.js

@@ -1,3 +1,4 @@
+import { DEFAULT_SEAL_INFO, OAuthError, isFlow, isOAuthSession, needsRefresh, pkcePair, randomToken, seal, unseal } from "../oauth/index.js";
 //#region src/create/supabase/guards.ts
 /** A plain JSON object. */
 function isRecord(value) {
@@ -26,80 +27,11 @@ const FLOW_COOKIE = "bs_supabase_flow";
 const FLOW_MAX_AGE = 600;
 /** The session cookie outlives the access token; the refresh token renews it. */
 const SESSION_MAX_AGE = 604800;
-function isSession(value) {
-	return isRecord(value) && typeof value["accessToken"] === "string" && (value["refreshToken"] === void 0 || typeof value["refreshToken"] === "string") && typeof value["expiresAt"] === "number";
-}
-function isFlow(value) {
-	return isRecord(value) && typeof value["state"] === "string" && typeof value["verifier"] === "string" && typeof value["returnTo"] === "string";
-}
-const encoder = new TextEncoder();
-const decoder = new TextDecoder();
-function base64url(bytes) {
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCodePoint(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
-}
-function fromBase64url(value) {
-	const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/"));
-	const bytes = new Uint8Array(binary.length);
-	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
-	return bytes;
-}
-/** `length` random bytes as base64url. */
-function randomToken(length = 32) {
-	return base64url(crypto.getRandomValues(new Uint8Array(length)));
-}
-/** A PKCE verifier and its S256 challenge (RFC 7636). */
-async function pkcePair() {
-	const verifier = randomToken(32);
-	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(verifier));
-	return {
-		verifier,
-		challenge: base64url(new Uint8Array(digest))
-	};
-}
-async function cookieKey(secret) {
-	const material = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveKey"]);
-	return crypto.subtle.deriveKey({
-		name: "HKDF",
-		hash: "SHA-256",
-		salt: /* @__PURE__ */ new Uint8Array(0),
-		info: encoder.encode("better-supabase create session")
-	}, material, {
-		name: "AES-GCM",
-		length: 256
-	}, false, ["encrypt", "decrypt"]);
-}
-/** Encrypts `value` as JSON with AES-GCM: base64url of the IV, then the ciphertext. */
-async function seal(value, secret) {
-	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
-	const cipher = await crypto.subtle.encrypt({
-		name: "AES-GCM",
-		iv
-	}, await cookieKey(secret), encoder.encode(JSON.stringify(value)));
-	const sealed = new Uint8Array(iv.length + cipher.byteLength);
-	sealed.set(iv);
-	sealed.set(new Uint8Array(cipher), iv.length);
-	return base64url(sealed);
-}
-/** The value `seal` wrote, or `undefined` when it is missing, tampered with or another shape. */
-async function unseal(sealed, secret, guard) {
-	if (sealed === void 0 || sealed === "") return;
-	try {
-		const bytes = fromBase64url(sealed);
-		const plain = await crypto.subtle.decrypt({
-			name: "AES-GCM",
-			iv: bytes.slice(0, 12)
-		}, await cookieKey(secret), bytes.slice(12));
-		const parsed = JSON.parse(decoder.decode(plain));
-		return guard(parsed) ? parsed : void 0;
-	} catch {
-		return;
-	}
-}
+/** `isOAuthSession`, under its Supabase name. */
+const isSession = isOAuthSession;
 /**
-* A same-site path under `/create` to return to after the consent screen,
-* or `/create` for anything else, so the callback never redirects off site.
+* A same-site path under `/create` to return to after the consent screen, or
+* `/create` for anything else, so the callback never redirects off site.
 */
 function returnPath(value) {
 	if (value === null) return "/create";
@@ -129,9 +61,6 @@ function authorizeUrl({ clientId, redirectUri, state, challenge }) {
 	}).toString();
 	return url.toString();
 }
-var OAuthError = class extends Error {
-	name = "OAuthError";
-};
 async function tokenRequest(config, body, fetchImpl, now) {
 	const response = await fetchImpl(new URL("/v1/oauth/token", SUPABASE_API), {
 		method: "POST",
@@ -160,11 +89,10 @@ function exchangeCode(config, { code, verifier, redirectUri }, fetchImpl = fetch
 		redirect_uri: redirectUri
 	}, fetchImpl, now);
 }
-/** Whether the access token expires within a minute. */
-function needsRefresh(session, now) {
-	return session.expiresAt - 6e4 <= now;
-}
-/** A new session from the refresh token; it keeps the old refresh token when Supabase sends none. */
+/**
+* A new session from the refresh token; it keeps the old refresh token when
+* Supabase sends none.
+*/
 async function refreshSession(config, session, fetchImpl = fetch, now = Date.now()) {
 	if (session.refreshToken === void 0) throw new OAuthError("The Supabase session expired. Connect again.");
 	const next = await tokenRequest(config, {
@@ -242,7 +170,10 @@ const readTableCount = (value) => {
 	return Number.isNaN(count) ? void 0 : count;
 };
 const readAny = () => true;
-/** A Management API call that failed; `status` is the HTTP status, 0 for a bad response. */
+/**
+* A Management API call that failed; `status` is the HTTP status, 0 for a bad
+* response.
+*/
 var ManagementError = class extends Error {
 	name = "ManagementError";
 	status;
@@ -256,7 +187,8 @@ from pg_catalog.pg_tables
 where schemaname = 'public'`;
 /**
 * The Management API calls the deploy dialog makes, with the user's OAuth
-* access token. Responses are parsed, and every failure is a `ManagementError`.
+* access token. Responses are parsed, and every failure is a
+* `ManagementError`.
 */
 function managementClient(accessToken, fetchImpl = fetch) {
 	async function call(path, read, init = {}) {
@@ -309,4 +241,4 @@ function managementClient(accessToken, fetchImpl = fetch) {
 	};
 }
 //#endregion
-export { COOKIE_PATH, FLOW_COOKIE, FLOW_MAX_AGE, ManagementError, OAuthError, SESSION_COOKIE, SESSION_MAX_AGE, SMART_REGIONS, SUPABASE_API, authorizeUrl, exchangeCode, isFlow, isProjectRef, isSession, managementClient, needsRefresh, pkcePair, randomToken, refreshSession, returnPath, seal, unseal, withDeployFlag };
+export { COOKIE_PATH, DEFAULT_SEAL_INFO, FLOW_COOKIE, FLOW_MAX_AGE, ManagementError, OAuthError, SESSION_COOKIE, SESSION_MAX_AGE, SMART_REGIONS, SUPABASE_API, authorizeUrl, exchangeCode, isFlow, isOAuthSession, isProjectRef, isSession, managementClient, needsRefresh, pkcePair, randomToken, refreshSession, returnPath, seal, unseal, withDeployFlag };

package/dist/create-blocks-kPUhCvje.js

@@ -0,0 +1,217 @@
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { t as onBlockEvent } from "./block-event-listener-Bu6G0TFH.js";
+import { B as dbTransport } from "./block-helpers-CiKtrb6g.js";
+import { i as wrapTransport, r as withBlockHooks } from "./block-hooks-BymdcD0V.js";
+import { t as blockNames } from "./block-names-Dbv_2wmE.js";
+import { i as forwardBlockEvents } from "./cloud-event-XsM53POL.js";
+//#region src/blocks/block-config.ts
+/**
+* The options a block's creator gets from its generated entry: the schema it
+* calls (the API schema when there is one, since the wrappers there are what
+* the caller may run) and the shared options. `defineBlocks` passes them;
+* spread them into a creator you call yourself: `createAiChat({
+* ...generatedOptions(blockConfig["ai-chat"]), transport })`.
+*/
+function generatedOptions(entry) {
+	return {
+		...entry.options,
+		schema: entry.api ?? entry.schema
+	};
+}
+/**
+* A realtime topic template from `blocks.generated.ts` with its placeholders
+* filled in, such as the notifications topic `notifications:{userId}`.
+*/
+function fillTopic(template, values) {
+	return template.replaceAll(/\{([A-Za-z]+)\}/g, (match, name) => {
+		const value = values[name];
+		if (value === void 0) throw new TypeError(`fillTopic: no value for ${match} in "${template}"`);
+		return value;
+	});
+}
+//#endregion
+//#region src/blocks/create-blocks.ts
+/** The CloudEvents `source` of block events that `createBlocks` forwards. */
+const BLOCK_EVENT_SOURCE = "/better-supabase/blocks";
+/**
+* The blocks an app uses, built with `blockConfig` from `blocks.generated.ts`
+* (`better-supabase gen`), so each block's schema and the options its SQL half
+* shares come from the `blocks` config, and the app's own events
+* (`defineEvents`). The event types are the union of every block's events, so
+* `on` and `events` type each one's data without `declare module` (invariant
+* 2).
+*/
+function defineBlocks(config, blocks, ...appEvents) {
+	const events = { types: [.../* @__PURE__ */ new Set([...Object.values(blocks).flatMap((block) => block.events.types), ...appEvents.flatMap((each) => each.types)])] };
+	return {
+		blocks,
+		config,
+		events,
+		create: (options) => buildBlocks({
+			...options,
+			config
+		}, blocks),
+		client: (db, key, options = {}) => blockBuilder(clientContext(db, {
+			config,
+			...options
+		}), blocks).build(String(key)),
+		on: (betterSupabase, pattern, handler) => onBlockEvent(betterSupabase, events, pattern, handler)
+	};
+}
+/**
+* Builds `blocks` with one set of options and wires them on their ports. Each
+* block gets its schema and shared options from its entry in `config`
+* (`blocks.generated.ts`), keyed by the block's name. Each block that consumes
+* a port (`notifier`, `files`, `attachments`, `workflows`) gets it from the one
+* block in the set that provides it, and `sinks` holds the outbox sinks the
+* blocks provide. `credentials` reaches every block, and block events go to
+* `audit`. Only the blocks you pass are imported, so the rest stay out of the
+* bundle. `hooks` wraps each block's methods with `withBlockHooks`, and the
+* ports are built from the wrapped clients, so a sibling's calls (ai-tasks
+* sending notifications) go through the hooks too.
+*/
+function createBlocks(options, blocks) {
+	return buildBlocks(options, blocks);
+}
+/**
+* One block's client over a `Db`: its calls run through `dbTransport(db)` and
+* act in the `Db`'s tenant (`db.$context.tenant`) unless `options.tenant` names
+* one. Pass `config: blockConfig` so it calls the schema and function names
+* `gen` wrote; `BlockSet.client(db, key)` does that for you.
+*
+* ```ts
+* const comments = createBlockClient(ctx.db, commentsBlock, {
+*   config: blockConfig,
+* });
+* ```
+*/
+function createBlockClient(db, block, options = {}) {
+	const { hooks, ...rest } = options;
+	return blockBuilder({
+		...clientContext(db, rest),
+		...hooks === void 0 ? {} : { hooks: { [block.name]: hooks } }
+	}, { [block.name]: block }).build(block.name);
+}
+function clientContext(db, options) {
+	const { hooks, ...rest } = options;
+	return {
+		tenant: () => db.$context?.tenant,
+		...rest,
+		transport: rest.transport ?? dbTransport(db),
+		...hooks === void 0 ? {} : { hooks }
+	};
+}
+const UNIQUE_PORTS = [
+	"notifier",
+	"files",
+	"attachments",
+	"workflows",
+	"mailer"
+];
+/** `key`'s entry in `hooks`, which `BlocksHooks` keys like the blocks. */
+function hooksOf(hooks, key) {
+	if (hooks === void 0) return;
+	const entry = Object.entries(hooks).find(([name]) => name === key)?.[1];
+	return isRecord(entry) ? entry : void 0;
+}
+/** Builds the blocks of `blocks` on demand, each one once, wired on ports. */
+function blockBuilder(options, blocks) {
+	const { audit: _audit, hooks, config, ...shared } = options;
+	const providers = /* @__PURE__ */ new Map();
+	for (const port of UNIQUE_PORTS) {
+		const keys = Object.keys(blocks).filter((key) => blocks[key]?.provides[port] !== void 0);
+		if (keys.length > 1) throw new TypeError(`createBlocks: ${keys.map((key) => `"${key}"`).join(" and ")} both provide the ${port} port; pass one`);
+		const [key] = keys;
+		if (key !== void 0) providers.set(port, key);
+	}
+	for (const [key, block] of Object.entries(blocks)) for (const [port, need] of Object.entries(block.consumes)) if (need === "required" && !providers.has(port)) throw new TypeError(`createBlocks: "${key}" needs a block that provides the ${port} port`);
+	const built = /* @__PURE__ */ new Map();
+	const building = /* @__PURE__ */ new Set();
+	const blockOf = (key) => {
+		const block = blocks[key];
+		if (block === void 0) throw new TypeError(`No block named "${key}"`);
+		return block;
+	};
+	/**
+	* The options `key`'s creator gets: shared, then its generated config, then
+	* ports, then `with` settings.
+	*/
+	const optionsOf = (key) => {
+		const ports = {};
+		for (const port of UNIQUE_PORTS) {
+			if (blockOf(key).consumes[port] === void 0) continue;
+			const provider = providers.get(port);
+			if (provider === void 0 || provider === key) continue;
+			const value = portOf(provider, port);
+			if (value !== void 0) ports[port] = value;
+		}
+		const block = blockOf(key);
+		const entry = config?.[block.name];
+		return {
+			...shared,
+			...entry === void 0 ? {} : generatedOptions(entry),
+			...entry?.names === void 0 ? {} : renamedTransports(entry.names),
+			...ports,
+			...block.settings
+		};
+	};
+	/**
+	* `shared`'s transports, calling the block functions by the names the SQL
+	* gave them.
+	*/
+	function renamedTransports(naming) {
+		const middleware = blockNames(naming);
+		return {
+			transport: wrapTransport(shared.transport, middleware),
+			...shared.service === void 0 ? {} : { service: wrapTransport(shared.service, middleware) }
+		};
+	}
+	function portOf(key, port) {
+		const provide = blockOf(key).provides[port];
+		if (provide === void 0) return;
+		return provide(build(key), optionsOf(key));
+	}
+	function build(key) {
+		if (built.has(key)) return built.get(key);
+		const block = blockOf(key);
+		if (block.create === void 0) throw new TypeError(`The "${block.name}" block has only SQL; it has no client to build`);
+		if (building.has(key)) throw new TypeError(`The "${key}" block depends on itself`);
+		building.add(key);
+		try {
+			const create = block.create;
+			const created = create(optionsOf(key));
+			const blockHooks = hooksOf(hooks, key);
+			const client = blockHooks !== void 0 && isRecord(created) ? withBlockHooks(created, blockHooks, {
+				block: key,
+				...shared.events === void 0 ? {} : { logger: shared.events.logger }
+			}) : created;
+			built.set(key, client);
+			return client;
+		} finally {
+			building.delete(key);
+		}
+	}
+	return {
+		build,
+		portOf
+	};
+}
+function buildBlocks(options, blocks) {
+	const { audit, events } = options;
+	if (audit !== void 0 && events === void 0) throw new TypeError("createBlocks: `audit` needs `events` to forward");
+	const { build, portOf } = blockBuilder(options, blocks);
+	const result = {};
+	const sinks = {};
+	for (const [key, block] of Object.entries(blocks)) {
+		if (block.create === void 0) continue;
+		result[key] = build(key);
+		const sink = portOf(key, "sink");
+		if (sink !== void 0) sinks[key] = sink;
+	}
+	result["sinks"] = sinks;
+	const stop = audit === void 0 || events === void 0 ? void 0 : forwardBlockEvents({ events }, audit, { source: BLOCK_EVENT_SOURCE });
+	result["close"] = () => stop?.();
+	return result;
+}
+//#endregion
+export { fillTopic as a, defineBlocks as i, createBlockClient as n, generatedOptions as o, createBlocks as r, BLOCK_EVENT_SOURCE as t };