better-supabase 0.12.0 → 0.14.0

package/dist/edge/index.js

@@ -1,17 +1,17 @@
-import { n as dbError } from "../errors-BV1SKTVs.js";
-import { a as ok, r as err } from "../result-DIeYscA3.js";
-import { n as validate } from "../standard-B1BigegP.js";
-import { o as problemResponse } from "../problem-JRCohp1j.js";
-import { a as unexpectedResponse, c as extendServer, o as withFlush, s as createServer } from "../adapter-CRNH2aX_.js";
-import { a as respond, o as settle, t as defaultExpose } from "../respond-Bhp3G__q.js";
-import { t as withBetterSupabase } from "../composite-1kPAxXto.js";
-import { r as defineAction } from "../resource-Bdkqi8jo.js";
-import { i as requireCaller } from "../kit-LTbHrWWD.js";
+import { n as dbError } from "../errors-03ysrOt4.js";
+import { a as ok, r as err } from "../result-B3m7xtRY.js";
+import { n as validate } from "../standard-DtkpFGkS.js";
+import { o as problemResponse } from "../problem-BWElIgIb.js";
+import { a as unexpectedResponse, c as extendServer, o as withFlush, s as createServer } from "../adapter-BCFAg58A.js";
+import { a as respond, o as settle, t as defaultExpose } from "../respond-z_yfyitp.js";
+import { t as withBetterSupabase } from "../composite-Dv6o2BSw.js";
+import { r as defineAction } from "../resource-Dk_JYsOt.js";
+import { i as requireCaller } from "../kit-Ct4Z6GIO.js";
 import { t as withExtra } from "../extra-CGQ2_q3S.js";
-import { n as resourceRouter } from "../resources-Ck7itNeX.js";
+import { n as resourceRouter } from "../resources-BV6j5TTD.js";
 import { n as corsConfig, t as SUPABASE_CORS_HEADERS } from "../cors-h_v7TPxl.js";
-import { t as EVERY_CALLER } from "../framework-C6PKBgme.js";
-import { t as FUNCTION_DESCRIPTOR } from "../function-contract-DmkBg19r.js";
+import { t as EVERY_CALLER } from "../framework-CXoyWGgd.js";
+import { t as FUNCTION_DESCRIPTOR } from "../function-contract-pEmsaUIf.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { withCors } from "@supabase/middleware/cors";
 //#region src/bridges/edge.ts
@@ -21,8 +21,11 @@ import { withCors } from "@supabase/middleware/cors";
 * context, so on Workers `getEnv` inside the entries reads the bindings.
 *
 * ```ts
-* Deno.serve(toEdge([withBetterSupabase(server)], async (req, ctx) =>
-*   Response.json(await ctx.db.notes.findMany().orThrow())))
+* Deno.serve(
+*   toEdge([withBetterSupabase(server)], async (req, ctx) =>
+*     Response.json(await ctx.db.notes.findMany().orThrow()),
+*   ),
+* );
 * ```
 */
 function toEdge(entries, handler) {
@@ -80,8 +83,8 @@ function paramsOf(segments, rest, parts) {
 	return params;
 }
 /**
-* The route for `method` and `path`: a match, the allowed methods when the
-* path matches under another method (`HEAD` falls back to `GET`), or `"none"`.
+* The route for `method` and `path`: a match, the allowed methods when the path
+* matches under another method (`HEAD` falls back to `GET`), or `"none"`.
 */
 function matchRoute(routes, method, path) {
 	const parts = split(path);
@@ -221,7 +224,7 @@ function createEdge(betterSupabase, options = {}) {
 				const caller = await requireCaller(ctx.auth, {
 					...shared,
 					...route.options
-				}, tenant, options.authorizer);
+				}, tenant, options.authorizer, ctx);
 				if ("kind" in caller) return err(caller);
 				return route.handler(request, withExtra(ctx, {
 					params,

package/dist/elysia/index.d.ts

@@ -1,25 +1,25 @@
-import { n as RouteGuardOptions } from "../refusal-C7geIBRl.js";
-import { t as Validated } from "../shared-DDSjEGDR.js";
+import { n as RouteGuardOptions } from "../refusal-efy5bZMd.js";
+import { t as Validated } from "../shared-CRRfQAKG.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 //#region src/bridges/elysia.d.ts
 interface ElysiaBridge<Entries extends readonly AnyEntry[]> {
   /**
-   * Runs the entries around the app's fetch (`app.handle`), so short
-   * circuits answer before Elysia routes and the route's response passes
-   * back through the entries.
+   * Runs the entries around the app's fetch (`app.handle`), so short circuits
+   * answer before Elysia routes and the route's response passes back through
+   * the entries.
    */
   wrap(handle: (request: Request) => Promise<Response>): (request: Request, env?: unknown) => Promise<Response>;
   /**
    * The contributions for a request `wrap` is serving. Throws for any other
-   * request, so a route reached without the entries fails closed.
-   * Expose it with `.derive(({ request }) => bridge.context(request))`.
+   * request, so a route reached without the entries fails closed. Expose it
+   * with `.derive(({ request }) => bridge.context(request))`.
    */
   context(request: Request): Contributions<Entries>;
 }
 /**
- * Runs an entry array around an Elysia app. Elysia has no middleware slot
- * that sees the response it produces, so the bridge wraps the app's fetch
- * and hands the contributions to routes through `context(request)`.
+ * Runs an entry array around an Elysia app. Elysia has no middleware slot that
+ * sees the response it produces, so the bridge wraps the app's fetch and hands
+ * the contributions to routes through `context(request)`.
  *
  * ```ts
  * const bridge = toElysia([withBetterSupabase(server)])
@@ -35,18 +35,20 @@ export declare function toElysia<const Entries extends readonly AnyEntry[]>(entr
  * Details, or a redirect to `signIn` or `mfa`.
  *
  * ```ts
- * app.get('/admin', handler, { beforeHandle: guard(bridge, { roles: ['admin'] }) })
+ * app.get("/admin", handler, {
+ *   beforeHandle: guard(bridge, { roles: ["admin"] }),
+ * });
  * ```
  */
 export declare function guard<Entries extends readonly AnyEntry[]>(bridge: ElysiaBridge<Entries>, options?: RouteGuardOptions): (context: {
   readonly request: Request;
 }) => Promise<Response | undefined>;
 /**
- * An `onError` hook that answers thrown `DbException`s (from `.orThrow()`)
- * with Problem Details and leaves every other error to Elysia.
+ * An `onError` hook that answers thrown `DbException`s (from `.orThrow()`) with
+ * Problem Details and leaves every other error to Elysia.
  *
  * ```ts
- * new Elysia().onError(problemOnError())
+ * new Elysia().onError(problemOnError());
  * ```
  */
 export declare function problemOnError(options?: {

package/dist/elysia/index.js

@@ -1,11 +1,11 @@
-import { t as around } from "../shared-BmMcMoW9.js";
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-CFpfmjcS.js";
+import { t as around } from "../shared-Bf-I13Ht.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-DXydjgsS.js";
 import { bufferRequest } from "@supabase/middleware";
 //#region src/bridges/elysia.ts
 /**
-* Runs an entry array around an Elysia app. Elysia has no middleware slot
-* that sees the response it produces, so the bridge wraps the app's fetch
-* and hands the contributions to routes through `context(request)`.
+* Runs an entry array around an Elysia app. Elysia has no middleware slot that
+* sees the response it produces, so the bridge wraps the app's fetch and hands
+* the contributions to routes through `context(request)`.
 *
 * ```ts
 * const bridge = toElysia([withBetterSupabase(server)])
@@ -38,7 +38,9 @@ function toElysia(entries) {
 * Details, or a redirect to `signIn` or `mfa`.
 *
 * ```ts
-* app.get('/admin', handler, { beforeHandle: guard(bridge, { roles: ['admin'] }) })
+* app.get("/admin", handler, {
+*   beforeHandle: guard(bridge, { roles: ["admin"] }),
+* });
 * ```
 */
 function guard(bridge, options = {}) {
@@ -48,11 +50,11 @@ function guard(bridge, options = {}) {
 	};
 }
 /**
-* An `onError` hook that answers thrown `DbException`s (from `.orThrow()`)
-* with Problem Details and leaves every other error to Elysia.
+* An `onError` hook that answers thrown `DbException`s (from `.orThrow()`) with
+* Problem Details and leaves every other error to Elysia.
 *
 * ```ts
-* new Elysia().onError(problemOnError())
+* new Elysia().onError(problemOnError());
 * ```
 */
 function problemOnError(options = {}) {

package/dist/email-tt2QqiSc.d.ts

@@ -0,0 +1,42 @@
+import { n as NotificationMessage, t as NotificationChannel } from "./channel-BjvGO39m.js";
+import { a as DeliveryTransport, c as UnsubscribeTarget, s as MailCategory } from "./delivery-n6lZGuGx.js";
+//#region src/blocks/notifications/email.d.ts
+/** The mail for one delivery. */
+interface ComposedEmail {
+  readonly subject: string;
+  readonly text?: string;
+  readonly html?: string;
+  readonly replyTo?: string;
+  /** Defaults to `notification`. */
+  readonly category?: MailCategory;
+  /**
+   * Names the template this mail came from, e.g. `task-assigned-v2`. The
+   * delivery keeps it, so a record's sent emails show which one went out.
+   */
+  readonly templateKey?: string;
+}
+interface EmailChannelOptions {
+  readonly transport: DeliveryTransport;
+  /** `Name <address>` or an address the provider has verified. */
+  readonly from: string;
+  readonly replyTo?: string;
+  /**
+   * The mail for a delivery. Defaults to the rendered title as the subject and
+   * the rendered body (or the title) as the text, so it needs
+   * `createNotifications({ render })`.
+   */
+  readonly compose?: (message: NotificationMessage) => ComposedEmail | Promise<ComposedEmail>;
+  /**
+   * Where the reader unsubscribes from this mail, such as a signed link to your
+   * preferences route. Only `notification` mail carries it.
+   */
+  readonly unsubscribe?: (message: NotificationMessage) => UnsubscribeTarget | undefined | Promise<UnsubscribeTarget | undefined>;
+}
+/**
+ * A `NotificationChannel` named `email` that sends through `transport`, with
+ * the delivery id as the idempotency key. A recipient without an address is
+ * skipped.
+ */
+declare function emailChannel(options: EmailChannelOptions): NotificationChannel;
+//#endregion
+export { EmailChannelOptions as n, emailChannel as r, ComposedEmail as t };

package/dist/embeddings-CcRP-cMN.d.ts

@@ -0,0 +1,78 @@
+import { d as KnowledgeSearchOptions, n as Embedder, o as KnowledgeHit, r as Knowledge } from "./knowledge-CFkCRxO9.js";
+import { EmbeddingModel, RerankingModel, SourceDocumentUIPart, Tool, embedMany } from "ai";
+//#region src/ai-sdk/embeddings/embeddings.d.ts
+type ProviderOptions = Parameters<typeof embedMany>[0]["providerOptions"];
+interface EmbedWithOptions {
+  /** Concurrent calls when the values need more than one. Default 4. */
+  readonly maxParallelCalls?: number;
+  readonly providerOptions?: ProviderOptions;
+  /** The name stored with each embedding; the provider and model id by default. */
+  readonly name?: string;
+}
+/** The name of an SDK model: the string itself, or `provider/modelId`. */
+declare function modelName(model: string | {
+  readonly provider: string;
+  readonly modelId: string;
+}): string;
+/** An `Embedder` for the knowledge and memory blocks over `embedMany`. */
+declare function embedWith(model: EmbeddingModel, options?: EmbedWithOptions): Embedder;
+type Reranker = (query: string, hits: readonly KnowledgeHit[], options?: {
+  readonly signal?: AbortSignal;
+}) => Promise<readonly KnowledgeHit[]>;
+/** Reorders search hits with a reranking model, keeping the best `topN`. */
+declare function rerankWith(model: RerankingModel, options?: {
+  readonly topN?: number;
+}): Reranker;
+/**
+ * Keeps the items of a search the caller may read. A tool applies it before
+ * anything else sees the items: the reranker, `onHits` and the model. A throw
+ * fails the tool call, so no items reach the model.
+ */
+type ResultsFilter<T, C = {
+  readonly query: string;
+}> = (items: readonly T[], context: C) => readonly T[] | PromiseLike<readonly T[]>;
+interface SearchToolOptions extends Omit<KnowledgeSearchOptions, "signal"> {
+  readonly description?: string;
+  /** Drops the hits the caller may not read, such as by a permission. */
+  readonly results?: ResultsFilter<KnowledgeHit>;
+  /** Reranks the hits before the model sees them. */
+  readonly rerank?: Reranker;
+  /** Called with the hits, to stream them as source parts. */
+  readonly onHits?: (hits: readonly KnowledgeHit[]) => void;
+}
+interface SearchToolResult {
+  readonly results: readonly {
+    readonly id: string;
+    readonly title: string;
+    readonly content: string;
+  }[];
+}
+/**
+ * A tool that searches the knowledge base as the caller. Each result id is
+ * `documentId#index`, the `sourceId` that `toSourceParts` gives it.
+ */
+declare function searchTool(knowledge: Knowledge, organizationId: string, options?: SearchToolOptions): Tool<{
+  query: string;
+}, SearchToolResult>;
+/** One `source-document` part per document among the hits, in hit order. */
+declare function toSourceParts(hits: readonly KnowledgeHit[]): SourceDocumentUIPart[];
+/** `Supabase.ai.Session` in Supabase Edge Functions, typed structurally. */
+interface SupabaseAiSession {
+  run(input: string, options: {
+    readonly mean_pool: boolean;
+    readonly normalize: boolean;
+  }): Promise<unknown>;
+}
+interface SupabaseEmbedOptions {
+  /** The built-in model. Default `gte-small` (384 dimensions). */
+  readonly model?: string;
+  /** A session to use instead of `new Supabase.ai.Session(model)`. */
+  readonly session?: SupabaseAiSession;
+}
+/**
+ * An `Embedder` over the model built into Supabase Edge Functions. Set the
+ * module's `dimensions` option to the model's size (384 for `gte-small`).
+ */
+declare function supabaseEmbed(options?: SupabaseEmbedOptions): Embedder;
+//#endregion
+export { SearchToolResult as a, embedWith as c, searchTool as d, supabaseEmbed as f, SearchToolOptions as i, modelName as l, Reranker as n, SupabaseAiSession as o, toSourceParts as p, ResultsFilter as r, SupabaseEmbedOptions as s, EmbedWithOptions as t, rerankWith as u };

package/dist/embeddings-vVzseUw0.js

@@ -0,0 +1,128 @@
+import { t as DbException } from "./db-exception-Lngc1W49.js";
+import { embedMany, jsonSchema, rerank, tool } from "ai";
+//#region src/ai-sdk/embeddings/embeddings.ts
+/** The name of an SDK model: the string itself, or `provider/modelId`. */
+function modelName(model) {
+	return typeof model === "string" ? model : `${model.provider}/${model.modelId}`;
+}
+/** An `Embedder` for the knowledge and memory blocks over `embedMany`. */
+function embedWith(model, options = {}) {
+	return {
+		apiVersion: 1,
+		model: options.name ?? modelName(model),
+		embed: async (values, embedOptions) => {
+			if (values.length === 0) return [];
+			const { embeddings } = await embedMany({
+				model,
+				values: [...values],
+				maxParallelCalls: options.maxParallelCalls ?? 4,
+				...options.providerOptions === void 0 ? {} : { providerOptions: options.providerOptions },
+				...embedOptions?.signal === void 0 ? {} : { abortSignal: embedOptions.signal }
+			});
+			return embeddings;
+		}
+	};
+}
+/** Reorders search hits with a reranking model, keeping the best `topN`. */
+function rerankWith(model, options = {}) {
+	return async (query, hits, rerankOptions) => {
+		if (hits.length <= 1) return hits;
+		const { ranking } = await rerank({
+			model,
+			query,
+			documents: hits.map((hit) => hit.content),
+			...options.topN === void 0 ? {} : { topN: options.topN },
+			...rerankOptions?.signal === void 0 ? {} : { abortSignal: rerankOptions.signal }
+		});
+		return ranking.flatMap((entry) => {
+			const hit = hits[entry.originalIndex];
+			return hit === void 0 ? [] : [{
+				...hit,
+				score: entry.score
+			}];
+		});
+	};
+}
+/**
+* A tool that searches the knowledge base as the caller. Each result id is
+* `documentId#index`, the `sourceId` that `toSourceParts` gives it.
+*/
+function searchTool(knowledge, organizationId, options = {}) {
+	const { description, results, rerank: reorder, onHits, ...search } = options;
+	return tool({
+		description: description ?? "Search the knowledge base for passages relevant to a query. Cite results by their id.",
+		inputSchema: jsonSchema({
+			type: "object",
+			properties: { query: {
+				type: "string",
+				description: "What to look for"
+			} },
+			required: ["query"],
+			additionalProperties: false
+		}),
+		execute: async ({ query }, { abortSignal }) => {
+			const found = await knowledge.search(organizationId, query, {
+				...search,
+				...abortSignal === void 0 ? {} : { signal: abortSignal }
+			});
+			if (!found.ok) throw new DbException(found.error);
+			const readable = results ? await results(found.data, { query }) : found.data;
+			const hits = reorder ? await reorder(query, readable, abortSignal === void 0 ? void 0 : { signal: abortSignal }) : readable;
+			onHits?.(hits);
+			return { results: hits.map((hit) => ({
+				id: sourceId(hit),
+				title: hit.title,
+				content: hit.content
+			})) };
+		}
+	});
+}
+const sourceId = (hit) => `${hit.documentId}#${String(hit.index)}`;
+/** One `source-document` part per document among the hits, in hit order. */
+function toSourceParts(hits) {
+	const seen = /* @__PURE__ */ new Set();
+	const parts = [];
+	for (const hit of hits) {
+		if (seen.has(hit.documentId)) continue;
+		seen.add(hit.documentId);
+		parts.push({
+			type: "source-document",
+			sourceId: sourceId(hit),
+			mediaType: "text/plain",
+			title: hit.title
+		});
+	}
+	return parts;
+}
+function supabaseSession(model) {
+	const Session = globalThis.Supabase?.ai?.Session;
+	if (typeof Session !== "function") throw new TypeError("supabaseEmbed runs in Supabase Edge Functions, where Supabase.ai.Session exists; pass session elsewhere");
+	return new Session(model);
+}
+/**
+* An `Embedder` over the model built into Supabase Edge Functions. Set the
+* module's `dimensions` option to the model's size (384 for `gte-small`).
+*/
+function supabaseEmbed(options = {}) {
+	const name = options.model ?? "gte-small";
+	let session = options.session;
+	return {
+		apiVersion: 1,
+		model: `supabase/${name}`,
+		embed: async (values) => {
+			session ??= supabaseSession(name);
+			const vectors = [];
+			for (const value of values) {
+				const output = await session.run(value, {
+					mean_pool: true,
+					normalize: true
+				});
+				if (!Array.isArray(output) || !output.every((x) => typeof x === "number")) throw new TypeError(`Supabase.ai.Session returned no vector for ${name}`);
+				vectors.push(output);
+			}
+			return vectors;
+		}
+	};
+}
+//#endregion
+export { supabaseEmbed as a, searchTool as i, modelName as n, toSourceParts as o, rerankWith as r, embedWith as t };

package/dist/employees-Dwyvxs4r.d.ts

@@ -0,0 +1,180 @@
+/// <reference lib="esnext.temporal" />
+import { T as ErrorMapper, t as AsyncResult } from "./result-C6jDfedy.js";
+import { t as StandardSchemaV1 } from "./standard-DbQsD2xZ.js";
+import { r as FieldsOf } from "./block-fields-3w4MZr8U.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { r as BlockTemporalOptions } from "./block-helpers-BaugZlJV.js";
+import { t as BlockTransport } from "./block-transport-d53POsem.js";
+import { n as BlockHooks } from "./block-hooks-CmjPKqQ_.js";
+import { n as Money } from "./money-BNRdJQzA.js";
+import { t as RecordRef } from "./sales-shared-DAAGwQwN.js";
+//#region src/blocks/employees/employees.d.ts
+type EmployeeStatus = "preboarding" | "active" | "on_leave" | "offboarded";
+type SalaryPeriod = "hour" | "week" | "month" | "year";
+/** An employee. `F` types the extra columns the `fields` schema describes. */
+interface Employee<F extends object = Record<never, never>> {
+  readonly id: string;
+  readonly organizationId: string;
+  readonly name: string;
+  readonly email?: string;
+  /**
+   * The account, when the employee has one; contractors and interns often
+   * don't.
+   */
+  readonly userId?: string;
+  readonly jobTitle?: string;
+  readonly teamId?: string;
+  readonly managerId?: string;
+  readonly employmentType?: string;
+  readonly status: EmployeeStatus;
+  readonly startDate?: Temporal.PlainDate;
+  readonly endDate?: Temporal.PlainDate;
+  readonly offboardReason?: string;
+  /** The record it was made from, such as `{ type: "application", id }`. */
+  readonly origin?: RecordRef;
+  readonly createdAt?: Temporal.Instant;
+  /** The app's extra columns (`options.extraColumns`), by column name. */
+  readonly fields: Readonly<Record<string, unknown>> & F;
+}
+/** An employee in the org chart or a manager's reports. */
+interface OrgChartEntry<F extends object = Record<never, never>> extends Employee<F> {
+  /** 0 for a root of the chart, 1 for a direct report. */
+  readonly depth: number;
+  readonly directReports: number;
+}
+interface EmployeeInput<F extends object = Record<never, never>> {
+  readonly name: string;
+  readonly email?: string;
+  readonly userId?: string;
+  readonly jobTitle?: string;
+  readonly teamId?: string;
+  readonly managerId?: string;
+  /** One of `options.employmentTypes`; the first one by default. */
+  readonly employmentType?: string;
+  /** Preboarding before the start date and active from it, by default. */
+  readonly status?: Exclude<EmployeeStatus, "offboarded">;
+  readonly startDate?: Temporal.PlainDate;
+  readonly endDate?: Temporal.PlainDate;
+  /** With an origin, creating again returns the same employee. */
+  readonly origin?: RecordRef;
+  readonly fields?: Partial<F> & Readonly<Record<string, unknown>>;
+}
+type EmployeeField = "name" | "email" | "userId" | "jobTitle" | "teamId" | "managerId" | "employmentType" | "status" | "startDate" | "endDate";
+/** One cell edit: a field above, or an extra column by name. `null` clears it. */
+interface EmployeeChange {
+  readonly employeeId: string;
+  readonly field: EmployeeField | (string & {});
+  readonly value: unknown;
+}
+interface EmployeeChangeResult {
+  readonly accepted: readonly {
+    readonly employeeId: string;
+    readonly field: string;
+  }[];
+  /** Each refused change, with the error hint and message. Others still applied. */
+  readonly rejected: readonly {
+    readonly employeeId: string;
+    readonly field: string;
+    readonly hint?: string;
+    readonly reason: string;
+  }[];
+}
+interface EmergencyContact {
+  readonly name: string;
+  readonly phone?: string;
+  readonly relation?: string;
+}
+interface PrivateDetails {
+  readonly employeeId: string;
+  readonly nationalId?: string;
+  readonly iban?: string;
+  readonly birthDate?: Temporal.PlainDate;
+  readonly personalEmail?: string;
+  readonly phone?: string;
+  readonly address?: Readonly<Record<string, unknown>>;
+  readonly emergencyContacts: readonly EmergencyContact[];
+  /** Set on offboarding, so an anonymize rule can start from it. */
+  readonly offboardedAt?: Temporal.Instant;
+  readonly anonymizedAt?: Temporal.Instant;
+}
+/** The details to save. Left out keeps the stored value; `null` clears it. */
+interface PrivateDetailsInput {
+  readonly nationalId?: string | null;
+  readonly iban?: string | null;
+  readonly birthDate?: Temporal.PlainDate | null;
+  readonly personalEmail?: string | null;
+  readonly phone?: string | null;
+  readonly address?: Readonly<Record<string, unknown>> | null;
+  readonly emergencyContacts?: readonly EmergencyContact[] | null;
+}
+/** A contract. */
+interface Contract {
+  readonly id: string;
+  readonly employeeId: string;
+  readonly startsOn: Temporal.PlainDate;
+  readonly endsOn?: Temporal.PlainDate;
+  readonly hoursPerWeek?: number;
+  readonly salary?: Money;
+  readonly salaryPeriod?: SalaryPeriod;
+  readonly note?: string;
+}
+interface ContractInput {
+  readonly startsOn: Temporal.PlainDate;
+  readonly endsOn?: Temporal.PlainDate;
+  readonly hoursPerWeek?: number;
+  readonly salary?: Money;
+  readonly salaryPeriod?: SalaryPeriod;
+  readonly note?: string;
+}
+interface Employees<F extends object = Record<never, never>> {
+  create(organizationId: string, input: EmployeeInput<F>): AsyncResult<Employee<F>>;
+  /** Applies each change on its own; one that fails doesn't stop the others. */
+  update(changes: readonly EmployeeChange[]): AsyncResult<EmployeeChangeResult>;
+  /**
+   * Sets the end date (today by default) and moves the reports to the
+   * employee's manager.
+   */
+  offboard(employeeId: string, options?: {
+    readonly endDate?: Temporal.PlainDate;
+    readonly reason?: string;
+  }): AsyncResult<Employee<F>>;
+  /** The chart under `rootId`, or under everyone without a manager. */
+  orgChart(organizationId: string, rootId?: string): AsyncResult<readonly OrgChartEntry<F>[]>;
+  /** Direct reports, or everyone under the manager with `indirect`. */
+  reportsOf(managerId: string, options?: {
+    readonly indirect?: boolean;
+  }): AsyncResult<readonly OrgChartEntry<F>[]>;
+  /**
+   * The employee for a hired application (the hiring module), in preboarding,
+   * made once. `overrides` replaces what the candidate and the job give.
+   */
+  fromApplication(applicationId: string, overrides?: Partial<EmployeeInput<F>>): AsyncResult<Employee<F>>;
+  /** Needs employees.view_sensitive, or being the employee. */
+  privateDetails(employeeId: string): AsyncResult<PrivateDetails | undefined>;
+  savePrivateDetails(employeeId: string, input: PrivateDetailsInput): AsyncResult<PrivateDetails>;
+  /** The newest first. */
+  contracts(employeeId: string): AsyncResult<readonly Contract[]>;
+  /** Starts after the latest contract, which ends the day before. */
+  addContract(employeeId: string, input: ContractInput): AsyncResult<Contract>;
+}
+interface EmployeesOptions<S extends StandardSchemaV1 | undefined = undefined> extends BlockTemporalOptions {
+  readonly transport: BlockTransport;
+  readonly schema?: string;
+  /**
+   * A Standard Schema for the extra columns
+   * (`blocks.employees.options.extraColumns`), keyed by column name. It types
+   * and parses `fields` on reads and validates them on writes.
+   */
+  readonly fields?: S;
+  readonly hooks?: NoInfer<BlockHooks<Employees<FieldsOf<S>>>>;
+  readonly logger?: Logger;
+  readonly mappers?: readonly ErrorMapper[];
+}
+/**
+ * The employees block: the people an organization employs, their manager, team
+ * and status, the org chart, offboarding, and private details and contracts
+ * behind employees.view_sensitive.
+ */
+declare function createEmployees<S extends StandardSchemaV1 | undefined = undefined>(options: EmployeesOptions<S>): Employees<FieldsOf<S>>;
+//#endregion
+export { EmployeeChange as a, EmployeeInput as c, EmployeesOptions as d, OrgChartEntry as f, createEmployees as g, SalaryPeriod as h, Employee as i, EmployeeStatus as l, PrivateDetailsInput as m, ContractInput as n, EmployeeChangeResult as o, PrivateDetails as p, EmergencyContact as r, EmployeeField as s, Contract as t, Employees as u };

package/dist/ended--Bd_Q6uL.d.ts

@@ -0,0 +1,76 @@
+import { m as RequestContext } from "./plugin-Ar5546xh.js";
+import { g as StoredSession, r as AuthState, u as CookieOptions } from "./resolve-CzUKTIMq.js";
+//#region src/auth/refresh.d.ts
+interface RefreshOptions {
+  readonly url: string;
+  readonly publishableKey: string;
+  /**
+   * Sends `Sb-Forwarded-For: ip` with the secret key, so Auth rate-limits the
+   * refresh by the user's IP (when IP forwarding is on for the project).
+   */
+  readonly forwardedFor?: {
+    readonly ip: string;
+    readonly secretKey: string;
+  };
+  readonly fetch?: typeof fetch;
+  /**
+   * Milliseconds before a refresh counts as a network failure (the session is
+   * kept). 5000 by default.
+   */
+  readonly timeoutMs?: number;
+  /** Epoch milliseconds, the unit JWT `exp` and `iat` math needs. */
+  readonly now?: () => number;
+}
+type RefreshOutcome = {
+  readonly ok: true;
+  readonly session: StoredSession;
+  /** Served from a concurrent or just-finished refresh of the same token. */
+  readonly shared?: boolean;
+} | {
+  readonly ok: false;
+  /**
+   * `rejected`: the refresh token is dead, sign the user out. `network`:
+   * keep the session and retry later.
+   */
+  readonly reason: "rejected" | "network";
+  /** For `network`: the fetch failed, timed out, or Auth answered 5xx or 429. */
+  readonly cause?: "fetch" | "timeout" | "status";
+  readonly status?: number;
+  /**
+   * The Auth server's `error_code`, such as `user_banned` or
+   * `refresh_token_not_found`.
+   */
+  readonly code?: string;
+  readonly message: string;
+};
+/**
+ * Exchanges a refresh token for a new session. Concurrent calls with the same
+ * token share one request, and a successful result is reused for a short window
+ * so parallel requests carrying the old cookie converge on one session.
+ */
+declare function refreshSession(refreshToken: string, options: RefreshOptions): Promise<RefreshOutcome>;
+//#endregion
+//#region src/auth/context.d.ts
+/** The repository context (`actor`, `claims`) for an auth state. */
+declare function authContext(auth: AuthState): RequestContext;
+//#endregion
+//#region src/auth/ended.d.ts
+/** `banned`: Auth rejected the token with `error_code: "user_banned"`. */
+type SessionStatus = "active" | "ended" | "banned" | "unknown";
+interface SessionStatusOptions {
+  readonly url: string;
+  readonly publishableKey: string;
+  readonly cookieName?: string;
+  readonly fetch?: typeof fetch;
+  readonly timeoutMs?: number;
+  readonly now?: () => number;
+}
+interface ClearSessionCookiesOptions {
+  readonly url: string;
+  readonly cookieName?: string;
+  readonly cookie?: CookieOptions;
+}
+declare function sessionStatus(input: Request | string, options: SessionStatusOptions): Promise<SessionStatus>;
+declare function clearSessionCookies<R extends Response>(request: Request, response: R, options: ClearSessionCookiesOptions): R;
+//#endregion
+export { sessionStatus as a, RefreshOutcome as c, clearSessionCookies as i, refreshSession as l, SessionStatus as n, authContext as o, SessionStatusOptions as r, RefreshOptions as s, ClearSessionCookiesOptions as t };