better-supabase 0.12.0 → 0.14.0

package/dist/errors-03ysrOt4.js

@@ -0,0 +1,325 @@
+import { t as DbException } from "./db-exception-Lngc1W49.js";
+//#region src/core/errors.ts
+const STATUS = {
+	not_found: 404,
+	unauthorized: 401,
+	forbidden: 403,
+	conflict: 409,
+	foreign_key: 409,
+	check: 422,
+	not_null: 422,
+	exclusion: 409,
+	invalid_input: 400,
+	invalid_value: 500,
+	raised: 400,
+	timeout: 504,
+	serialization: 409,
+	network: 503,
+	aborted: 499,
+	invalid_request: 400,
+	validation: 422,
+	multiple_rows: 409,
+	stale: 412,
+	max_affected: 400,
+	rate_limited: 429,
+	quota_exceeded: 429,
+	unsupported: 501,
+	unexpected: 500
+};
+function statusOf(kind) {
+	return STATUS[kind];
+}
+/** Creates a `DbError` with the default status for its kind. */
+function dbError(kind, message, ...[extra]) {
+	const error = {
+		kind,
+		message,
+		status: STATUS[kind]
+	};
+	if (extra) {
+		for (const [key, value] of Object.entries(extra)) if (value !== void 0) error[key] = value;
+	}
+	return error;
+}
+/**
+* A plain `DbError`. A `DbException` carries the same fields but is not one;
+* `dbErrorOf()` reads the `DbError` out of it.
+*/
+function isDbError(value) {
+	return typeof value === "object" && value !== null && !(value instanceof Error) && typeof value.kind === "string" && typeof value.message === "string" && typeof value.status === "number";
+}
+/**
+* The `DbError` in a `DbError`, a `DbException`, or an error whose `cause` is a
+* `DbError` (what `betterSupabase.mapError()` mappers should set).
+*/
+function dbErrorOf(value) {
+	if (value instanceof DbException) return value.error;
+	if (value instanceof Error && isDbError(value.cause)) return value.cause;
+	return isDbError(value) ? value : void 0;
+}
+function constraintGuard(kind) {
+	return (error, constraint) => {
+		const found = dbErrorOf(error);
+		if (found?.kind !== kind) return false;
+		return constraint === void 0 || found.constraint === constraint;
+	};
+}
+/**
+* A unique violation, optionally for one constraint. Accepts a `DbError` or a
+* `DbException`. Pass the generated `UniqueConstraint` type to check names:
+* `isConflict<UniqueConstraint>(error, 'customers_organization_id_kvk_key')`.
+*/
+const isConflict = constraintGuard("conflict");
+/** A CHECK violation, optionally for one constraint (`CheckConstraint`). */
+const isCheck = constraintGuard("check");
+/**
+* A foreign key violation, optionally for one constraint
+* (`ForeignKeyConstraint`).
+*/
+const isForeignKey = constraintGuard("foreign_key");
+/**
+* Builds the factory `.orThrow()` takes from handlers per error kind and per
+* SQLSTATE code. A handler that returns `undefined`, and an error no handler
+* matches, throw a `DbException`.
+*/
+function matchDbError(matchers) {
+	return (error) => {
+		return (error.code === void 0 || !matchers.codes ? void 0 : Object.hasOwn(matchers.codes, error.code) ? matchers.codes[error.code] : void 0)?.(error) ?? kindHandler(matchers, error)?.(error) ?? new DbException(error);
+	};
+}
+function kindHandler(matchers, error) {
+	if (!Object.hasOwn(matchers, error.kind)) return;
+	return matchers[error.kind];
+}
+const CONSTRAINT_IN_MESSAGE = /constraint "([^"]+)"/;
+const KEY_COLUMNS_IN_DETAILS = /^Key \(([^)]+)\)=/;
+const COLUMN_IN_MESSAGE = /column "([^"]+)"/;
+const RETRY_AFTER = /retry after (\d+)/i;
+const PERMISSION_DENIED = /^permission denied for (table|view|sequence|function|schema) (\S+)/;
+/**
+* The SQL compiler fails a write past `maxAffected` by casting this text,
+* followed by `:<rows>`, to an integer: plain SQL has no `raise`.
+*/
+const MAX_AFFECTED_MARKER = "better_supabase:max_affected";
+const MAX_AFFECTED_COUNT = /better_supabase:max_affected:(\d+)/;
+function constraintOf(raw) {
+	return raw.constraint ?? CONSTRAINT_IN_MESSAGE.exec(raw.message ?? "")?.[1];
+}
+/**
+* The hint `better_supabase.check_json_schema()` raises with (the
+* `jsonb-schemas` module).
+*/
+const JSON_SCHEMA_HINT = "JSON_SCHEMA_INVALID";
+/** The prefix of the `jsonb-schemas` check constraints and triggers. */
+const JSON_SCHEMA_CONSTRAINT = "bs_json_";
+const JSON_SCHEMA_COLUMN = /^[\w$]+\.([\w$]+) does not match its JSON Schema/;
+/**
+* One issue per pg_jsonschema error in DETAIL (a JSON array of strings), at the
+* column's database name. Without the list (the check constraint itself
+* failed), one issue for the whole value.
+*/
+function jsonSchemaIssues(raw) {
+	const column = raw.column ?? JSON_SCHEMA_COLUMN.exec(raw.message ?? "")?.[1];
+	const path = column === void 0 ? {} : { path: [column] };
+	let errors;
+	try {
+		errors = JSON.parse(raw.details ?? "");
+	} catch {
+		errors = void 0;
+	}
+	const messages = Array.isArray(errors) ? errors.filter((entry) => typeof entry === "string") : [];
+	return messages.length > 0 ? messages.map((message) => ({
+		message,
+		...path
+	})) : [{
+		message: "The value does not match its JSON Schema",
+		...path
+	}];
+}
+function columnsOf(raw) {
+	return KEY_COLUMNS_IN_DETAILS.exec(raw.details ?? "")?.[1]?.split(",").map((column) => column.trim());
+}
+function optional(raw) {
+	const out = {};
+	if (raw.code) out.code = raw.code;
+	if (raw.details) out.details = raw.details;
+	if (raw.hint) out.hint = raw.hint;
+	return out;
+}
+/**
+* The `permissions` a `42501` raised with `detail = '{"permissions": [...]}'`
+* names, so a refusal from SQL carries the keys the caller lacks.
+*/
+function permissionsOf(details) {
+	if (details === void 0 || !details.startsWith("{")) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(details);
+	} catch {
+		return {};
+	}
+	if (typeof parsed !== "object" || parsed === null) return {};
+	const permissions = "permissions" in parsed ? parsed.permissions : void 0;
+	return Array.isArray(permissions) && permissions.every((key) => typeof key === "string") ? { permissions } : {};
+}
+/** Adds the operation's limit to a `max_affected` error that doesn't name it. */
+function withMaxAffected(error, maxAffected) {
+	return error.kind === "max_affected" && maxAffected !== void 0 && error.maxAffected === void 0 ? {
+		...error,
+		maxAffected
+	} : error;
+}
+/**
+* Maps a PostgREST or Postgres error to a `DbError`. Custom mappers run first;
+* the first one that returns an error wins.
+*/
+function mapDbError(raw, mappers = []) {
+	const fallback = mapBuiltin(raw);
+	for (const mapper of mappers) {
+		const mapped = mapper(raw, fallback);
+		if (mapped) return mapped;
+	}
+	return fallback;
+}
+function mapBuiltin(raw) {
+	const message = raw.message ?? "Unknown database error";
+	const base = optional(raw);
+	const code = raw.code ?? "";
+	if (raw.name === "AbortError" || code === "20" || message.startsWith("AbortError:")) return dbError("aborted", message, base);
+	switch (code) {
+		case "23505": {
+			const extra = {};
+			const constraint = constraintOf(raw);
+			const columns = columnsOf(raw);
+			if (constraint) extra.constraint = constraint;
+			if (columns) extra.columns = columns;
+			return dbError("conflict", message, {
+				...base,
+				...extra
+			});
+		}
+		case "23503": {
+			const extra = {};
+			const constraint = constraintOf(raw);
+			const columns = columnsOf(raw);
+			if (constraint) extra.constraint = constraint;
+			if (columns) extra.columns = columns;
+			return dbError("foreign_key", message, {
+				...base,
+				...extra
+			});
+		}
+		case "23514": {
+			const constraint = constraintOf(raw);
+			if (base.hint === JSON_SCHEMA_HINT || constraint?.startsWith(JSON_SCHEMA_CONSTRAINT)) return dbError("validation", message, {
+				...base,
+				issues: jsonSchemaIssues(raw)
+			});
+			return dbError("check", message, {
+				...base,
+				...constraint ? { constraint } : {}
+			});
+		}
+		case "23502": {
+			const column = raw.column ?? COLUMN_IN_MESSAGE.exec(message)?.[1];
+			return dbError("not_null", message, {
+				...base,
+				...column ? { column } : {}
+			});
+		}
+		case "23P01": {
+			const constraint = constraintOf(raw);
+			return dbError("exclusion", message, {
+				...base,
+				...constraint ? { constraint } : {}
+			});
+		}
+		case "42501": {
+			const object = PERMISSION_DENIED.exec(message);
+			const postgrestHint = base.hint?.startsWith("Grant the required");
+			if (!object || base.hint && !postgrestHint) return dbError("forbidden", message, {
+				...base,
+				...permissionsOf(base.details)
+			});
+			const advice = object[1] === "table" || object[1] === "view" ? `The Data API role has no grant on this ${object[1]}, as on a project with default privileges turned off: add it to \`expose\` and run \`better-supabase add grants\`. \`better-supabase doctor\` (BS106) lists every missing grant.` : `The Data API role has no ${object[1] === "function" ? "execute" : "usage"} grant on this ${object[1]}; grant it to the role that needs it.`;
+			const details = [
+				message,
+				base.details,
+				postgrestHint ? base.hint : ""
+			].filter(Boolean).join("\n");
+			return dbError("forbidden", "permission denied", {
+				...base,
+				details,
+				hint: advice
+			});
+		}
+		case "25006": return dbError("forbidden", "This connection is read-only, so the write was refused", {
+			...base,
+			details: base.details ?? message,
+			hint: base.hint ?? "The transaction is read-only, such as in a read-only support session; writes need a writable connection."
+		});
+		case "P0001": return dbError("raised", message, base);
+		case "P0002": return dbError("not_found", message, base);
+		case "57014": return dbError("timeout", message, base);
+		case "40001":
+		case "40P01": return dbError("serialization", message, base);
+		case "PGRST116": return /multiple|more than one/i.test(raw.details ?? message) ? dbError("multiple_rows", message, base) : dbError("not_found", message, base);
+		case "PGRST301":
+		case "PGRST302":
+		case "PGRST303": return dbError("unauthorized", message, base);
+		case "PGRST124": return dbError("max_affected", message, base);
+		case "22P02":
+			if (message.includes("better_supabase:max_affected")) {
+				const affected = MAX_AFFECTED_COUNT.exec(message)?.[1];
+				return dbError("max_affected", `The write affects ${affected ?? "more"} rows, more than maxAffected allows`, { code: "22P02" });
+			}
+			break;
+		case "PGRST123": return dbError("invalid_request", message, {
+			...base,
+			hint: base.hint ?? "PostgREST aggregates are off. Run `alter role authenticator set pgrst.db_aggregates_enabled = 'true'; notify pgrst, 'reload config';` (see BS210), or use better-supabase/postgres."
+		});
+		case "BS429":
+		case "PT429": {
+			const seconds = RETRY_AFTER.exec(raw.details ?? "")?.[1];
+			return dbError("rate_limited", message, {
+				...base,
+				...seconds ? { retryAfter: Number(seconds) } : {}
+			});
+		}
+		case "POSTGRES_POOL_BUSY":
+		case "POSTGRES_CONNECT_PAUSED": return dbError("network", message, {
+			...base,
+			...raw.retryAfterMs === void 0 ? {} : { retryAfter: Math.max(1, Math.ceil(raw.retryAfterMs / 1e3)) }
+		});
+		case "BSQ29": return dbError("quota_exceeded", message, {
+			...base,
+			...quotaDetails(raw.details)
+		});
+	}
+	if (code.startsWith("22")) return dbError("invalid_input", message, base);
+	if (code.startsWith("PGRST1") || code.startsWith("PGRST2")) return dbError("invalid_request", message, base);
+	if (code.startsWith("08") || /fetch failed|network/i.test(message)) return dbError("network", message, base);
+	return dbError("unexpected", message, base);
+}
+/** `consume_quota` puts `{ meter, limit, retry_after }` in the error's DETAIL. */
+function quotaDetails(details) {
+	let parsed;
+	try {
+		parsed = JSON.parse(details ?? "");
+	} catch {
+		return {};
+	}
+	if (typeof parsed !== "object" || parsed === null) return {};
+	const record = parsed;
+	const field = (key) => record[key];
+	const meter = field("meter");
+	const limit = field("limit");
+	const retryAfter = field("retry_after");
+	return {
+		...typeof meter === "string" ? { meter } : {},
+		...typeof limit === "number" ? { limit } : {},
+		...typeof retryAfter === "number" ? { retryAfter } : {}
+	};
+}
+//#endregion
+export { isConflict as a, mapDbError as c, withMaxAffected as d, isCheck as i, matchDbError as l, dbError as n, isDbError as o, dbErrorOf as r, isForeignKey as s, MAX_AFFECTED_MARKER as t, statusOf as u };

package/dist/errors-DZx8w-MH.js

@@ -0,0 +1,44 @@
+import { t as DbException } from "./db-exception-Lngc1W49.js";
+import { n as dbError, o as isDbError } from "./errors-03ysrOt4.js";
+import { s as toDbError } from "./result-B3m7xtRY.js";
+//#region src/storage/errors.ts
+/** Maps a Storage error (`StorageApiError`, fetch failures) to a `DbError`. */
+function fromStorageError(raw, table) {
+	if (isDbError(raw)) return raw;
+	if (raw instanceof DbException) return raw.error;
+	if (typeof raw !== "object" || raw === null) return toDbError(raw);
+	const failure = raw;
+	if (failure.name === "AbortError") return toDbError(raw);
+	const message = failure.message ?? "Storage request failed";
+	const code = failure.code ?? failure.statusCode;
+	const base = {
+		...code ? { code } : {},
+		...table ? { table } : {}
+	};
+	const statusCode = Number(failure.statusCode);
+	const status = Number.isFinite(statusCode) && statusCode >= 400 ? statusCode : failure.status ?? 0;
+	if (code === "FeatureNotEnabled" || /^Route \S+ not found$/.test(message)) return dbError("unsupported", message, base);
+	if (/row-level security|unauthorized to|AccessDenied/i.test(`${message} ${code ?? ""}`)) return dbError("forbidden", message, base);
+	if (/already exists|duplicate/i.test(`${message} ${code ?? ""}`)) return dbError("conflict", message, base);
+	if (failure.name === "StorageUnknownError" && status === 0) return dbError("network", message, base);
+	switch (status) {
+		case 400: return dbError("invalid_request", message, base);
+		case 401: return dbError("unauthorized", message, base);
+		case 403: return dbError("forbidden", message, base);
+		case 404: return dbError("not_found", message, base);
+		case 409: return dbError("conflict", message, base);
+		case 413:
+		case 415: return dbError("invalid_input", message, {
+			...base,
+			status
+		});
+		case 408:
+		case 429: return dbError("network", message, {
+			...base,
+			status
+		});
+		default: return status >= 500 ? dbError("network", message, base) : dbError("unexpected", message, base);
+	}
+}
+//#endregion
+export { fromStorageError as t };

package/dist/escape-like-BfXS-iVe.d.ts

@@ -0,0 +1,30 @@
+import { b as DbError, x as DbErrorKind } from "./result-C6jDfedy.js";
+//#region src/core/db-exception.d.ts
+/**
+ * Thrown by `.orThrow()`. Carries the plain `DbError` as `error` and as
+ * `cause`, and copies its `kind`, `code`, `status`, `details`, `hint` and
+ * `table` onto the exception, so error trackers and `catch` blocks that only
+ * read an error's own fields see them.
+ */
+declare class DbException extends Error {
+  override readonly name = "DbException";
+  readonly error: DbError;
+  readonly kind: DbErrorKind;
+  /** Suggested HTTP status. */
+  readonly status: number;
+  /** SQLSTATE or PostgREST code (`23505`, `PGRST116`), when known. */
+  readonly code?: string;
+  readonly details?: string;
+  /** Postgres `HINT`. `raised` errors use it as an app-level error code. */
+  readonly hint?: string;
+  /** App-cased table key the operation ran against. */
+  readonly table?: string;
+  readonly cause: DbError;
+  constructor(error: DbError);
+}
+//#endregion
+//#region src/ir/escape-like.d.ts
+/** Escapes LIKE wildcards so user input matches literally. */
+declare function escapeLike(value: string): string;
+//#endregion
+export { DbException as n, escapeLike as t };

package/dist/eve/index.d.ts

@@ -1,10 +1,13 @@
-import { a as ResolveAuthOptions, r as AuthState } from "../resolve-Ceft-18-.js";
-import { i as CredentialRef, r as CredentialProvider } from "../provider-DXgx5oSA.js";
-import { i as AiChat } from "../ai-chat-D-2MH1sU.js";
-import { a as Inbox } from "../inbox-Du5aPwKB.js";
-import { a as EveMemoryToolsContext, c as MemoryDocumentConflictError, d as supabaseDocumentBackend, f as supabaseMemory, i as EveMemoryTool, l as SupabaseDocumentBackendOptions, m as EveSessionContext, n as EveMemoryContext, o as EveRecallMessage, p as EveSessionAuth, r as EveMemoryProvider, s as EveRecallResult, t as EveDocumentBackend, u as SupabaseMemoryOptions } from "../eve-B6ru2Bt4.js";
+import { a as ResolveAuthOptions, r as AuthState } from "../resolve-CzUKTIMq.js";
+import { i as CredentialRef, r as CredentialProvider } from "../provider-DmiaI1qt.js";
+import { i as AiChat } from "../ai-chat-DBxEz3o1.js";
+import { a as Inbox } from "../inbox-BPBb6etH.js";
+import { a as EveMemoryToolsContext, c as MemoryDocumentConflictError, d as supabaseDocumentBackend, f as supabaseMemory, i as EveMemoryTool, l as SupabaseDocumentBackendOptions, m as EveSessionContext, n as EveMemoryContext, o as EveRecallMessage, p as EveSessionAuth, r as EveMemoryProvider, s as EveRecallResult, t as EveDocumentBackend, u as SupabaseMemoryOptions } from "../eve-BlJI8ZXL.js";
 //#region src/eve/auth.d.ts
-/** Thrown by `supabaseAuth` so eve answers with `response` instead of downgrading to anonymous. */
+/**
+ * Thrown by `supabaseAuth` so eve answers with `response` instead of
+ * downgrading to anonymous.
+ */
 export declare class EveAuthRejection extends Error {
   override readonly name = "EveAuthRejection";
   readonly response: Response;
@@ -13,7 +16,10 @@ export declare class EveAuthRejection extends Error {
 interface SupabaseAuthOptions extends Omit<ResolveAuthOptions, "refresh" | "leeway" | "refreshTimeoutMs"> {
   /** The tenant claim, `config.claims.tenant`. Defaults to `tenant_id`. */
   readonly tenantClaim?: string;
-  /** The memberships claim, `config.claims.memberships`. Defaults to `memberships`. */
+  /**
+   * The memberships claim, `config.claims.memberships`. Defaults to
+   * `memberships`.
+   */
   readonly membershipsClaim?: string;
   /** Extra attributes from the verified claims, merged over the defaults. */
   readonly attributes?: (claims: Readonly<Record<string, unknown>>) => Readonly<Record<string, string | readonly string[]>>;
@@ -28,7 +34,7 @@ export declare function principalOf(auth: AuthState, options?: Pick<SupabaseAuth
 export declare function supabaseAuth(options: SupabaseAuthOptions): (request: Request) => Promise<EveSessionAuth | null>;
 //#endregion
 //#region src/eve/connections.d.ts
-/** eve's `ConnectionAuthorizationRequiredError`, matched by name. */
+/** Eve's `ConnectionAuthorizationRequiredError`, matched by name. */
 export declare class ConnectionAuthorizationRequiredError extends Error {
   override readonly name = "ConnectionAuthorizationRequiredError";
   readonly connectionName: string;
@@ -36,7 +42,7 @@ export declare class ConnectionAuthorizationRequiredError extends Error {
     readonly message?: string;
   });
 }
-/** eve's `ConnectionAuthorizationFailedError`, matched by name. */
+/** Eve's `ConnectionAuthorizationFailedError`, matched by name. */
 export declare class ConnectionAuthorizationFailedError extends Error {
   override readonly name = "ConnectionAuthorizationFailedError";
   readonly connectionName: string;
@@ -110,19 +116,25 @@ interface CredentialAuthOptions {
   /** The connection's name in errors. Defaults to the ref's provider. */
   readonly connection?: string;
   readonly scopes?: readonly string[];
-  /** For `user`: let eve send the user to connect the account when the provider can. Defaults to true. */
+  /**
+   * For `user`: let eve send the user to connect the account when the provider
+   * can. Defaults to true.
+   */
   readonly interactive?: boolean;
 }
 /**
- * An eve connection `authorization` over a better-supabase
- * `CredentialProvider` (Vault, Vercel Connect or your own): tokens come from
- * the provider for the app or for the session's user. A user without a stored
- * credential gets eve's authorization flow when the provider supports one.
+ * An eve connection `authorization` over a better-supabase `CredentialProvider`
+ * (Vault, Vercel Connect or your own): tokens come from the provider for the
+ * app or for the session's user. A user without a stored credential gets eve's
+ * authorization flow when the provider supports one.
  */
 export declare function credentialAuth(options: CredentialAuthOptions): EveConnectionAuthorization;
 //#endregion
 //#region src/eve/ids.d.ts
-/** A UUID (version 8) from the SHA-256 of `input`, so the same input always gets the same id. */
+/**
+ * A UUID (version 8) from the SHA-256 of `input`, so the same input always gets
+ * the same id.
+ */
 export declare function stableUuid(input: string): Promise<string>;
 //#endregion
 //#region src/eve/inbox.d.ts
@@ -153,7 +165,10 @@ interface EveChatSdkBridge<T extends EveChatThread = EveChatThread> {
 interface RouteInboxOptions {
   /** `createInbox` on a service transport. */
   readonly inbox: Inbox;
-  /** The session title for a new conversation. Defaults to the conversation's subject. */
+  /**
+   * The session title for a new conversation. Defaults to the conversation's
+   * subject.
+   */
   readonly title?: string;
 }
 /**
@@ -206,14 +221,17 @@ interface PersistSessionsOptions {
   /** The title of a new chat. Defaults to `eve session`. */
   readonly title?: string;
 }
-/** The `ai_chats` id of an eve session: the same session always maps to the same chat. */
+/**
+ * The `ai_chats` id of an eve session: the same session always maps to the same
+ * chat.
+ */
 export declare function chatIdOf(sessionId: string): Promise<string>;
 /**
- * Hook handlers that copy an eve session into the canonical chat tables, so
- * the chat UI, search, memory recall and analytics read eve sessions like any
- * other chat. Every write is keyed by the event, so eve's at-least-once
- * delivery stores each message once. Sessions without a signed-in user and
- * tenant are skipped.
+ * Hook handlers that copy an eve session into the canonical chat tables, so the
+ * chat UI, search, memory recall and analytics read eve sessions like any other
+ * chat. Every write is keyed by the event, so eve's at-least-once delivery
+ * stores each message once. Sessions without a signed-in user and tenant are
+ * skipped.
  */
 export declare function persistSessions(options: PersistSessionsOptions): EveSessionHooks;
 //#endregion

package/dist/eve/index.js

@@ -1,11 +1,14 @@
-import { t as DbException } from "../db-exception-CnWcYPxL.js";
+import { t as DbException } from "../db-exception-Lngc1W49.js";
 import { n as isRecord } from "../guards-6F2bCtQR.js";
-import { a as tenantClaimPaths, n as claimAt, t as DEFAULT_CLAIMS } from "../claims-PqzCxaTD.js";
-import { r as resolveAuth } from "../resolve-AtncaPTU.js";
-import { t as isAnonymousUser } from "../view-CYX1wsgp.js";
-import { t as importOptionalPeer } from "../optional-peer-Dx8TaYXw.js";
+import { a as tenantClaimPaths, n as claimAt, t as DEFAULT_CLAIMS } from "../claims-Bp9My7XP.js";
+import { r as resolveAuth } from "../resolve-DAYdcs22.js";
+import { t as isAnonymousUser } from "../view-BtgqxQLM.js";
+import { t as importOptionalPeer } from "../optional-peer-C1NbBRJm.js";
 //#region src/eve/ids.ts
-/** A UUID (version 8) from the SHA-256 of `input`, so the same input always gets the same id. */
+/**
+* A UUID (version 8) from the SHA-256 of `input`, so the same input always gets
+* the same id.
+*/
 async function stableUuid(input) {
 	const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input))).slice(0, 16);
 	bytes[6] = (bytes[6] ?? 0) & 15 | 128;
@@ -15,7 +18,10 @@ async function stableUuid(input) {
 }
 //#endregion
 //#region src/eve/auth.ts
-/** Thrown by `supabaseAuth` so eve answers with `response` instead of downgrading to anonymous. */
+/**
+* Thrown by `supabaseAuth` so eve answers with `response` instead of
+* downgrading to anonymous.
+*/
 var EveAuthRejection = class extends Error {
 	name = "EveAuthRejection";
 	response;
@@ -69,7 +75,7 @@ function supabaseAuth(options) {
 }
 //#endregion
 //#region src/eve/connections.ts
-/** eve's `ConnectionAuthorizationRequiredError`, matched by name. */
+/** Eve's `ConnectionAuthorizationRequiredError`, matched by name. */
 var ConnectionAuthorizationRequiredError = class extends Error {
 	name = "ConnectionAuthorizationRequiredError";
 	connectionName;
@@ -78,7 +84,7 @@ var ConnectionAuthorizationRequiredError = class extends Error {
 		this.connectionName = connectionName;
 	}
 };
-/** eve's `ConnectionAuthorizationFailedError`, matched by name. */
+/** Eve's `ConnectionAuthorizationFailedError`, matched by name. */
 var ConnectionAuthorizationFailedError = class extends Error {
 	name = "ConnectionAuthorizationFailedError";
 	connectionName;
@@ -107,10 +113,10 @@ function connectionError(name, error) {
 	return new DbException(error);
 }
 /**
-* An eve connection `authorization` over a better-supabase
-* `CredentialProvider` (Vault, Vercel Connect or your own): tokens come from
-* the provider for the app or for the session's user. A user without a stored
-* credential gets eve's authorization flow when the provider supports one.
+* An eve connection `authorization` over a better-supabase `CredentialProvider`
+* (Vault, Vercel Connect or your own): tokens come from the provider for the
+* app or for the session's user. A user without a stored credential gets eve's
+* authorization flow when the provider supports one.
 */
 function credentialAuth(options) {
 	const name = options.connection ?? options.ref.provider;
@@ -210,17 +216,20 @@ function routeInbox(bridge, options) {
 }
 //#endregion
 //#region src/eve/sessions.ts
-/** The `ai_chats` id of an eve session: the same session always maps to the same chat. */
+/**
+* The `ai_chats` id of an eve session: the same session always maps to the same
+* chat.
+*/
 function chatIdOf(sessionId) {
 	return stableUuid(`eve-session:${sessionId}`);
 }
 const streamOf = (sessionId, turnId) => `eve:${sessionId}:${turnId}`;
 /**
-* Hook handlers that copy an eve session into the canonical chat tables, so
-* the chat UI, search, memory recall and analytics read eve sessions like any
-* other chat. Every write is keyed by the event, so eve's at-least-once
-* delivery stores each message once. Sessions without a signed-in user and
-* tenant are skipped.
+* Hook handlers that copy an eve session into the canonical chat tables, so the
+* chat UI, search, memory recall and analytics read eve sessions like any other
+* chat. Every write is keyed by the event, so eve's at-least-once delivery
+* stores each message once. Sessions without a signed-in user and tenant are
+* skipped.
 */
 function persistSessions(options) {
 	const { chats } = options;
@@ -306,7 +315,7 @@ function persistSessions(options) {
 }
 //#endregion
 //#region src/eve/eve.ts
-/** eve's `MemoryDocumentConflictError`, matched by name. */
+/** Eve's `MemoryDocumentConflictError`, matched by name. */
 var MemoryDocumentConflictError = class extends Error {
 	name = "MemoryDocumentConflictError";
 	key;
@@ -346,16 +355,16 @@ function textOfMessage(message) {
 }
 const isToolsModule = (value) => isRecord(value) && typeof value["defineTool"] === "function";
 /**
-* Loads `eve/tools` when the provider first builds its tools. The specifier
-* is a variable so bundlers leave the optional peer out.
+* Loads `eve/tools` when the provider first builds its tools. The specifier is
+* a variable so bundlers leave the optional peer out.
 */
 const loadTools = () => importOptionalPeer("eve/tools");
 const isRecallResult = (value) => isRecord(value) && Array.isArray(value["messages"]) && value["messages"].every((message) => isRecord(message) && typeof message["content"] === "string");
 /**
-* An eve memory provider over the memory and knowledge blocks. Every read
-* and write is partitioned by the scope key and the signed-in user; recall
-* stores its answer under the operation id, so a replayed recall returns the
-* same messages.
+* An eve memory provider over the memory and knowledge blocks. Every read and
+* write is partitioned by the scope key and the signed-in user; recall stores
+* its answer under the operation id, so a replayed recall returns the same
+* messages.
 */
 function supabaseMemory(options) {
 	const { memory } = options;