better-supabase 0.12.0 → 0.14.0

package/dist/authorization-hooks-dLmUO_PZ.d.ts

@@ -0,0 +1,217 @@
+import { m as RequestContext } from "./plugin-Ar5546xh.js";
+import { r as AuthState } from "./resolve-CzUKTIMq.js";
+//#region src/core/contracts/authorization-hooks.d.ts
+/**
+ * An email address or chat user, as a bot or a mail webhook sees it. The value
+ * is what the platform reports; it names no one until an identity link maps it
+ * to a user or a contact.
+ */
+interface IdentityRef {
+  readonly kind: "email" | "chat";
+  /** `slack`, `teams`, `whatsapp`, an email provider; unset for a plain address. */
+  readonly provider?: string;
+  /** The address (lower case) or the platform's user id. */
+  readonly value: string;
+  /** The platform workspace, such as a Slack team id. */
+  readonly workspace?: string;
+}
+/** Where an identity link points: an app user or a contact the app stores. */
+type IdentityTarget = {
+  readonly kind: "user";
+  readonly userId: string;
+} | {
+  readonly kind: "contact";
+  readonly contactId: string;
+};
+/**
+ * Looks up the verified link for an identity. `null` for an identity no
+ * signed-in link flow or verified address created; the caller then treats the
+ * author as anonymous.
+ */
+type PrincipalByIdentity = (identity: IdentityRef) => IdentityTarget | null | Promise<IdentityTarget | null>;
+/** The fields of an event a subscriber check reads. */
+interface SubscriberEvent {
+  readonly type: string;
+  readonly tenant: string | null;
+  /** The user who caused the event, or `null` for service work. */
+  readonly actorId: string | null;
+  readonly payload: unknown;
+  /** The event's subject, such as `invoices/123`, when it has one. */
+  readonly subject?: string | null;
+}
+/**
+ * A subscription a fan-out may deliver to. `principal` is the user who owns it,
+ * or the id of the service principal an organization-owned subscription runs as
+ * (`kind: "service"`).
+ */
+interface Subscriber {
+  readonly principal: string;
+  readonly kind?: "user" | "service";
+}
+/**
+ * Narrows a fan-out to the subscribers that may read the event: webhook
+ * endpoints, outbox consumers, realtime members and notification recipients. It
+ * returns a subset of `subscribers`; a subscriber it leaves out gets nothing,
+ * and a throw or rejection delivers to no one.
+ */
+type SubscriberPolicy = <S extends Subscriber>(event: SubscriberEvent, subscribers: readonly S[]) => readonly S[] | Promise<readonly S[]>;
+/** A request that waits for someone other than the requester to approve it. */
+interface ApprovalRequestRef {
+  /** `ai-tool` (an AI tool call), `support-session`, or the app's own kind. */
+  readonly kind: string;
+  /** The tool name for `ai-tool`, the request id for `support-session`. */
+  readonly subject: string;
+  readonly tenant?: string;
+  /** The user who asked; never their own approver. */
+  readonly requester?: string;
+}
+/** The signed-in user who would approve, with their verified claims. */
+interface Approver {
+  readonly userId: string;
+  readonly claims: Readonly<Record<string, unknown>>;
+}
+/**
+ * Whether `approver` may decide `request`. The SQL side is the `isApprover`
+ * template of the authorization provider; this is the same decision for server
+ * code. A throw counts as `false`, and better-supabase refuses the requester
+ * before it asks.
+ */
+type ApproverOf = (approver: Approver, request: ApprovalRequestRef) => boolean | Promise<boolean>;
+/** What `mayPublish` and `runAs` get about a published automation. */
+interface AutomationRef {
+  /** The user who published it, or `null` for an organization-owned automation. */
+  readonly publisher: string | null;
+  readonly tenant: string | null;
+  /** The permissions its nodes need, as stored at publish. */
+  readonly permissions: readonly string[];
+}
+/** How a provider decides published automations (workflow builder versions). */
+interface AutomationHooks {
+  /** Whether the publisher may publish a version whose nodes need `permissions`. */
+  readonly mayPublish?: (automation: AutomationRef & {
+    readonly claims: Readonly<Record<string, unknown>>;
+  }) => boolean | Promise<boolean>;
+  /**
+   * The claims a step of a published version runs with: the publisher's current
+   * claims narrowed to `permissions`, or the service principal's for an
+   * organization-owned automation. `null` when the publisher is gone, suspended
+   * or no longer holds a stored permission; the step then fails and never falls
+   * back to the service role.
+   */
+  readonly runAs?: (automation: AutomationRef) => Readonly<Record<string, unknown>> | null | Promise<Readonly<Record<string, unknown>> | null>;
+}
+/**
+ * Turns an opaque run ticket back into the context a job or a workflow step
+ * runs as. `null` or a throw refuses the ticket (expired, revoked, or for a
+ * principal that is gone), and the run fails instead of running as anyone else.
+ * The ticket is stored in plain text as a run attribute, so it is an id the
+ * provider looks up, never a bearer secret.
+ */
+type TicketSubject = (ticket: string) => RequestContext | null | Promise<RequestContext | null>;
+/**
+ * A delegated token, as `forContext` sees it: an OAuth client or agent acting
+ * for a user.
+ */
+interface DelegationRef {
+  readonly userId: string;
+  readonly tenant?: string;
+  /** The OAuth client, when the token has a `client_id`. */
+  readonly clientId?: string;
+  /** The scopes the user granted, split on spaces. */
+  readonly scopes: readonly string[];
+  /** RFC 9396 `authorization_details`, when the token has them. */
+  readonly authorizationDetails?: readonly {
+    readonly type: string;
+    readonly [field: string]: unknown;
+  }[];
+}
+/**
+ * The permission keys a delegated token may use, for scopes the provider maps
+ * at runtime (`authorization.delegation.scopes` is the static form in SQL).
+ * `forContext` caps the work to them, narrowed by its own `permissions`; a
+ * throw grants nothing.
+ */
+type DelegationPermissions = (delegation: DelegationRef) => readonly string[] | Promise<readonly string[]>;
+/** A button a chat user pressed on a message the app sent. */
+interface ChatAction {
+  /** The action id the card declared, such as `approve`. */
+  readonly id: string;
+  readonly value?: string;
+  /** The chat user, as the platform reports them. */
+  readonly author: IdentityRef;
+}
+/**
+ * Decides a chat action for its linked author: `undefined` when the provider
+ * does not handle the action. An approval button is decided here, through the
+ * provider; an unlinked author is refused.
+ */
+type ChatActionHook = (action: ChatAction, author: IdentityTarget | null) => {
+  readonly allowed: boolean;
+  readonly userId?: string;
+} | undefined | Promise<{
+  readonly allowed: boolean;
+  readonly userId?: string;
+} | undefined>;
+/** A support session start the `authorize` hook decides. */
+interface SupportAuthorizeInput {
+  readonly admin: Extract<AuthState, {
+    kind: "user";
+  }>;
+  readonly targetUserId: string;
+  /** Never empty: a start without a reason is refused before `authorize` runs. */
+  readonly reason: string;
+  readonly readOnly: boolean;
+  readonly tenant?: string;
+  readonly metadata: Readonly<Record<string, unknown>>;
+}
+/**
+ * `true` allows a support start that still needs a second approver unless
+ * approval is off; `{ approvedBy }` allows it and names the distinct approver
+ * the provider checked. `false`, a throw and an `approvedBy` equal to the admin
+ * refuse it.
+ */
+type SupportDecision = boolean | {
+  readonly approvedBy: string;
+};
+/** Decides a support session start. */
+type SupportAuthorize = (input: SupportAuthorizeInput) => SupportDecision | Promise<SupportDecision>;
+/**
+ * The runtime half of an authorization provider (`apiVersion: 1`). The
+ * `authorization` config key is plain data for SQL; these hooks decide the same
+ * things in server code, so one provider can own automations, support sessions,
+ * delivery, identity links, chat actions, approvals and delegated tokens end to
+ * end. Every hook is optional, and a slot passed to a block directly wins over
+ * the hook.
+ */
+interface AuthorizationHooks {
+  readonly apiVersion: 1;
+  /** The provider's name, for messages. */
+  readonly name: string;
+  readonly automation?: AutomationHooks;
+  readonly support?: {
+    readonly authorize: SupportAuthorize;
+  };
+  readonly delivery?: {
+    /** Webhook endpoints, outbox consumers and realtime members. */
+    readonly subscribers?: SubscriberPolicy;
+    /** Notification recipients. */
+    readonly audience?: SubscriberPolicy;
+  };
+  readonly identities?: {
+    readonly principalByIdentity: PrincipalByIdentity;
+  };
+  readonly chat?: {
+    readonly onAction?: ChatActionHook;
+  };
+  readonly approverOf?: ApproverOf;
+  readonly tickets?: {
+    readonly subject: TicketSubject;
+  };
+  readonly delegation?: {
+    readonly permissions: DelegationPermissions;
+  };
+}
+/** Types `hooks` and freezes it; better-supabase never mutates a provider. */
+declare function defineAuthorizationHooks<const H extends AuthorizationHooks>(hooks: H): H;
+//#endregion
+export { SupportAuthorize as _, AutomationHooks as a, TicketSubject as b, ChatActionHook as c, IdentityRef as d, IdentityTarget as f, SubscriberPolicy as g, SubscriberEvent as h, AuthorizationHooks as i, DelegationPermissions as l, Subscriber as m, Approver as n, AutomationRef as o, PrincipalByIdentity as p, ApproverOf as r, ChatAction as s, ApprovalRequestRef as t, DelegationRef as u, SupportAuthorizeInput as v, defineAuthorizationHooks as x, SupportDecision as y };

package/dist/authorizer-DFP3gHv8.d.ts

@@ -0,0 +1,82 @@
+//#region src/core/authorizer.d.ts
+type JsonObject = Readonly<Record<string, unknown>>;
+/** Who asks (AuthZEN Subject). Always built from the verified request context. */
+interface AuthorizationSubject {
+  /**
+   * `user`, `service`, `anon`, or `agent` for a delegated token with an `act`
+   * chain.
+   */
+  readonly type: string;
+  readonly id: string;
+  /**
+   * `role`, `email` and `impersonator` when set, and `claims`: the verified
+   * access-token claims (a frozen copy, including what a token hook wrote, such
+   * as `memberships`, `roles` and `act`). The client never supplies them.
+   * Anonymous subjects have no properties.
+   */
+  readonly properties?: JsonObject;
+}
+/** What is acted on (AuthZEN Resource): a table, a topic or an action's target. */
+interface AuthorizationResource {
+  readonly type: string;
+  readonly id?: string;
+  /** The row, for decisions that read it (`get`, `update`, `delete`). */
+  readonly properties?: JsonObject;
+}
+/**
+ * One access request, in the AuthZEN Authorization API 1.0 information model
+ * (`SPEC_PINS.authzen`): subject, action, resource and context. `action` is the
+ * permission reference the authorizer understands.
+ */
+interface AuthorizationRequest<Ref = string> {
+  readonly subject: AuthorizationSubject;
+  readonly action: Ref;
+  readonly resource: AuthorizationResource;
+  /** The tenant, assurance level and scopes of the request. */
+  readonly context: JsonObject;
+}
+type AuthorizationOutcome = {
+  readonly outcome: "granted";
+  readonly context?: JsonObject;
+} | {
+  readonly outcome: "denied";
+  readonly reason?: string;
+  readonly context?: JsonObject;
+} | {
+  readonly outcome: "approval-required";
+  readonly approval?: {
+    readonly id: string;
+  };
+  readonly context?: JsonObject;
+};
+/**
+ * A runtime authorization decision point (API v1). Authorization libraries ship
+ * an adapter that implements it; better-supabase builds every request and fails
+ * closed on anything but `granted`.
+ */
+interface Authorizer<Ref = string> {
+  readonly apiVersion: 1;
+  readonly name: string;
+  /** The stable key of a permission reference, for specs, SQL and messages. */
+  key(ref: Ref): string;
+  /**
+   * The default permission for a table operation; lets `permissions: true`
+   * work.
+   */
+  forOperation?(table: string, operation: string): Ref | undefined;
+  evaluate(request: AuthorizationRequest<Ref>): AuthorizationOutcome | Promise<AuthorizationOutcome>;
+  /**
+   * The batch form (AuthZEN Access Evaluations); results keep the request
+   * order.
+   */
+  evaluations?(requests: readonly AuthorizationRequest<Ref>[]): Promise<readonly AuthorizationOutcome[]>;
+}
+type AnyAuthorizer = Authorizer<any>;
+/** The permission reference type of an authorizer, `string` without one. */
+type PermissionRef<A> = A extends Authorizer<infer R> ? R : string;
+/** Identity helper that fixes `apiVersion` and infers `Ref`. */
+declare function defineAuthorizer<Ref = string>(authorizer: Omit<Authorizer<Ref>, "apiVersion"> & {
+  readonly apiVersion?: 1;
+}): Authorizer<Ref>;
+//#endregion
+export { AuthorizationSubject as a, defineAuthorizer as c, AuthorizationResource as i, AuthorizationOutcome as n, Authorizer as o, AuthorizationRequest as r, PermissionRef as s, AnyAuthorizer as t };

package/dist/authorizer-DPTeL-7h.js

@@ -0,0 +1,125 @@
+import { n as deepFreeze, r as isPlainObject, t as cloneValue } from "./clone-CkG0-hlI.js";
+import { n as dbError } from "./errors-03ysrOt4.js";
+import { a as ok, r as err } from "./result-B3m7xtRY.js";
+//#region src/core/authorizer.ts
+/** Identity helper that fixes `apiVersion` and infers `Ref`. */
+function defineAuthorizer(authorizer) {
+	return {
+		...authorizer,
+		apiVersion: 1
+	};
+}
+const ANONYMOUS = {
+	type: "anon",
+	id: "anonymous"
+};
+function scopesOf(claims) {
+	const scope = claims?.["scope"];
+	return typeof scope === "string" ? scope.split(" ").filter(Boolean) : [];
+}
+/** A frozen copy of the verified claims, so an authorizer cannot change them. */
+function claimsProperty(claims) {
+	if (!isPlainObject(claims)) return {};
+	return { claims: deepFreeze(cloneValue(claims)) };
+}
+/** The subject and context of a request, from the verified context only. */
+function requestOf(context) {
+	const actor = context?.actor;
+	const claims = context?.claims;
+	const act = claims?.["act"];
+	const subject = actor ? {
+		type: typeof act === "object" && act !== null && actor.kind === "user" ? "agent" : actor.kind,
+		id: actor.id,
+		properties: {
+			...actor.role === void 0 ? {} : { role: actor.role },
+			...actor.email === void 0 ? {} : { email: actor.email },
+			...actor.impersonator === void 0 ? {} : { impersonator: actor.impersonator },
+			...claimsProperty(claims)
+		}
+	} : ANONYMOUS;
+	const aal = claims?.["aal"];
+	return {
+		subject,
+		context: {
+			...context?.tenant === void 0 ? {} : { tenant: context.tenant },
+			...typeof aal === "string" ? { aal } : {},
+			scopes: scopesOf(claims)
+		}
+	};
+}
+function isOutcome(value) {
+	if (typeof value !== "object" || value === null || !("outcome" in value)) return false;
+	const { outcome } = value;
+	return outcome === "granted" || outcome === "denied" || outcome === "approval-required";
+}
+/** The `forbidden` error for an outcome other than `granted`, or `undefined`. */
+function outcomeError(outcome, permission) {
+	if (!isOutcome(outcome)) return dbError("forbidden", `The authorizer gave no decision for ${permission}`, {
+		code: "PERMISSION_DENIED",
+		permission
+	});
+	switch (outcome.outcome) {
+		case "granted": return;
+		case "denied": return dbError("forbidden", outcome.reason ?? `Permission ${permission} is required`, {
+			code: "PERMISSION_DENIED",
+			permission
+		});
+		case "approval-required": return dbError("forbidden", `${permission} needs an approval`, {
+			code: "APPROVAL_REQUIRED",
+			permission,
+			...outcome.approval ? { approval: { id: outcome.approval.id } } : {}
+		});
+		default: return outcome;
+	}
+}
+/**
+* Checks one permission and fails closed: a missing authorizer, a throw or an
+* unknown outcome all deny. Never throws (invariant 4).
+*/
+async function checkPermission(options) {
+	const { authorizer, permission } = options;
+	if (!authorizer) return err(dbError("forbidden", "A permission is declared, but no authorizer is set", { code: "PERMISSION_DENIED" }));
+	let key;
+	try {
+		key = authorizer.key(permission);
+	} catch {
+		return err(dbError("forbidden", "Unknown permission", { code: "PERMISSION_DENIED" }));
+	}
+	const { subject, context } = requestOf(options.context);
+	try {
+		const error = outcomeError(await authorizer.evaluate({
+			subject,
+			action: permission,
+			resource: options.resource,
+			context
+		}), key);
+		return error ? err(error) : ok(void 0);
+	} catch {
+		return err(dbError("forbidden", `The authorizer failed for ${key}`, {
+			code: "PERMISSION_DENIED",
+			permission: key
+		}));
+	}
+}
+/**
+* Checks one permission per resource, with `evaluations` when the authorizer
+* has it. Returns whether each one is granted, in order; any failure denies.
+*/
+async function checkEach(authorizer, permission, resources, context) {
+	if (!authorizer || resources.length === 0) return resources.map(() => false);
+	const { subject, context: requestContext } = requestOf(context);
+	const requests = resources.map((resource) => ({
+		subject,
+		action: permission,
+		resource,
+		context: requestContext
+	}));
+	try {
+		const outcomes = authorizer.evaluations ? await authorizer.evaluations(requests) : await Promise.all(requests.map((request) => Promise.resolve(authorizer.evaluate(request))));
+		return requests.map((_, index) => isOutcome(outcomes[index]) && outcomes[index].outcome === "granted");
+	} catch {
+		return resources.map(() => false);
+	}
+}
+//#endregion
+export { requestOf as i, checkPermission as n, defineAuthorizer as r, checkEach as t };

package/dist/availability-q3dZoZYM.d.ts

@@ -0,0 +1,226 @@
+/// <reference lib="esnext.temporal" />
+//#region src/blocks/calendar/ics.d.ts
+/** How an attendee takes part (RFC 5545 `ROLE`), in lowercase. */
+type AttendeeRole = "chair" | "required" | "optional" | "non-participant";
+/** An attendee's answer (RFC 5545 `PARTSTAT`), in lowercase. */
+type AttendeeResponse = "needs-action" | "accepted" | "declined" | "tentative";
+type CalendarEventStatus = "confirmed" | "tentative" | "cancelled";
+interface CalendarAttendee {
+  readonly email: string;
+  readonly name?: string;
+  readonly userId?: string;
+  readonly role: AttendeeRole;
+  readonly response: AttendeeResponse;
+}
+/** One `VEVENT`, ready for `importIcs` or `save`. */
+interface IcsEvent {
+  readonly uid: string;
+  readonly title: string;
+  readonly description?: string;
+  readonly location?: string;
+  readonly startsAt: Temporal.Instant;
+  /** Exclusive, as in `DTEND`. */
+  readonly endsAt: Temporal.Instant;
+  readonly allDay: boolean;
+  /** The IANA zone the event's wall-clock times and recurrence follow. */
+  readonly tz: string;
+  readonly status: CalendarEventStatus;
+  readonly rrule?: string;
+  readonly exdates: readonly Temporal.Instant[];
+  /** `RECURRENCE-ID`: the occurrence of the series this event overrides. */
+  readonly originalStart?: Temporal.Instant;
+  readonly attendees: readonly CalendarAttendee[];
+  /** `TRANSP:TRANSPARENT` reads as `transparent`; absent means opaque. */
+  readonly transparency?: CalendarTransparency;
+}
+interface ParsedIcs {
+  /** `X-WR-CALNAME`, when the file has one. */
+  readonly name?: string;
+  /** `X-WR-TIMEZONE`, else `UTC`: the zone of floating and all-day times. */
+  readonly tz: string;
+  readonly events: readonly IcsEvent[];
+  /** `VEVENT`s without a `UID` or `DTSTART`, which are left out. */
+  readonly skipped: number;
+}
+/**
+ * Reads an iCalendar file (RFC 5545): unfolds lines, unescapes TEXT values and
+ * reads each `VEVENT`'s times, recurrence (`RRULE`, `EXDATE`, `RECURRENCE-ID`)
+ * and attendees. Times in a zone Temporal does not know, floating times and
+ * dates use `X-WR-TIMEZONE`, else UTC.
+ */
+declare function parseIcs(text: string): ParsedIcs;
+/** The event fields `toIcs` writes. `CalendarEvent` has all of them. */
+interface IcsSource {
+  readonly transparency?: CalendarTransparency;
+  readonly uid: string;
+  readonly title: string;
+  readonly description?: string;
+  readonly location?: string;
+  readonly startsAt: Temporal.Instant;
+  readonly endsAt: Temporal.Instant;
+  readonly allDay: boolean;
+  readonly tz: string;
+  readonly status: CalendarEventStatus;
+  readonly rrule?: string;
+  readonly exdates: readonly Temporal.Instant[];
+  readonly originalStart?: Temporal.Instant;
+  readonly attendees?: readonly CalendarAttendee[];
+  readonly updatedAt?: Temporal.Instant;
+}
+interface ToIcsOptions {
+  readonly name?: string;
+  /** `X-WR-TIMEZONE`. */
+  readonly tz?: string;
+  readonly prodId?: string;
+  /** `DTSTAMP` for events without `updatedAt`. Default now. */
+  readonly now?: Temporal.Instant;
+}
+/**
+ * Writes events as an iCalendar file (RFC 5545): CRLF line ends, lines folded
+ * at 75 octets, escaped TEXT, and a `VTIMEZONE` for every zone a timed event
+ * uses, so recurrence keeps its wall-clock time across DST.
+ */
+declare function toIcs(events: readonly IcsSource[], options?: ToIcsOptions): string;
+//#endregion
+//#region src/blocks/calendar/occurrences.d.ts
+/** One row of `calendar_events`: a single event, a series or an override. */
+interface CalendarEvent {
+  readonly id: string;
+  readonly calendarId: string;
+  readonly uid: string;
+  readonly title: string;
+  readonly description?: string;
+  readonly location?: string;
+  readonly startsAt: Temporal.Instant;
+  /** Exclusive. */
+  readonly endsAt: Temporal.Instant;
+  readonly allDay: boolean;
+  readonly tz: string;
+  readonly status: CalendarEventStatus;
+  /** The RFC 5545 `RRULE` value of a series, without the `RRULE:` prefix. */
+  readonly rrule?: string;
+  readonly exdates: readonly Temporal.Instant[];
+  /** The series an override belongs to. */
+  readonly recurrenceId?: string;
+  /** The occurrence of the series an override replaces. */
+  readonly originalStart?: Temporal.Instant;
+  readonly subjectType?: string;
+  readonly subjectId?: string;
+  readonly color?: string;
+  /** Absent when the table has no `kind` column; read it as `event`. */
+  readonly kind?: CalendarEventKind;
+  readonly transparency?: CalendarTransparency;
+  /** An out-of-office or focus-time block that declines new invitations. */
+  readonly autoDecline?: boolean;
+  readonly attendees: readonly CalendarAttendee[];
+  readonly updatedAt?: Temporal.Instant;
+}
+/** One occurrence in a range: a single event, or one instance of a series. */
+interface CalendarOccurrence {
+  /** `${seriesId}::${originalStart}`, stable across edits of the occurrence. */
+  readonly key: string;
+  /** The row the occurrence comes from: the event, the series or its override. */
+  readonly event: CalendarEvent;
+  /** The series, for an occurrence of one (also when it is overridden). */
+  readonly series?: CalendarEvent;
+  readonly start: Temporal.Instant;
+  readonly end: Temporal.Instant;
+  /** Where the series put this occurrence before any override moved it. */
+  readonly originalStart: Temporal.Instant;
+  readonly allDay: boolean;
+  readonly recurring: boolean;
+}
+interface OccurrenceRange {
+  readonly from: Temporal.Instant;
+  readonly until: Temporal.Instant;
+}
+interface OccurrenceOptions {
+  /** Keep cancelled events and occurrences. Default false. */
+  readonly includeCancelled?: boolean;
+}
+/**
+ * Expands events into the occurrences that overlap `[from, until)`. Series
+ * expand with the reminders block's `expandRule` in their own zone, so a weekly
+ * 09:00 meeting stays at 09:00 across DST. `EXDATE`s drop occurrences, and
+ * overrides replace the occurrence they name, also when they move it out of the
+ * range.
+ */
+declare function expandOccurrences(events: readonly CalendarEvent[], range: OccurrenceRange, options?: OccurrenceOptions): CalendarOccurrence[];
+/** The rules of a series split at one of its occurrences. */
+interface SplitRules {
+  /** The series up to the occurrence before `at`: `UNTIL` instead of `COUNT`. */
+  readonly before: string;
+  /** The series from `at` on: the remaining `COUNT`, or the old `UNTIL`. */
+  readonly after: string;
+}
+/**
+ * Splits a series for "this and following": the first rule ends one second
+ * before `at` (RFC 5545 forbids `COUNT` with `UNTIL`, so it drops `COUNT`), and
+ * the second keeps the occurrences that are left.
+ */
+declare function splitRule(rrule: string, dtstart: Temporal.ZonedDateTime, at: Temporal.Instant): SplitRules;
+//#endregion
+//#region src/blocks/calendar/availability.d.ts
+/**
+ * What an event is: a meeting, a block the owner is away (`out_of_office`), or
+ * time they keep for deep work (`focus_time`).
+ */
+type CalendarEventKind = "event" | "out_of_office" | "focus_time";
+/** `transparent` events don't make anyone busy (RFC 5545 `TRANSP`). */
+type CalendarTransparency = "opaque" | "transparent";
+/** One stretch of a weekday, in `HH:MM` local time (`end` may be `24:00`). */
+interface WeeklyHours {
+  /** ISO weekday: 1 is Monday, 7 is Sunday. */
+  readonly weekday: 1 | 2 | 3 | 4 | 5 | 6 | 7;
+  readonly start: string;
+  readonly end: string;
+}
+interface WorkingHours {
+  readonly userId: string;
+  readonly tz: string;
+  readonly hours: readonly WeeklyHours[];
+}
+interface WorkingHoursInput {
+  /** IANA time zone the hours are in. */
+  readonly tz: string;
+  /** An empty list clears them. */
+  readonly hours: readonly WeeklyHours[];
+  /** Default the signed-in user; calendar managers can set anyone's. */
+  readonly userId?: string;
+}
+/** A half-open range of instants. */
+interface BusyRange {
+  readonly from: Temporal.Instant;
+  readonly until: Temporal.Instant;
+}
+/** When one member is busy, merged and clipped to the asked range. */
+interface FreeBusy {
+  readonly userId: string;
+  /** Every busy range: events, out of office, focus time and leave. */
+  readonly busy: readonly BusyRange[];
+  readonly outOfOffice: readonly BusyRange[];
+  readonly focusTime: readonly BusyRange[];
+  /** Their working hours in the range; absent when they set none. */
+  readonly workingHours?: readonly BusyRange[];
+  readonly tz?: string;
+}
+interface CommonFreeTimeOptions {
+  /** The shortest free range worth returning. Default zero. */
+  readonly minimum?: Temporal.Duration;
+  /**
+   * Keep only the time inside everyone's working hours (members without working
+   * hours don't narrow it). Default `true`.
+   */
+  readonly workingHours?: boolean;
+}
+/** A `calendar_free_busy` result. */
+declare function freeBusyOf(value: unknown): FreeBusy[];
+/** A `list_calendar_working_hours` result. */
+declare function workingHoursOf(value: unknown): WorkingHours[];
+/**
+ * The ranges in `range` when every member in `freeBusy` is free, for a "find a
+ * time" view or a scheduling suggestion.
+ */
+declare function commonFreeTime(freeBusy: readonly FreeBusy[], range: OccurrenceRange, options?: CommonFreeTimeOptions): BusyRange[];
+//#endregion
+export { IcsEvent as C, parseIcs as D, ToIcsOptions as E, toIcs as O, CalendarEventStatus as S, ParsedIcs as T, expandOccurrences as _, FreeBusy as a, AttendeeRole as b, WorkingHoursInput as c, workingHoursOf as d, CalendarEvent as f, SplitRules as g, OccurrenceRange as h, CommonFreeTimeOptions as i, commonFreeTime as l, OccurrenceOptions as m, CalendarEventKind as n, WeeklyHours as o, CalendarOccurrence as p, CalendarTransparency as r, WorkingHours as s, BusyRange as t, freeBusyOf as u, splitRule as v, IcsSource as w, CalendarAttendee as x, AttendeeResponse as y };