better-supabase 0.12.0 → 0.14.0

package/dist/mcp/index.js

@@ -1,34 +1,34 @@
-import { n as dbError } from "../errors-BV1SKTVs.js";
-import { a as ok } from "../result-DIeYscA3.js";
-import { t as base64ToText } from "../base64-D4aqdnDR.js";
-import { n as validate } from "../standard-B1BigegP.js";
-import { a as methodNotAllowed, c as toProblem, o as problemResponse } from "../problem-JRCohp1j.js";
-import { t as SPEC_PINS } from "../spec-pins-S4PymRxp.js";
-import { t as buildJsonSchema, v as toDraft07 } from "../json-schema-CpYINXG8.js";
-import { r as operationPermission, t as OPERATION_PREFIXES } from "../operations-CsIfMED7.js";
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CRNH2aX_.js";
-import { n as jsonResponse, t as jsonReplacer } from "../json-CEnpTHlZ.js";
-import { o as settle, r as guard, t as defaultExpose } from "../respond-Bhp3G__q.js";
-import { t as boundedTtlCache } from "../ttl-cache-XzZ-Q2eX.js";
-import { n as checkPermission, t as checkEach } from "../authorizer-B3yyCVUF.js";
-import { t as defineResource } from "../resource-Bdkqi8jo.js";
-import { r as hasRole } from "../kit-LTbHrWWD.js";
+import { n as dbError } from "../errors-03ysrOt4.js";
+import { a as ok } from "../result-B3m7xtRY.js";
+import { t as base64ToText } from "../base64-B9Wlsdj7.js";
+import { n as validate } from "../standard-DtkpFGkS.js";
+import { a as methodNotAllowed, c as toProblem, o as problemResponse } from "../problem-BWElIgIb.js";
+import { t as SPEC_PINS } from "../spec-pins-D3Tm6HJi.js";
+import { r as toDraft07, t as buildJsonSchema } from "../json-schema-DWDTfD8J.js";
+import { r as operationPermission, t as OPERATION_PREFIXES } from "../operations-DVHRHvv6.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-BCFAg58A.js";
+import { n as jsonResponse, t as jsonReplacer } from "../json-DaByVJpw.js";
+import { o as settle, r as guard, t as defaultExpose } from "../respond-z_yfyitp.js";
+import { t as boundedTtlCache } from "../ttl-cache-Bhr9swjT.js";
+import { n as checkPermission, t as checkEach } from "../authorizer-DPTeL-7h.js";
+import { t as defineResource } from "../resource-Dk_JYsOt.js";
+import { r as hasRole } from "../kit-Ct4Z6GIO.js";
 import { t as withExtra } from "../extra-CGQ2_q3S.js";
-import { r as pageSchema, t as pageInputSchema } from "../resource-schemas-BJ518zFH.js";
-import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../http-DdYadv-o.js";
+import { r as pageSchema, t as pageInputSchema } from "../resource-schemas-up6bKOUi.js";
+import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../http-DzbloBR-.js";
 import { resourceMetadataResponse, unauthorizedResponse } from "@supabase/server/oauth-protected-resource";
 //#region src/mcp/dialect.ts
 /**
-* Revisions before 2025-11-25 have no default dialect, and clients written
-* for them validate tool schemas as draft-07.
+* Revisions before 2025-11-25 have no default dialect, and clients written for
+* them validate tool schemas as draft-07.
 */
 function schemaTargetFor(version) {
 	return version < "2025-11-25" ? "draft-07" : "draft-2020-12";
 }
 /**
-* Returns the listed tool with its schemas in a target's dialect, built
-* once per target. `convert` asks the input's Standard Schema library for
-* the target; without it, or when it can't, the 2020-12 schema is lowered.
+* Returns the listed tool with its schemas in a target's dialect, built once
+* per target. `convert` asks the input's Standard Schema library for the
+* target; without it, or when it can't, the 2020-12 schema is lowered.
 */
 function toolDialects(info, convert) {
 	const built = /* @__PURE__ */ new Map();
@@ -104,9 +104,8 @@ function missingRole(auth, required) {
 	return dbError("forbidden", `This server needs the role ${roles.join(" or ")}`, { code: "MISSING_ROLE" });
 }
 /**
-* The permission a tool needs: the provider's entry for the tool's
-* `operation` (default `mcp.tool.<name>`) first, then the tool's own
-* `permission`.
+* The permission a tool needs: the provider's entry for the tool's `operation`
+* (default `mcp.tool.<name>`) first, then the tool's own `permission`.
 */
 function toolPermission(operations, name, declared, operation = `${OPERATION_PREFIXES.mcpTool}${name}`) {
 	return operationPermission(operations, operation, typeof declared === "string" ? declared : void 0) ?? declared;
@@ -135,8 +134,8 @@ async function checkTool(authorizer, tool, args, db) {
 	});
 }
 /**
-* Which tools the caller may see, in `tools` order: one batch per
-* permission, and a tool without a permission is always shown.
+* Which tools the caller may see, in `tools` order: one batch per permission,
+* and a tool without a permission is always shown.
 */
 async function permittedTools(authorizer, tools, context) {
 	const shown = tools.map((tool) => tool.permission === void 0);
@@ -167,12 +166,6 @@ async function permittedTools(authorizer, tools, context) {
 }
 //#endregion
 //#region src/mcp/protocol.ts
-/**
-* The transport-free part of MCP: protocol versions, tool and result shapes,
-* the handshake results and a dispatcher for one JSON-RPC message. The
-* Streamable HTTP server in `mcp.ts` and the CLI's stdio server share it, so
-* it imports nothing from Node.
-*/
 const MCP_PROTOCOL_VERSION = SPEC_PINS.mcp;
 /** Revisions before 2026-07-28 open with an `initialize` handshake. */
 const LEGACY_VERSIONS = [
@@ -184,7 +177,10 @@ const SUPPORTED_VERSIONS = [MCP_PROTOCOL_VERSION, ...LEGACY_VERSIONS];
 /** How long clients may cache `tools/list` and `server/discover`. */
 const LIST_TTL_MS = 3e5;
 const CAPABILITIES = { tools: { listChanged: false } };
-/** A tool result: the value as text, and as `structuredContent` when it is an object. */
+/**
+* A tool result: the value as text, and as `structuredContent` when it is an
+* object.
+*/
 function textResult(value, isError = false) {
 	const structured = isObject(value) ? value : void 0;
 	return {
@@ -234,8 +230,8 @@ const response = (id, result) => ({
 	result
 });
 /**
-* The JSON-RPC response to one message, or `undefined` for a notification.
-* It answers `initialize`, `server/discover`, `ping`, `tools/list` and
+* The JSON-RPC response to one message, or `undefined` for a notification. It
+* answers `initialize`, `server/discover`, `ping`, `tools/list` and
 * `tools/call`, for message-based transports such as stdio.
 */
 async function answerMessage(message, server) {
@@ -399,10 +395,10 @@ function tableTools(resource, defs) {
 /** Callers whose visible tool lists are kept; the oldest goes first. */
 const VISIBLE_LISTS_MAX = 1e3;
 /**
-* An MCP server (Streamable HTTP, stateless) whose tools run as the caller:
-* the Bearer token from the MCP client is verified and every query goes
-* through RLS. Answers 401 with RFC 9728 metadata so clients can sign in with
-* Supabase Auth's OAuth server.
+* An MCP server (Streamable HTTP, stateless) whose tools run as the caller: the
+* Bearer token from the MCP client is verified and every query goes through
+* RLS. Answers 401 with RFC 9728 metadata so clients can sign in with Supabase
+* Auth's OAuth server.
 */
 function createMcp(betterSupabase, options) {
 	const server = createServer(betterSupabase, options);
@@ -421,7 +417,7 @@ function createMcp(betterSupabase, options) {
 		registry.set(entry.info.name, entry);
 		allTools = void 0;
 		listed.clear();
-		generation++;
+		generation += 1;
 	};
 	const failure = (error) => textResult(toProblem(error, { expose }), true);
 	const refused = async (tool, args, ctx) => {
@@ -510,7 +506,10 @@ function createMcp(betterSupabase, options) {
 	*/
 	const visibleLists = boundedTtlCache({ max: VISIBLE_LISTS_MAX });
 	let warned = false;
-	/** A tool with a permission and no authorizer to check it is never listed, which is easy to miss. */
+	/**
+	* A tool with a permission and no authorizer to check it is never listed,
+	* which is easy to miss.
+	*/
 	const warnHidden = (all) => {
 		if (warned || options.authorizer) return;
 		const hidden = all.filter((entry) => entry.permission !== void 0).map((entry) => entry.info.name);
@@ -519,7 +518,10 @@ function createMcp(betterSupabase, options) {
 			console.warn(`createMcp: ${hidden.join(", ")} ${hidden.length === 1 ? "has" : "have"} a permission but no authorizer is set, so tools/list hides ${hidden.length === 1 ? "it" : "them"}. Pass authorizer to createMcp, or drop the permission.`);
 		}
 	};
-	/** Without a `visible` hook or permissions every caller sees the same list, built once. */
+	/**
+	* Without a `visible` hook or permissions every caller sees the same list,
+	* built once.
+	*/
 	const visibleTools = async (context, target) => {
 		const all = [...registry.values()];
 		const gated = all.some((entry) => entry.permission !== void 0);
@@ -582,7 +584,10 @@ function createMcp(betterSupabase, options) {
 		response.headers.set("www-authenticate", challenge);
 		return response;
 	};
-	/** A missing second factor is no scope problem, and an outage is not the caller's fault. */
+	/**
+	* A missing second factor is no scope problem, and an outage is not the
+	* caller's fault.
+	*/
 	const refuse = (request, denied) => {
 		if (denied.kind === "unauthorized") return unauthorized(request);
 		if (denied.kind !== "forbidden") return problemResponse(denied, { expose });
@@ -592,7 +597,10 @@ function createMcp(betterSupabase, options) {
 		supported: [...SUPPORTED_VERSIONS],
 		requested
 	});
-	/** 2026-07-28 requests carry their version and capabilities, mirrored in headers. */
+	/**
+	* 2026-07-28 requests carry their version and capabilities, mirrored in
+	* headers.
+	*/
 	const checkModern = (message, header, headers) => {
 		const meta = message.params?.["_meta"];
 		const version = isObject(meta) ? meta[META_VERSION] : void 0;

package/dist/mcp/sdk/index.d.ts

@@ -1,25 +1,25 @@
-import { a as AnyModels, i as AnyFunctions } from "../../types-BrpW5ixT.js";
-import { r as AuthState } from "../../resolve-Ceft-18-.js";
-import { i as CredentialRef, r as CredentialProvider } from "../../provider-DXgx5oSA.js";
-import { i as SupabaseMcpScope, n as SupabaseMcpModule, r as SupabaseMcpPlatformModule, t as SupabaseMcpFeature } from "../../supabase-mcp-C6tMoEjn.js";
-import { t as BetterSupabase } from "../../define-DYZnvAbs.js";
-import { a as ServerContext$1, c as ServerOptions, n as BetterServer } from "../../server-types-fLdep4gb.js";
-import { r as GuardOptions, t as AllowedCaller } from "../../respond-BSL36dQp.js";
+import { M as AnyFunctions, N as AnyModels } from "../../executor-CPyrQdjh.js";
+import { r as AuthState } from "../../resolve-CzUKTIMq.js";
+import { i as CredentialRef, r as CredentialProvider } from "../../provider-DmiaI1qt.js";
+import { i as SupabaseMcpScope, n as SupabaseMcpModule, r as SupabaseMcpPlatformModule, t as SupabaseMcpFeature } from "../../supabase-mcp-Z4vtsuoO.js";
+import { t as BetterSupabase } from "../../define-Dw7pRO4h.js";
+import { a as ServerContext$1, c as ServerOptions, n as BetterServer } from "../../server-types-BOs-eFpo.js";
+import { r as GuardOptions, t as AllowedCaller } from "../../respond-CZYibxUx.js";
 import { AuthInfo, CallToolResult, Icon, InputRequiredResult, OAuthTokenVerifier, RegisteredTool, ScopeChallengeHandler, ServerContext, StandardSchemaWithJSON, ToolAnnotations } from "@modelcontextprotocol/server";
 //#region src/mcp/sdk/sdk.d.ts
 interface McpAuthOptions extends ServerOptions, Omit<GuardOptions, "scopes"> {
   /**
    * The MCP endpoint's public URL, the RFC 9728 `resource`. Defaults to the
-   * request URL without a trailing slash, and on Supabase Edge Functions to
-   * the public `<origin>/functions/v1/<slug>`; pass it when a proxy rewrites
-   * the host or path.
+   * request URL without a trailing slash, and on Supabase Edge Functions to the
+   * public `<origin>/functions/v1/<slug>`; pass it when a proxy rewrites the
+   * host or path.
    */
   readonly resource?: string | ((request: Request) => string);
   /** Defaults to the project's Supabase Auth issuer. */
   readonly authorizationServers?: readonly string[];
   /**
-   * Answers CORS preflights in `serve` and adds `Access-Control-*` headers
-   * (any origin), so browser MCP clients can call the server. Defaults to true.
+   * Answers CORS preflights in `serve` and adds `Access-Control-*` headers (any
+   * origin), so browser MCP clients can call the server. Defaults to true.
    */
   readonly cors?: boolean;
   /** Scopes published as `scopes_supported`; `offline_access` is never listed. */
@@ -37,22 +37,28 @@ interface McpAuthOptions extends ServerOptions, Omit<GuardOptions, "scopes"> {
    */
   readonly waitUntil?: (promise: Promise<unknown>) => void;
 }
-/** A fetch handler that takes verified auth, like the SDK's `createMcpHandler(...)`. */
+/**
+ * A fetch handler that takes verified auth, like the SDK's
+ * `createMcpHandler(...)`.
+ */
 interface McpFetchHandler {
   fetch(request: Request, options?: {
     readonly authInfo?: AuthInfo;
   }): Promise<Response>;
 }
 interface BetterMcpAuth<M extends AnyModels = AnyModels, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown, B = unknown> extends BetterServer<M, F, E, C, P, B> {
-  /** An `OAuthTokenVerifier` for the SDK's bearer helpers; it verifies the token locally. */
+  /**
+   * An `OAuthTokenVerifier` for the SDK's bearer helpers; it verifies the token
+   * locally.
+   */
   readonly verifier: OAuthTokenVerifier;
   /** The RFC 9728 Protected Resource Metadata document. */
   metadata(request: Request): Response;
   /** Where the metadata is served, for `WWW-Authenticate` challenges. */
   metadataUrl(request: Request): string;
   /**
-   * A fetch handler that serves the metadata, refuses callers without a
-   * valid bearer token (401 or 403 with an RFC 9728 challenge), then calls
+   * A fetch handler that serves the metadata, refuses callers without a valid
+   * bearer token (401 or 403 with an RFC 9728 challenge), then calls
    * `handler.fetch(request, { authInfo })`.
    */
   serve(handler: McpFetchHandler): (request: Request) => Promise<Response>;
@@ -77,7 +83,10 @@ interface BetterToolConfig<InputArgs extends StandardSchemaWithJSON | undefined,
   readonly icons?: Icon[];
   readonly scopeChallenge?: ScopeChallengeHandler;
   readonly _meta?: Record<string, unknown>;
-  /** Extra keys for wrappers registered in between, such as an authorization library's `permission`. */
+  /**
+   * Extra keys for wrappers registered in between, such as an authorization
+   * library's `permission`.
+   */
   readonly [key: string]: unknown;
 }
 type ToolReturn = CallToolResult | InputRequiredResult | Promise<CallToolResult | InputRequiredResult>;
@@ -86,21 +95,24 @@ type BetterToolCallback<InputArgs extends StandardSchemaWithJSON | undefined, Ct
 type BetterMcpServer<S, M extends AnyModels = AnyModels, F extends AnyFunctions = AnyFunctions, E = unknown, C = unknown, P = unknown, B = unknown> = Omit<S, "registerTool"> & {
   registerTool<OutputArgs extends StandardSchemaWithJSON | undefined = undefined, InputArgs extends StandardSchemaWithJSON | undefined = undefined>(name: string, config: BetterToolConfig<InputArgs, OutputArgs>, cb: BetterToolCallback<InputArgs, BetterToolContext<M, F, E, C, P, B>>): RegisteredTool;
 };
-/** The structural part of `McpServer` (or a wrapper of it) that `withBetterSupabaseMcp` needs. */
+/**
+ * The structural part of `McpServer` (or a wrapper of it) that
+ * `withBetterSupabaseMcp` needs.
+ */
 interface ToolRegistrar {
   registerTool(name: string, config: never, cb: (...params: never[]) => unknown): unknown;
 }
 /**
  * Bearer auth for an MCP server built on the official SDK
  * (`@modelcontextprotocol/server` 2.3 or later). Verifies Supabase access
- * tokens locally, serves the RFC 9728 metadata, and binds repositories to
- * the caller. Pair it with `withBetterSupabaseMcp` and `createMcpHandler`.
+ * tokens locally, serves the RFC 9728 metadata, and binds repositories to the
+ * caller. Pair it with `withBetterSupabaseMcp` and `createMcpHandler`.
  */
 export declare function createMcpAuth<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, options?: McpAuthOptions): BetterMcpAuth<M, F, E, C, P, B>;
 /**
- * Wraps `server.registerTool` so every tool callback gets `db`, `auth` and
- * `bs` for the caller on its context. Wrap after an authorization wrapper
- * so permissions are checked before the context is built.
+ * Wraps `server.registerTool` so every tool callback gets `db`, `auth` and `bs`
+ * for the caller on its context. Wrap after an authorization wrapper so
+ * permissions are checked before the context is built.
  */
 export declare function withBetterSupabaseMcp<S extends ToolRegistrar, M extends AnyModels, F extends AnyFunctions, E, C, P, B>(server: S, auth: Pick<BetterMcpAuth<M, F, E, C, P, B>, "contextOf">): BetterMcpServer<S, M, F, E, C, P>;
 //#endregion
@@ -114,8 +126,8 @@ interface SupabaseMcpHandlerOptions<C = unknown, P = unknown> extends SupabaseMc
   /** The app credential that holds a Management API access token. */
   readonly credentialRef: CredentialRef;
   /**
-   * Who may use the server once the bearer token verified. Its tools
-   * administer the project, so allow only the people who run it.
+   * Who may use the server once the bearer token verified. Its tools administer
+   * the project, so allow only the people who run it.
    */
   readonly authorize: (auth: UserAuth<C, P>) => boolean | Promise<boolean>;
   /** The Management API URL; Supabase's when unset. */

package/dist/mcp/sdk/index.js

@@ -1,11 +1,11 @@
-import { n as dbError } from "../../errors-BV1SKTVs.js";
-import { o as problemResponse } from "../../problem-JRCohp1j.js";
-import { i as delegationOf } from "../../actor-CAL8mMih.js";
-import { c as extendServer, i as resolveToken, n as flushEvents, s as createServer } from "../../adapter-CRNH2aX_.js";
-import { r as guard } from "../../respond-Bhp3G__q.js";
+import { n as dbError } from "../../errors-03ysrOt4.js";
+import { o as problemResponse } from "../../problem-BWElIgIb.js";
+import { i as delegationOf } from "../../actor-hNajGNEK.js";
+import { c as extendServer, i as resolveToken, n as flushEvents, s as createServer } from "../../adapter-BCFAg58A.js";
+import { r as guard } from "../../respond-z_yfyitp.js";
 import { t as withExtra } from "../../extra-CGQ2_q3S.js";
-import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../../http-DdYadv-o.js";
-import { n as loadSupabaseMcp, r as loadSupabaseMcpPlatform, t as isRecord } from "../../supabase-mcp-DomZ-amK.js";
+import { a as withCors, i as metadataPreflight, n as endpointPreflight, r as isMetadataRequest, t as discovery } from "../../http-DzbloBR-.js";
+import { n as loadSupabaseMcp, r as loadSupabaseMcpPlatform, t as isRecord } from "../../supabase-mcp-Dz9DgrKP.js";
 import { OAuthError, bearerAuthChallengeResponse, verifyBearerToken } from "@modelcontextprotocol/server";
 //#region src/mcp/sdk/sdk.ts
 /** Where `serve` keeps the verified `AuthState` in `AuthInfo.extra`. */
@@ -20,12 +20,15 @@ function isUserState(value, verified) {
 /**
 * Bearer auth for an MCP server built on the official SDK
 * (`@modelcontextprotocol/server` 2.3 or later). Verifies Supabase access
-* tokens locally, serves the RFC 9728 metadata, and binds repositories to
-* the caller. Pair it with `withBetterSupabaseMcp` and `createMcpHandler`.
+* tokens locally, serves the RFC 9728 metadata, and binds repositories to the
+* caller. Pair it with `withBetterSupabaseMcp` and `createMcpHandler`.
 */
 function createMcpAuth(betterSupabase, options = {}) {
 	const server = createServer(betterSupabase, options);
-	/** Auth states this instance verified and guarded; any other `AuthInfo.extra` is ignored. */
+	/**
+	* Auth states this instance verified and guarded; any other `AuthInfo.extra`
+	* is ignored.
+	*/
 	const verified = /* @__PURE__ */ new WeakSet();
 	const allow = options.allow ?? ["user"];
 	const scopes = options.requiredScopes ?? [];
@@ -104,9 +107,9 @@ function createMcpAuth(betterSupabase, options = {}) {
 	});
 }
 /**
-* Wraps `server.registerTool` so every tool callback gets `db`, `auth` and
-* `bs` for the caller on its context. Wrap after an authorization wrapper
-* so permissions are checked before the context is built.
+* Wraps `server.registerTool` so every tool callback gets `db`, `auth` and `bs`
+* for the caller on its context. Wrap after an authorization wrapper so
+* permissions are checked before the context is built.
 */
 function withBetterSupabaseMcp(server, auth) {
 	const register = server.registerTool.bind(server);

package/dist/mentions-ByYnRNIG.js

@@ -0,0 +1,114 @@
+//#region src/blocks/messaging/mentions.ts
+/**
+* Mention markup, the same `parse_mentions` reads in SQL: `@[Ada](user:<user
+* id>)` or `@[Ada](<user id>)` mentions a user, `@[Acme
+* deal](subject:<type>/<id>)` a record, and `@channel` or `@here` the
+* conversation's members.
+*/
+const UUID = "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}";
+const NAME = String.raw`\[([^\]\n]{1,100})\]`;
+const USER = String.raw`\((?:[uU][sS][eE][rR]:)?(${UUID})\)`;
+const TYPE = "[a-z][a-z0-9_]{0,62}";
+const RECORD = String.raw`\(subject:(${TYPE})/([^)\s]{1,200})\)`;
+const SCOPE = String.raw`(^|[^\w@])@(channel|here)\b`;
+const TOKEN = new RegExp(String.raw`@${NAME}(?:${USER}|${RECORD})|${SCOPE}`, "g");
+const SUBJECT_TYPE = new RegExp(`^${TYPE}$`);
+const SUBJECT_ID = /^[^)\s]{1,200}$/;
+/** The longest name a mention keeps. */
+const MAX_NAME = 100;
+/**
+* Splits a body into text and mentions, in order. Adjacent text stays one
+* segment.
+*
+* ```tsx
+* mentionSegments(message.body).map((part) =>
+*   part.kind === "record" ? <RecordChip subject={part.subject} /> : ...
+* );
+* ```
+*/
+function mentionSegments(body) {
+	const segments = [];
+	let text = "";
+	let last = 0;
+	const flush = () => {
+		if (text !== "") {
+			segments.push({
+				kind: "text",
+				text
+			});
+			text = "";
+		}
+	};
+	for (const match of body.matchAll(TOKEN)) {
+		const [whole, name, userId, type, id, lead, scope] = match;
+		text += body.slice(last, match.index);
+		last = match.index + whole.length;
+		if (scope !== void 0) {
+			text += String(lead);
+			flush();
+			segments.push({
+				kind: "scope",
+				scope: scope === "here" ? "here" : "channel"
+			});
+			continue;
+		}
+		flush();
+		segments.push(userId === void 0 ? {
+			kind: "record",
+			name: String(name),
+			subject: {
+				type: String(type),
+				id: String(id)
+			}
+		} : {
+			kind: "user",
+			name: String(name),
+			userId: userId.toLowerCase()
+		});
+	}
+	text += body.slice(last);
+	flush();
+	return segments;
+}
+/** The users, records and scope a body mentions. */
+function parseMentions(body) {
+	const users = /* @__PURE__ */ new Set();
+	const records = /* @__PURE__ */ new Map();
+	let channel = false;
+	let here = false;
+	for (const segment of mentionSegments(body)) switch (segment.kind) {
+		case "user":
+			users.add(segment.userId);
+			break;
+		case "record":
+			records.set(`${segment.subject.type}/${segment.subject.id}`, segment.subject);
+			break;
+		case "scope":
+			channel ||= segment.scope === "channel";
+			here ||= segment.scope === "here";
+			break;
+		case "text": break;
+		default: throw new TypeError(`unknown mention segment ${String(segment)}`);
+	}
+	return {
+		users: [...users],
+		records: [...records.values()],
+		scope: channel ? "channel" : here ? "here" : void 0
+	};
+}
+/** A name a mention can hold: one line, no `]`, at most 100 characters. */
+function mentionName(name, fallback) {
+	const clean = name.replaceAll(/[\]\n\r]/g, " ").trim();
+	return (clean === "" ? fallback : clean).slice(0, MAX_NAME);
+}
+/** `@[Name](user:<id>)`: the markup that mentions a user. */
+function userMention(name, userId) {
+	return `@[${mentionName(name, "user")}](user:${userId})`;
+}
+/** `@[Name](subject:<type>/<id>)`: the markup that mentions a record. */
+function recordMention(name, subject) {
+	if (!SUBJECT_TYPE.test(subject.type) || !SUBJECT_ID.test(subject.id)) throw new TypeError("better-supabase: a record mention needs a lowercase subject type and an id of at most 200 characters without spaces or )");
+	return `@[${mentionName(name, subject.type)}](subject:${subject.type}/${subject.id})`;
+}
+//#endregion
+export { userMention as i, parseMentions as n, recordMention as r, mentionSegments as t };

package/dist/message-Bg4TKA12.d.ts

@@ -0,0 +1,99 @@
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/blocks/ai-chat/message.d.ts
+/** `$id` of `schemas/ai-message-v1.json`, the JSON Schema of `AiMessage`. */
+declare const AI_MESSAGE_SCHEMA_ID = "https://unpkg.com/better-supabase/schemas/ai-message-v1.json";
+type ProviderMetadata = Readonly<Record<string, unknown>>;
+interface PartBase {
+  /** What the provider attached, kept for replay; never read for logic. */
+  readonly providerMetadata?: ProviderMetadata;
+}
+interface AiTextPart extends PartBase {
+  readonly type: "text";
+  readonly text: string;
+  readonly state?: "streaming" | "done";
+}
+interface AiReasoningPart extends PartBase {
+  readonly type: "reasoning";
+  readonly text: string;
+  readonly state?: "streaming" | "done";
+}
+interface AiFilePart extends PartBase {
+  readonly type: "file";
+  /** IANA media type, e.g. `image/png`. */
+  readonly mediaType: string;
+  /**
+   * A URL the reader can fetch: `https:`, `data:` or a storage path the app
+   * signs.
+   */
+  readonly url: string;
+  readonly filename?: string;
+}
+interface AiToolCallPart extends PartBase {
+  readonly type: "tool-call";
+  readonly toolCallId: string;
+  readonly toolName: string;
+  readonly input: unknown;
+  /** The provider ran the tool itself (web search on the model's side). */
+  readonly providerExecuted?: boolean;
+}
+interface AiToolResultPart extends PartBase {
+  readonly type: "tool-result";
+  readonly toolCallId: string;
+  readonly toolName: string;
+  readonly output: unknown;
+  readonly isError?: boolean;
+}
+interface AiToolApprovalPart extends PartBase {
+  readonly type: "tool-approval";
+  readonly toolCallId: string;
+  readonly approvalId: string;
+  readonly state: "requested" | "approved" | "denied";
+  readonly reason?: string;
+}
+interface AiSourcePart extends PartBase {
+  readonly type: "source";
+  readonly sourceType: "url" | "document";
+  readonly id: string;
+  readonly url?: string;
+  readonly title?: string;
+  readonly mediaType?: string;
+}
+/**
+ * App data in the message (`data-weather` in the AI SDK becomes `name:
+ * "weather"`).
+ */
+interface AiDataPart extends PartBase {
+  readonly type: "data";
+  readonly name: string;
+  readonly id?: string;
+  readonly data: unknown;
+}
+/** Where a model step starts or ends, for multi-step tool loops. */
+interface AiStepPart extends PartBase {
+  readonly type: "step";
+  readonly boundary: "start" | "finish";
+  readonly stepId?: string;
+}
+/**
+ * A part of a canonical message. Adapters map their SDK's parts onto these; a
+ * part with no counterpart becomes a `data` part rather than being lost.
+ */
+type AiMessagePart = AiTextPart | AiReasoningPart | AiFilePart | AiToolCallPart | AiToolResultPart | AiToolApprovalPart | AiSourcePart | AiDataPart | AiStepPart;
+type AiMessagePartType = AiMessagePart["type"];
+type AiMessageRole = "system" | "user" | "assistant" | "tool";
+/** A message in the SDK-neutral format `ai_messages.parts` stores (version 1). */
+interface AiMessage {
+  readonly id: string;
+  readonly role: AiMessageRole;
+  readonly parts: readonly AiMessagePart[];
+  readonly metadata?: Readonly<Record<string, unknown>>;
+}
+/**
+ * A Standard Schema for `AiMessage`, matching `schemas/ai-message-v1.json`.
+ * Pass it to `validate()` or any library that takes a Standard Schema.
+ */
+declare const aiMessageSchema: StandardSchemaV1<unknown, AiMessage>;
+/** Whether `value` is a canonical message, without collecting the issues. */
+declare function isAiMessage(value: unknown): value is AiMessage;
+//#endregion
+export { AiMessagePart as a, AiReasoningPart as c, AiTextPart as d, AiToolApprovalPart as f, isAiMessage as g, aiMessageSchema as h, AiMessage as i, AiSourcePart as l, AiToolResultPart as m, AiDataPart as n, AiMessagePartType as o, AiToolCallPart as p, AiFilePart as r, AiMessageRole as s, AI_MESSAGE_SCHEMA_ID as t, AiStepPart as u };