better-supabase 0.12.0 → 0.14.0

package/dist/next/index.d.ts

@@ -1,22 +1,28 @@
-import { a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
-import { r as AuthState } from "../resolve-Ceft-18-.js";
-import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
-import { Wt as DbStats, at as QuerySpec, q as ReadSet, s as CacheAdapter, t as BetterSupabase } from "../define-DYZnvAbs.js";
-import { n as Impersonator } from "../impersonation-D5chOkrO.js";
-import { C as SupportSessions, S as SupportPolicy, T as supportSessions, a as ServerContext, c as ServerOptions, l as SharedServer, n as BetterServer, r as ContextOptions, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions } from "../server-types-fLdep4gb.js";
-import { n as AmrEntry, t as Aal } from "../mfa-YzkRjNad.js";
-import { t as tenantOf } from "../tenant-DZMLVuyQ.js";
-import { n as toSession, t as AuthSession } from "../view-KQhe6eNc.js";
-import { t as AuthOutageHook } from "../session-DObioXpX.js";
-import { n as AuthKind, r as GuardOptions } from "../respond-BSL36dQp.js";
-import { a as AuthorizedContext, c as Unwrapped, i as AuthorizeOptions, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-De-EVRhw.js";
-import { r as LiveCountSeed, t as CountRunner } from "../index-DTQSeHx2.js";
-import { r as MembershipClaim } from "../entitlements-CtBGXb3B.js";
-import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-LW1i5-h3.js";
-import { t as ResourceMap } from "../resources-D3_FAz_H.js";
-import { t as defineAction } from "../resource-execute-Bxvgmx-n.js";
-import { i as tagFor, t as TagOptions } from "../tags-BrGopDVG.js";
-import { n as supportOf, t as SupportView } from "../support-view-Bj_lZ8Wr.js";
+import { b as DbError, f as Result } from "../result-C6jDfedy.js";
+import { M as AnyFunctions, N as AnyModels, dt as SubjectRef } from "../executor-CPyrQdjh.js";
+import { r as AuthState } from "../resolve-CzUKTIMq.js";
+import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-DFP3gHv8.js";
+import { I as ReadSet, J as QuerySpec, Lt as DbStats, Ut as CacheAdapter, t as BetterSupabase } from "../define-Dw7pRO4h.js";
+import { n as Impersonator } from "../impersonation-YTa9dZUv.js";
+import { n as AmrEntry, t as Aal } from "../mfa-wrx1rqJT.js";
+import { Ct as BlockClientSource, Vt as SectionOptions } from "../define-block-COpcS6aT.js";
+import { F as SectionNamed, P as SectionName, S as SectionWritesOf, _ as PlainSections, d as FeatureBlocks, h as Plain, m as FeatureWriteOutput, p as FeatureWriteInput, v as RecordCan, x as RecordWriteInput, y as RecordFeature } from "../index-DbXWcrOI.js";
+import { t as tenantOf } from "../tenant-Bg4PDLkG.js";
+import { n as toSession, t as AuthSession } from "../view-2_I-2ukO.js";
+import { C as SupportSessions, S as SupportPolicy, T as supportSessions, a as ServerContext, c as ServerOptions, l as SharedServer, n as BetterServer, r as ContextOptions, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions } from "../server-types-BOs-eFpo.js";
+import { t as AuthOutageHook } from "../session-BgsOPGZs.js";
+import { n as AuthKind, r as GuardOptions } from "../respond-CZYibxUx.js";
+import { a as AuthorizedContext, c as ResourceLoaderContext, i as AuthorizeOptions, l as Unwrapped, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-DKfbNTAA.js";
+import { c as ListParseOptions, m as ListSearchParams } from "../list-query-BtluNnYk.js";
+import { r as LiveCountSeed, t as CountRunner } from "../index-eTY4kJzo.js";
+import { r as MembershipClaim } from "../entitlements-DDevu4ZE.js";
+import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-Bzt_bpR5.js";
+import { t as ResourceMap } from "../resources-Du5wcL3f.js";
+import { t as defineAction } from "../resource-execute-bT9ltHVT.js";
+import { i as BlockMethodName, n as BlockDataOf, t as BlockArgsOf } from "../block-method-hsPAGFi5.js";
+import { i as tagFor, t as TagOptions } from "../tags-CLXi2c6O.js";
+import { c as RecordListCells, n as Timeline, o as RecordList, u as RecordListPage } from "../timeline-DUUsPLv5.js";
+import { n as supportOf, t as SupportView } from "../support-view-vwJbRMpV.js";
 import { NextRequest } from "next/server.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/collector.d.ts
@@ -32,16 +38,16 @@ interface NextResourcesOptions extends GuardOptions {
   /** The catch-all route's path, e.g. `/api` for `app/api/[...path]/route.ts`. */
   readonly basePath?: string;
   /**
-   * Refresh an expired session cookie and send the new cookies. Off by
-   * default because the proxy refreshes everything it matches.
+   * Refresh an expired session cookie and send the new cookies. Off by default
+   * because the proxy refreshes everything it matches.
    */
   readonly refresh?: boolean;
 }
 /** A route handler of the resources' catch-all route. */
 type NextResourceHandler = (request: Request) => Promise<Response>;
 /**
- * The exports of `app/api/[...path]/route.ts`:
- * `export const { GET, POST, PATCH, PUT, DELETE } = bs.resources({ ... })`.
+ * The exports of `app/api/[...path]/route.ts`: `export const { GET, POST,
+ * PATCH, PUT, DELETE } = bs.resources({ ... })`.
  */
 interface NextResourceRoutes {
   readonly GET: NextResourceHandler;
@@ -60,7 +66,10 @@ interface NextOptions extends ServerOptions {
   readonly server?: SharedServer;
   /** Invalidate `tagFor(table)` cache tags after mutations. Defaults to true. */
   readonly cacheTags?: boolean;
-  /** Include internal error messages in Problem Details. Defaults to development only. */
+  /**
+   * Include internal error messages in Problem Details. Defaults to development
+   * only.
+   */
   readonly exposeErrors?: boolean;
   /** Per-request database call counts. See the Budget docs. */
   readonly debug?: NextDebugOptions;
@@ -68,7 +77,10 @@ interface NextOptions extends ServerOptions {
 interface NextDebugOptions {
   /** Collect outside development too, e.g. for e2e runs against `next start`. */
   readonly enabled?: boolean;
-  /** Header with `calls;waves;ms` on route handler responses. Defaults to `x-bs-db-calls`. */
+  /**
+   * Header with `calls;waves;ms` on route handler responses. Defaults to
+   * `x-bs-db-calls`.
+   */
   readonly header?: string;
   /** Warns in development when one render goes over it. */
   readonly budget?: DbBudget;
@@ -78,25 +90,28 @@ interface NextDebugOptions {
 interface ProxyOptions<C = unknown, P = unknown> {
   /**
    * Another middleware to compose with, such as next-intl's. It runs on the
-   * original request, alongside auth; its rewrite, redirect or request
-   * headers are kept, and refreshed cookies are merged into its response.
+   * original request, alongside auth; its rewrite, redirect or request headers
+   * are kept, and refreshed cookies are merged into its response.
    */
   readonly before?: (request: NextRequest) => Response | undefined | Promise<Response | undefined>;
-  /** Answer before rendering, e.g. redirect signed-out users. Refreshed cookies are kept. */
+  /**
+   * Answer before rendering, e.g. redirect signed-out users. Refreshed cookies
+   * are kept.
+   */
   readonly protect?: (auth: AuthState<C, P>, request: NextRequest) => Response | undefined | Promise<Response | undefined>;
   /**
    * A prefetch never refreshes, so a session cookie whose token expired
-   * resolves to `{ kind: 'anon', reason: 'expired' }` there. `'protect'`
-   * (the default) passes that to `protect` like any other caller.
-   * `'render'` skips `protect` for it, so the prefetch renders signed out
-   * instead of caching a redirect to sign-in; `sessionStale` keeps that view
-   * out of the App Shell, and the navigation itself refreshes the session.
+   * resolves to `{ kind: 'anon', reason: 'expired' }` there. `'protect'` (the
+   * default) passes that to `protect` like any other caller. `'render'` skips
+   * `protect` for it, so the prefetch renders signed out instead of caching a
+   * redirect to sign-in; `sessionStale` keeps that view out of the App Shell,
+   * and the navigation itself refreshes the session.
    */
   readonly expiredPrefetch?: "protect" | "render";
   /**
    * Methods that run `protect`. Defaults to `GET` and `HEAD`, so a Server
-   * Action POST is not redirected before the action runs. Set `true` to
-   * include mutations, or pass the methods yourself.
+   * Action POST is not redirected before the action runs. Set `true` to include
+   * mutations, or pass the methods yourself.
    */
   readonly protectMethods?: true | readonly string[];
   /** Post-processes the final response; return a new one to replace it. */
@@ -108,35 +123,54 @@ interface ProxyOptions<C = unknown, P = unknown> {
   readonly serverTiming?: boolean;
   readonly endedSession?: true | EndedSessionOptions;
   /**
-   * Called when a refresh failed because the Auth server was unreachable,
-   * timed out or answered 5xx or 429. When the access token couldn't be
-   * kept (`event.kept` is false), a returned `Response` replaces the
-   * proxy's response, such as a 503 with `Retry-After`. A throw is logged
-   * and ignored.
+   * Called when a refresh failed because the Auth server was unreachable, timed
+   * out or answered 5xx or 429. When the access token couldn't be kept
+   * (`event.kept` is false), a returned `Response` replaces the proxy's
+   * response, such as a 503 with `Retry-After`. A throw is logged and ignored.
    */
   readonly onAuthOutage?: AuthOutageHook;
 }
 interface EndedSessionOptions {
   readonly paths?: readonly string[];
   readonly redirect?: string;
-  /** The `reason` query value on the redirect. Defaults to `session_ended` and `account_banned`. */
+  /**
+   * The `reason` query value on the redirect. Defaults to `session_ended` and
+   * `account_banned`.
+   */
   readonly reasons?: {
     readonly ended?: string;
     readonly banned?: string;
   };
 }
-interface ActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R, Ref> {
+interface ActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown, X = ResourceLoaderContext<C, P>> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R, Ref, X> {
   /** Validates the input (plain object or `FormData`) with any Standard Schema. */
   readonly input?: S;
   /**
    * The active tenant for the action's context, from the validated input,
-   * instead of `NextOptions.tenant`. It is checked the same way: the
-   * `tenant()` plugin and `current_tenant_id()` only honor a tenant the
-   * caller belongs to.
+   * instead of `NextOptions.tenant`. It is checked the same way: the `tenant()`
+   * plugin and `current_tenant_id()` only honor a tenant the caller belongs
+   * to.
    */
   readonly tenant?: (input: ActionParsed<S>) => string | undefined;
 }
-interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<NextRequest, C, P, R, Ref> {
+/**
+ * How `blockAction` calls the method: without `args` it passes the validated
+ * input as the only argument, so `args` is required when the method takes
+ * anything else.
+ */
+type BlockActionArgs<S, A, Ctx> = [ActionParsed<S>] extends A ? {
+  readonly args?: (input: ActionParsed<S>, ctx: Ctx) => A;
+} : {
+  readonly args: (input: ActionParsed<S>, ctx: Ctx) => A;
+};
+/** The record and section a `sectionAction` writes to. */
+interface SectionActionTarget<S, Ctx> {
+  /** The section to invalidate after the write, such as `"comments"`. */
+  readonly section: string;
+  /** The record the write is on, from the validated input. */
+  readonly subject: (input: ActionParsed<S>, ctx: Ctx) => SubjectRef;
+}
+interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown, X = ResourceLoaderContext<C, P>> extends GuardOptions, AuthorizeOptions<NextRequest, C, P, R, Ref, X> {
   /**
    * Refresh an expired session cookie in the route and send the new cookies
    * with its response. For routes the proxy's matcher skips; off by default
@@ -144,16 +178,16 @@ interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean, Re
    */
   readonly refresh?: boolean;
 }
-interface RequireOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<undefined, C, P, R, Ref> {
+interface RequireOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown, X = ResourceLoaderContext<C, P>> extends GuardOptions, AuthorizeOptions<undefined, C, P, R, Ref, X> {
   /** The active tenant, as for `bs.context({ tenant })`. */
   readonly tenant?: string;
 }
 interface ScopeOptions {
   /**
    * The active tenant, e.g. from route params, instead of `NextOptions.tenant`
-   * (whose request has the incoming headers but no URL here). It goes where
-   * the resolver's result goes, so it gets the same checks: the `tenant()`
-   * plugin and `current_tenant_id()` only honor a tenant the caller belongs to.
+   * (whose request has the incoming headers but no URL here). It goes where the
+   * resolver's result goes, so it gets the same checks: the `tenant()` plugin
+   * and `current_tenant_id()` only honor a tenant the caller belongs to.
    */
   readonly tenant?: string;
 }
@@ -177,9 +211,9 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   session(): Promise<AuthSession<C, P>>;
   /**
-   * The context for a session and its token, without reading the request.
-   * The token is verified again (memoized, no network call); a token for
-   * another user than `session` gives an `invalid` context.
+   * The context for a session and its token, without reading the request. The
+   * token is verified again (memoized, no network call); a token for another
+   * user than `session` gives an `invalid` context.
    */
   contextForSession(session: AuthSession<C, P>, options: {
     readonly token: string | null;
@@ -192,7 +226,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    *
    * ```ts
    * async function getCustomers() {
-   *   'use cache: private';
+   *   "use cache: private";
    *   const { db } = await bs.cached();
    *   return db.customers.findMany().orThrow();
    * }
@@ -200,12 +234,12 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   cached(options?: CachedOptions<Extract<keyof M, string>>): Promise<CachedContext<M, F, E, C, P, B>>;
   /**
-   * Drops every `bs.cached()` entry of a user, e.g. after a role change,
-   * and the entries tagged with `tags` (such as a permission snapshot's tag).
-   * In a Server Action it also re-renders the caller's page, so no
-   * `refresh()` is needed. It reaches server caches and the caller's router
-   * only: another user's browser keeps its `'use cache: private'` entries
-   * until they go stale or that user's token changes.
+   * Drops every `bs.cached()` entry of a user, e.g. after a role change, and
+   * the entries tagged with `tags` (such as a permission snapshot's tag). In a
+   * Server Action it also re-renders the caller's page, so no `refresh()` is
+   * needed. It reaches server caches and the caller's router only: another
+   * user's browser keeps its `'use cache: private'` entries until they go stale
+   * or that user's token changes.
    */
   invalidateSession(userId: string, options?: {
     readonly tags?: readonly string[];
@@ -213,15 +247,15 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
   /**
    * Counts on the server and returns a serializable seed for
    * `useLiveCount(seed)`, so the badge renders with a number and the client
-   * only refetches on changes. Pass `db` inside `'use cache: private'`
-   * (from `bs.cached()`); otherwise it uses `bs.context()`. A failed
-   * count gives `count: null` instead of throwing.
+   * only refetches on changes. Pass `db` inside `'use cache: private'` (from
+   * `bs.cached()`); otherwise it uses `bs.context()`. A failed count gives
+   * `count: null` instead of throwing.
    */
   liveCount<T extends Extract<keyof M, string>>(spec: QuerySpec<T, "count", number>, db?: CountRunner): Promise<LiveCountSeed<T>>;
   /** Route handler with auth, Result unwrapping and Problem Details errors. */
   route<Params = Record<string, string | string[]>, R extends boolean = false>(handler: (request: NextRequest, ctx: ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R> & {
     readonly params: Params;
-  }) => unknown, options?: RouteOptions<C, P, R, Ref>): (request: NextRequest, segment: {
+  }) => unknown, options?: RouteOptions<C, P, R, Ref, NextResource<M, F, E, C, P, B>>): (request: NextRequest, segment: {
     readonly params: Promise<Params>;
   }) => Promise<Response>;
   /**
@@ -229,30 +263,76 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    *
    * ```ts
    * export const invite = bs.action(
-   *   { input: Invite, requireTenant: true, roles: ['admin'] },
-   *   async (input, { db, tenant }) => db.invitations.create({ ...input, organizationId: tenant }),
+   *   { input: Invite, requireTenant: true, roles: ["admin"] },
+   *   async (input, { db, tenant }) =>
+   *     db.invitations.create({ ...input, organizationId: tenant }),
+   * );
+   * ```
+   */
+  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: ActionOptions<S, C, P, R, Ref, NextResource<M, F, E, C, P, B>>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  /**
+   * A server action that calls one block method as the caller, with the same
+   * guard, validation and authorize checks as `action`.
+   *
+   * ```ts
+   * export const issueInvoice = bs.blockAction(
+   *   ({ supabase }) => blocks(supabase).invoices,
+   *   "issue",
+   *   {
+   *     input: v.object({ invoiceId: v.pipe(v.string(), v.uuid()) }),
+   *     permission: permissions.invoices.write,
+   *     args: ({ invoiceId }) => [invoiceId],
+   *   },
    * );
    * ```
    */
-  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: ActionOptions<S, C, P, R, Ref>, fn: (input: ActionParsed<S>, ctx: ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>) => Promise<T> | T): (input: ActionInput<S>) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  blockAction<Cl extends object, const K extends string, S extends StandardSchemaV1 | undefined = undefined, R extends boolean = false>(client: (ctx: ServerContext<M, F, E, C, P, B>) => Cl, method: K & BlockMethodName<Cl>, options: ActionOptions<S, C, P, R, Ref, NextResource<M, F, E, C, P, B>> & BlockActionArgs<S, BlockArgsOf<Cl, K & BlockMethodName<Cl>>, ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>): (input: ActionInput<S>) => Promise<ActionResult<BlockDataOf<Cl, K & BlockMethodName<Cl>>>>;
   /**
-   * For Server Components: the caller's context, or the Next.js interrupt
-   * for a refused caller. `unauthorized` calls `unauthorized()`, `forbidden`
-   * calls `forbidden()` (both need `experimental.authInterrupts`, else
-   * `notFound()`), and `not_found` calls `notFound()`.
+   * A `blockAction` on one record's section: after the write succeeds it
+   * invalidates the section's and the record's cache tags in the caller's
+   * tenant (`invalidateSection`).
    *
    * ```ts
-   * const { db, tenant } = await bs.require({ requireTenant: true, roles: ['admin'] });
+   * export const addComment = bs.sectionAction(
+   *   ({ db }) => blockSet.client(db, "comments"),
+   *   "create",
+   *   {
+   *     input: v.object({ customerId: v.string(), body: v.string() }),
+   *     section: "comments",
+   *     subject: ({ customerId }) => ({
+   *       type: "customer",
+   *       id: customerId,
+   *     }),
+   *     args: ({ customerId, body }) => [
+   *       { type: "customer", id: customerId },
+   *       { body },
+   *     ],
+   *   },
+   * );
+   * ```
+   */
+  sectionAction<Cl extends object, const K extends string, S extends StandardSchemaV1 | undefined = undefined, R extends boolean = false>(client: (ctx: ServerContext<M, F, E, C, P, B>) => Cl, method: K & BlockMethodName<Cl>, options: ActionOptions<S, C, P, R, Ref, NextResource<M, F, E, C, P, B>> & BlockActionArgs<S, BlockArgsOf<Cl, K & BlockMethodName<Cl>>, ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>> & SectionActionTarget<S, ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>): (input: ActionInput<S>) => Promise<ActionResult<BlockDataOf<Cl, K & BlockMethodName<Cl>>>>;
+  /**
+   * For Server Components: the caller's context, or the Next.js interrupt for a
+   * refused caller. `unauthorized` calls `unauthorized()`, `forbidden` calls
+   * `forbidden()` (both need `experimental.authInterrupts`, else `notFound()`),
+   * and `not_found` calls `notFound()`.
+   *
+   * ```ts
+   * const { db, tenant } = await bs.require({
+   *   requireTenant: true,
+   *   roles: ["admin"],
+   * });
    * ```
    */
-  require<R extends boolean = false>(options?: RequireOptions<C, P, R, Ref>): Promise<ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>;
+  require<R extends boolean = false>(options?: RequireOptions<C, P, R, Ref, NextResource<M, F, E, C, P, B>>): Promise<ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>;
   /**
-   * REST resources for a catch-all route, matching the API model:
-   * collections, items and actions, as the caller (RLS), behind the guard in
-   * `options`, with Problem Details errors. An unknown path answers 404
-   * before auth resolves.
+   * REST resources for a catch-all route, matching the API model: collections,
+   * items and actions, as the caller (RLS), behind the guard in `options`, with
+   * Problem Details errors. An unknown path answers 404 before auth resolves.
    *
-   * ```ts title="app/api/[...path]/route.ts"
+   * ```ts
+   * // app/api/[...path]/route.ts
    * export const { GET, POST, PATCH, PUT, DELETE } = bs.resources(
    *   { customers: true },
    *   { basePath: "/api" },
@@ -266,9 +346,9 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   cacheTag(table: Extract<keyof M, string>, id?: string | number, options?: TagOptions): void;
   /**
-   * Tags the current `"use cache"` scope with every table the specs (or a
-   * read set) read, plus the row of each `findById`, so any mutation that
-   * changes one revalidates it.
+   * Tags the current `"use cache"` scope with every table the specs (or a read
+   * set) read, plus the row of each `findById`, so any mutation that changes
+   * one revalidates it.
    */
   cacheTags(target: QuerySpec<Extract<keyof M, string>> | readonly QuerySpec<Extract<keyof M, string>>[] | ReadSet, options?: TagOptions): void;
   /**
@@ -277,12 +357,15 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   debugRoute(): (request: Request) => Promise<Response>;
   /**
-   * Starts a support session for the signed-in admin and sets its cookie,
-   * so the admin's next requests render as the target. Call it from a
-   * server action.
+   * Starts a support session for the signed-in admin and sets its cookie, so
+   * the admin's next requests render as the target. Call it from a server
+   * action.
    */
   startSupport(request: SupportStartRequest): Promise<ActionResult<SupportStarted>>;
-  /** Ends the admin's support session and clears its cookie. Call it from a server action. */
+  /**
+   * Ends the admin's support session and clears its cookie. Call it from a
+   * server action.
+   */
   stopSupport(): Promise<ActionResult<{
     readonly ended: boolean;
   }>>;
@@ -298,9 +381,9 @@ interface SupportStarted {
 interface SessionStaleOptions {
   /**
    * With fewer seconds left on the token, the view is not reused at all (0):
-   * Next.js would not prefetch it anyway. Defaults to 30, and values below
-   * 30 count as 30: the client router keeps any entry for at least 30
-   * seconds, so a shorter stale time would outlive the token.
+   * Next.js would not prefetch it anyway. Defaults to 30, and values below 30
+   * count as 30: the client router keeps any entry for at least 30 seconds, so
+   * a shorter stale time would outlive the token.
    */
   readonly min?: number;
   /** 300 (5 minutes) joins the route's App Shell. Defaults to 300. */
@@ -315,15 +398,18 @@ interface CachedOptions<T extends string = string> extends ScopeOptions {
   readonly tenant?: string;
   /**
    * `cacheLife` for the entry. `stale` is `sessionStale`, and never more than
-   * `stale` when it is set: pass a permission snapshot's lifetime so the
-   * entry goes stale with the snapshot too.
+   * `stale` when it is set: pass a permission snapshot's lifetime so the entry
+   * goes stale with the snapshot too.
    */
   readonly life?: SessionStaleOptions & {
     readonly stale?: number;
     readonly revalidate?: number;
     readonly expire?: number;
   };
-  /** More `cacheTag`s for the entry, e.g. `snapshotTag(sub)` or `organization:<id>`. */
+  /**
+   * More `cacheTag`s for the entry, e.g. `snapshotTag(sub)` or
+   * `organization:<id>`.
+   */
   readonly tags?: readonly string[];
   /**
    * Tables the entry reads, so the `updateTag` after a mutation drops it:
@@ -337,12 +423,19 @@ interface CachedOptions<T extends string = string> extends ScopeOptions {
 type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> = ServerContext<M, F, E, C, P, B> & {
   readonly session: AuthSession<C, P>;
 };
+/**
+ * The second argument of `revalidateTag`: a `cacheLife` profile name or `{
+ * expire }`.
+ */
+type RevalidateProfile = string | {
+  readonly expire?: number;
+};
 interface NextCacheOptions {
   /**
-   * How a mutation outside a Server Action (a route handler, a webhook)
-   * expires its tags with `revalidateTag`. Defaults to `{ expire: 0 }`, so
-   * the next read waits for fresh data; `'max'` serves the stale entry
-   * while it revalidates.
+   * How a mutation outside a Server Action (a route handler, a webhook) expires
+   * its tags with `revalidateTag`. Defaults to `{ expire: 0 }`, so the next
+   * read waits for fresh data; `'max'` serves the stale entry while it
+   * revalidates.
    */
   readonly revalidate?: string | {
     readonly expire?: number;
@@ -350,19 +443,24 @@ interface NextCacheOptions {
 }
 interface RequireAalOptions {
   /**
-   * Page that enrolls or challenges a second factor. Signed-in users below
-   * the level are redirected there with `?next=<path>`; without it they get
-   * a 403 Problem Details response.
+   * Page that enrolls or challenges a second factor. Signed-in users below the
+   * level are redirected there with `?next=<path>`; without it they get a 403
+   * Problem Details response.
    */
   readonly redirect?: string;
   /** Paths that need the level. Defaults to every path but `redirect`. */
   readonly match?: (pathname: string) => boolean;
 }
+/**
+ * What a `resource` loader gets in Next.js: the caller's context, with the
+ * checked tenant.
+ */
+type NextResource<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> = ServerContext<M, F, E, C, P, B> & ResourceLoaderContext<C, P>;
 //#endregion
 //#region src/next/create.d.ts
 /**
- * The Next.js adapter: proxy, Server Components, route handlers, server
- * actions and cache tags, on top of `createServer`.
+ * The Next.js adapter: proxy, Server Components, route handlers, server actions
+ * and cache tags, on top of `createServer`.
  *
  * ```ts
  * export const bs = createNext(betterSupabase);
@@ -378,39 +476,173 @@ export declare function supportTag(sessionId: string): string;
 /**
  * `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
  * the token's expiry, and 0 once fewer than `min` seconds are left. A
- * signed-out view that a refresh would change (an `expired` or
- * `refresh_failed` cookie, or an `invalid` token) is 0 as well, so it never
- * joins the App Shell.
+ * signed-out view that a refresh would change (an `expired` or `refresh_failed`
+ * cookie, or an `invalid` token) is 0 as well, so it never joins the App
+ * Shell.
  */
 export declare function sessionStale(session: AuthSession, options?: SessionStaleOptions, now?: number): number;
 /** The tag `bs.cached()` puts on a user's entries. */
 export declare function sessionTag(userId: string): string;
 /**
  * Invalidates `bs:<table>` for every table in the target, the tenant's
- * `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has
- * no tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
+ * `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has no
+ * tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
  * tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
  */
 export declare function nextCache(options?: NextCacheOptions): CacheAdapter;
 //#endregion
+//#region src/next/feature.d.ts
+/**
+ * The context `recordServer` reads: the caller's `Db`, and its supabase-js
+ * client, whose `storage` the attachments block deletes files with.
+ */
+interface RecordServerContext {
+  readonly db: BlockClientSource;
+  readonly supabase?: {
+    readonly storage?: unknown;
+  };
+}
+/**
+ * What `recordServer` needs of `bs` (`createNext`): its context and its
+ * actions, typed loosely so any app's `bs` fits.
+ */
+interface RecordServerHost {
+  context(): Promise<RecordServerContext>;
+  action<S extends StandardSchemaV1, T>(options: {
+    readonly input: S;
+    readonly requireTenant: true;
+  }, fn: (input: StandardSchemaV1.InferOutput<S>, ctx: RecordServerContext & {
+    readonly tenant: string;
+  }) => Promise<T>): (input: never) => Promise<ActionResult<unknown>>;
+}
+interface RecordLoadOptions<B extends FeatureBlocks, M extends SectionName<B>> {
+  /** The sections to load. Default: every section of the feature. */
+  readonly sections?: readonly M[];
+  /** Options for each section's `load`, such as `{ versions: { pageSize: 5 } }`. */
+  readonly options?: { readonly [K in M]?: SectionOptions<SectionNamed<B, K>>; };
+}
+/** What a generated loader resolves to, safe to pass to a Client Component. */
+interface RecordView<T extends string, B extends FeatureBlocks, N extends string, M extends N> {
+  readonly subject: SubjectRef<T>;
+  /** Each requested section settled: `ok`, `error` or `hidden`. */
+  readonly sections: PlainSections<B, M>;
+  /** What the caller may do on every section of the feature. */
+  readonly can: RecordCan<B, N>;
+  /**
+   * Set when the caller's permissions failed to load; every flag is then
+   * `false`.
+   */
+  readonly permissionsError?: DbError;
+}
+interface RecordTimelineOptions<N extends string> {
+  /** Default: every section of the feature with a `timeline`. */
+  readonly sections?: readonly N[];
+  /** The most entries to return, newest first. */
+  readonly limit?: number;
+}
+/** One Server Action per write of each section. */
+type RecordServerActions<B extends FeatureBlocks, N extends string> = { readonly [S in N]: { readonly [W in SectionWritesOf<B, S>]: (input: RecordWriteInput<FeatureWriteInput<B, S, W>>) => Promise<ActionResult<Plain<FeatureWriteOutput<B, S, W>>>>; }; };
+interface RecordServer<T extends string, B extends FeatureBlocks, N extends SectionName<B>> {
+  /**
+   * Loads one record's sections and the caller's flags. It reads the request,
+   * so call it outside `"use cache"`: a cached section error would stick.
+   */
+  load<const M extends N = N>(id: string, options?: RecordLoadOptions<B, M>): Promise<RecordView<T, B, N, M>>;
+  /**
+   * One record's history across its sections, newest first, with the sections
+   * the caller can't read skipped. Call it outside `"use cache"`, like `load`.
+   */
+  timeline(id: string, options?: RecordTimelineOptions<N>): Promise<Plain<Timeline>>;
+  /** The Server Actions; re-export them from a `"use server"` file. */
+  readonly actions: RecordServerActions<B, N>;
+  /** The record's cache tag and one per section, scoped to `tenant`. */
+  tags(id: string, tenant?: string | null): readonly string[];
+}
+/**
+ * The server half of a generated feature for Next.js: a loader for Server
+ * Components and one Server Action per section write. Each action builds the
+ * block's client over the caller's `Db` (its tenant), runs the write, and drops
+ * the section's and the record's cache tags (`invalidateSection`).
+ *
+ * ```ts
+ * const customer = recordServer(bs, customerFeature);
+ * const view = await customer.load(id, { sections: ["comments"] });
+ * ```
+ */
+export declare function recordServer<T extends string, B extends FeatureBlocks, N extends SectionName<B>>(bs: RecordServerHost, feature: RecordFeature<T, B> & {
+  readonly sections: readonly N[];
+}): RecordServer<T, B, N>;
+/** What `recordListServer(...).load` resolves to, safe for a Client Component. */
+type RecordListView<B extends FeatureBlocks, N extends string, Q, P extends {
+  readonly items: readonly unknown[];
+}, Cols> = Result<Plain<RecordListPage<Q, P, P["items"][number], RecordListCells<B, Cols>, RecordCan<B, N>>>>;
+interface RecordListServer<B extends FeatureBlocks, N extends string, Q, P extends {
+  readonly items: readonly unknown[];
+}, Cols> {
+  /**
+   * Parses the page's `searchParams` and loads the page with its section
+   * columns, over the caller's `Db`. Call it outside `"use cache"`.
+   */
+  load(input: ListSearchParams | undefined, options?: ListParseOptions): Promise<RecordListView<B, N, Q, P, Cols>>;
+}
+/**
+ * The server half of a `defineRecordList` for Next.js: it builds the feature's
+ * block clients and the caller's permissions, then runs `recordList.load`.
+ *
+ * ```ts
+ * const customers = recordListServer(bs, customerRecordList);
+ * const view = await customers.load(await searchParams);
+ * ```
+ */
+export declare function recordListServer<T extends string, B extends FeatureBlocks, N extends SectionName<B>, Q, P extends {
+  readonly items: readonly unknown[];
+}, Cols>(bs: Pick<RecordServerHost, "context">, recordList: RecordList<T, B, N, Q, P, Cols>): RecordListServer<B, N, Q, P, Cols>;
+//#endregion
+//#region src/next/records.d.ts
+interface RecordTagOptions {
+  /** The tenant the read is scoped to, so other tenants' writes keep it. */
+  readonly tenant?: string | null | undefined;
+}
+/**
+ * The cache tag of a record's header and tab badges (`record_summary`):
+ * `bs:record@<tenant>:<type>:<id>`, or `bs:record:<type>:<id>` without a
+ * tenant.
+ */
+export declare function recordTag(subject: SubjectRef, options?: RecordTagOptions): string;
+/** The cache tag of one section of a record, such as its comments. */
+export declare function sectionTag(subject: SubjectRef, section: string, options?: RecordTagOptions): string;
+/**
+ * Drops the cached section and the record's header, whose counts change with
+ * it: `updateTag` in a Server Action, else `revalidateTag`.
+ */
+export declare function invalidateSection(subject: SubjectRef, section: string, options?: RecordTagOptions & {
+  readonly revalidate?: RevalidateProfile;
+}): void;
+//#endregion
 //#region src/next/support.d.ts
 /** Response header with the URL of the request's totals on `bs.debugRoute()`. */
 export declare const STATS_URL_HEADER = "x-bs-stats";
 export declare function shouldCheckSession(request: NextRequest, options?: EndedSessionOptions): boolean;
-/** Page loads, client navigations and server actions; never prefetches or assets. */
+/**
+ * Page loads, client navigations and server actions; never prefetches or
+ * assets.
+ */
 export declare function shouldRefresh(request: Request): boolean;
 /**
  * A `proxy` `protect` that keeps signed-in users below `level` out of the
  * matched paths. The JWT carries no factor list, so this also sends users
- * without a factor to `redirect` to enroll one. Anonymous callers pass;
- * combine it with your sign-in redirect.
+ * without a factor to `redirect` to enroll one. Anonymous callers pass; combine
+ * it with your sign-in redirect.
  *
  * ```ts
  * bs.proxy(request, {
- *   protect: requireAal('aal2', { redirect: '/mfa', match: (path) => path.startsWith('/settings') }),
+ *   protect: requireAal("aal2", {
+ *     redirect: "/mfa",
+ *     match: (path) => path.startsWith("/settings"),
+ *   }),
  * });
  * ```
  */
 export declare function requireAal(level: Aal, options?: RequireAalOptions): (auth: AuthState, request: NextRequest) => Response | undefined;
 //#endregion
-export { type Aal, type ActionArgs, type ActionOptions, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthSession, type AuthorizeOptions, type AuthorizedContext, type BetterNext, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EndedSessionOptions, type GuardOptions, type Impersonator, type LiveCountSeed, type MembershipClaim, type NextCacheOptions, type NextDebugOptions, type NextOptions, type NextResourceHandler, type NextResourceRoutes, type NextResourcesOptions, type ProxyOptions, type RequireAalOptions, type RequireOptions, type ResourceAction, type ResourceContext, type ResourceHooks, type ResourceMap, type ResourceRouteOptions, type RouteOptions, type ScopeOptions, type SessionStaleOptions, type SupportOptions, type SupportPolicy, type SupportSessions, type SupportStartRequest, type SupportStarted, type SupportView, type TagOptions, defineAction, supportOf, supportSessions, tagFor, tenantOf, toSession };
+export { type Aal, type ActionArgs, type ActionOptions, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthSession, type AuthorizeOptions, type AuthorizedContext, type BetterNext, type BlockActionArgs, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EndedSessionOptions, type GuardOptions, type Impersonator, type LiveCountSeed, type MembershipClaim, type NextCacheOptions, type NextDebugOptions, type NextOptions, type NextResourceHandler, type NextResourceRoutes, type NextResourcesOptions, type ProxyOptions, type RecordListServer, type RecordListView, type RecordLoadOptions, type RecordServer, type RecordServerActions, type RecordServerContext, type RecordServerHost, type RecordTagOptions, type RecordTimelineOptions, type RecordView, type RequireAalOptions, type RequireOptions, type ResourceAction, type ResourceContext, type ResourceHooks, type ResourceLoaderContext, type ResourceMap, type ResourceRouteOptions, type RouteOptions, type ScopeOptions, type SessionStaleOptions, type SupportOptions, type SupportPolicy, type SupportSessions, type SupportStartRequest, type SupportStarted, type SupportView, type TagOptions, defineAction, supportOf, supportSessions, tagFor, tenantOf, toSession };