better-supabase 0.12.0 → 0.14.0

package/dist/chat-sdk/index.js

@@ -1,8 +1,7 @@
-import { s as nowInstant } from "../temporal-CB5Fpo5d.js";
+import { s as nowInstant } from "../temporal-DLZlWbOi.js";
 import { n as isRecord } from "../guards-6F2bCtQR.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-J7ZepTq2.js";
-import { C as optionalText, I as textOf, R as toInstant, T as randomToken, f as errorText, j as run, o as blockCall } from "../block-helpers-DkVZNDrj.js";
-import { r as writeToStore } from "../tee-Cw-iJAWL.js";
+import { B as dbTransport, C as optionalText, H as rpcTransport, I as textOf, R as toInstant, T as randomToken, U as sqlTransport, f as errorText, j as run, o as blockCall } from "../block-helpers-CiKtrb6g.js";
+import { r as writeToStore } from "../tee-DwkUvJD_.js";
 import { BaseFormatConverter, Message, defaultEmojiResolver, parseMarkdown, stringifyMarkdown } from "chat";
 //#region src/chat-sdk/delivery.ts
 const STATUSES = {
@@ -55,7 +54,10 @@ const whatsappDeliveries = ({ body }) => {
 		only: updates.length > 0 && !other
 	};
 };
-/** Messenger and Instagram: `entry[].messaging[].delivery.mids`. Read receipts carry no ids and are skipped. */
+/**
+* Messenger and Instagram: `entry[].messaging[].delivery.mids`. Read receipts
+* carry no ids and are skipped.
+*/
 const messengerDeliveries = ({ body }) => {
 	const payload = json(body);
 	if (!isRecord(payload) || payload["object"] !== "page" && payload["object"] !== "instagram") return null;
@@ -72,7 +74,10 @@ const messengerDeliveries = ({ body }) => {
 		only: receipts.length > 0 && receipts.length === events.length
 	};
 };
-/** Twilio status callbacks: a form body with `MessageSid` and `MessageStatus` and no `Body`. */
+/**
+* Twilio status callbacks: a form body with `MessageSid` and `MessageStatus`
+* and no `Body`.
+*/
 const twilioDeliveries = ({ body, headers }) => {
 	if (!(headers["content-type"] ?? "").includes("application/x-www-form-urlencoded")) return null;
 	const form = new URLSearchParams(body);
@@ -102,7 +107,10 @@ const DELIVERY_PARSERS = {
 const APP$1 = { type: "app" };
 const ECHO_TTL_MS = 864e5;
 const echoKey = (adapter, id) => `better-supabase:inbox:echo:${adapter}:${id}`;
-/** A platform adapter built from the token the credential provider holds, so no secret sits in env. */
+/**
+* A platform adapter built from the token the credential provider holds, so no
+* secret sits in env.
+*/
 async function channelAdapter(options) {
 	const token = await options.credentials.getToken(options.ref, { subject: options.subject ?? APP$1 }).orThrow();
 	return options.create(token);
@@ -114,10 +122,9 @@ const DROPPED_HEADERS = /* @__PURE__ */ new Set([
 ]);
 const defaultPassthrough = (request, body) => request.method === "GET" || body.includes("\"type\":\"url_verification\"");
 /**
-* A route handler that verifies a channel webhook, stores the raw event in
-* the inbox's `inbound_events` and answers 200 at once. `inboundHandler`
-* replays it into Chat SDK later, so a slow bot never makes the platform
-* retry.
+* A route handler that verifies a channel webhook, stores the raw event in the
+* inbox's `inbound_events` and answers 200 at once. `inboundHandler` replays it
+* into Chat SDK later, so a slow bot never makes the platform retry.
 */
 function webhook(options) {
 	const passthrough = options.passthrough ?? defaultPassthrough;
@@ -131,9 +138,7 @@ function webhook(options) {
 			if (!verified.ok || !verified.data) return new Response("unauthorized", { status: 401 });
 		} else if (options.verify && !await options.verify(request, body)) return new Response("unauthorized", { status: 401 });
 		const headers = {};
-		request.headers.forEach((value, key) => {
-			if (!DROPPED_HEADERS.has(key)) headers[key] = value;
-		});
+		for (const [key, value] of request.headers.entries()) if (!DROPPED_HEADERS.has(key)) headers[key] = value;
 		const externalId = options.externalId?.(body, request);
 		const stored = await options.inbox.inbound.store({
 			adapter: options.adapter,
@@ -148,6 +153,12 @@ function webhook(options) {
 		return new Response("ok", { status: 200 });
 	};
 }
+async function readSource(file) {
+	if (file.source.url === void 0) throw new Error(`file ${file.id} has no URL; pass read`);
+	const response = await fetch(file.source.url);
+	if (!response.ok) throw new Error(`${file.source.url} answered ${String(response.status)}`);
+	return response.blob();
+}
 /** Replays stored webhook events and mirrors channel messages into the inbox. */
 function inboundHandler(options) {
 	const { chat, inbox } = options;
@@ -231,7 +242,7 @@ function inboundHandler(options) {
 			if (await chat.getState().get(echoKey(adapter, message.id)) !== null) return null;
 			const inboxId = options.inboxes[adapter];
 			if (inboxId === void 0) throw new Error(`inboundHandler: no inbox for adapter "${adapter}"`);
-			const attachments = await files(message, adapter, thread.id);
+			const sources = await files(message, adapter, thread.id);
 			return inbox.inbound.record({
 				inboxId,
 				threadId: thread.id,
@@ -243,30 +254,51 @@ function inboundHandler(options) {
 				message: {
 					body: message.text,
 					externalId: message.id,
-					...attachments.length > 0 ? { attachments } : {}
+					...sources.length > 0 ? { files: sources } : {}
 				}
 			}).orThrow();
+		},
+		importFiles: async (importOptions) => {
+			const read = importOptions.read ?? readSource;
+			const pending = await inbox.files.pending(importOptions.limit ?? 50).orThrow();
+			let processed = 0;
+			let failed = 0;
+			for (const file of pending) try {
+				await importOptions.write(file, await read(file));
+				await inbox.files.stored(file.id).orThrow();
+				processed += 1;
+			} catch (error) {
+				await inbox.files.failed(file.id, errorText(error));
+				failed += 1;
+			}
+			return {
+				processed,
+				failed
+			};
 		}
 	};
 }
 const CHANNELS = { twilio: "sms" };
 const channelFor = (adapter) => CHANNELS[adapter] ?? adapter;
-/** True while WhatsApp's customer service window is open: within 24 hours of the contact's last message. */
+/**
+* True while WhatsApp's customer service window is open: within 24 hours of the
+* contact's last message.
+*/
 async function whatsappWindowOpen(inbox, conversationId, now = nowInstant()) {
 	const last = (await inbox.messages.list(conversationId, { limit: 200 }).orThrow()).findLast((message) => message.direction === "inbound" && message.kind === "message");
 	return last !== void 0 && last.createdAt.add({ hours: 24 }).epochMilliseconds > now.epochMilliseconds;
 }
 /**
-* Posts a staff reply the `inbox` module queued on its channel, records
-* the delivery with the platform's message id, and remembers the id so
-* `mirror` skips the platform's echo. A failed post is recorded and thrown,
-* so the job retries.
+* Posts a staff reply the `inbox` module queued on its channel, records the
+* delivery with the platform's message id, and remembers the id so `mirror`
+* skips the platform's echo. A failed post is recorded and thrown, so the job
+* retries.
 */
 function deliver(options) {
 	const { chat, inbox } = options;
 	return async (job) => {
 		const message = await inbox.messages.get(job.message_id).orThrow();
-		if (message?.kind !== "message" || message.deletedAt !== null) return null;
+		if (message?.kind !== "message" || message.deletedAt !== void 0) return null;
 		const conversation = await inbox.conversations.get(message.conversationId).orThrow();
 		if (!conversation) return null;
 		const name = options.adapterFor?.(conversation) ?? (conversation.inbox?.channel === "sms" ? "twilio" : conversation.inbox?.channel);
@@ -299,15 +331,21 @@ function deliver(options) {
 		}
 	};
 }
-/** The inbox's periodic work: wake snoozed conversations, replay and purge webhook events, sweep state. Run it from a cron job. */
+/**
+* The inbox's periodic work: wake snoozed conversations, send the scheduled
+* replies whose time came, replay and purge webhook events, sweep state. Run it
+* from a cron job.
+*/
 async function maintain(options) {
 	const woken = await options.inbox.wakeSnoozed().orThrow();
+	const published = await options.inbox.publishDue().orThrow();
 	const replayed = options.handler ? await options.handler.drain() : {
 		processed: 0,
 		failed: 0
 	};
 	return {
 		woken,
+		published,
 		purgedEvents: await options.inbox.inbound.purge({ olderThan: options.keepEvents ?? "7 days" }).orThrow(),
 		replayed,
 		purgedState: options.state ? await options.state.purge() : 0
@@ -316,9 +354,9 @@ async function maintain(options) {
 //#endregion
 //#region src/chat-sdk/identity.ts
 /**
-* The `IdentityRef` of a Chat SDK author: `kind: "chat"`, the adapter name
-* as the provider and the platform's user id. Pass `workspace` (a Slack
-* team id) when one app serves several workspaces.
+* The `IdentityRef` of a Chat SDK author: `kind: "chat"`, the adapter name as
+* the provider and the platform's user id. Pass `workspace` (a Slack team id)
+* when one app serves several workspaces.
 */
 function chatIdentityOf(author, adapter, workspace) {
 	return {
@@ -328,7 +366,10 @@ function chatIdentityOf(author, adapter, workspace) {
 		...workspace === void 0 ? {} : { workspace }
 	};
 }
-/** The user or contact `identity` is linked to; `null` without a resolver or a link. */
+/**
+* The user or contact `identity` is linked to; `null` without a resolver or a
+* link.
+*/
 async function resolveChatAuthor(identity, options) {
 	const resolve = options.principalByIdentity ?? options.server?.authorization?.identities?.principalByIdentity;
 	return resolve ? await resolve(identity) ?? null : null;
@@ -358,10 +399,10 @@ function chatActionOf(event, workspace) {
 	};
 }
 /**
-* Decides a chat button press through the provider: the author is
-* resolved, then `onAction(action, author)` runs. Everything but
-* `allowed: true` refuses, and an unlinked author is refused before the
-* hook runs. Act on the decision, never on the button alone.
+* Decides a chat button press through the provider: the author is resolved,
+* then `onAction(action, author)` runs. Everything but `allowed: true` refuses,
+* and an unlinked author is refused before the hook runs. Act on the decision,
+* never on the button alone.
 */
 function chatActions(options) {
 	return async (action) => {
@@ -423,8 +464,8 @@ function chatActions(options) {
 }
 /**
 * The approval page URL for `request`, with `kind` and `subject` as query
-* parameters. Opening it approves nothing: the signed-in approver decides
-* on the page, and the page's server action or POST route checks them.
+* parameters. Opening it approves nothing: the signed-in approver decides on
+* the page, and the page's server action or POST route checks them.
 */
 function approvalLink(page, request) {
 	const url = new URL(page);
@@ -450,7 +491,10 @@ var MarkdownConverter = class extends BaseFormatConverter {
 	}
 };
 const converter = new MarkdownConverter();
-/** The `IdentityRef` of an inbox contact: `kind: "chat"`, `provider: "inbox"` and the contact id. */
+/**
+* The `IdentityRef` of an inbox contact: `kind: "chat"`, `provider: "inbox"`
+* and the contact id.
+*/
 function inboxIdentityOf(contactId) {
 	return {
 		kind: "chat",
@@ -482,16 +526,16 @@ function bodyOf(message) {
 	};
 }
 const emojiOf = (value) => typeof value === "string" ? value : defaultEmojiResolver.toGChat(value);
-function attachmentsOf(message) {
+function attachmentsOf(message, download) {
 	return message.attachments.flatMap((file) => {
-		const url = file.url;
-		if (url === void 0) return [];
+		if (file.status !== "clean") return [];
 		return [{
-			type: file.contentType?.startsWith("image/") ? "image" : file.contentType?.startsWith("video/") ? "video" : file.contentType?.startsWith("audio/") ? "audio" : "file",
-			url,
-			...file.name === void 0 ? {} : { name: file.name },
-			...file.contentType === void 0 ? {} : { mimeType: file.contentType },
-			...file.size === void 0 ? {} : { size: file.size }
+			type: file.mimeType?.startsWith("image/") ? "image" : file.mimeType?.startsWith("video/") ? "video" : file.mimeType?.startsWith("audio/") ? "audio" : "file",
+			name: file.name,
+			fetchMetadata: { attachmentId: file.id },
+			...file.mimeType === void 0 ? {} : { mimeType: file.mimeType },
+			...file.size === void 0 ? {} : { size: file.size },
+			...download === void 0 ? {} : { fetchData: () => download(file) }
 		}];
 	});
 }
@@ -500,10 +544,10 @@ async function* textOnly(source) {
 	else if (chunk.type === "markdown_text") yield chunk.text;
 }
 /**
-* A Chat SDK adapter for the in-app inbox: the bot reads and writes the
-* `inbox` module's conversations, so one `Chat` instance answers the
-* widget and the other channels. Contact messages reach the bot as jobs
-* on the module's bot queue; pass them to `dispatch`.
+* A Chat SDK adapter for the in-app inbox: the bot reads and writes the `inbox`
+* module's conversations, so one `Chat` instance answers the widget and the
+* other channels. Contact messages reach the bot as jobs on the module's bot
+* queue; pass them to `dispatch`.
 */
 function inboxAdapter(options) {
 	const { inbox } = options;
@@ -542,11 +586,11 @@ function inboxAdapter(options) {
 				...raw.authorType === "system" ? { isSystem: true } : {}
 			},
 			metadata: {
-				dateSent: new Date(raw.createdAt.epochMilliseconds),
-				edited: raw.editedAt !== null,
-				...raw.editedAt === null ? {} : { editedAt: new Date(raw.editedAt.epochMilliseconds) }
+				dateSent: new Date((raw.sentAt ?? raw.createdAt).epochMilliseconds),
+				edited: raw.editedAt !== void 0,
+				...raw.editedAt === void 0 ? {} : { editedAt: new Date(raw.editedAt.epochMilliseconds) }
 			},
-			attachments: attachmentsOf(raw)
+			attachments: attachmentsOf(raw, options.download)
 		});
 	};
 	const rawOf = (message) => ({
@@ -568,8 +612,9 @@ function inboxAdapter(options) {
 		const message = await inbox.messages.get(job.message_id).orThrow();
 		if (message?.conversationId !== job.conversation_id || message.authorType !== "contact" || message.kind !== "message") return;
 		const parsed = parseMessage(message);
-		if (ticketJobs !== void 0 && message.authorId !== null) {
-			const { result } = await ticketJobs.enqueue(inboxIdentityOf(message.authorId), parsed);
+		const contactId = ticketJobs === void 0 ? void 0 : (await inbox.conversations.get(message.conversationId).orThrow())?.contactId;
+		if (ticketJobs !== void 0 && contactId !== void 0) {
+			const { result } = await ticketJobs.enqueue(inboxIdentityOf(contactId), parsed);
 			if (result !== void 0) tickets.set(message.id, result);
 		}
 		try {
@@ -654,7 +699,7 @@ function inboxAdapter(options) {
 			const oldest = page[0];
 			return {
 				messages: visible.map(parseMessage),
-				...oldest !== void 0 && page.length >= limit ? { nextCursor: oldest.createdAt.toString() } : {}
+				...oldest !== void 0 && page.length >= limit ? { nextCursor: (oldest.sentAt ?? oldest.createdAt).toString() } : {}
 			};
 		},
 		fetchThread: async (threadId) => {
@@ -726,8 +771,8 @@ function installationOf(value) {
 const APP = { type: "app" };
 const sameRef = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 /**
-* The `chat_installations` registry with the credential lifecycle: every
-* ref an install drops is revoked through the `CredentialProvider`.
+* The `chat_installations` registry with the credential lifecycle: every ref an
+* install drops is revoked through the `CredentialProvider`.
 */
 function createChatInstallations(options) {
 	const call = blockCall(options.transport, options.schema ?? "better_supabase", options.mappers);
@@ -806,8 +851,8 @@ function queueEntryOf(value) {
 const ms = (value) => value === void 0 || value <= 0 ? void 0 : Math.ceil(value);
 /**
 * A Chat SDK `StateAdapter` on the `chat-sdk-state` SQL module: thread
-* subscriptions, locks, the cache, lists and the per-thread queue in
-* Postgres, so a bot needs no Redis. Service role only.
+* subscriptions, locks, the cache, lists and the per-thread queue in Postgres,
+* so a bot needs no Redis. Service role only.
 */
 function createSupabaseState(options) {
 	const prefix = options.keyPrefix ?? "chat-sdk";

package/dist/chat-sdk/react/index.d.ts

@@ -1,3 +1,3 @@
-import { l as InboxSource } from "../../client-BONsuFYf.js";
-import { a as UseInboxOptions, c as useInbox, i as UseConversationOptions, l as useInboxWidget, n as InboxListState, o as UseInboxWidgetOptions, r as InboxWidgetState, s as useConversation, t as ConversationState } from "../../index-1Vsg-7YV.js";
+import { u as InboxSource } from "../../client-7_4Y21ue.js";
+import { a as UseInboxOptions, c as useInbox, i as UseConversationOptions, l as useInboxWidget, n as InboxListState, o as UseInboxWidgetOptions, r as InboxWidgetState, s as useConversation, t as ConversationState } from "../../index-U0o7kU0s.js";
 export { type ConversationState, type InboxListState, type InboxSource, type InboxWidgetState, type UseConversationOptions, type UseInboxOptions, type UseInboxWidgetOptions, useConversation, useInbox, useInboxWidget };

package/dist/chat-sdk/react/server.d.ts

@@ -1,4 +1,4 @@
-import { l as InboxSource } from "../../client-BONsuFYf.js";
-import { a as UseInboxOptions, i as UseConversationOptions, n as InboxListState, o as UseInboxWidgetOptions, r as InboxWidgetState, t as ConversationState } from "../../index-1Vsg-7YV.js";
+import { u as InboxSource } from "../../client-7_4Y21ue.js";
+import { a as UseInboxOptions, i as UseConversationOptions, n as InboxListState, o as UseInboxWidgetOptions, r as InboxWidgetState, t as ConversationState } from "../../index-U0o7kU0s.js";
 import { useConversation, useInbox, useInboxWidget } from "../../blocks/inbox/react/server.js";
 export { type ConversationState, type InboxListState, type InboxSource, type InboxWidgetState, type UseConversationOptions, type UseInboxOptions, type UseInboxWidgetOptions, useConversation, useInbox, useInboxWidget };

package/dist/claims-Bp9My7XP.js

@@ -0,0 +1,88 @@
+//#region src/core/claims.ts
+const DEFAULT_CLAIMS = {
+	tenant: "tenant_id",
+	scope: "tenant",
+	features: "features",
+	memberships: "memberships"
+};
+/**
+* The claim paths for `config.claims`, with defaults. For a generated schema,
+* pass `claimsOf(meta)`.
+*/
+function claimPaths(claims) {
+	const resolved = {
+		...DEFAULT_CLAIMS,
+		...claims
+	};
+	return {
+		tenant: tenantClaimPaths(resolved.tenant),
+		features: resolved.features,
+		memberships: resolved.memberships,
+		scope: resolved.scope
+	};
+}
+/** The configured claim names, with defaults for the ones codegen left out. */
+function claimsOf(meta) {
+	if (!meta?.claims) return DEFAULT_CLAIMS;
+	let claims = claimsByMeta.get(meta);
+	if (!claims) {
+		claims = {
+			...DEFAULT_CLAIMS,
+			...meta.claims
+		};
+		claimsByMeta.set(meta, claims);
+	}
+	return claims;
+}
+const claimsByMeta = /* @__PURE__ */ new WeakMap();
+/**
+* Where the active tenant is read from: the top-level claim, then
+* `app_metadata`.
+*/
+function tenantClaimPaths(tenant = DEFAULT_CLAIMS.tenant) {
+	let paths = tenantPaths.get(tenant);
+	if (!paths) {
+		paths = [tenant, `app_metadata.${tenant}`];
+		tenantPaths.set(tenant, paths);
+	}
+	return paths;
+}
+const tenantPaths = /* @__PURE__ */ new Map();
+/**
+* The claim paths a tenant option names: one path, a list, or the configured
+* default (`config.claims.tenant`, then the same key in `app_metadata`).
+*/
+function tenantPathsFor(claim, meta) {
+	if (typeof claim === "string") return [claim];
+	return claim ?? tenantClaimPaths(claimsOf(meta).tenant);
+}
+/**
+* The tenant of a request: `context.tenant`, then the first of `paths` that
+* holds a non-empty string. Every tenant-aware module resolves through this, so
+* they agree on precedence.
+*/
+function tenantFrom(context, paths) {
+	if (typeof context.tenant === "string") return context.tenant;
+	for (const path of paths) {
+		const value = claimAt(context.claims, path);
+		if (value !== void 0) return value;
+	}
+}
+/** Claim paths come from configuration, so this stays small. */
+const segmentsByPath = /* @__PURE__ */ new Map();
+function segmentsOf(path) {
+	let segments = segmentsByPath.get(path);
+	if (!segments) {
+		segments = path.split(".");
+		if (segmentsByPath.size < 256) segmentsByPath.set(path, segments);
+	}
+	return segments;
+}
+/** The string at a dotted claim path, if any. */
+function claimAt(claims, path) {
+	let value = claims;
+	for (const segment of segmentsOf(path)) value = typeof value === "object" && value !== null ? value[segment] : void 0;
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+//#endregion
+export { tenantClaimPaths as a, claimsOf as i, claimAt as n, tenantFrom as o, claimPaths as r, tenantPathsFor as s, DEFAULT_CLAIMS as t };

package/dist/claims-T8TWZ53E.js

@@ -0,0 +1,63 @@
+import { defineMiddleware } from "@supabase/middleware";
+//#region src/auth/claims.ts
+/** Entry contributing `ctx.auth`, the typed caller, from `ctx.bs`. */
+function withAuth() {
+	return defineMiddleware({
+		key: "auth",
+		run: () => (_request, ctx) => Promise.resolve({ auth: ctx.bs.auth })
+	})();
+}
+/**
+* `jwtClaims` as `withSupabase` contributes it: the verified token's payload,
+* or `null`.
+*/
+function jwtClaimsOf(auth) {
+	if (auth.kind === "user") return auth.claims;
+	if (auth.kind === "apiKey") return auth.claims;
+	return null;
+}
+/** `userClaims` as `withSupabase` contributes it, or `null` without a user. */
+function userClaimsOf(auth) {
+	return auth.kind === "user" ? auth.user : null;
+}
+/**
+* `authMode` as `withSupabase` names it: `user` for a verified user token or a
+* user's API key, `secret` for a secret key or an organization's API key,
+* `none` otherwise (no credentials, or ones a guard refuses).
+*/
+function authModeOf(auth) {
+	switch (auth.kind) {
+		case "user": return "user";
+		case "service": return "secret";
+		case "apiKey": return auth.userId ? "user" : "secret";
+		case "anon":
+		case "invalid": return "none";
+		default: return auth;
+	}
+}
+/**
+* Entry contributing `ctx.jwtClaims` under the `withSupabase` key, so
+* `withPostgresClient` and `withOpenFeature` compose downstream.
+*/
+function withJwtClaims() {
+	return defineMiddleware({
+		key: "jwtClaims",
+		run: () => (_request, ctx) => Promise.resolve({ jwtClaims: jwtClaimsOf(ctx.auth) })
+	})();
+}
+/** Entry contributing `ctx.userClaims` under the `withSupabase` key. */
+function withUserClaims() {
+	return defineMiddleware({
+		key: "userClaims",
+		run: () => (_request, ctx) => Promise.resolve({ userClaims: userClaimsOf(ctx.auth) })
+	})();
+}
+/** Entry contributing `ctx.authMode` under the `withSupabase` key. */
+function withAuthMode() {
+	return defineMiddleware({
+		key: "authMode",
+		run: () => (_request, ctx) => Promise.resolve({ authMode: authModeOf(ctx.auth) })
+	})();
+}
+//#endregion
+export { withAuthMode as a, withAuth as i, jwtClaimsOf as n, withJwtClaims as o, userClaimsOf as r, withUserClaims as s, authModeOf as t };

package/dist/cli/add-Bf3kE6PY.js

@@ -0,0 +1,75 @@
+import { n as CliError } from "./errors-BTe6A15O.js";
+import { D as providerLabel, _ as providerOwnsMemberships, g as layoutFor, m as MEMBERSHIP_CLAIM_MODULES } from "./module-migration-CbX-jRhV.js";
+import { n as applyPlan } from "./files-C5JfVnj5.js";
+import { n as addBlocksToJson, s as keyText, t as addBlocksToConfig } from "./config-edit-D46H0UHp.js";
+import { a as write, i as unlistedModuleFiles, n as nextStep } from "./write-3qdrpS1v.js";
+import { basename, dirname } from "node:path";
+import { readFile } from "node:fs/promises";
+import { SQL_MODULES, resolveModules } from "better-supabase/sql";
+//#region src/cli/sql/add.ts
+async function addModules(config, args, names, deps) {
+	if (names.length === 0) throw new CliError("input_required", "Name at least one module.", {
+		missing: ["<module>"],
+		choices: { "<module>": Object.keys(SQL_MODULES) }
+	});
+	const unknown = names.filter((name) => !(name in SQL_MODULES));
+	if (unknown.length > 0) throw new CliError("usage", `Unknown module ${unknown.join(", ")}. Available: ${Object.keys(SQL_MODULES).join(", ")}`);
+	const owner = config.authorization && providerOwnsMemberships(config) ? providerLabel(config.authorization) : void 0;
+	const hookModules = names.filter((name) => MEMBERSHIP_CLAIM_MODULES.has(name));
+	if (owner && hookModules.length > 0 && args["allow-hook-overlap"] !== true) return {
+		code: 1,
+		error: [
+			`The access token hook of ${owner} writes the memberships claim.`,
+			`${hookModules.join(" and ")} would add a second source for it. Use the provider's hook instead,`,
+			"or pass --allow-hook-overlap to write the modules anyway."
+		].join("\n")
+	};
+	const listed = [...config.blockNames, ...names.filter((name) => !config.blockNames.includes(name))];
+	const sqlLayout = await layoutFor(config, args, listed);
+	const added = resolveModules(names, sqlLayout).map((module) => module.name);
+	const lines = await write(config, args, listed, sqlLayout, deps.now, added);
+	const pulledIn = resolveModules(names, sqlLayout).map((module) => module.name).filter((name) => MEMBERSHIP_CLAIM_MODULES.has(name) && !names.includes(name));
+	if (owner && pulledIn.length > 0) lines.push("", `${pulledIn.join(" and ")} came along as a dependency: its memberships table backs has_organization_role() and has_entitlement().`, `The hook of ${owner} still writes the memberships claim, so don't call better_supabase.membership_claims from a hook.`, "Make better_supabase.memberships one of the provider's membership sources if both should agree.");
+	const untracked = resolveModules(names, sqlLayout).map((module) => module.name).filter((name) => !config.blockNames.includes(name));
+	if (untracked.length > 0) lines.push("", ...await listInConfig(args, untracked, deps));
+	if (args["dry-run"] !== true) lines.push(...await unlistedModuleFiles(config, names, sqlLayout));
+	return {
+		code: 0,
+		output: lines.join("\n"),
+		data: {
+			added,
+			pulledIn,
+			untracked
+		},
+		next: [await nextStep(config)]
+	};
+}
+/**
+* Lists `untracked` in `blocks` of the config file, so `sql sync --check` keeps
+* them current, or prints the snippet when the file isn't a literal object the
+* edit can follow.
+*/
+async function listInConfig(args, untracked, deps) {
+	const file = deps.configFile;
+	if (file === void 0) return ["Add them to blocks in better-supabase.config.ts so `sql sync --check` keeps them current:", ...untracked.map((name) => `  ${keyText(name)}: {},`)];
+	const source = await readFile(file, "utf-8");
+	const edit = file.endsWith(".json") ? addBlocksToJson(source, untracked) : addBlocksToConfig(source, untracked);
+	if (!edit.ok) return [
+		`${basename(file)} wasn't changed: ${edit.reason}.`,
+		"Add them to blocks so `sql sync --check` keeps them current:",
+		...untracked.map((name) => `  ${keyText(name)}: {},`)
+	];
+	await applyPlan({
+		root: dirname(file),
+		regenerate: "better-supabase sql add",
+		files: [{
+			path: file,
+			contents: edit.text,
+			policy: "edit"
+		}]
+	}, { "dry-run": args["dry-run"] });
+	if (args["dry-run"] === true) return [`Would add ${untracked.join(", ")} to blocks in ${basename(file)}.`];
+	return [`Added ${untracked.join(", ")} to blocks in ${basename(file)}.`];
+}
+//#endregion
+export { addModules as t };