better-supabase 0.13.0 → 0.14.0

package/dist/create/index.d.ts

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
-import { et as ModuleAccessProvider } from "../index-DdZcWH6q.js";
-import { Cn as AppColumnFormat, En as AppOnDeleteAction, Fn as AppTableVersions, at as Preset, vn as APP_ON_DELETE_ACTIONS, wn as AppColumnType, xn as AppColumnAccess } from "../codegen-DGtOsqz9.js";
-import { c as DesignChange, g as DesignErrorCode, p as CreateDesign, z as PresetInput } from "../index-PADpaDku.js";
+import { it as ModuleAccessProvider } from "../index-CvxK2BZS.js";
+import { At as AppTableVersions, en as Preset, gt as AppColumnAccess, pt as APP_ON_DELETE_ACTIONS, r as PresetInput, vt as AppColumnFormat, xt as AppOnDeleteAction, yt as AppColumnType } from "../config-BuOz_O-y.js";
+import { c as DesignChange, g as DesignErrorCode, p as CreateDesign } from "../index-BSUX4dlB.js";
 import { a as SupabaseLint, o as SupabaseOrganization, s as SupabaseProject } from "../management-wtecfrNf.js";
 import { t as PresetMigrationFile } from "../types-DGHfTW8_.js";
 //#region src/create/design-computed.d.ts
@@ -287,6 +287,11 @@ export interface AppColumn {
    * (ADR 0051).
    */
   readonly access?: AppColumnAccess;
+  /**
+   * Stores ciphertext with the tenant's Vault key; read through
+   * `<table>_reveal`.
+   */
+  readonly encrypted?: boolean;
 }
 export type AppScope = "inherit" | "user" | "none";
 export type AppTableId = "uuid" | "bigint";
@@ -303,6 +308,8 @@ export interface AppTable {
   readonly lookups?: Readonly<Record<string, AppLookup>>;
   /** Outbox events on insert, update and delete; the shape of `AppTableEvents`. */
   readonly events?: true | AppEvents;
+  /** One `read` audit entry per tenant per reveal call. */
+  readonly auditReads?: boolean;
 }
 /**
  * What the canvas adds to a preset: app tables, extra columns on block tables
@@ -478,6 +485,11 @@ export declare function checkDesign(input: unknown, preset: PresetInput): Promis
  * which `appTables` refuses: nobody but the server could insert a row.
  */
 export declare function lockedWithoutDefault(column: AppColumn): boolean;
+/**
+ * Whether a column can be encrypted: not a `text[]`, and no unique key,
+ * reference or identity, which only work on the stored value.
+ */
+export declare function encryptable(column: AppColumn): boolean;
 /** Whether `min` and `max` apply to a `type` column, as a value or a length. */
 export declare function takesBounds(type: AppColumnType): boolean;
 /**
@@ -687,8 +699,9 @@ export declare const SAMPLE_ROW_COUNT = 8;
 /** Who reads the rows: a signed-in member, or server code with the service role. */
 export type SampleViewer = "member" | "server";
 /**
- * The columns of `table` a `viewer` can't select: `access: "server"` ones for a
- * member.
+ * The columns of `table` a `viewer` can't select: `access: "server"` and
+ * encrypted ones for a member, who reads an encrypted column through
+ * `<table>_reveal` instead.
  */
 export declare function hiddenColumns(table: AppTable | undefined, viewer: SampleViewer): readonly string[];
 /**

package/dist/create/index.js

@@ -1,8 +1,8 @@
-import { c as PRESET_CATALOG, i as presetOf, s as resolvePreset, v as encodePreset } from "../config-V6HMvce5.js";
-import { a as appDefaultError, c as appReservedColumns, o as appIdentifierError, p as isAppDefault, s as appNameLengthError, x as APP_ON_DELETE_ACTIONS } from "../app-tables-0YZ9IskE.js";
-import { o as resolveConfig } from "../config-xUf0dj0t.js";
-import { _ as encodeDesign, a as DesignParseError, b as parseDesign, h as designOf, n as diffDesigns, o as DesignTooLongError, u as designConfig, y as jsonPointer } from "../preset-HNFqCWaD.js";
-import { D as SQL_MODULES, h as renderModules, i as moduleLayout } from "../sql-frpIs51D.js";
+import { c as PRESET_CATALOG, i as presetOf, s as resolvePreset, v as encodePreset } from "../config-Dh4D8lBa.js";
+import { C as APP_ON_DELETE_ACTIONS, a as appIdentifierError, m as isAppDefault, o as appNameLengthError, p as appDefaultError, s as appReservedColumns } from "../app-tables-C5aoI5rZ.js";
+import { c as resolveConfig } from "../config-Dn0cC3bM.js";
+import { _ as encodeDesign, a as DesignParseError, b as parseDesign, h as designOf, n as diffDesigns, o as DesignTooLongError, u as designConfig, y as jsonPointer } from "../preset-DzcQ5CQM.js";
+import { O as SQL_MODULES, i as moduleLayout, m as renderModules } from "../sql-rQDL6PIL.js";
 //#region src/create/column-keys.ts
 /** The most options a select takes, and the longest option. */
 const MAX_OPTIONS = 100;
@@ -42,6 +42,13 @@ const CONTROL = /\p{Cc}/u;
 function lockedWithoutDefault(column) {
 	return column.access !== void 0 && column.nullable === false && column.default === void 0 && column.identity !== true;
 }
+/**
+* Whether a column can be encrypted: not a `text[]`, and no unique key,
+* reference or identity, which only work on the stored value.
+*/
+function encryptable(column) {
+	return column.type !== "text[]" && column.unique !== true && column.references === void 0 && column.identity !== true;
+}
 /** Whether `min` and `max` apply to a `type` column, as a value or a length. */
 function takesBounds(type) {
 	return type === "text" || NUMBER_TYPES.has(type);
@@ -59,7 +66,7 @@ function fitsBound(type, value) {
 * integer and bigint, and a default an identity or the type refuses.
 */
 function fitted(column) {
-	const { format, options, min, max, identity, default: fallback, nullable, ...rest } = column;
+	const { format, options, min, max, identity, default: fallback, nullable, encrypted, ...rest } = column;
 	const { type } = column;
 	const counted = identity === true && (type === "integer" || type === "bigint");
 	const next = { ...rest };
@@ -70,6 +77,7 @@ function fitted(column) {
 	if (fitsBound(type, min)) next.min = min;
 	if (fitsBound(type, max)) next.max = max;
 	if (counted) next.identity = true;
+	if (encrypted === true && encryptable(next)) next.encrypted = true;
 	return next;
 }
 /** Why `option` can't join a select's `options`, or `undefined` when it can. */
@@ -2094,12 +2102,13 @@ function undoHistory(current, action) {
 //#region src/create/sample-rows.ts
 const SAMPLE_ROW_COUNT = 8;
 /**
-* The columns of `table` a `viewer` can't select: `access: "server"` ones for a
-* member.
+* The columns of `table` a `viewer` can't select: `access: "server"` and
+* encrypted ones for a member, who reads an encrypted column through
+* `<table>_reveal` instead.
 */
 function hiddenColumns(table, viewer) {
 	if (viewer === "server") return [];
-	return Object.entries(table?.columns ?? {}).filter(([, column]) => column.access === "server").map(([key]) => key);
+	return Object.entries(table?.columns ?? {}).filter(([, column]) => column.access === "server" || column.encrypted === true).map(([key]) => key);
 }
 const USERS = "auth.users";
 const PEOPLE = [
@@ -2266,4 +2275,4 @@ function migrationBetween(code, base, next) {
 	};
 }
 //#endregion
-export { APP_MODULE, COLUMN_KINDS, EMPTY_DESIGN, HISTORY_LIMIT, KIND_GROUPS, MIGRATION_NAME, APP_ON_DELETE_ACTIONS as ON_DELETE_ACTIONS, ROLLUP_AGGREGATES, SAMPLE_ROW_COUNT, addTable, appTableId, boundError, checkDesign, columnError, columnLabel, computedColumnRenamed, computedRows, computedTableRenamed, connect, dashboardUrl, defaultError, deleteColumn, deleteExtraColumn, deleteTable, deployBlocker, deployQuery, designIssues, duplicateTable, editTable, eventsColumnsEdited, filterColumns, fitted, fittedRollup, freeTableName, generatePassword, hiddenColumns, identifierError, initialHistory, isAppTable, isEmptyDesign, isRollupAggregate, keyColumnsOf, kindById, kindOf, lockedWithoutDefault, lookupSources, migrationBetween, moveTables, newDeployId, optionError, parseSchema, previewAccessProvider, previewFiles, prunedComputed, readableColumns, referenceFrom, renameColumn, renameTable, rollupColumns, rollupSources, sampleRows, schemaData, schemaRelations, setColumn, setColumnKind, setExtraColumn, setTableId, singular, subjectColumns, subjectColumnsEdited, subjectTypeError, suggestedProjectName, tableStatements, tableWithComputed, tableWithoutComputed, takesBounds, tenantColumnOf, tidy, undoHistory, updateTable, userConnection, withBounds, withDesign, withKind };
+export { APP_MODULE, COLUMN_KINDS, EMPTY_DESIGN, HISTORY_LIMIT, KIND_GROUPS, MIGRATION_NAME, APP_ON_DELETE_ACTIONS as ON_DELETE_ACTIONS, ROLLUP_AGGREGATES, SAMPLE_ROW_COUNT, addTable, appTableId, boundError, checkDesign, columnError, columnLabel, computedColumnRenamed, computedRows, computedTableRenamed, connect, dashboardUrl, defaultError, deleteColumn, deleteExtraColumn, deleteTable, deployBlocker, deployQuery, designIssues, duplicateTable, editTable, encryptable, eventsColumnsEdited, filterColumns, fitted, fittedRollup, freeTableName, generatePassword, hiddenColumns, identifierError, initialHistory, isAppTable, isEmptyDesign, isRollupAggregate, keyColumnsOf, kindById, kindOf, lockedWithoutDefault, lookupSources, migrationBetween, moveTables, newDeployId, optionError, parseSchema, previewAccessProvider, previewFiles, prunedComputed, readableColumns, referenceFrom, renameColumn, renameTable, rollupColumns, rollupSources, sampleRows, schemaData, schemaRelations, setColumn, setColumnKind, setExtraColumn, setTableId, singular, subjectColumns, subjectColumnsEdited, subjectTypeError, suggestedProjectName, tableStatements, tableWithComputed, tableWithoutComputed, takesBounds, tenantColumnOf, tidy, undoHistory, updateTable, userConnection, withBounds, withDesign, withKind };

package/dist/create-blocks-kPUhCvje.js

@@ -0,0 +1,217 @@
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { t as onBlockEvent } from "./block-event-listener-Bu6G0TFH.js";
+import { B as dbTransport } from "./block-helpers-CiKtrb6g.js";
+import { i as wrapTransport, r as withBlockHooks } from "./block-hooks-BymdcD0V.js";
+import { t as blockNames } from "./block-names-Dbv_2wmE.js";
+import { i as forwardBlockEvents } from "./cloud-event-XsM53POL.js";
+//#region src/blocks/block-config.ts
+/**
+* The options a block's creator gets from its generated entry: the schema it
+* calls (the API schema when there is one, since the wrappers there are what
+* the caller may run) and the shared options. `defineBlocks` passes them;
+* spread them into a creator you call yourself: `createAiChat({
+* ...generatedOptions(blockConfig["ai-chat"]), transport })`.
+*/
+function generatedOptions(entry) {
+	return {
+		...entry.options,
+		schema: entry.api ?? entry.schema
+	};
+}
+/**
+* A realtime topic template from `blocks.generated.ts` with its placeholders
+* filled in, such as the notifications topic `notifications:{userId}`.
+*/
+function fillTopic(template, values) {
+	return template.replaceAll(/\{([A-Za-z]+)\}/g, (match, name) => {
+		const value = values[name];
+		if (value === void 0) throw new TypeError(`fillTopic: no value for ${match} in "${template}"`);
+		return value;
+	});
+}
+//#endregion
+//#region src/blocks/create-blocks.ts
+/** The CloudEvents `source` of block events that `createBlocks` forwards. */
+const BLOCK_EVENT_SOURCE = "/better-supabase/blocks";
+/**
+* The blocks an app uses, built with `blockConfig` from `blocks.generated.ts`
+* (`better-supabase gen`), so each block's schema and the options its SQL half
+* shares come from the `blocks` config, and the app's own events
+* (`defineEvents`). The event types are the union of every block's events, so
+* `on` and `events` type each one's data without `declare module` (invariant
+* 2).
+*/
+function defineBlocks(config, blocks, ...appEvents) {
+	const events = { types: [.../* @__PURE__ */ new Set([...Object.values(blocks).flatMap((block) => block.events.types), ...appEvents.flatMap((each) => each.types)])] };
+	return {
+		blocks,
+		config,
+		events,
+		create: (options) => buildBlocks({
+			...options,
+			config
+		}, blocks),
+		client: (db, key, options = {}) => blockBuilder(clientContext(db, {
+			config,
+			...options
+		}), blocks).build(String(key)),
+		on: (betterSupabase, pattern, handler) => onBlockEvent(betterSupabase, events, pattern, handler)
+	};
+}
+/**
+* Builds `blocks` with one set of options and wires them on their ports. Each
+* block gets its schema and shared options from its entry in `config`
+* (`blocks.generated.ts`), keyed by the block's name. Each block that consumes
+* a port (`notifier`, `files`, `attachments`, `workflows`) gets it from the one
+* block in the set that provides it, and `sinks` holds the outbox sinks the
+* blocks provide. `credentials` reaches every block, and block events go to
+* `audit`. Only the blocks you pass are imported, so the rest stay out of the
+* bundle. `hooks` wraps each block's methods with `withBlockHooks`, and the
+* ports are built from the wrapped clients, so a sibling's calls (ai-tasks
+* sending notifications) go through the hooks too.
+*/
+function createBlocks(options, blocks) {
+	return buildBlocks(options, blocks);
+}
+/**
+* One block's client over a `Db`: its calls run through `dbTransport(db)` and
+* act in the `Db`'s tenant (`db.$context.tenant`) unless `options.tenant` names
+* one. Pass `config: blockConfig` so it calls the schema and function names
+* `gen` wrote; `BlockSet.client(db, key)` does that for you.
+*
+* ```ts
+* const comments = createBlockClient(ctx.db, commentsBlock, {
+*   config: blockConfig,
+* });
+* ```
+*/
+function createBlockClient(db, block, options = {}) {
+	const { hooks, ...rest } = options;
+	return blockBuilder({
+		...clientContext(db, rest),
+		...hooks === void 0 ? {} : { hooks: { [block.name]: hooks } }
+	}, { [block.name]: block }).build(block.name);
+}
+function clientContext(db, options) {
+	const { hooks, ...rest } = options;
+	return {
+		tenant: () => db.$context?.tenant,
+		...rest,
+		transport: rest.transport ?? dbTransport(db),
+		...hooks === void 0 ? {} : { hooks }
+	};
+}
+const UNIQUE_PORTS = [
+	"notifier",
+	"files",
+	"attachments",
+	"workflows",
+	"mailer"
+];
+/** `key`'s entry in `hooks`, which `BlocksHooks` keys like the blocks. */
+function hooksOf(hooks, key) {
+	if (hooks === void 0) return;
+	const entry = Object.entries(hooks).find(([name]) => name === key)?.[1];
+	return isRecord(entry) ? entry : void 0;
+}
+/** Builds the blocks of `blocks` on demand, each one once, wired on ports. */
+function blockBuilder(options, blocks) {
+	const { audit: _audit, hooks, config, ...shared } = options;
+	const providers = /* @__PURE__ */ new Map();
+	for (const port of UNIQUE_PORTS) {
+		const keys = Object.keys(blocks).filter((key) => blocks[key]?.provides[port] !== void 0);
+		if (keys.length > 1) throw new TypeError(`createBlocks: ${keys.map((key) => `"${key}"`).join(" and ")} both provide the ${port} port; pass one`);
+		const [key] = keys;
+		if (key !== void 0) providers.set(port, key);
+	}
+	for (const [key, block] of Object.entries(blocks)) for (const [port, need] of Object.entries(block.consumes)) if (need === "required" && !providers.has(port)) throw new TypeError(`createBlocks: "${key}" needs a block that provides the ${port} port`);
+	const built = /* @__PURE__ */ new Map();
+	const building = /* @__PURE__ */ new Set();
+	const blockOf = (key) => {
+		const block = blocks[key];
+		if (block === void 0) throw new TypeError(`No block named "${key}"`);
+		return block;
+	};
+	/**
+	* The options `key`'s creator gets: shared, then its generated config, then
+	* ports, then `with` settings.
+	*/
+	const optionsOf = (key) => {
+		const ports = {};
+		for (const port of UNIQUE_PORTS) {
+			if (blockOf(key).consumes[port] === void 0) continue;
+			const provider = providers.get(port);
+			if (provider === void 0 || provider === key) continue;
+			const value = portOf(provider, port);
+			if (value !== void 0) ports[port] = value;
+		}
+		const block = blockOf(key);
+		const entry = config?.[block.name];
+		return {
+			...shared,
+			...entry === void 0 ? {} : generatedOptions(entry),
+			...entry?.names === void 0 ? {} : renamedTransports(entry.names),
+			...ports,
+			...block.settings
+		};
+	};
+	/**
+	* `shared`'s transports, calling the block functions by the names the SQL
+	* gave them.
+	*/
+	function renamedTransports(naming) {
+		const middleware = blockNames(naming);
+		return {
+			transport: wrapTransport(shared.transport, middleware),
+			...shared.service === void 0 ? {} : { service: wrapTransport(shared.service, middleware) }
+		};
+	}
+	function portOf(key, port) {
+		const provide = blockOf(key).provides[port];
+		if (provide === void 0) return;
+		return provide(build(key), optionsOf(key));
+	}
+	function build(key) {
+		if (built.has(key)) return built.get(key);
+		const block = blockOf(key);
+		if (block.create === void 0) throw new TypeError(`The "${block.name}" block has only SQL; it has no client to build`);
+		if (building.has(key)) throw new TypeError(`The "${key}" block depends on itself`);
+		building.add(key);
+		try {
+			const create = block.create;
+			const created = create(optionsOf(key));
+			const blockHooks = hooksOf(hooks, key);
+			const client = blockHooks !== void 0 && isRecord(created) ? withBlockHooks(created, blockHooks, {
+				block: key,
+				...shared.events === void 0 ? {} : { logger: shared.events.logger }
+			}) : created;
+			built.set(key, client);
+			return client;
+		} finally {
+			building.delete(key);
+		}
+	}
+	return {
+		build,
+		portOf
+	};
+}
+function buildBlocks(options, blocks) {
+	const { audit, events } = options;
+	if (audit !== void 0 && events === void 0) throw new TypeError("createBlocks: `audit` needs `events` to forward");
+	const { build, portOf } = blockBuilder(options, blocks);
+	const result = {};
+	const sinks = {};
+	for (const [key, block] of Object.entries(blocks)) {
+		if (block.create === void 0) continue;
+		result[key] = build(key);
+		const sink = portOf(key, "sink");
+		if (sink !== void 0) sinks[key] = sink;
+	}
+	result["sinks"] = sinks;
+	const stop = audit === void 0 || events === void 0 ? void 0 : forwardBlockEvents({ events }, audit, { source: BLOCK_EVENT_SOURCE });
+	result["close"] = () => stop?.();
+	return result;
+}
+//#endregion
+export { fillTopic as a, defineBlocks as i, createBlockClient as n, generatedOptions as o, createBlocks as r, BLOCK_EVENT_SOURCE as t };

package/dist/credentials/index.d.ts

@@ -1,8 +1,8 @@
-import { t as AsyncResult } from "../result-mijqfoJN.js";
-import { F as CredentialEventData, wt as Events } from "../events-DhGgwqQA.js";
-import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-Dmsbl8ug.js";
-import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-DBPhgF3W.js";
-import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-BQThkbws.js";
+import { t as AsyncResult } from "../result-C6jDfedy.js";
+import { Ct as Events, P as CredentialEventData } from "../events-DbLjvxDX.js";
+import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-DmiaI1qt.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-d53POsem.js";
+import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-BQTdu4eH.js";
 //#region src/credentials/compose.d.ts
 /**
  * One provider over several: each call goes to the provider whose `name` is the

package/dist/credentials/index.js

@@ -1,12 +1,11 @@
-import { n as dbError } from "../errors-D7u24ZJH.js";
-import { a as ok, r as err, t as AsyncResult } from "../result-DIT_qp4G.js";
-import { a as tenantCredentialRef, i as subjectFor, n as credentialRefInTenant, r as foreignCredentialRef } from "../provider-BhIkKBOh.js";
+import { n as dbError } from "../errors-03ysrOt4.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-B3m7xtRY.js";
+import { B as dbTransport, H as rpcTransport, U as sqlTransport, o as blockCall } from "../block-helpers-CiKtrb6g.js";
+import { a as tenantCredentialRef, i as subjectFor, n as credentialRefInTenant, r as foreignCredentialRef } from "../provider-EJ0-5GwJ.js";
 import { n as event, t as defineEvents } from "../event-map-CtPFhcOp.js";
 import { n as hmacHex, r as timingSafeEqual } from "../hmac-B3CTTlfv.js";
-import { o as verifySharedSecret, s as verifyWebhook } from "../signatures-D8IoN3Rw.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-Ds0C2mUf.js";
-import { o as blockCall } from "../block-helpers-DwE32_gT.js";
-import { n as revokeIfConfigured, t as credentialRouter } from "../compose-VBQL7zIO.js";
+import { o as verifySharedSecret, s as verifyWebhook } from "../signatures-GUBuhLOB.js";
+import { n as revokeIfConfigured, t as credentialRouter } from "../compose--4D1FoPN.js";
 //#region src/credentials/vault.ts
 const MAX_CACHED = 256;
 const invalidRef = (message) => err(dbError("invalid_input", message, { hint: "CREDENTIAL_REF_INVALID" }));

package/dist/cron-_i5pBGkY.js

@@ -0,0 +1,148 @@
+import { t as temporal } from "./temporal-required-B8qQHYbI.js";
+//#region src/blocks/jobs/cron.ts
+const MACROS = {
+	"@yearly": "0 0 1 1 *",
+	"@annually": "0 0 1 1 *",
+	"@monthly": "0 0 1 * *",
+	"@weekly": "0 0 * * 0",
+	"@daily": "0 0 * * *",
+	"@midnight": "0 0 * * *",
+	"@hourly": "0 * * * *"
+};
+const MONTHS = [
+	"jan",
+	"feb",
+	"mar",
+	"apr",
+	"may",
+	"jun",
+	"jul",
+	"aug",
+	"sep",
+	"oct",
+	"nov",
+	"dec"
+];
+const WEEKDAYS = [
+	"sun",
+	"mon",
+	"tue",
+	"wed",
+	"thu",
+	"fri",
+	"sat"
+];
+/** Replaces `JAN` or `MON` style names with their numbers. */
+function named(text, names, first) {
+	return text.replaceAll(/[a-z]{3}/gi, (name) => {
+		const index = names.indexOf(name.toLowerCase());
+		return index === -1 ? name : String(index + first);
+	});
+}
+const INTERVAL = /^(\d+)\s+(second|minute|hour)s?$/i;
+/** Gives up when no minute matches within this many days (`0 0 30 2 *`). */
+const SEARCH_DAYS = 1830;
+function invalid(expression, reason) {
+	return /* @__PURE__ */ new TypeError(`Invalid cron "${expression}": ${reason}`);
+}
+function field(expression, text, min, max) {
+	const values = /* @__PURE__ */ new Set();
+	for (const part of text.split(",")) {
+		const match = /^(\*|\d+(?:-\d+)?)(?:\/(\d+))?$/.exec(part);
+		if (!match) throw invalid(expression, `"${part}" is not a cron field`);
+		const [, range = "", stepText] = match;
+		const step = stepText === void 0 ? 1 : Number(stepText);
+		let from = min;
+		let to = max;
+		if (range !== "*") {
+			const [start = "", end] = range.split("-");
+			from = Number(start);
+			to = end === void 0 ? stepText === void 0 ? from : max : Number(end);
+		}
+		if (step < 1 || from < min || to > max || from > to) throw invalid(expression, `"${part}" is outside ${String(min)}-${String(max)}`);
+		for (let value = from; value <= to; value += step) values.add(value);
+	}
+	return [...values].toSorted((a, b) => a - b);
+}
+function parse(expression) {
+	const parts = (MACROS[expression.trim().toLowerCase()] ?? expression).trim().split(/\s+/);
+	if (parts.length !== 5) throw invalid(expression, "expected 5 fields (minute hour day month weekday)");
+	const [minute = "", hour = "", day = "", monthText = "", weekdayText = ""] = parts;
+	const month = named(monthText, MONTHS, 1);
+	const weekday = named(weekdayText, WEEKDAYS, 0);
+	return {
+		minutes: field(expression, minute, 0, 59),
+		hours: field(expression, hour, 0, 23),
+		days: new Set(field(expression, day, 1, 31)),
+		months: new Set(field(expression, month, 1, 12)),
+		weekdays: new Set(field(expression, weekday, 0, 7).map((value) => value === 0 ? 7 : value)),
+		daysRestricted: day !== "*",
+		weekdaysRestricted: weekday !== "*"
+	};
+}
+function dayMatches(fields, date) {
+	if (!fields.months.has(date.month)) return false;
+	const day = fields.days.has(date.day);
+	const weekday = fields.weekdays.has(date.dayOfWeek);
+	if (fields.daysRestricted && fields.weekdaysRestricted) return day || weekday;
+	if (fields.daysRestricted) return day;
+	if (fields.weekdaysRestricted) return weekday;
+	return true;
+}
+/**
+* The first matching minute of `date` after `after`, from `start` on its first
+* day.
+*/
+function firstRunOn(fields, date, start, timeZone, after) {
+	for (const hour of fields.hours) {
+		if (start && hour < start.hour) continue;
+		for (const minute of fields.minutes) {
+			if (hour === start?.hour && minute < start.minute) continue;
+			const instant = date.toPlainDateTime({
+				hour,
+				minute
+			}).toZonedDateTime(timeZone, { disambiguation: "compatible" }).toInstant();
+			if (temporal().Instant.compare(instant, after) > 0) return instant;
+		}
+	}
+}
+/**
+* Throws a `TypeError` unless `expression` is a schedule `nextCronRun`
+* understands: five cron fields, a macro such as `@daily`, or an interval such
+* as `30 seconds`.
+*/
+function assertCron(expression) {
+	if (!INTERVAL.test(expression.trim())) parse(expression);
+}
+/**
+* The first run of `expression` after `after`, in `timeZone`.
+*
+* Accepts five cron fields (lists, ranges and steps; a restricted day of month
+* and day of week match either, as in cron), the macros `@hourly`, `@daily`,
+* `@weekly`, `@monthly` and `@yearly`, and intervals such as `30 seconds`, `5
+* minutes` or `2 hours`, counted from `after`. A local time that a DST change
+* skips runs at the same offset after the gap.
+*/
+function nextCronRun(expression, timeZone, after) {
+	const interval = INTERVAL.exec(expression.trim());
+	if (interval) {
+		const amount = Number(interval[1]);
+		if (amount < 1) throw invalid(expression, "the interval must be positive");
+		const unit = interval[2].toLowerCase();
+		return after.add(unit === "second" ? { seconds: amount } : unit === "minute" ? { minutes: amount } : { hours: amount });
+	}
+	const fields = parse(expression);
+	const start = after.toZonedDateTimeISO(timeZone).toPlainDateTime().round({
+		smallestUnit: "minute",
+		roundingMode: "floor"
+	}).add({ minutes: 1 });
+	let date = start.toPlainDate();
+	for (let offset = 0; offset < SEARCH_DAYS; offset += 1) {
+		const found = dayMatches(fields, date) && firstRunOn(fields, date, offset === 0 ? start : void 0, timeZone, after);
+		if (found) return found;
+		date = date.add({ days: 1 });
+	}
+	throw invalid(expression, "it never matches a date");
+}
+//#endregion
+export { nextCronRun as n, assertCron as t };

package/dist/cron-route-Y0eJ-FNi.js

@@ -0,0 +1,24 @@
+import { n as dbError } from "./errors-03ysrOt4.js";
+import { a as methodNotAllowed, o as problemResponse } from "./problem-BWElIgIb.js";
+import { o as verifySharedSecret } from "./signatures-GUBuhLOB.js";
+//#region src/core/cron-route.ts
+/**
+* A `GET` or `POST` handler for a cron caller such as Vercel Cron. It throws
+* when the secret is missing, answers 405 to other methods and 401 without the
+* bearer secret, and only then calls `handle` with the request path.
+*/
+function cronRoute(guard, handle) {
+	const { name, secret } = guard;
+	if (!secret) throw new TypeError(`${name}Route needs a secret, such as process.env.CRON_SECRET`);
+	return async (request) => {
+		const instance = new URL(request.url).pathname;
+		if (request.method !== "GET" && request.method !== "POST") return methodNotAllowed(["GET", "POST"]);
+		if (!verifySharedSecret(request, secret)) return problemResponse(dbError("unauthorized", `The ${name} route needs its bearer secret`), {
+			instance,
+			format: guard.problem
+		});
+		return handle(request, instance);
+	};
+}
+//#endregion
+export { cronRoute as t };

package/dist/db-exception-Lngc1W49.js

@@ -0,0 +1,31 @@
+//#region src/core/db-exception.ts
+/**
+* Thrown by `.orThrow()`. Carries the plain `DbError` as `error` and as
+* `cause`, and copies its `kind`, `code`, `status`, `details`, `hint` and
+* `table` onto the exception, so error trackers and `catch` blocks that only
+* read an error's own fields see them.
+*/
+var DbException = class extends Error {
+	name = "DbException";
+	error;
+	kind;
+	/** Suggested HTTP status. */
+	status;
+	constructor(error) {
+		super(error.message, { cause: error });
+		this.error = error;
+		this.kind = error.kind;
+		this.status = error.status;
+		for (const key of [
+			"code",
+			"details",
+			"hint",
+			"table"
+		]) if (error[key] !== void 0) Object.defineProperty(this, key, {
+			value: error[key],
+			enumerable: true
+		});
+	}
+};
+//#endregion
+export { DbException as t };

package/dist/deal-forecast-CBlp20PY.js

@@ -0,0 +1,39 @@
+import { C as optionalText, D as recordOf, I as textOf, k as recordsOf } from "./block-helpers-CiKtrb6g.js";
+import { i as moneyOf, o as optionalMoneyOf } from "./money-codec-jMP0PQLZ.js";
+//#region src/blocks/deal-forecast.ts
+function sums(row, currency, fn) {
+	const at = (key) => moneyOf(row[key], currency, `${fn} ${key}`);
+	return {
+		won: at("won"),
+		commit: at("commit"),
+		bestCase: at("bestCase"),
+		pipeline: at("pipeline"),
+		notCalled: at("notCalled"),
+		omit: at("omit"),
+		later: at("later")
+	};
+}
+/** Decodes `deal_forecast`'s totals; `fn` names the function in errors. */
+function forecastOf(value, fn = "deal_forecast") {
+	const row = recordOf(value, fn);
+	const currency = textOf(row["currency"]);
+	const target = optionalMoneyOf(row["target"], currency, `${fn} target`);
+	const gap = optionalMoneyOf(row["gap"], currency, `${fn} gap`);
+	const attainment = row["attainment"];
+	return {
+		currency,
+		...sums(row, currency, fn),
+		...target === void 0 ? {} : { target },
+		...typeof attainment === "number" ? { attainment } : {},
+		...gap === void 0 ? {} : { gap },
+		owners: recordsOf(row["owners"], `${fn} owners`).map((owner) => {
+			const ownerId = optionalText(owner["ownerId"]);
+			return {
+				...ownerId === void 0 ? {} : { ownerId },
+				...sums(owner, currency, fn)
+			};
+		})
+	};
+}
+//#endregion
+export { forecastOf as t };

package/dist/deal-forecast-LwO-Z4_C.d.ts

@@ -0,0 +1,23 @@
+import { n as Money } from "./money-BNRdJQzA.js";
+//#region src/blocks/deal-forecast.d.ts
+/** The forecast call for one currency. */
+interface DealForecast {
+  readonly currency: string;
+  readonly won: Money;
+  readonly commit: Money;
+  readonly bestCase: Money;
+  readonly pipeline: Money;
+  readonly notCalled: Money;
+  readonly omit: Money;
+  /** Open deals that close after the period. */
+  readonly later: Money;
+  readonly target?: Money;
+  /** Won plus commit over the target. */
+  readonly attainment?: number;
+  readonly gap?: Money;
+  readonly owners: readonly (Omit<DealForecast, "owners" | "currency" | "target" | "attainment" | "gap"> & {
+    readonly ownerId?: string;
+  })[];
+}
+//#endregion
+export { DealForecast as t };