better-supabase 0.13.0 → 0.14.0

package/dist/entity-naming-DLDhHTbK.js

@@ -0,0 +1,131 @@
+//#region src/core/entity-naming.ts
+const DEFAULT_TENANT = {
+	singular: "organization",
+	plural: "organizations"
+};
+const ENTITY_NAME = /^[a-z][a-z0-9_]{0,40}$/;
+const ALL_CASES = [
+	"snake",
+	"kebab",
+	"camel",
+	"pascal"
+];
+const LOWER_CASES = [
+	"snake",
+	"kebab",
+	"camel"
+];
+/** The English plural of a snake_case noun: `company` to `companies`. */
+function pluralOf(word) {
+	if (/[^aeiou]y$/.test(word)) return `${word.slice(0, -1)}ies`;
+	if (/(s|x|z|ch|sh)$/.test(word)) return `${word}es`;
+	return `${word}s`;
+}
+/** Throws unless `name` is a lowercase identifier a noun can be. */
+function checkEntityName(where, name) {
+	if (!ENTITY_NAME.test(name)) throw new TypeError(`${where}: "${name}" is not a lowercase identifier (letters, digits and underscores)`);
+	return name;
+}
+/** A noun with its plural, derived unless given. */
+function entityNoun(singular, plural) {
+	return {
+		singular,
+		plural: plural ?? pluralOf(singular)
+	};
+}
+function camel(snake) {
+	return snake.replaceAll(/_([a-z0-9])/g, (_, c) => c.toUpperCase());
+}
+function form(snake, kind) {
+	switch (kind) {
+		case "snake": return snake;
+		case "kebab": return snake.replaceAll("_", "-");
+		case "camel": return camel(snake);
+		case "pascal": {
+			const value = camel(snake);
+			return value.charAt(0).toUpperCase() + value.slice(1);
+		}
+		default: return kind;
+	}
+}
+/** The case a matched form is used in, read from the character after it. */
+function caseAt(next) {
+	if (next !== void 0 && /[A-Z]/.test(next)) return "camel";
+	return next === "-" ? "kebab" : "snake";
+}
+function escape(value) {
+	return value.replaceAll(/[.*+?^${}()|[\]\\-]/g, String.raw`\$&`);
+}
+function alternatives(rename, direction) {
+	const [source, target] = direction === "forward" ? [rename.from, rename.to] : [rename.to, rename.from];
+	const bounded = rename.bounded ?? true;
+	const found = /* @__PURE__ */ new Map();
+	for (const kind of rename.cases ?? ALL_CASES) for (const number of ["plural", "singular"]) {
+		const match = form(source[number], kind);
+		const replace = form(target[number], kind);
+		const known = found.get(match);
+		if (known !== void 0) {
+			found.set(match, {
+				...known,
+				replace: {
+					...known.replace,
+					[kind]: replace
+				}
+			});
+			continue;
+		}
+		const before = bounded && kind !== "pascal" ? "(?<![A-Za-z0-9])" : "";
+		const after = bounded ? "(?![a-z0-9])" : "";
+		found.set(match, {
+			match,
+			replace: { [kind]: replace },
+			pattern: `${before}${escape(match)}${after}`
+		});
+	}
+	return [...found.values()];
+}
+function compile(renames, direction) {
+	const active = renames.filter((rename) => rename.from.singular !== rename.to.singular || rename.from.plural !== rename.to.plural);
+	if (active.length === 0) return (identifier) => identifier;
+	const all = active.flatMap((rename) => alternatives(rename, direction)).toSorted((a, b) => b.match.length - a.match.length);
+	const replacements = new Map(all.map((each) => [each.match, each.replace]));
+	const pattern = new RegExp(all.map((each) => each.pattern).join("|"), "g");
+	return (identifier) => identifier.replaceAll(pattern, (matched, offset) => {
+		const options = replacements.get(matched) ?? {};
+		return options[caseAt(identifier[offset + matched.length])] ?? Object.values(options)[0] ?? matched;
+	});
+}
+/** Renames for `renames`, longest form first, in one pass. */
+function entityNames(renames = []) {
+	const forward = compile(renames, "forward");
+	const back = compile(renames, "back");
+	return {
+		renames,
+		renamed: renames.some((rename) => rename.from.singular !== rename.to.singular || rename.from.plural !== rename.to.plural),
+		rename: forward,
+		reverse: back
+	};
+}
+/** Several rename sets as one, applied in the same pass. */
+function composeNames(...names) {
+	return entityNames(names.flatMap((each) => each.renames));
+}
+/**
+* The tenant rename (`blocks.tenant.entities.organization`): lowercase forms,
+* anywhere in an identifier, as the tenant rename has always worked.
+*/
+function tenantRename(to = DEFAULT_TENANT) {
+	const noun = typeof to === "string" ? entityNoun(checkEntityName("blocks.tenant.entities.organization", to)) : to;
+	return {
+		from: DEFAULT_TENANT,
+		to: noun,
+		cases: LOWER_CASES,
+		bounded: false
+	};
+}
+/** The renames for the tenant concept alone. */
+function tenantNames(to) {
+	return entityNames(to === void 0 ? [] : [tenantRename(to)]);
+}
+//#endregion
+export { entityNoun as a, entityNames as i, checkEntityName as n, tenantNames as o, composeNames as r, tenantRename as s, DEFAULT_TENANT as t };

package/dist/entity-schema-BXXC1NnT.js

@@ -0,0 +1,39 @@
+import { n as tableSchema } from "./table-schema-BcB-VCQb.js";
+//#region src/blocks/entity-schema.ts
+/** The keys of `EntitySchemas`. */
+const ENTITY_SCHEMA_KINDS = [
+	"input",
+	"change",
+	"listFilter"
+];
+/**
+* The Standard Schema for one of a block's input types, without a validation
+* library: it validates like `tableSchema`, drops unknown keys, and converts to
+* JSON Schema. The spec names every key of `T`.
+*/
+function entitySchema(spec) {
+	return {
+		...tableSchema(spec),
+		spec
+	};
+}
+/** A `Money` field: an amount in minor units and an ISO 4217 code. */
+const moneyField = {
+	kind: "custom",
+	schema: entitySchema({
+		title: "Money",
+		fields: {
+			amount: {
+				kind: "bigint",
+				description: "The amount in minor units."
+			},
+			currency: {
+				kind: "string",
+				minLength: 3,
+				maxLength: 3
+			}
+		}
+	})
+};
+//#endregion
+export { entitySchema as n, moneyField as r, ENTITY_SCHEMA_KINDS as t };

package/dist/envelope-DCfHtVtZ.js

@@ -0,0 +1,90 @@
+import { n as dbError } from "./errors-03ysrOt4.js";
+import { a as ok, r as err } from "./result-B3m7xtRY.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { o as tenantFrom, s as tenantPathsFor } from "./claims-Bp9My7XP.js";
+import { n as impersonatorClaim, r as impersonatorOf } from "./impersonation-CZD9AOAk.js";
+import { i as delegatedClaims, n as PERMISSION_CAP_CLAIM, o as permissionCapOf, t as DELEGATION_CLAIMS } from "./delegation-CeXm9AJ3.js";
+//#region src/blocks/jobs/envelope.ts
+/** Marks a payload that carries a job context; pgmq stores it as the payload. */
+const ENVELOPE = "$bs";
+function ticketOf(context, options) {
+	const ticket = options.ticket ?? context?.["ticket"];
+	if (ticket === void 0) return ok(void 0);
+	if (typeof ticket === "string" && ticket !== "") return ok(ticket);
+	return err(dbError("validation", "A job ticket is a non-empty string", { issues: [{
+		message: "Expected a non-empty string",
+		path: ["ticket"]
+	}] }));
+}
+/**
+* The context a job records: the actor, the tenant, the ticket, and the `act`
+* chain and delegation of the token, so a job an OAuth or MCP client queued
+* runs with that client's scopes, never the user's full rights. An invalid
+* `act` chain or malformed delegation is `forbidden`.
+*/
+function recordContext(context, options = {}) {
+	const ticket = ticketOf(context, options);
+	if (!ticket.ok) return ticket;
+	if (!context) return ok(ticket.data === void 0 ? void 0 : { ticket: ticket.data });
+	const claims = context.claims ?? {};
+	const delegated = delegatedClaims(claims);
+	if (!delegated.ok) return err(dbError("forbidden", delegated.reason === "invalid-chain" ? "The job context has an invalid act claim" : "The job context has invalid delegation claims"));
+	const cap = permissionCapOf(claims);
+	if (cap === false) return err(dbError("forbidden", "The job context has an invalid permission cap"));
+	const tenant = tenantFrom(context, tenantPathsFor(void 0));
+	const impersonator = impersonatorOf(claims);
+	const recorded = {
+		...context.actor ? { actor: context.actor } : {},
+		...tenant === void 0 ? {} : { tenant },
+		...ticket.data === void 0 ? {} : { ticket: ticket.data },
+		...delegated.delegation,
+		...cap === void 0 ? {} : { [PERMISSION_CAP_CLAIM]: cap },
+		...impersonator ? { act: impersonatorClaim(impersonator) } : {}
+	};
+	if (!recorded.actor && recorded.tenant === void 0 && recorded.ticket === void 0) return ok(void 0);
+	return ok(recorded);
+}
+/** Wraps a payload with the recorded context of `context`, when there is one. */
+function wrapPayload(payload, context, options = {}) {
+	const recorded = recordContext(context, options);
+	if (!recorded.ok) return recorded;
+	return ok(recorded.data === void 0 ? payload : {
+		[ENVELOPE]: 1,
+		context: recorded.data,
+		payload
+	});
+}
+/** `wrapPayload` that throws a `TypeError` for a context it refuses. */
+function withContext(payload, context, options = {}) {
+	const wrapped = wrapPayload(payload, context, options);
+	if (!wrapped.ok) throw new TypeError(wrapped.error.message);
+	return wrapped.data;
+}
+function isActor(value) {
+	return isRecord(value) && typeof value["id"] === "string" && (value["kind"] === "user" || value["kind"] === "service" || value["kind"] === "anon");
+}
+/**
+* Splits a stored payload into the payload and its recorded context. The
+* recorded `act` and delegation claims come back as they were stored, so
+* `forContext` checks them again and refuses a malformed one.
+*/
+function unwrap(stored) {
+	if (!isRecord(stored) || stored[ENVELOPE] !== 1 || !Object.hasOwn(stored, "payload")) return {
+		payload: stored,
+		context: {}
+	};
+	const recorded = isRecord(stored["context"]) ? stored["context"] : {};
+	const { actor, tenant, ticket } = recorded;
+	const claims = Object.fromEntries(DELEGATION_CLAIMS.filter((key) => Object.hasOwn(recorded, key) && recorded[key] !== void 0).map((key) => [key, recorded[key]]));
+	return {
+		payload: stored["payload"],
+		context: {
+			...isActor(actor) ? { actor } : {},
+			...typeof tenant === "string" && tenant.length > 0 ? { tenant } : {},
+			...ticket === void 0 ? {} : { ticket },
+			...Object.keys(claims).length > 0 ? { claims } : {}
+		}
+	};
+}
+//#endregion
+export { withContext as n, wrapPayload as r, unwrap as t };

package/dist/errors-03ysrOt4.js

@@ -0,0 +1,325 @@
+import { t as DbException } from "./db-exception-Lngc1W49.js";
+//#region src/core/errors.ts
+const STATUS = {
+	not_found: 404,
+	unauthorized: 401,
+	forbidden: 403,
+	conflict: 409,
+	foreign_key: 409,
+	check: 422,
+	not_null: 422,
+	exclusion: 409,
+	invalid_input: 400,
+	invalid_value: 500,
+	raised: 400,
+	timeout: 504,
+	serialization: 409,
+	network: 503,
+	aborted: 499,
+	invalid_request: 400,
+	validation: 422,
+	multiple_rows: 409,
+	stale: 412,
+	max_affected: 400,
+	rate_limited: 429,
+	quota_exceeded: 429,
+	unsupported: 501,
+	unexpected: 500
+};
+function statusOf(kind) {
+	return STATUS[kind];
+}
+/** Creates a `DbError` with the default status for its kind. */
+function dbError(kind, message, ...[extra]) {
+	const error = {
+		kind,
+		message,
+		status: STATUS[kind]
+	};
+	if (extra) {
+		for (const [key, value] of Object.entries(extra)) if (value !== void 0) error[key] = value;
+	}
+	return error;
+}
+/**
+* A plain `DbError`. A `DbException` carries the same fields but is not one;
+* `dbErrorOf()` reads the `DbError` out of it.
+*/
+function isDbError(value) {
+	return typeof value === "object" && value !== null && !(value instanceof Error) && typeof value.kind === "string" && typeof value.message === "string" && typeof value.status === "number";
+}
+/**
+* The `DbError` in a `DbError`, a `DbException`, or an error whose `cause` is a
+* `DbError` (what `betterSupabase.mapError()` mappers should set).
+*/
+function dbErrorOf(value) {
+	if (value instanceof DbException) return value.error;
+	if (value instanceof Error && isDbError(value.cause)) return value.cause;
+	return isDbError(value) ? value : void 0;
+}
+function constraintGuard(kind) {
+	return (error, constraint) => {
+		const found = dbErrorOf(error);
+		if (found?.kind !== kind) return false;
+		return constraint === void 0 || found.constraint === constraint;
+	};
+}
+/**
+* A unique violation, optionally for one constraint. Accepts a `DbError` or a
+* `DbException`. Pass the generated `UniqueConstraint` type to check names:
+* `isConflict<UniqueConstraint>(error, 'customers_organization_id_kvk_key')`.
+*/
+const isConflict = constraintGuard("conflict");
+/** A CHECK violation, optionally for one constraint (`CheckConstraint`). */
+const isCheck = constraintGuard("check");
+/**
+* A foreign key violation, optionally for one constraint
+* (`ForeignKeyConstraint`).
+*/
+const isForeignKey = constraintGuard("foreign_key");
+/**
+* Builds the factory `.orThrow()` takes from handlers per error kind and per
+* SQLSTATE code. A handler that returns `undefined`, and an error no handler
+* matches, throw a `DbException`.
+*/
+function matchDbError(matchers) {
+	return (error) => {
+		return (error.code === void 0 || !matchers.codes ? void 0 : Object.hasOwn(matchers.codes, error.code) ? matchers.codes[error.code] : void 0)?.(error) ?? kindHandler(matchers, error)?.(error) ?? new DbException(error);
+	};
+}
+function kindHandler(matchers, error) {
+	if (!Object.hasOwn(matchers, error.kind)) return;
+	return matchers[error.kind];
+}
+const CONSTRAINT_IN_MESSAGE = /constraint "([^"]+)"/;
+const KEY_COLUMNS_IN_DETAILS = /^Key \(([^)]+)\)=/;
+const COLUMN_IN_MESSAGE = /column "([^"]+)"/;
+const RETRY_AFTER = /retry after (\d+)/i;
+const PERMISSION_DENIED = /^permission denied for (table|view|sequence|function|schema) (\S+)/;
+/**
+* The SQL compiler fails a write past `maxAffected` by casting this text,
+* followed by `:<rows>`, to an integer: plain SQL has no `raise`.
+*/
+const MAX_AFFECTED_MARKER = "better_supabase:max_affected";
+const MAX_AFFECTED_COUNT = /better_supabase:max_affected:(\d+)/;
+function constraintOf(raw) {
+	return raw.constraint ?? CONSTRAINT_IN_MESSAGE.exec(raw.message ?? "")?.[1];
+}
+/**
+* The hint `better_supabase.check_json_schema()` raises with (the
+* `jsonb-schemas` module).
+*/
+const JSON_SCHEMA_HINT = "JSON_SCHEMA_INVALID";
+/** The prefix of the `jsonb-schemas` check constraints and triggers. */
+const JSON_SCHEMA_CONSTRAINT = "bs_json_";
+const JSON_SCHEMA_COLUMN = /^[\w$]+\.([\w$]+) does not match its JSON Schema/;
+/**
+* One issue per pg_jsonschema error in DETAIL (a JSON array of strings), at the
+* column's database name. Without the list (the check constraint itself
+* failed), one issue for the whole value.
+*/
+function jsonSchemaIssues(raw) {
+	const column = raw.column ?? JSON_SCHEMA_COLUMN.exec(raw.message ?? "")?.[1];
+	const path = column === void 0 ? {} : { path: [column] };
+	let errors;
+	try {
+		errors = JSON.parse(raw.details ?? "");
+	} catch {
+		errors = void 0;
+	}
+	const messages = Array.isArray(errors) ? errors.filter((entry) => typeof entry === "string") : [];
+	return messages.length > 0 ? messages.map((message) => ({
+		message,
+		...path
+	})) : [{
+		message: "The value does not match its JSON Schema",
+		...path
+	}];
+}
+function columnsOf(raw) {
+	return KEY_COLUMNS_IN_DETAILS.exec(raw.details ?? "")?.[1]?.split(",").map((column) => column.trim());
+}
+function optional(raw) {
+	const out = {};
+	if (raw.code) out.code = raw.code;
+	if (raw.details) out.details = raw.details;
+	if (raw.hint) out.hint = raw.hint;
+	return out;
+}
+/**
+* The `permissions` a `42501` raised with `detail = '{"permissions": [...]}'`
+* names, so a refusal from SQL carries the keys the caller lacks.
+*/
+function permissionsOf(details) {
+	if (details === void 0 || !details.startsWith("{")) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(details);
+	} catch {
+		return {};
+	}
+	if (typeof parsed !== "object" || parsed === null) return {};
+	const permissions = "permissions" in parsed ? parsed.permissions : void 0;
+	return Array.isArray(permissions) && permissions.every((key) => typeof key === "string") ? { permissions } : {};
+}
+/** Adds the operation's limit to a `max_affected` error that doesn't name it. */
+function withMaxAffected(error, maxAffected) {
+	return error.kind === "max_affected" && maxAffected !== void 0 && error.maxAffected === void 0 ? {
+		...error,
+		maxAffected
+	} : error;
+}
+/**
+* Maps a PostgREST or Postgres error to a `DbError`. Custom mappers run first;
+* the first one that returns an error wins.
+*/
+function mapDbError(raw, mappers = []) {
+	const fallback = mapBuiltin(raw);
+	for (const mapper of mappers) {
+		const mapped = mapper(raw, fallback);
+		if (mapped) return mapped;
+	}
+	return fallback;
+}
+function mapBuiltin(raw) {
+	const message = raw.message ?? "Unknown database error";
+	const base = optional(raw);
+	const code = raw.code ?? "";
+	if (raw.name === "AbortError" || code === "20" || message.startsWith("AbortError:")) return dbError("aborted", message, base);
+	switch (code) {
+		case "23505": {
+			const extra = {};
+			const constraint = constraintOf(raw);
+			const columns = columnsOf(raw);
+			if (constraint) extra.constraint = constraint;
+			if (columns) extra.columns = columns;
+			return dbError("conflict", message, {
+				...base,
+				...extra
+			});
+		}
+		case "23503": {
+			const extra = {};
+			const constraint = constraintOf(raw);
+			const columns = columnsOf(raw);
+			if (constraint) extra.constraint = constraint;
+			if (columns) extra.columns = columns;
+			return dbError("foreign_key", message, {
+				...base,
+				...extra
+			});
+		}
+		case "23514": {
+			const constraint = constraintOf(raw);
+			if (base.hint === JSON_SCHEMA_HINT || constraint?.startsWith(JSON_SCHEMA_CONSTRAINT)) return dbError("validation", message, {
+				...base,
+				issues: jsonSchemaIssues(raw)
+			});
+			return dbError("check", message, {
+				...base,
+				...constraint ? { constraint } : {}
+			});
+		}
+		case "23502": {
+			const column = raw.column ?? COLUMN_IN_MESSAGE.exec(message)?.[1];
+			return dbError("not_null", message, {
+				...base,
+				...column ? { column } : {}
+			});
+		}
+		case "23P01": {
+			const constraint = constraintOf(raw);
+			return dbError("exclusion", message, {
+				...base,
+				...constraint ? { constraint } : {}
+			});
+		}
+		case "42501": {
+			const object = PERMISSION_DENIED.exec(message);
+			const postgrestHint = base.hint?.startsWith("Grant the required");
+			if (!object || base.hint && !postgrestHint) return dbError("forbidden", message, {
+				...base,
+				...permissionsOf(base.details)
+			});
+			const advice = object[1] === "table" || object[1] === "view" ? `The Data API role has no grant on this ${object[1]}, as on a project with default privileges turned off: add it to \`expose\` and run \`better-supabase add grants\`. \`better-supabase doctor\` (BS106) lists every missing grant.` : `The Data API role has no ${object[1] === "function" ? "execute" : "usage"} grant on this ${object[1]}; grant it to the role that needs it.`;
+			const details = [
+				message,
+				base.details,
+				postgrestHint ? base.hint : ""
+			].filter(Boolean).join("\n");
+			return dbError("forbidden", "permission denied", {
+				...base,
+				details,
+				hint: advice
+			});
+		}
+		case "25006": return dbError("forbidden", "This connection is read-only, so the write was refused", {
+			...base,
+			details: base.details ?? message,
+			hint: base.hint ?? "The transaction is read-only, such as in a read-only support session; writes need a writable connection."
+		});
+		case "P0001": return dbError("raised", message, base);
+		case "P0002": return dbError("not_found", message, base);
+		case "57014": return dbError("timeout", message, base);
+		case "40001":
+		case "40P01": return dbError("serialization", message, base);
+		case "PGRST116": return /multiple|more than one/i.test(raw.details ?? message) ? dbError("multiple_rows", message, base) : dbError("not_found", message, base);
+		case "PGRST301":
+		case "PGRST302":
+		case "PGRST303": return dbError("unauthorized", message, base);
+		case "PGRST124": return dbError("max_affected", message, base);
+		case "22P02":
+			if (message.includes("better_supabase:max_affected")) {
+				const affected = MAX_AFFECTED_COUNT.exec(message)?.[1];
+				return dbError("max_affected", `The write affects ${affected ?? "more"} rows, more than maxAffected allows`, { code: "22P02" });
+			}
+			break;
+		case "PGRST123": return dbError("invalid_request", message, {
+			...base,
+			hint: base.hint ?? "PostgREST aggregates are off. Run `alter role authenticator set pgrst.db_aggregates_enabled = 'true'; notify pgrst, 'reload config';` (see BS210), or use better-supabase/postgres."
+		});
+		case "BS429":
+		case "PT429": {
+			const seconds = RETRY_AFTER.exec(raw.details ?? "")?.[1];
+			return dbError("rate_limited", message, {
+				...base,
+				...seconds ? { retryAfter: Number(seconds) } : {}
+			});
+		}
+		case "POSTGRES_POOL_BUSY":
+		case "POSTGRES_CONNECT_PAUSED": return dbError("network", message, {
+			...base,
+			...raw.retryAfterMs === void 0 ? {} : { retryAfter: Math.max(1, Math.ceil(raw.retryAfterMs / 1e3)) }
+		});
+		case "BSQ29": return dbError("quota_exceeded", message, {
+			...base,
+			...quotaDetails(raw.details)
+		});
+	}
+	if (code.startsWith("22")) return dbError("invalid_input", message, base);
+	if (code.startsWith("PGRST1") || code.startsWith("PGRST2")) return dbError("invalid_request", message, base);
+	if (code.startsWith("08") || /fetch failed|network/i.test(message)) return dbError("network", message, base);
+	return dbError("unexpected", message, base);
+}
+/** `consume_quota` puts `{ meter, limit, retry_after }` in the error's DETAIL. */
+function quotaDetails(details) {
+	let parsed;
+	try {
+		parsed = JSON.parse(details ?? "");
+	} catch {
+		return {};
+	}
+	if (typeof parsed !== "object" || parsed === null) return {};
+	const record = parsed;
+	const field = (key) => record[key];
+	const meter = field("meter");
+	const limit = field("limit");
+	const retryAfter = field("retry_after");
+	return {
+		...typeof meter === "string" ? { meter } : {},
+		...typeof limit === "number" ? { limit } : {},
+		...typeof retryAfter === "number" ? { retryAfter } : {}
+	};
+}
+//#endregion
+export { isConflict as a, mapDbError as c, withMaxAffected as d, isCheck as i, matchDbError as l, dbError as n, isDbError as o, dbErrorOf as r, isForeignKey as s, MAX_AFFECTED_MARKER as t, statusOf as u };

package/dist/errors-DZx8w-MH.js

@@ -0,0 +1,44 @@
+import { t as DbException } from "./db-exception-Lngc1W49.js";
+import { n as dbError, o as isDbError } from "./errors-03ysrOt4.js";
+import { s as toDbError } from "./result-B3m7xtRY.js";
+//#region src/storage/errors.ts
+/** Maps a Storage error (`StorageApiError`, fetch failures) to a `DbError`. */
+function fromStorageError(raw, table) {
+	if (isDbError(raw)) return raw;
+	if (raw instanceof DbException) return raw.error;
+	if (typeof raw !== "object" || raw === null) return toDbError(raw);
+	const failure = raw;
+	if (failure.name === "AbortError") return toDbError(raw);
+	const message = failure.message ?? "Storage request failed";
+	const code = failure.code ?? failure.statusCode;
+	const base = {
+		...code ? { code } : {},
+		...table ? { table } : {}
+	};
+	const statusCode = Number(failure.statusCode);
+	const status = Number.isFinite(statusCode) && statusCode >= 400 ? statusCode : failure.status ?? 0;
+	if (code === "FeatureNotEnabled" || /^Route \S+ not found$/.test(message)) return dbError("unsupported", message, base);
+	if (/row-level security|unauthorized to|AccessDenied/i.test(`${message} ${code ?? ""}`)) return dbError("forbidden", message, base);
+	if (/already exists|duplicate/i.test(`${message} ${code ?? ""}`)) return dbError("conflict", message, base);
+	if (failure.name === "StorageUnknownError" && status === 0) return dbError("network", message, base);
+	switch (status) {
+		case 400: return dbError("invalid_request", message, base);
+		case 401: return dbError("unauthorized", message, base);
+		case 403: return dbError("forbidden", message, base);
+		case 404: return dbError("not_found", message, base);
+		case 409: return dbError("conflict", message, base);
+		case 413:
+		case 415: return dbError("invalid_input", message, {
+			...base,
+			status
+		});
+		case 408:
+		case 429: return dbError("network", message, {
+			...base,
+			status
+		});
+		default: return status >= 500 ? dbError("network", message, base) : dbError("unexpected", message, base);
+	}
+}
+//#endregion
+export { fromStorageError as t };

package/dist/escape-like-BfXS-iVe.d.ts

@@ -0,0 +1,30 @@
+import { b as DbError, x as DbErrorKind } from "./result-C6jDfedy.js";
+//#region src/core/db-exception.d.ts
+/**
+ * Thrown by `.orThrow()`. Carries the plain `DbError` as `error` and as
+ * `cause`, and copies its `kind`, `code`, `status`, `details`, `hint` and
+ * `table` onto the exception, so error trackers and `catch` blocks that only
+ * read an error's own fields see them.
+ */
+declare class DbException extends Error {
+  override readonly name = "DbException";
+  readonly error: DbError;
+  readonly kind: DbErrorKind;
+  /** Suggested HTTP status. */
+  readonly status: number;
+  /** SQLSTATE or PostgREST code (`23505`, `PGRST116`), when known. */
+  readonly code?: string;
+  readonly details?: string;
+  /** Postgres `HINT`. `raised` errors use it as an app-level error code. */
+  readonly hint?: string;
+  /** App-cased table key the operation ran against. */
+  readonly table?: string;
+  readonly cause: DbError;
+  constructor(error: DbError);
+}
+//#endregion
+//#region src/ir/escape-like.d.ts
+/** Escapes LIKE wildcards so user input matches literally. */
+declare function escapeLike(value: string): string;
+//#endregion
+export { DbException as n, escapeLike as t };

package/dist/eve/index.d.ts

@@ -1,8 +1,8 @@
-import { a as ResolveAuthOptions, r as AuthState } from "../resolve-D57oDWNr.js";
-import { i as CredentialRef, r as CredentialProvider } from "../provider-Dmsbl8ug.js";
-import { i as AiChat } from "../ai-chat-B00sIOjY.js";
-import { a as Inbox } from "../inbox-CLsIrPXs.js";
-import { a as EveMemoryToolsContext, c as MemoryDocumentConflictError, d as supabaseDocumentBackend, f as supabaseMemory, i as EveMemoryTool, l as SupabaseDocumentBackendOptions, m as EveSessionContext, n as EveMemoryContext, o as EveRecallMessage, p as EveSessionAuth, r as EveMemoryProvider, s as EveRecallResult, t as EveDocumentBackend, u as SupabaseMemoryOptions } from "../eve-dWNqpd9Z.js";
+import { a as ResolveAuthOptions, r as AuthState } from "../resolve-CzUKTIMq.js";
+import { i as CredentialRef, r as CredentialProvider } from "../provider-DmiaI1qt.js";
+import { i as AiChat } from "../ai-chat-DBxEz3o1.js";
+import { a as Inbox } from "../inbox-BPBb6etH.js";
+import { a as EveMemoryToolsContext, c as MemoryDocumentConflictError, d as supabaseDocumentBackend, f as supabaseMemory, i as EveMemoryTool, l as SupabaseDocumentBackendOptions, m as EveSessionContext, n as EveMemoryContext, o as EveRecallMessage, p as EveSessionAuth, r as EveMemoryProvider, s as EveRecallResult, t as EveDocumentBackend, u as SupabaseMemoryOptions } from "../eve-BlJI8ZXL.js";
 //#region src/eve/auth.d.ts
 /**
  * Thrown by `supabaseAuth` so eve answers with `response` instead of