better-supabase 0.13.0 → 0.14.0

package/dist/app-tables-CbWUI7h_.d.ts

@@ -1,35 +0,0 @@
-import { Sn as AppColumnConfig, jn as AppTableConfig, wn as AppColumnType } from "./codegen-DGtOsqz9.js";
-//#region src/config/app-tables.d.ts
-/**
- * The columns every app table gets, which `columns` may not name: `id`,
- * `created_at`, `updated_at`, `user_id` and the tenant column
- * (`organization_id`, or `<sql.naming.tenant>_id`), whatever the table's scope,
- * so changing the scope never collides with a column.
- */
-declare function appReservedColumns(tenant?: string): readonly string[];
-/** The longest app table or column name: `<table>_view` still fits in 63 bytes. */
-declare const APP_NAME_MAX: number;
-/**
- * Why `name` can't name an app table or column, or `undefined` when it can:
- * lower snake case starting with a letter, not `pg_`, and at most
- * `APP_NAME_MAX` characters.
- */
-declare function appIdentifierError(name: string): string | undefined;
-/**
- * The first constraint or index name the SQL derives for `table` that is longer
- * than 63 bytes, which Postgres would truncate into a collision, as a message;
- * `undefined` when every name fits.
- */
-declare function appNameLengthError(table: string, config: Pick<AppTableConfig, "columns" | "unique" | "indexes">): string | undefined;
-/**
- * Why `value` can't be the default of `column`, or `undefined` when it can: it
- * must be on the `isAppDefault` allowlist, one of the column's `options`, and
- * inside its bounds (`min`, `max`, or those of its format).
- */
-declare function appDefaultError(column: Pick<AppColumnConfig, "type" | "options" | "min" | "max" | "format">, value: string): string | undefined;
-/** Whether `value` is a default `type` accepts; see `AppColumnConfig.default`. */
-declare function isAppDefault(type: AppColumnType, value: string): boolean;
-/** The event types an app table emits: `<subject type or table>.<kind>`. */
-declare function appTableEventTypes(name: string, table: AppTableConfig): readonly string[];
-//#endregion
-export { appReservedColumns as a, appNameLengthError as i, appDefaultError as n, appTableEventTypes as o, appIdentifierError as r, isAppDefault as s, APP_NAME_MAX as t };

package/dist/approvals-C-4MOWdV.d.ts

@@ -1,127 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { T as ErrorMapper, t as AsyncResult } from "./result-mijqfoJN.js";
-import { t as StandardSchemaV1 } from "./standard-16AIDny5.js";
-import { r as FieldsOf } from "./block-fields-DnXkMney.js";
-import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as BlockTransport } from "./block-transport-DBPhgF3W.js";
-import { r as BlockTemporalOptions } from "./block-helpers-DyA5BAW4.js";
-import { n as BlockHooks } from "./block-hooks-BadAniNI.js";
-import { i as AuthorizationHooks, n as Approver } from "./authorization-hooks-HXVZXxUk.js";
-//#region src/blocks/approvals/approvals.d.ts
-interface ApprovalsOptions<S extends StandardSchemaV1 | undefined = undefined> extends BlockTemporalOptions {
-  readonly transport: BlockTransport;
-  /**
-   * The module schema, or its API schema: `defineBlocks` passes it from
-   * `blocks.generated.ts`.
-   */
-  readonly schema?: string;
-  /**
-   * A Standard Schema for the request columns the app adds
-   * (`blocks.approvals.options.extraColumns`), keyed by column name. It types
-   * and parses them on every read, and validates them on `request`, which
-   * returns a `validation` error for a bad value.
-   */
-  readonly fields?: S;
-  /** `withBlockHooks` hooks around the client's methods. */
-  readonly hooks?: NoInfer<BlockHooks<Approvals<FieldsOf<S>>>>;
-  /** Receives the errors `after` hooks throw. Default: `console`. */
-  readonly logger?: Logger;
-  readonly mappers?: readonly ErrorMapper[];
-  /**
-   * The authorization hooks. `approverOf` sees every approve, reject and
-   * delegate with kind `<subject type>.<action>` and the subject id, after the
-   * SQL eligibility check, and can only refuse. Needs `approver`.
-   */
-  readonly authorization?: Pick<AuthorizationHooks, "approverOf">;
-  /** The signed-in user the transport runs as, for `approverOf`. */
-  readonly approver?: Approver;
-}
-type ApprovalStatus = "pending" | "approved" | "rejected" | "cancelled" | "expired";
-/** Who may decide a step. Any match is enough. */
-interface ApprovalApprovers {
-  readonly permission?: string;
-  readonly role?: string;
-  readonly team?: string;
-  readonly users?: readonly string[];
-}
-interface ApprovalStep {
-  readonly approvers: ApprovalApprovers;
-  readonly required: number;
-}
-interface ApprovalRequest {
-  readonly id: string;
-  readonly organizationId: string;
-  readonly subjectType: string;
-  readonly subjectId: string;
-  readonly action: string;
-  readonly status: ApprovalStatus;
-  /** The current step, from 0. */
-  readonly step: number;
-  /** The policy's steps when the request was made. */
-  readonly steps: readonly ApprovalStep[];
-  readonly requestedBy?: string;
-  readonly reason?: string;
-  readonly payload: Readonly<Record<string, unknown>>;
-  readonly expiresAt?: Temporal.Instant;
-  readonly decidedAt?: Temporal.Instant;
-  readonly createdAt: Temporal.Instant;
-}
-interface ApprovalDecision {
-  readonly id: string;
-  readonly step: number;
-  readonly approver?: string;
-  readonly decision: "approved" | "rejected" | "delegated";
-  readonly delegateTo?: string;
-  readonly comment?: string;
-  readonly createdAt: Temporal.Instant;
-}
-/** A request with its decisions, from `get`. */
-interface ApprovalRequestDetail extends ApprovalRequest {
-  /** Whether the caller can decide the current step. */
-  readonly canDecide: boolean;
-  readonly decisions: readonly ApprovalDecision[];
-}
-interface ApprovalRequestInput {
-  readonly organizationId: string;
-  readonly subjectType: string;
-  readonly subjectId: string;
-  /** An action `options.policies` names for the subject type. */
-  readonly action: string;
-  readonly reason?: string;
-  /** Passed to the job the final approval enqueues. */
-  readonly payload?: Readonly<Record<string, unknown>>;
-}
-interface ApprovalListOptions {
-  /** `null` lists every status. Default: `pending`. */
-  readonly status?: ApprovalStatus | null;
-  /** Only requests whose current step the caller can decide. */
-  readonly assigned?: boolean;
-  readonly subjectType?: string;
-  readonly subjectId?: string;
-  readonly pageSize?: number;
-  /** Requests made before this time, for the next page. */
-  readonly before?: Temporal.Instant;
-}
-/** `F` is the extra request fields `options.fields` describes. */
-interface Approvals<F extends object = Record<never, never>> {
-  /** Files a request under the subject type's policy for the action. */
-  /** Keys besides the input's own are the request's extra columns. */
-  request(input: ApprovalRequestInput & Partial<F>): AsyncResult<ApprovalRequest & F>;
-  /** Approves the current step; the last step runs the policy's action. */
-  approve(id: string, comment?: string): AsyncResult<ApprovalRequest & F>;
-  /** Rejects the request. */
-  reject(id: string, comment?: string): AsyncResult<ApprovalRequest & F>;
-  /** Hands the caller's place on the current step to another member. */
-  delegate(id: string, userId: string, comment?: string): AsyncResult<ApprovalRequest & F>;
-  /** The requester or a manager closes a pending request. */
-  cancel(id: string): AsyncResult<ApprovalRequest & F>;
-  get(id: string): AsyncResult<ApprovalRequestDetail & F>;
-  /** Newest first. */
-  list(organizationId: string, options?: ApprovalListOptions): AsyncResult<readonly (ApprovalRequest & F)[]>;
-  /** Whether the subject's latest request for the action was approved. */
-  isApproved(subjectType: string, subjectId: string, action: string): AsyncResult<boolean>;
-}
-/** The `approvals` SQL module as typed calls. */
-declare function createApprovals<S extends StandardSchemaV1 | undefined = undefined>(options: ApprovalsOptions<S>): Approvals<FieldsOf<S>>;
-//#endregion
-export { ApprovalRequestDetail as a, ApprovalStep as c, createApprovals as d, ApprovalRequest as i, Approvals as l, ApprovalDecision as n, ApprovalRequestInput as o, ApprovalListOptions as r, ApprovalStatus as s, ApprovalApprovers as t, ApprovalsOptions as u };

package/dist/assistant-CcP_kpu7.d.ts

@@ -1,157 +0,0 @@
-import { b as DbError } from "./result-mijqfoJN.js";
-import { i as AiMessage } from "./message-Bg4TKA12.js";
-import { E as AiRunStatus, F as AiUserMessageTrigger, _ as AiModerationAction, i as AiChat, u as AiChatRecord } from "./ai-chat-B00sIOjY.js";
-import { n as GatewayOptions } from "./gateway-options-BlVCqgb8.js";
-import { o as StreamStore } from "./store-DKqbuNvw.js";
-import { i as CostBackfillPayload, t as AiUsage } from "./gateway-Dar9C0uP.js";
-import { LanguageModelUsage, ModelMessage, UIMessage, UIMessageChunk, UIMessageStreamOnEndCallback } from "ai";
-//#region src/ai-sdk/chat/assistant.d.ts
-/** Who asks, for one request. */
-interface AssistantContext {
-  /**
-   * The chat block for this request: the user's transport, and a service
-   * transport (`service`) for the writes only the server makes.
-   */
-  readonly chats: AiChat;
-  readonly userId: string;
-  readonly organizationId: string;
-  /**
-   * Keeps the function alive until the answer is stored, after the response is
-   * sent: `after` in Next.js, `ctx.waitUntil` on Workers and Vercel.
-   */
-  readonly waitUntil?: (promise: Promise<unknown>) => void;
-}
-/** What `run` gets to generate one answer. */
-interface AssistantRunArgs {
-  readonly chat: AiChatRecord;
-  /** The model the request may use, after the catalog check. */
-  readonly model: string;
-  readonly messages: ModelMessage[];
-  /** The history the model sees, as UI messages. */
-  readonly uiMessages: UIMessage[];
-  /** Aborted by `stop()`; pass it to `streamText` or `agent.stream`. */
-  readonly abortSignal: AbortSignal;
-  /** Spend attribution for the AI Gateway (`gatewayOptions`). */
-  readonly providerOptions: {
-    readonly gateway: GatewayOptions;
-  };
-  readonly context: AssistantContext;
-}
-/** The part of a `streamText` or `agent.stream` result the assistant reads. */
-interface AssistantRunResult {
-  toUIMessageStream(options: {
-    originalMessages: UIMessage[];
-    generateMessageId: () => string;
-    onEnd: UIMessageStreamOnEndCallback<UIMessage>;
-    onError?: (error: unknown) => string;
-  }): ReadableStream<UIMessageChunk>;
-  readonly totalUsage?: PromiseLike<LanguageModelUsage>;
-  readonly providerMetadata?: PromiseLike<unknown>;
-}
-/** The verdict of a moderation hook. */
-interface AssistantModeration {
-  readonly action: AiModerationAction;
-  readonly category: string;
-  readonly score?: number;
-}
-/** What `onFinish` gets once the answer is stored. */
-interface AssistantFinish {
-  readonly chat: AiChatRecord;
-  readonly message: UIMessage;
-  readonly status: AiRunStatus;
-  readonly model: string;
-  readonly usage: AiUsage | undefined;
-  readonly context: AssistantContext;
-}
-interface AssistantOptions {
-  /** Where the answer's stream is kept, so a reload resumes it. */
-  readonly streams: StreamStore;
-  /** Starts the generation: `agent.stream(...)` or `streamText(...)`. */
-  readonly run: (args: AssistantRunArgs) => AssistantRunResult | PromiseLike<AssistantRunResult>;
-  /** The model when neither the request nor the chat names an allowed one. */
-  readonly defaultModel: string;
-  /**
-   * The quota check before a generation (`usageQuota(usage, meter)`); an error
-   * answers 429.
-   */
-  readonly quota?: (organizationId: string) => Promise<DbError | undefined>;
-  /** Checks the user's message; `block` answers 403, others are recorded. */
-  readonly moderate?: (input: {
-    readonly message: AiMessage;
-    readonly chat: AiChatRecord;
-  }) => Promise<AssistantModeration | undefined>;
-  /**
-   * Called with the cost backfill payload when the gateway hasn't reported a
-   * cost yet.
-   */
-  readonly enqueueCostBackfill?: (payload: CostBackfillPayload) => Promise<unknown>;
-  /** Called after the answer is stored, such as to record usage. */
-  readonly onFinish?: (finish: AssistantFinish) => void | Promise<void>;
-  /**
-   * What the stream is kept for: seconds or a Postgres interval. Defaults to
-   * one day.
-   */
-  readonly streamTtl?: number | string;
-  /** The `feature` tag of the gateway options. Defaults to `chat`. */
-  readonly feature?: string;
-  /** Turns a stream error into the message the client sees. */
-  readonly onError?: (error: unknown) => string;
-  /** Makes message and stream ids. Defaults to `crypto.randomUUID()`. */
-  readonly generateId?: () => string;
-}
-/** The body `useAssistant` sends. */
-interface AssistantRequestBody {
-  /** The chat id; the client may make it, and the chat is created on first use. */
-  readonly id: string;
-  readonly message: UIMessage;
-  readonly trigger?: AiUserMessageTrigger;
-  /** For `regenerate-message`, the answer to write again. */
-  readonly messageId?: string;
-  readonly model?: string;
-}
-/** A checked and stored user turn, ready for a model: what `prepare` returns. */
-interface AssistantTurn {
-  readonly chat: AiChatRecord;
-  /** The model the request may use, after the catalog check. */
-  readonly model: string;
-  /** The stored user message, which the answer is saved under. */
-  readonly parentId: string;
-  /** The history the model sees, as UI messages. */
-  readonly uiMessages: UIMessage[];
-  readonly messages: ModelMessage[];
-  /** Spend attribution for the AI Gateway (`gatewayOptions`). */
-  readonly providerOptions: {
-    readonly gateway: GatewayOptions;
-  };
-}
-interface Assistant {
-  /** Stores the user's message, starts the answer and streams it (SSE). */
-  respond(request: Request, context: AssistantContext): Promise<Response>;
-  /**
-   * The checks and writes before a generation, without one: parses the body
-   * `useAssistant` sends, creates the chat on first use, picks the model,
-   * moderates, checks the quota, stores the user's message and loads the
-   * history. Returns a problem response when one of them fails.
-   */
-  prepare(body: unknown, context: AssistantContext): Promise<AssistantTurn | Response>;
-  /** The running answer of `chatId` from the start, or 204 when none runs. */
-  resume(chatId: string, context: AssistantContext, options?: {
-    readonly fromIdx?: number;
-    readonly signal?: AbortSignal;
-  }): Promise<Response>;
-  /**
-   * Asks the running answer to stop: 204 whether or not one runs, a problem
-   * when the user may not.
-   */
-  stop(chatId: string, context: AssistantContext): Promise<Response>;
-}
-/**
- * A chat route for the AI SDK on the `ai-chat` block: `respond` stores the
- * user's message, picks an allowed model, checks the quota, claims the chat's
- * answer, runs the model and streams it while keeping a copy in the stream
- * store; the answer and its usage are stored when it ends, even after the
- * client left. `resume` replays it after a reload, `stop` ends it.
- */
-declare function createAssistant(options: AssistantOptions): Assistant;
-//#endregion
-export { AssistantOptions as a, AssistantRunResult as c, AssistantModeration as i, AssistantTurn as l, AssistantContext as n, AssistantRequestBody as o, AssistantFinish as r, AssistantRunArgs as s, Assistant as t, createAssistant as u };

package/dist/attachments-CPkGJVfk.js

@@ -1,270 +0,0 @@
-import { n as dbError } from "./errors-D7u24ZJH.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-DIT_qp4G.js";
-import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { t as fromStorageError } from "./errors-Cq72lONT.js";
-import { C as optionalText, D as recordOf, I as textOf, R as toInstant, S as optionalInstant, f as errorText, k as recordsOf, n as applyTemporal, o as blockCall } from "./block-helpers-DwE32_gT.js";
-import { r as withBlockHooks } from "./block-hooks-C1r-R2r0.js";
-import { c as withFields, i as extraOf, n as blockFields, r as extraFieldsArg, t as allWithFields } from "./block-fields-Cwd4c8m-.js";
-import { n as claimsUploads, t as claimUpload } from "./upload-claim-DCuklVyh.js";
-//#region src/blocks/attachments/attachments.ts
-const STATUSES = [
-	"pending",
-	"clean",
-	"infected",
-	"failed"
-];
-function statusOf(value) {
-	const status = STATUSES.find((candidate) => candidate === value);
-	if (status === void 0) throw new TypeError(`Unknown attachment status ${JSON.stringify(value)}`);
-	return status;
-}
-/** An attachments row, as `get_attachment` and `create_attachment` return it. */
-function attachmentOf(value) {
-	const row = recordOf(value, "attachments");
-	return {
-		id: textOf(row["id"]),
-		organizationId: optionalText(row["organization_id"]),
-		subjectType: optionalText(row["subject_type"]),
-		subjectId: optionalText(row["subject_id"]),
-		bucket: textOf(row["bucket"]),
-		path: textOf(row["object_path"]),
-		name: textOf(row["name"]),
-		mimeType: textOf(row["mime_type"]),
-		size: Number(row["size"]),
-		status: statusOf(row["status"]),
-		scanDetail: optionalText(row["scan_detail"]),
-		metadata: isRecord(row["metadata"]) ? row["metadata"] : {},
-		uploadedBy: optionalText(row["uploaded_by"]),
-		createdAt: toInstant(textOf(row["created_at"])),
-		uploadedAt: optionalInstant(row["uploaded_at"]),
-		scannedAt: optionalInstant(row["scanned_at"])
-	};
-}
-const CLAIM_HINTS = {
-	notUploaded: "ATTACHMENT_NOT_UPLOADED",
-	forbidden: "ATTACHMENT_FORBIDDEN"
-};
-const notFound = () => dbError("not_found", "No attachment you can see has this id", { hint: "ATTACHMENT_NOT_FOUND" });
-/** A Storage reply as a result, its error mapped to a `DbError`. */
-function stored(reply) {
-	return AsyncResult.from(async () => {
-		try {
-			const { data, error } = await reply;
-			if (error) return err(fromStorageError(error, "storage.objects"));
-			if (data === null || data === void 0) return err(dbError("network", "Storage returned no data"));
-			return ok(data);
-		} catch (cause) {
-			return err(fromStorageError(cause, "storage.objects"));
-		}
-	});
-}
-/**
-* Waits for a scan from a job or an event. A scan whose target is gone (the
-* attachment row, or for an object the stored object) is done, not a failure,
-* so the job or event is not retried; every other error throws.
-*/
-async function settle(scanned, gone) {
-	const result = await scanned;
-	if (result.ok || gone(result.error)) return;
-	await scanned.orThrow();
-}
-const attachmentGone = (error) => error.kind === "not_found" && error.hint === "ATTACHMENT_NOT_FOUND";
-const objectGone = (error) => error.kind === "not_found" && error.code === "NoSuchKey";
-function lookup(call, id) {
-	return call("get_attachment", { id }, (value) => value).andThen((value) => Promise.resolve(isRecord(value) ? ok(attachmentOf(value)) : err(notFound())));
-}
-/** Attachments as the caller: the table's and the bucket's policies apply. */
-const NEW_ATTACHMENT = /* @__PURE__ */ new Set([
-	"organizationId",
-	"name",
-	"mimeType",
-	"size",
-	"subjectType",
-	"subjectId",
-	"metadata"
-]);
-function createAttachments(options) {
-	applyTemporal(options);
-	const call = blockCall(options.transport, options.schema, options.mappers);
-	const fields = blockFields(options.fields, "attachment fields");
-	const typed = (value) => AsyncResult.from(() => withFields(fields, value, attachmentOf(value)));
-	const find = (id) => call("get_attachment", { id }, (value) => value).andThen((value) => isRecord(value) ? typed(value) : AsyncResult.err(notFound()));
-	const confirmed = (id) => call("confirm_attachment", { id }, (value) => value).andThen(typed);
-	const confirm = (id) => claimsUploads(options.storage) ? lookup(call, id).andThen((attachment) => attachment.uploadedAt === void 0 ? claimUpload(options.storage, attachment, CLAIM_HINTS).andThen(() => confirmed(id)) : confirmed(id)) : confirmed(id);
-	const requireScan = options.requireScan ?? true;
-	const ttl = options.downloadTtl ?? 300;
-	const bucket = (attachment) => options.storage.from(attachment.bucket);
-	/** Why a file can't be read yet, or `undefined` once it can. */
-	const gate = (attachment) => {
-		return attachment.status === "clean" || !requireScan && attachment.status !== "infected" && attachment.uploadedAt !== void 0 ? void 0 : dbError("invalid_request", attachment.status === "infected" ? "The file failed the malware scan" : "The file is not scanned yet", { hint: "ATTACHMENT_NOT_SCANNED" });
-	};
-	const discard = async (created, error) => {
-		await call("delete_attachment", { id: created.id }, (value) => value);
-		return err(error);
-	};
-	const create = (attachment) => AsyncResult.from(() => extraFieldsArg(fields, extraOf(attachment, NEW_ATTACHMENT))).andThen((more) => call("create_attachment", {
-		tenant: attachment.organizationId,
-		name: attachment.name,
-		mime_type: attachment.mimeType,
-		size: attachment.size,
-		subject_type: attachment.subjectType,
-		subject_id: attachment.subjectId,
-		metadata: attachment.metadata,
-		...more
-	}, (value) => value)).andThen(typed);
-	const upload = (attachment) => create(attachment).andThen(async (created) => {
-		const url = await stored(bucket(created).createSignedUploadUrl(created.path));
-		if (!url.ok) return discard(created, url.error);
-		return ok({
-			attachment: created,
-			signedUrl: url.data.signedUrl,
-			token: url.data.token
-		});
-	});
-	return withBlockHooks({
-		upload,
-		confirm,
-		get: find,
-		list: (organizationId, subject) => call("list_attachments", {
-			tenant: organizationId,
-			subject_type: subject?.type,
-			subject_id: subject?.id
-		}, (value) => recordsOf(value, "list_attachments").map((raw) => [raw, attachmentOf(raw)])).andThen((rows) => allWithFields(fields, rows)),
-		download: (id, download = {}) => find(id).andThen((attachment) => {
-			const blocked = gate(attachment);
-			if (blocked) return Promise.resolve(err(blocked));
-			return stored(bucket(attachment).createSignedUrl(attachment.path, ttl, download.as === void 0 ? void 0 : { download: download.as })).map((url) => ({
-				attachment,
-				signedUrl: url.signedUrl
-			}));
-		}),
-		put: (attachment, file) => create(attachment).andThen(async (created) => {
-			const target = bucket(created);
-			if (!target.upload) return discard(created, dbError("invalid_request", "The storage client has no upload", { hint: "ATTACHMENT_STORAGE_CLIENT" }));
-			const sent = await stored(target.upload(created.path, file, {
-				contentType: created.mimeType,
-				upsert: false
-			}));
-			if (!sent.ok) return discard(created, sent.error);
-			return confirmed(created.id);
-		}),
-		read: (id) => find(id).andThen((attachment) => {
-			const blocked = gate(attachment);
-			if (blocked) return Promise.resolve(err(blocked));
-			return stored(bucket(attachment).download(attachment.path)).map((file) => ({
-				attachment,
-				file
-			}));
-		}),
-		remove: (id) => find(id).andThen((attachment) => stored(bucket(attachment).remove([attachment.path]))).andThen(() => call("delete_attachment", { id }, (value) => value === true))
-	}, options.hooks, {
-		block: "attachments",
-		...options.logger ? { logger: options.logger } : {}
-	});
-}
-/**
-* Scans uploaded files with the app's `scan` function and records `clean`,
-* `infected` or `failed`. A file already clean or infected is not scanned
-* again, so replayed events and retried jobs are safe.
-*/
-function createAttachmentScanner(options) {
-	applyTemporal(options);
-	const call = blockCall(options.transport, options.schema);
-	const prefix = `${options.typePrefix ?? "dev.better-supabase"}.`;
-	const record = (id, status, detail) => call("set_attachment_status", {
-		id,
-		status,
-		detail
-	}, (value) => value).andThen((value) => Promise.resolve(isRecord(value) ? ok(attachmentOf(value)) : err(notFound())));
-	const scan = (id, signal) => lookup(call, id).andThen((attachment) => {
-		if (attachment.status === "clean" || attachment.status === "infected") return Promise.resolve(ok(attachment));
-		if (attachment.uploadedAt === void 0) return Promise.resolve(err(dbError("invalid_request", "The file was not uploaded yet", { hint: "ATTACHMENT_NOT_UPLOADED" })));
-		return stored(options.storage.from(attachment.bucket).download(attachment.path)).andThen(async (file) => {
-			let verdict;
-			try {
-				verdict = await options.scan(file, attachment, signal);
-			} catch (cause) {
-				const failed = await record(id, "failed", errorText(cause));
-				return failed.ok ? err(dbError("raised", `The scan failed: ${errorText(cause)}`, { hint: "ATTACHMENT_SCAN_FAILED" })) : failed;
-			}
-			return record(id, verdict.status, verdict.detail);
-		});
-	});
-	return {
-		scan,
-		job: async (payload, _job, signal) => {
-			await settle(scan(payload.attachmentId, signal), attachmentGone);
-		},
-		sink: () => ({ async send(events) {
-			for (const event of events) {
-				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "attachment.uploaded" || !isRecord(event.data)) continue;
-				const id = optionalText(event.data["attachmentId"]);
-				if (id !== void 0) await settle(scan(id), attachmentGone);
-			}
-		} })
-	};
-}
-function scannedOf(value) {
-	const row = recordOf(value, "scanned_objects");
-	const status = textOf(row["status"]);
-	return {
-		bucket: textOf(row["bucket"]),
-		path: textOf(row["object_path"]),
-		status: status === "clean" || status === "infected" || status === "failed" ? status : "pending",
-		detail: optionalText(row["scan_detail"]),
-		scannedAt: optionalInstant(row["scanned_at"])
-	};
-}
-/**
-* The scan gate for objects outside the attachments table, such as a file drive
-* or avatars: scans an object with the app's `scan` function and records the
-* verdict in `scanned_objects`, which storage policies read with
-* `object_clean(bucket_id, name)`. With `options.scanBuckets`, new objects in
-* those buckets get a pending row and an `object.uploaded` event.
-*/
-function createObjectScanner(options) {
-	applyTemporal(options);
-	const call = blockCall(options.transport, options.schema);
-	const prefix = `${options.typePrefix ?? "dev.better-supabase"}.`;
-	const record = (bucket, path, status, detail) => call("set_object_scan", {
-		bucket,
-		path,
-		status,
-		detail
-	}, scannedOf);
-	const scan = (bucket, path, signal) => call("object_scan", {
-		bucket,
-		path
-	}, (value) => isRecord(value) ? scannedOf(value) : void 0).andThen((current) => {
-		if (current?.status === "clean" || current?.status === "infected") return Promise.resolve(ok(current));
-		return stored(options.storage.from(bucket).download(path)).andThen(async (file) => {
-			let verdict;
-			try {
-				verdict = await options.scan(file, {
-					bucket,
-					path
-				}, signal);
-			} catch (cause) {
-				const failed = await record(bucket, path, "failed", errorText(cause));
-				return failed.ok ? err(dbError("raised", `The scan failed: ${errorText(cause)}`, { hint: "ATTACHMENT_SCAN_FAILED" })) : failed;
-			}
-			return record(bucket, path, verdict.status, verdict.detail);
-		});
-	});
-	return {
-		scan,
-		job: async (payload, _job, signal) => {
-			await settle(scan(payload.bucket, payload.path, signal), objectGone);
-		},
-		sink: () => ({ async send(events) {
-			for (const event of events) {
-				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "object.uploaded" || !isRecord(event.data)) continue;
-				const bucket = optionalText(event.data["bucket"]);
-				const path = optionalText(event.data["path"]);
-				if (bucket !== void 0 && path !== void 0) await settle(scan(bucket, path), objectGone);
-			}
-		} })
-	};
-}
-//#endregion
-export { stored as a, createObjectScanner as i, createAttachmentScanner as n, createAttachments as r, attachmentOf as t };