better-supabase 0.13.0 → 0.14.0

package/dist/blocks/signatures/index.js

@@ -0,0 +1,149 @@
+import { n as isRecord } from "../../guards-6F2bCtQR.js";
+import { t as signaturesSqlOptions } from "../../options-BkpqTGrJ.js";
+import { A as requiredInstant, B as dbTransport, C as optionalText, D as recordOf, H as rpcTransport, I as textOf, S as optionalInstant, U as sqlTransport, d as enumOrThrow, k as recordsOf, m as instantArg, n as applyTemporal, o as blockCall } from "../../block-helpers-CiKtrb6g.js";
+import { r as withBlockHooks } from "../../block-hooks-BymdcD0V.js";
+import { n as event, t as defineEvents } from "../../event-map-CtPFhcOp.js";
+import { n as blockFields } from "../../block-fields-DBSJSeaO.js";
+import { n as defineBlock } from "../../define-block-Dze77QTw.js";
+//#region src/blocks/signatures/signatures.ts
+const STATUSES = [
+	"pending",
+	"completed",
+	"declined",
+	"cancelled"
+];
+const ORDERS = ["parallel", "sequential"];
+const METHODS = [
+	"drawn",
+	"typed",
+	"click"
+];
+function optional(key, value) {
+	return value === void 0 ? {} : { [key]: value };
+}
+const textsOf = (value) => Array.isArray(value) ? value.map((item) => textOf(item)) : [];
+function requestOf(value, fn) {
+	const row = recordOf(value, fn);
+	return {
+		id: textOf(row["id"]),
+		organizationId: textOf(row["organizationId"]),
+		subjectType: textOf(row["subjectType"]),
+		subjectId: textOf(row["subjectId"]),
+		versionId: textOf(row["versionId"]),
+		contentHash: textOf(row["contentHash"]),
+		signers: textsOf(row["signers"]),
+		order: enumOrThrow(row["order"], ORDERS, "signing order"),
+		status: enumOrThrow(row["status"], STATUSES, "signature request status"),
+		createdAt: requiredInstant(row["createdAt"], "createdAt"),
+		...optional("approvalRequestId", optionalText(row["approvalRequestId"])),
+		...optional("message", optionalText(row["message"])),
+		...optional("requestedBy", optionalText(row["requestedBy"])),
+		...optional("completedAt", optionalInstant(row["completedAt"])),
+		fields: isRecord(row["fields"]) ? row["fields"] : {}
+	};
+}
+function signatureOf(value, fn) {
+	const row = recordOf(value, fn);
+	return {
+		id: textOf(row["id"]),
+		requestId: textOf(row["requestId"]),
+		signer: textOf(row["signer"]),
+		method: enumOrThrow(row["method"], METHODS, "signature method"),
+		signedHash: textOf(row["signedHash"]),
+		signedAt: requiredInstant(row["signedAt"], "signedAt"),
+		...optional("typedName", optionalText(row["typedName"])),
+		...optional("imageAttachmentId", optionalText(row["imageAttachmentId"])),
+		...optional("ip", optionalText(row["ip"])),
+		...optional("userAgent", optionalText(row["userAgent"]))
+	};
+}
+function verificationOf(value, fn) {
+	const row = recordOf(value, fn);
+	return {
+		valid: row["valid"] === true,
+		contentMatches: row["contentMatches"] === true,
+		changedSince: row["changedSince"] === true,
+		signatures: recordsOf(row["signatures"], fn).map((item) => ({
+			id: textOf(item["id"]),
+			signer: textOf(item["signer"]),
+			valid: item["valid"] === true
+		})),
+		...optional("latestVersionId", optionalText(row["latestVersionId"]))
+	};
+}
+/** The `signatures` SQL module as typed calls. */
+function createSignatures(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const fields = blockFields(options.fields, "signature request fields");
+	return withBlockHooks({
+		request: (input) => fields.args(input.fields).andThen((checked) => call("create_signature_request", {
+			tenant: input.organizationId,
+			subject_type: input.subjectType,
+			subject_id: input.subjectId,
+			signers: input.signers,
+			version_id: input.versionId ?? null,
+			sign_order: input.order ?? "parallel",
+			approval_request_id: input.approvalRequestId ?? null,
+			message: input.message ?? null,
+			fields: checked
+		}, (value) => requestOf(value, "create_signature_request")).andThen(fields.row)),
+		sign: (requestId, input) => call("sign_signature", {
+			request_id: requestId,
+			method: input.method,
+			typed_name: input.method === "typed" ? input.typedName : null,
+			image_attachment_id: input.method === "drawn" ? input.imageAttachmentId : null
+		}, (value) => ({
+			...signatureOf(value, "sign_signature"),
+			requestStatus: enumOrThrow(recordOf(value, "sign_signature")["requestStatus"], STATUSES, "signature request status")
+		})),
+		decline: (requestId, reason) => call("decline_signature_request", {
+			request_id: requestId,
+			reason: reason ?? null
+		}, (value) => requestOf(value, "decline_signature_request")).andThen(fields.row),
+		cancel: (requestId) => call("cancel_signature_request", { request_id: requestId }, (value) => requestOf(value, "cancel_signature_request")).andThen(fields.row),
+		get: (requestId) => call("get_signature_request", { request_id: requestId }, (value) => {
+			const row = recordOf(value, "get_signature_request");
+			return {
+				...requestOf(row, "get_signature_request"),
+				signatures: recordsOf(row["signatures"], "get_signature_request").map((item) => signatureOf(item, "get_signature_request")),
+				verification: verificationOf(row["verification"], "get_signature_request")
+			};
+		}).andThen(fields.row),
+		list: (organizationId, list = {}) => call("list_signature_requests", {
+			tenant: organizationId,
+			subject_type: list.subjectType ?? null,
+			subject_id: list.subjectId ?? null,
+			status: list.status ?? null,
+			mine: list.mine ?? false,
+			page_size: list.pageSize ?? null,
+			before: instantArg(list.before) ?? null
+		}, (value) => recordsOf(value, "list_signature_requests").map((row) => requestOf(row, "list_signature_requests"))).andThen(fields.rows)
+	}, options.hooks, {
+		block: "signatures",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+//#endregion
+//#region src/blocks/signatures/events.ts
+/** The `signatures` block's event types, for its manifest and `onBlockEvent`. */
+const signaturesEvents = defineEvents({
+	"signature.requested": event(),
+	"signature.signed": event(),
+	"signature.completed": event(),
+	"signature.declined": event(),
+	"signature.cancelled": event()
+});
+//#endregion
+//#region src/blocks/signatures/manifest.ts
+/** The `signatures` block's manifest (ADR 0029). */
+const signaturesBlock = defineBlock({
+	name: "signatures",
+	sql: ["signatures"],
+	options: { signatures: signaturesSqlOptions },
+	events: signaturesEvents,
+	create: createSignatures,
+	category: "content"
+});
+//#endregion
+export { createSignatures, dbTransport, rpcTransport, signaturesBlock, signaturesEvents, sqlTransport };

package/dist/blocks/signing-keys/index.d.ts

@@ -1,8 +1,8 @@
-import { wt as Events } from "../../events-DhGgwqQA.js";
-import { s as sqlTransport, t as BlockTransport } from "../../block-transport-DBPhgF3W.js";
-import { s as BlockOf } from "../../define-block-MyM4lH42.js";
+import { Ct as Events } from "../../events-DbLjvxDX.js";
+import { s as sqlTransport, t as BlockTransport } from "../../block-transport-d53POsem.js";
+import { c as BlockOf } from "../../define-block-COpcS6aT.js";
 import { a as JwsError, c as VerifyCompactOptions, d as verifyCompact, i as JwsAlgorithm, l as jwkThumbprint, n as Jwks, o as SigningAlgorithm, s as VerifiedJws, t as Jwk, u as jwksOf } from "../../jws-D0toeQlA.js";
-import { a as Signature, c as SigningKeyOwner, d as createSigningKeys, f as jwtType, i as PLATFORM_OWNER, l as SigningKeys, n as JwksOptions, o as Signer, r as JwksResponseOptions, s as SignerOptions, t as CreatedSigningKey, u as SigningKeysOptions } from "../../signing-keys-i2Rsll6L.js";
+import { a as Signature, c as SigningKeyOwner, d as createSigningKeys, f as jwtType, i as PLATFORM_OWNER, l as SigningKeys, n as JwksOptions, o as Signer, r as JwksResponseOptions, s as SignerOptions, t as CreatedSigningKey, u as SigningKeysOptions } from "../../signing-keys-B3RHGMMu.js";
 //#region src/blocks/signing-keys/events.d.ts
 /** `signing_key.*`: the key's owner and kid, never key material. */
 interface SigningKeyEventData {

package/dist/blocks/signing-keys/index.js

@@ -1,170 +1,9 @@
-import { n as dbError } from "../../errors-D7u24ZJH.js";
-import { t as temporal } from "../../temporal-required-Dt4mcPsi.js";
-import { t as AsyncResult } from "../../result-DIT_qp4G.js";
-import { n as isRecord } from "../../guards-6F2bCtQR.js";
 import { t as signingKeysSqlOptions } from "../../options-CmraJhd9.js";
+import { U as sqlTransport } from "../../block-helpers-CiKtrb6g.js";
 import { n as event, t as defineEvents } from "../../event-map-CtPFhcOp.js";
-import { i as sqlTransport } from "../../block-transport-Ds0C2mUf.js";
-import { D as recordOf, I as textOf, d as enumOrThrow, j as run, n as applyTemporal, o as blockCall } from "../../block-helpers-DwE32_gT.js";
-import { a as jwksOf, c as verifyCompact, i as jwkThumbprint, n as generateSigningKey, o as signBytes, r as importSigningKey, s as signCompact, t as JwsError } from "../../jws-DOgHJKHb.js";
-import { r as withBlockHooks } from "../../block-hooks-C1r-R2r0.js";
-import { n as defineBlock } from "../../define-block-B6Gjs57G.js";
-//#region src/blocks/signing-keys/signing-keys.ts
-const ALGORITHMS = ["Ed25519", "ES256"];
-/**
-* The owner of the platform's own keys, for a single authorization server that
-* signs for every tenant. A key per tenant uses `{ type, id }` of the tenant
-* instead, such as `{ type: "environment", id: environment.id }`.
-*/
-const PLATFORM_OWNER = {
-	type: "platform",
-	id: "default"
-};
-const TYPE_NAME = /^[a-z0-9][a-z0-9-]{0,62}$/;
-const JWT_TYPE = /^(?:JWT|[a-z0-9][a-z0-9.-]{0,126}\+jwt)$/i;
-/**
-* The `typ` header for a token kind of your own: `jwtType("invite")` is
-* `vnd.invite+jwt`. Sign with `{ typ }` and verify with `verifyCompact(..., {
-* typ })` so a token of one kind can't be replayed as another (RFC 8725 section
-* 3.11). Throws a `TypeError` for a name outside lower-case letters, digits and
-* `-`.
-*/
-function jwtType(name) {
-	if (!TYPE_NAME.test(name)) throw new TypeError(`jwtType name must be lower-case letters, digits and "-", got ${JSON.stringify(name)}`);
-	return `vnd.${name}+jwt`;
-}
-const HOUR = 3600;
-const interval = (duration) => duration === void 0 ? null : `${String(duration.total({ unit: "seconds" }))} seconds`;
-const ownerArgs = (owner) => ({
-	owner_type: owner.type,
-	owner_id: owner.id
-});
-/**
-* The `signing-keys` SQL module as typed calls: keys are generated and used
-* with WebCrypto here, kept in Supabase Vault there. Service role only.
-*/
-function createSigningKeys(options) {
-	applyTemporal(options);
-	const call = blockCall(options.transport, options.schema, options.mappers);
-	const ed25519Alg = options.ed25519Alg ?? "EdDSA";
-	const cacheMs = (options.cacheSeconds ?? 300) * 1e3;
-	const keys = /* @__PURE__ */ new Map();
-	const noted = /* @__PURE__ */ new Map();
-	const jwsAlg = (alg) => alg === "Ed25519" ? ed25519Alg : "ES256";
-	const add = (owner, alg) => run(() => generateSigningKey(alg)).andThen((generated) => call("add_signing_key", {
-		...ownerArgs(owner),
-		kid: generated.kid,
-		alg,
-		public_jwk: generated.publicKey,
-		private_jwk: JSON.stringify(generated.privateKey)
-	}, (value) => {
-		const row = recordOf(value, "add_signing_key");
-		keys.delete(`${owner.type}:${owner.id}`);
-		return {
-			kid: generated.kid,
-			alg,
-			publicKey: generated.publicKey,
-			retired: typeof row["retired"] === "string" ? row["retired"] : null
-		};
-	}));
-	const stored = (owner) => call("signing_key", ownerArgs(owner), (value) => {
-		if (value === null || value === void 0) return null;
-		const row = recordOf(value, "signing_key");
-		return {
-			kid: textOf(row["kid"]),
-			alg: enumOrThrow(row["alg"], ALGORITHMS, "signing key alg"),
-			privateKey: textOf(row["privateKey"])
-		};
-	});
-	const active = (owner, create) => {
-		const cacheKey = `${owner.type}:${owner.id}`;
-		const cached = keys.get(cacheKey);
-		if (cached && Date.now() - cached.at < cacheMs) return AsyncResult.ok(cached);
-		return stored(owner).andThen((found) => {
-			if (found) return run(async () => {
-				const parsed = JSON.parse(found.privateKey);
-				if (!isRecord(parsed) || typeof parsed["kty"] !== "string") throw new TypeError("The stored signing key is not a JWK");
-				const key = await importSigningKey(parsed);
-				const entry = {
-					kid: found.kid,
-					alg: found.alg,
-					key,
-					at: Date.now()
-				};
-				keys.set(cacheKey, entry);
-				return entry;
-			});
-			if (create === void 0) return AsyncResult.err(dbError("not_found", `${cacheKey} has no signing key`, { hint: "SIGNING_KEY_MISSING" }));
-			return add(owner, create).andThen(() => active(owner, void 0));
-		});
-	};
-	const noteExp = (kid, exp) => call("note_signing_key_exp", {
-		kid,
-		exp: exp.toString()
-	}, (value) => value === true);
-	const client = {
-		create: (owner, alg = "Ed25519") => add(owner, alg),
-		rotate: (owner, alg) => alg === void 0 ? stored(owner).andThen((found) => add(owner, found?.alg ?? "Ed25519")) : add(owner, alg),
-		retire: (kid) => call("retire_signing_key", { kid }, (value) => {
-			for (const [owner, entry] of keys) if (entry.kid === kid) keys.delete(owner);
-			return value === true;
-		}),
-		noteExp,
-		jwks: (owner, jwksOptions = {}) => call("signing_jwks", {
-			...ownerArgs(owner),
-			grace: interval(jwksOptions.grace)
-		}, jwksOf),
-		jwksResponse: async (owner, responseOptions = {}) => {
-			const result = await client.jwks(owner, responseOptions);
-			if (!result.ok) return Response.json({
-				title: "The key set is unavailable",
-				status: 503
-			}, {
-				status: 503,
-				headers: { "content-type": "application/problem+json" }
-			});
-			return Response.json(result.data, { headers: {
-				"content-type": "application/jwk-set+json",
-				"cache-control": `public, max-age=${String(responseOptions.maxAge ?? 300)}`
-			} });
-		},
-		remove: (owner) => call("delete_signing_keys", ownerArgs(owner), (value) => {
-			keys.delete(`${owner.type}:${owner.id}`);
-			return Number(value);
-		}),
-		purge: (purgeOptions = {}) => call("purge_signing_keys", { grace: interval(purgeOptions.grace) }, Number),
-		signer: (owner, signerOptions = {}) => ({
-			owner,
-			sign: (data) => active(owner, signerOptions.create).andThen((key) => run(async () => ({
-				kid: key.kid,
-				alg: jwsAlg(key.alg),
-				signature: await signBytes(key.key, key.alg, data)
-			}))),
-			signJwt: (claims, header = {}) => {
-				const typ = header["typ"];
-				if (typ !== void 0 && (typeof typ !== "string" || !JWT_TYPE.test(typ))) return AsyncResult.err(dbError("invalid_input", "The typ header is not a JWT media type", { hint: "SIGNING_TYP_INVALID" }));
-				return active(owner, signerOptions.create).andThen((key) => {
-					const exp = claims["exp"];
-					const until = typeof exp === "number" && Number.isFinite(exp) ? Math.ceil(exp / HOUR) * HOUR : void 0;
-					return (until !== void 0 && until > (noted.get(key.kid) ?? 0) ? noteExp(key.kid, temporal().Instant.fromEpochMilliseconds(until * 1e3)).map((known) => {
-						noted.set(key.kid, until);
-						return known;
-					}) : AsyncResult.ok(true)).andThen(() => run(() => signCompact(key.key, key.alg, {
-						alg: jwsAlg(key.alg),
-						kid: key.kid,
-						typ: "JWT",
-						...header
-					}, claims)));
-				});
-			}
-		})
-	};
-	return withBlockHooks(client, options.hooks, {
-		block: "signing-keys",
-		...options.logger ? { logger: options.logger } : {}
-	});
-}
-//#endregion
+import { a as jwksOf, c as verifyCompact, i as jwkThumbprint, t as JwsError } from "../../jws-DOgHJKHb.js";
+import { n as defineBlock } from "../../define-block-Dze77QTw.js";
+import { n as createSigningKeys, r as jwtType, t as PLATFORM_OWNER } from "../../signing-keys-fWapUzi0.js";
 //#region src/blocks/signing-keys/events.ts
 /** The `signing-keys` block's event types, for its manifest and `onBlockEvent`. */
 const signingKeysEvents = defineEvents({

package/dist/blocks/sla/index.d.ts

@@ -1,14 +1,15 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult } from "../../result-mijqfoJN.js";
-import { t as StandardSchemaV1 } from "../../standard-16AIDny5.js";
-import { n as ExtraFields, r as FieldsOf } from "../../block-fields-DnXkMney.js";
-import { wt as Events } from "../../events-DhGgwqQA.js";
-import { w as SlaEventData } from "../../index-CE0p3st5.js";
+import { t as AsyncResult } from "../../result-C6jDfedy.js";
+import { t as StandardSchemaV1 } from "../../standard-DbQsD2xZ.js";
+import { n as ExtraFields, r as FieldsOf } from "../../block-fields-3w4MZr8U.js";
+import { dt as SubjectRef } from "../../executor-CPyrQdjh.js";
+import { Ct as Events } from "../../events-DbLjvxDX.js";
+import { E as SlaEventData } from "../../block-events-records-BGVyoz57.js";
 import { n as Logger } from "../../logger-DWVYUmwi.js";
-import { a as dbTransport, i as RpcClient, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DBPhgF3W.js";
-import { n as BlockOptions } from "../../block-helpers-DyA5BAW4.js";
-import { a as BlockTransportMiddleware, d as extendBlock, f as withBlockHooks, n as BlockHooks, p as wrapTransport } from "../../block-hooks-BadAniNI.js";
-import { s as BlockOf } from "../../define-block-MyM4lH42.js";
+import { n as BlockOptions } from "../../block-helpers-BaugZlJV.js";
+import { a as dbTransport, i as RpcClient, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-d53POsem.js";
+import { a as BlockTransportMiddleware, d as extendBlock, f as withBlockHooks, n as BlockHooks, p as wrapTransport } from "../../block-hooks-CmjPKqQ_.js";
+import { Gt as SectionWrite, Lt as Section, c as BlockOf, rn as EntitySchema } from "../../define-block-COpcS6aT.js";
 //#region src/blocks/sla/sla.d.ts
 type SlaMetric = "first_response" | "next_response" | "resolution";
 type SlaState = "running" | "paused" | "met" | "breached";
@@ -33,8 +34,7 @@ interface SlaPolicy<F extends object = Record<never, never>> {
 }
 interface SlaClock {
   readonly id: string;
-  readonly subjectType: string;
-  readonly subjectId: string;
+  readonly subject: SubjectRef;
   readonly metric: SlaMetric;
   readonly state: SlaState;
   readonly startedAt: Temporal.Instant;
@@ -61,21 +61,16 @@ interface SlaPolicyInput<F extends object = Record<never, never>> {
   readonly fields?: Partial<F>;
 }
 interface Sla<F extends object = Record<never, never>> {
-  savePolicy(organizationId: string, policy: SlaPolicyInput<F>): AsyncResult<SlaPolicy<F>>;
-  /** Starts a record's clocks, or recomputes them for a new priority. */
-  start(subject: {
-    readonly type: string;
-    readonly id: string;
-  }, priority?: string): AsyncResult<SlaClock[]>;
+  /** Creates or updates a policy in the block's `tenant`. */
+  savePolicy(policy: SlaPolicyInput<F>): AsyncResult<SlaPolicy<F>>;
+  /**
+   * Starts a record's clocks, or recomputes them for a new priority. The tenant
+   * comes from the record.
+   */
+  start(subject: SubjectRef, priority?: string): AsyncResult<SlaClock[]>;
   /** Moves a record's clocks: a reply, a resolution, a pause. */
-  record(subject: {
-    readonly type: string;
-    readonly id: string;
-  }, event: SlaEvent): AsyncResult<SlaClock[]>;
-  clocks(subject: {
-    readonly type: string;
-    readonly id: string;
-  }): AsyncResult<SlaClock[]>;
+  record(subject: SubjectRef, event: SlaEvent): AsyncResult<SlaClock[]>;
+  clocks(subject: SubjectRef): AsyncResult<SlaClock[]>;
   /** Records warnings and breaches. Service role only; run it from a job. */
   check(): AsyncResult<number>;
   /** The time `minutes` of working time after `start`. */
@@ -107,8 +102,25 @@ type SlaEvents = {
 /** The `sla` block's event types, for its manifest and `onBlockEvent`. */
 export declare const slaEvents: Events<SlaEvents>;
 //#endregion
+//#region src/blocks/sla/section.d.ts
+/** What starting a record's clocks takes. */
+interface SlaStartInput {
+  readonly priority?: string;
+}
+/** The input schema of the SLA section's `start`. */
+export declare const slaStartInput: EntitySchema<SlaStartInput>;
+/** The writes of the SLA section. */
+type SlaWrites = {
+  /** Starts the record's clocks, or recomputes them for a new priority. */
+  readonly start: SectionWrite<Sla, SlaStartInput, SlaClock[]>;
+};
+/** A record's response and resolution clocks. */
+export declare const slaSection: Section<Sla, SlaClock[], never, never, SlaWrites>;
+//#endregion
 //#region src/blocks/sla/manifest.d.ts
 /** The `sla` block's manifest (ADR 0029). */
-export declare const slaBlock: BlockOf<"sla", typeof createSla, SlaEvents>;
+export declare const slaBlock: BlockOf<"sla", typeof createSla, SlaEvents, Record<never, never>, never, {
+  readonly sla: typeof slaSection;
+}>;
 //#endregion
-export { type BlockHooks, type BlockTransport, type BlockTransportMiddleware, type RpcClient, type Sla, type SlaClock, type SlaEvent, type SlaEvents, type SlaMetric, type SlaOptions, type SlaPolicy, type SlaPolicyInput, type SlaState, dbTransport, extendBlock, rpcTransport, sqlTransport, withBlockHooks, wrapTransport };
+export { type BlockHooks, type BlockTransport, type BlockTransportMiddleware, type RpcClient, type Sla, type SlaClock, type SlaEvent, type SlaEvents, type SlaMetric, type SlaOptions, type SlaPolicy, type SlaPolicyInput, type SlaStartInput, type SlaState, type SlaWrites, dbTransport, extendBlock, rpcTransport, sqlTransport, withBlockHooks, wrapTransport };

package/dist/blocks/sla/index.js

@@ -1,12 +1,15 @@
 import { n as isRecord } from "../../guards-6F2bCtQR.js";
 import { t as slaSqlOptions } from "../../options-Blg8lAkz.js";
+import { A as requiredInstant, B as dbTransport, C as optionalText, D as recordOf, H as rpcTransport, I as textOf, S as optionalInstant, U as sqlTransport, d as enumOrThrow, k as recordsOf, m as instantArg, n as applyTemporal, o as blockCall } from "../../block-helpers-CiKtrb6g.js";
+import { i as wrapTransport, n as extendBlock, r as withBlockHooks } from "../../block-hooks-BymdcD0V.js";
+import { n as entitySchema } from "../../entity-schema-BXXC1NnT.js";
+import { t as defineSection } from "../../sections-DjxYmpu-.js";
 import { n as event, t as defineEvents } from "../../event-map-CtPFhcOp.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../../block-transport-Ds0C2mUf.js";
-import { A as requiredInstant, C as optionalText, D as recordOf, I as textOf, S as optionalInstant, d as enumOrThrow, k as recordsOf, m as instantArg, n as applyTemporal, o as blockCall } from "../../block-helpers-DwE32_gT.js";
-import { i as wrapTransport, n as extendBlock, r as withBlockHooks } from "../../block-hooks-C1r-R2r0.js";
-import { n as blockFields } from "../../block-fields-Cwd4c8m-.js";
-import { n as defineBlock } from "../../define-block-B6Gjs57G.js";
-import { n as compact } from "../../sales-shared-CjXsy0NJ.js";
+import { n as blockFields } from "../../block-fields-DBSJSeaO.js";
+import { n as defineBlock } from "../../define-block-Dze77QTw.js";
+import { i as subjectRefOf } from "../../block-subjects-Dzq5Xn_0.js";
+import { t as requireTenant } from "../../block-tenant-C1sNV8_4.js";
+import { n as compact } from "../../sales-shared-C_u68eq2.js";
 //#region src/blocks/sla/sla.ts
 const METRICS = [
 	"first_response",
@@ -39,8 +42,7 @@ function clockOf(value) {
 	const row = recordOf(value, "sla clock");
 	return compact({
 		id: textOf(row["id"]),
-		subjectType: textOf(row["subject_type"]),
-		subjectId: textOf(row["subject_id"]),
+		subject: subjectRefOf(row["subject_type"], row["subject_id"]),
 		metric: enumOrThrow(row["metric"], METRICS, "sla metric"),
 		state: enumOrThrow(row["state"], STATES, "sla state"),
 		startedAt: requiredInstant(row["started_at"], "startedAt"),
@@ -61,17 +63,18 @@ function createSla(options) {
 	applyTemporal(options);
 	const call = blockCall(options.transport, options.schema, options.mappers);
 	const fields = blockFields(options.fields, "sla policy fields");
+	const tenant = () => requireTenant(options.tenant);
 	return withBlockHooks({
-		savePolicy: (organizationId, policy) => {
+		savePolicy: (policy) => {
 			const { id, fields: extra, ...attrs } = policy;
-			return fields.args(extra).andThen((checked) => call("save_sla_policy", {
+			return tenant().andThen((organizationId) => fields.args(extra).andThen((checked) => call("save_sla_policy", {
 				tenant: organizationId,
 				policy: id ?? null,
 				attrs: checked === void 0 ? attrs : {
 					...attrs,
 					fields: checked
 				}
-			}, policyOf).andThen(fields.row));
+			}, policyOf).andThen(fields.row)));
 		},
 		start: (subject, priority) => call("start_sla_clocks", {
 			subject_type: subject.type,
@@ -107,6 +110,31 @@ const slaEvents = defineEvents({
 	"sla.completed": event()
 });
 //#endregion
+//#region src/blocks/sla/section.ts
+/** The input schema of the SLA section's `start`. */
+const slaStartInput = entitySchema({
+	title: "SlaStartInput",
+	fields: { priority: {
+		kind: "string",
+		optional: true,
+		minLength: 1
+	} }
+});
+/** A record's response and resolution clocks. */
+const slaSection = defineSection({
+	permissions: {
+		read: "read",
+		write: "manage"
+	},
+	module: "sla",
+	load: (client, subject) => client.clocks(subject),
+	events: ["sla.*"],
+	writes: { start: {
+		input: slaStartInput,
+		run: (client, subject, input) => client.start(subject, input.priority)
+	} }
+});
+//#endregion
 //#region src/blocks/sla/manifest.ts
 /** The `sla` block's manifest (ADR 0029). */
 const slaBlock = defineBlock({
@@ -115,8 +143,9 @@ const slaBlock = defineBlock({
 	options: { sla: slaSqlOptions },
 	events: slaEvents,
 	create: createSla,
+	sections: { sla: slaSection },
 	category: "work",
 	recipes: ["sla-badges"]
 });
 //#endregion
-export { createSla, dbTransport, extendBlock, rpcTransport, slaBlock, slaEvents, sqlTransport, withBlockHooks, wrapTransport };
+export { createSla, dbTransport, extendBlock, rpcTransport, slaBlock, slaEvents, slaSection, slaStartInput, sqlTransport, withBlockHooks, wrapTransport };

package/dist/blocks/sso/index.d.ts

@@ -1,11 +1,11 @@
 /// <reference lib="esnext.temporal" />
-import { f as Result } from "../../result-mijqfoJN.js";
-import { X as OrganizationDomainEventData, Z as OrganizationEventData, at as SsoProviderEventData, nt as ScimEventData, wt as Events } from "../../events-DhGgwqQA.js";
-import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DBPhgF3W.js";
-import { r as BlockTemporalOptions } from "../../block-helpers-DyA5BAW4.js";
-import { s as BlockOf } from "../../define-block-MyM4lH42.js";
-import { l as ApiKeys } from "../../api-keys-Bade6Qtl.js";
-import { _ as dohResolver, a as SamlProviderInput, c as SsoAdmin, d as SsoDomain, f as SsoOptions, g as createSsoAdmin, h as createSso, i as SamlMetadata, l as SsoAdminOptions, m as TxtResolver, n as DomainRecord, o as Sso, p as SsoProvider, r as OrganizationDomain, s as SsoActor, t as DohResolverOptions, u as SsoAuthAdmin } from "../../sso-D_am-gBz.js";
+import { f as Result } from "../../result-C6jDfedy.js";
+import { Ct as Events, X as OrganizationDomainEventData, Z as OrganizationEventData, at as SsoProviderEventData, nt as ScimEventData } from "../../events-DbLjvxDX.js";
+import { r as BlockTemporalOptions } from "../../block-helpers-BaugZlJV.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-d53POsem.js";
+import { c as BlockOf } from "../../define-block-COpcS6aT.js";
+import { l as ApiKeys } from "../../api-keys-CboAenU8.js";
+import { _ as dohResolver, a as SamlProviderInput, c as SsoAdmin, d as SsoDomain, f as SsoOptions, g as createSsoAdmin, h as createSso, i as SamlMetadata, l as SsoAdminOptions, m as TxtResolver, n as DomainRecord, o as Sso, p as SsoProvider, r as OrganizationDomain, s as SsoActor, t as DohResolverOptions, u as SsoAuthAdmin } from "../../sso-B744gHeS.js";
 //#region src/blocks/sso/scim-filter.d.ts
 type CompareOp = "eq" | "ne" | "co" | "sw" | "ew" | "gt" | "ge" | "lt" | "le";
 type ScimFilter = {

package/dist/blocks/sso/index.js

@@ -1,11 +1,10 @@
-import { a as ok } from "../../result-DIT_qp4G.js";
+import { a as ok } from "../../result-B3m7xtRY.js";
 import { n as isRecord } from "../../guards-6F2bCtQR.js";
 import { t as ssoSqlOptions } from "../../options-CK5WiFwG.js";
+import { B as dbTransport, C as optionalText, D as recordOf, H as rpcTransport, I as textOf, R as toInstant, U as sqlTransport, k as recordsOf, n as applyTemporal, o as blockCall } from "../../block-helpers-CiKtrb6g.js";
 import { n as event, t as defineEvents } from "../../event-map-CtPFhcOp.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../../block-transport-Ds0C2mUf.js";
-import { C as optionalText, D as recordOf, I as textOf, R as toInstant, k as recordsOf, n as applyTemporal, o as blockCall } from "../../block-helpers-DwE32_gT.js";
-import { n as defineBlock } from "../../define-block-B6Gjs57G.js";
-import { n as createSsoAdmin, r as dohResolver, t as createSso } from "../../sso-C86TPpZr.js";
+import { n as defineBlock } from "../../define-block-Dze77QTw.js";
+import { n as createSsoAdmin, r as dohResolver, t as createSso } from "../../sso-Bt9HocgW.js";
 //#region src/blocks/sso/scim-filter.ts
 /** SCIM filters (RFC 7644 §3.4.2.2): parsing and evaluation over resource JSON. */
 /** A filter the service provider can't parse or apply: 400 `invalidFilter`. */

package/dist/blocks/state-machine/index.d.ts

@@ -1,10 +1,11 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult } from "../../result-mijqfoJN.js";
-import { et as SaasSubjectEventData, wt as Events } from "../../events-DhGgwqQA.js";
+import { t as AsyncResult } from "../../result-C6jDfedy.js";
+import { dt as SubjectRef } from "../../executor-CPyrQdjh.js";
+import { Ct as Events, et as SaasSubjectEventData } from "../../events-DbLjvxDX.js";
 import { n as Logger } from "../../logger-DWVYUmwi.js";
-import { i as CursorPageOptions, n as BlockOptions } from "../../block-helpers-DyA5BAW4.js";
-import { n as BlockHooks } from "../../block-hooks-BadAniNI.js";
-import { s as BlockOf } from "../../define-block-MyM4lH42.js";
+import { i as CursorPageOptions, n as BlockOptions } from "../../block-helpers-BaugZlJV.js";
+import { n as BlockHooks } from "../../block-hooks-CmjPKqQ_.js";
+import { c as BlockOf } from "../../define-block-COpcS6aT.js";
 //#region src/blocks/state-machine/state-machine.d.ts
 interface StateMachineOptions<S extends string = string> extends BlockOptions {
   /** `withBlockHooks` hooks around the client's methods. */
@@ -15,8 +16,7 @@ interface StateMachineOptions<S extends string = string> extends BlockOptions {
 /** Where a record is in its machine, from `state()`. */
 interface StatusState {
   readonly organizationId: string;
-  readonly subjectType: string;
-  readonly subjectId: string;
+  readonly subject: SubjectRef;
   readonly status: string;
   /** The machine's `order`, empty when it sets none. */
   readonly order: readonly string[];
@@ -64,34 +64,34 @@ interface StateMachine<S extends string = string> {
    * they may update it, and the trigger rejects a change the machine does not
    * allow. `not_found` for a record they can't see.
    */
-  transition(subjectType: S, subjectId: string, to: string, reason?: string): AsyncResult<boolean>;
+  transition(subject: SubjectRef<S>, to: string, reason?: string): AsyncResult<boolean>;
   /**
    * Pauses the record (`lifecycle: true`): transitions fail with `STATE_PAUSED`
    * until `until` passes, or until `resume()` without one.
    */
-  pause(subjectType: S, subjectId: string, options?: {
+  pause(subject: SubjectRef<S>, options?: {
     readonly until?: Temporal.Instant;
     readonly reason?: string;
   }): AsyncResult<boolean>;
   /** Ends a pause; `false` when the record wasn't paused. */
-  resume(subjectType: S, subjectId: string): AsyncResult<boolean>;
+  resume(subject: SubjectRef<S>): AsyncResult<boolean>;
   /**
    * Turns a flag the machine lists in `flags` on or off; `false` when it
    * already was.
    */
-  setFlag(subjectType: S, subjectId: string, flag: string, enabled: boolean): AsyncResult<boolean>;
+  setFlag(subject: SubjectRef<S>, flag: string, enabled: boolean): AsyncResult<boolean>;
   /** The record's status, progress, flags, pause and pinned version. */
-  state(subjectType: S, subjectId: string): AsyncResult<StatusState>;
+  state(subject: SubjectRef<S>): AsyncResult<StatusState>;
   /**
    * Status changes, newest first; page with the last `createdAt` as `cursor`.
    * Default 50, at most 500.
    */
-  history(subjectType: S, subjectId: string, page?: CursorPageOptions<Temporal.Instant>): AsyncResult<readonly StatusChange[]>;
+  history(subject: SubjectRef<S>, page?: CursorPageOptions<Temporal.Instant>): AsyncResult<readonly StatusChange[]>;
   /**
    * The stages timeline in display order; empty for a machine without `stages:
    * true`.
    */
-  stages(subjectType: S, subjectId: string): AsyncResult<readonly StatusStage[]>;
+  stages(subject: SubjectRef<S>): AsyncResult<readonly StatusStage[]>;
 }
 /** The `state-machine` SQL module as typed calls. */
 export declare function createStateMachine<S extends string = string>(options: StateMachineOptions<S>): StateMachine<S>;