better-supabase 0.13.0 → 0.15.0

package/dist/create/lite/index.d.ts

@@ -64,7 +64,7 @@ export interface DesignIssue {
  * A module PGlite can't run, such as one that needs an extension it doesn't
  * ship.
  */
-export interface SkippedModule {
+export interface SkippedBlock {
   readonly module: string;
   readonly reason: string;
 }
@@ -72,7 +72,7 @@ export interface DesignValidation {
   /** `true` when every file that could run applied cleanly. */
   readonly ok: boolean;
   readonly issues: readonly DesignIssue[];
-  readonly skipped: readonly SkippedModule[];
+  readonly skipped: readonly SkippedBlock[];
   /** Tables in `public` after the files applied. */
   readonly tables: number;
 }

package/dist/create/supabase/index.d.ts

@@ -4,8 +4,8 @@ import { a as isFlow, c as pkcePair, d as unseal, i as OAuthSession, l as random
 export declare const SUPABASE_API: string;
 /** Where the session and the in-flight authorization live. */
 export declare const COOKIE_PATH: string;
-export declare const SESSION_COOKIE = "bs_supabase";
-export declare const FLOW_COOKIE = "bs_supabase_flow";
+export declare const SESSION_COOKIE = "bsb_supabase";
+export declare const FLOW_COOKIE = "bsb_supabase_flow";
 /** A flow cookie older than this is ignored, so a stale tab can't finish one. */
 export declare const FLOW_MAX_AGE = 600;
 /** The session cookie outlives the access token; the refresh token renews it. */

package/dist/create/supabase/index.js

@@ -21,8 +21,8 @@ function arrayOf(read) {
 const SUPABASE_API = "https://api.supabase.com";
 /** Where the session and the in-flight authorization live. */
 const COOKIE_PATH = "/create/supabase";
-const SESSION_COOKIE = "bs_supabase";
-const FLOW_COOKIE = "bs_supabase_flow";
+const SESSION_COOKIE = "bsb_supabase";
+const FLOW_COOKIE = "bsb_supabase_flow";
 /** A flow cookie older than this is ignored, so a stale tab can't finish one. */
 const FLOW_MAX_AGE = 600;
 /** The session cookie outlives the access token; the refresh token renews it. */

package/dist/create-blocks-Bu4H5TXw.js

@@ -0,0 +1,352 @@
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { i as entityNames, o as tenantNames, r as composeNames } from "./entity-naming-Dtyq5sKE.js";
+import { t as onBlockEvent } from "./block-event-listener-Bu6G0TFH.js";
+import { B as dbTransport } from "./block-helpers-CtBdjgO4.js";
+import { i as wrapTransport, r as withBlockHooks, t as defineTransportMiddleware } from "./block-hooks-BfxX3682.js";
+import { i as forwardBlockEvents } from "./cloud-event-XsM53POL.js";
+//#region src/core/block-names.ts
+const TENANT_COLUMNS = ["organization_id", "active_organization_id"];
+const OPAQUE_KEYS = /* @__PURE__ */ new Set(["fields", "metadata"]);
+const KEY_VALUES = /* @__PURE__ */ new Set(["field"]);
+function isPlainObject(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+function renameEntry(key, value, rename) {
+	if (OPAQUE_KEYS.has(key)) return value;
+	if (KEY_VALUES.has(key) && typeof value === "string") return rename(value);
+	return renameKeys(value, rename);
+}
+/**
+* `value` with every key of every plain object in it passed through `rename`,
+* and the column a `field` names, leaving the values under `fields` and
+* `metadata` alone.
+*/
+function renameKeys(value, rename) {
+	if (Array.isArray(value)) return value.map((each) => renameKeys(each, rename));
+	if (!isPlainObject(value)) return value;
+	return Object.fromEntries(Object.entries(value).map(([key, each]) => [rename(key), renameEntry(key, each, rename)]));
+}
+/** The arguments with the keys nested inside them renamed; parameter names stay. */
+function renameArgs(args, entities) {
+	return Object.fromEntries(Object.entries(args).map(([key, value]) => [key, renameEntry(key, value, (each) => entities.rename(each))]));
+}
+/**
+* Transport middleware that calls each block function by the name the SQL wrote
+* it under and translates the payload keys: `create_organization` becomes
+* `create_workspace` with `tenant: "workspace"`, `list_work_items` becomes
+* `list_tasks` with `work_item` renamed to `task`, then `functions` renames
+* single functions. Keys inside the arguments (`projectId`) go out renamed, and
+* the keys of the result come back by their default names, so the block's
+* client reads what it always has. Wrap a block's transport with it when the
+* config sets `blocks.<name>.entities` or `blocks.<name>.functions`;
+* `defineBlocks` does it from `blocks.generated.ts`.
+*/
+function blockNames(naming) {
+	const tenant = tenantNames(naming.tenant);
+	const entities = entityNames(naming.entities);
+	const names = composeNames(tenant, entities);
+	const functions = naming.functions ?? {};
+	const rename = (fn) => {
+		const renamed = names.rename(fn);
+		return functions[fn] ?? functions[renamed] ?? renamed;
+	};
+	const columns = new Map(TENANT_COLUMNS.map((column) => [tenant.rename(column), column]));
+	const restore = (key) => columns.get(key) ?? entities.reverse(key);
+	return defineTransportMiddleware({
+		name: "block-names",
+		call: async (request, next) => {
+			const result = await next({
+				...request,
+				fn: rename(request.fn),
+				...entities.renamed ? { args: renameArgs(request.args, entities) } : {}
+			});
+			return names.renamed ? renameKeys(result, restore) : result;
+		}
+	});
+}
+//#endregion
+//#region src/blocks/block-config.ts
+/**
+* The options a block's creator gets from its generated entry: the schema it
+* calls (the API schema when there is one, since the wrappers there are what
+* the caller may run) and the shared options. `defineBlocks` passes them;
+* spread them into a creator you call yourself: `createAiChat({
+* ...generatedOptions(blockConfig["ai-chat"]), transport })`.
+*/
+function generatedOptions(entry) {
+	return {
+		...entry.options,
+		schema: entry.api ?? entry.schema
+	};
+}
+/**
+* A realtime topic template from `blocks.generated.ts` with its placeholders
+* filled in, such as the notifications topic `notifications:{userId}`.
+*/
+function fillTopic(template, values) {
+	return template.replaceAll(/\{([A-Za-z]+)\}/g, (match, name) => {
+		const value = values[name];
+		if (value === void 0) throw new TypeError(`fillTopic: no value for ${match} in "${template}"`);
+		return value;
+	});
+}
+//#endregion
+//#region src/blocks/create-blocks.ts
+/** The CloudEvents `source` of block events that `createBlocks` forwards. */
+const BLOCK_EVENT_SOURCE = "/better-supabase/blocks";
+/**
+* The blocks an app uses, built with `blockConfig` from `blocks.generated.ts`
+* (`better-supabase gen`), so each block's schema and the options its SQL half
+* shares come from the `blocks` config, and the app's own events
+* (`defineEvents`). The event types are the union of every block's events, so
+* `on` and `events` type each one's data without `declare module` (invariant
+* 2).
+*/
+function defineBlocks(config, blocks, ...appEvents) {
+	const events = { types: [.../* @__PURE__ */ new Set([...Object.values(blocks).flatMap((block) => block.events.types), ...appEvents.flatMap((each) => each.types)])] };
+	const created = (key) => blocks[key]?.create !== void 0;
+	const api = Object.values(config).find((entry) => entry.api !== void 0)?.api;
+	const surfaces = /* @__PURE__ */ new Map();
+	return {
+		blocks,
+		instances: Object.keys(blocks).filter(created),
+		config,
+		events,
+		create: (options) => buildBlocks({
+			...options,
+			config
+		}, blocks),
+		call: (db, fn, args) => {
+			if (api === void 0) return Promise.reject(/* @__PURE__ */ new TypeError("better-supabase: no block has an API schema (`sql.api`) to call"));
+			return dbTransport(db).call(api, fn, args);
+		},
+		client: (db, key, options = {}) => blockBuilder(clientContext(db, {
+			config,
+			...options
+		}), blocks).build(String(key)),
+		describe: (key) => {
+			if (!surfaces.has(key)) surfaces.set(key, describeInstance(config, blocks, key));
+			return surfaces.get(key);
+		},
+		on: (betterSupabase, pattern, handler) => onBlockEvent(betterSupabase, events, pattern, handler)
+	};
+}
+/**
+* Client functions that are wiring, not calls: route and webhook handlers,
+* outbox sinks, job definitions, signers and sync checks.
+*/
+const NOT_VERBS = /^(?:sink|handler|job|webhook|signer|transmitter|receiver|partnerApi|isApiKey)$|[a-z](?:Route|Response|Sink|Job)$/u;
+const NO_TRANSPORT = { call: () => Promise.reject(/* @__PURE__ */ new TypeError("better-supabase: describe() has no db")) };
+function methodsOf(client) {
+	return Object.entries(client).flatMap(([name, value]) => typeof value === "function" && !NOT_VERBS.test(name) ? [name] : []);
+}
+/** Builds a client that can't call anything and reads its methods. */
+function describeInstance(config, blocks, key) {
+	const block = blocks[key];
+	if (block?.create === void 0) return;
+	let client;
+	try {
+		client = blockBuilder({
+			config,
+			transport: NO_TRANSPORT,
+			tenant: () => void 0
+		}, blocks).build(key);
+	} catch {
+		return;
+	}
+	if (!isRecord(client)) return;
+	const members = {};
+	for (const [name, value] of Object.entries(client)) if (isRecord(value) && !NOT_VERBS.test(name)) {
+		const methods = methodsOf(value);
+		if (methods.length > 0) members[name] = methods;
+	}
+	return {
+		block: block.name,
+		methods: methodsOf(client),
+		members,
+		schemas: block.schemas ?? {}
+	};
+}
+/**
+* Builds `blocks` with one set of options and wires them on their ports. Each
+* block gets its schema and shared options from its entry in `config`
+* (`blocks.generated.ts`), keyed by the block's name. Each block that consumes
+* a port (`notifier`, `files`, `attachments`, `workflows`) gets it from the one
+* block in the set that provides it, and `sinks` holds the outbox sinks the
+* blocks provide. `credentials` reaches every block, and block events go to
+* `audit`. Only the blocks you pass are imported, so the rest stay out of the
+* bundle. `hooks` wraps each block's methods with `withBlockHooks`, and the
+* ports are built from the wrapped clients, so a sibling's calls (ai-schedules
+* sending notifications) go through the hooks too.
+*/
+function createBlocks(options, blocks) {
+	return buildBlocks(options, blocks);
+}
+/**
+* One block's client over a `Db`: its calls run through `dbTransport(db)` and
+* act in the `Db`'s tenant (`db.$context.tenant`) unless `options.tenant` names
+* one. Pass `config: blockConfig` so it calls the schema and function names
+* `gen` wrote; `BlockSet.client(db, key)` does that for you.
+*
+* ```ts
+* const comments = createBlockClient(ctx.db, commentsBlock, {
+*   config: blockConfig,
+* });
+* ```
+*/
+function createBlockClient(db, block, options = {}) {
+	const { hooks, instance, ...rest } = options;
+	const key = instance ?? block.name;
+	return blockBuilder({
+		...clientContext(db, rest),
+		...hooks === void 0 ? {} : { hooks: { [key]: hooks } }
+	}, { [key]: block }).build(key);
+}
+function clientContext(db, options) {
+	const { hooks, instance: _instance, ...rest } = options;
+	return {
+		tenant: () => db.$context?.tenant,
+		...rest,
+		transport: rest.transport ?? dbTransport(db),
+		...hooks === void 0 ? {} : { hooks }
+	};
+}
+const UNIQUE_PORTS = [
+	"notifier",
+	"files",
+	"attachments",
+	"workflows",
+	"mailer"
+];
+/** `key`'s entry in `hooks`, which `BlocksHooks` keys like the blocks. */
+function hooksOf(hooks, key) {
+	if (hooks === void 0) return;
+	const entry = Object.entries(hooks).find(([name]) => name === key)?.[1];
+	return isRecord(entry) ? entry : void 0;
+}
+/** Builds the blocks of `blocks` on demand, each one once, wired on ports. */
+function blockBuilder(options, blocks) {
+	const { audit: _audit, hooks, config, ports: bound, ...shared } = options;
+	const blockOf = (key) => {
+		const block = blocks[key];
+		if (block === void 0) throw new TypeError(`No block named "${key}"`);
+		return block;
+	};
+	/** `key`'s generated entry: under its key, else under its block's name. */
+	const entryOf = (key) => {
+		const block = blockOf(key);
+		const own = config?.[key];
+		if (own === void 0) return config?.[block.name];
+		if ((own.block ?? key) !== block.name) throw new TypeError(`createBlocks: blocks.${key} installs the "${own.block ?? key}" block, not "${block.name}"`);
+		return own;
+	};
+	for (const port of UNIQUE_PORTS) {
+		const key = bound?.[port];
+		if (key !== void 0 && blocks[key]?.provides[port] === void 0) throw new TypeError(`createBlocks: ports.${port} names "${key}", which provides no ${port} port`);
+	}
+	/**
+	* The key of the block `key` takes `port` from: the only other block that
+	* provides it, else the one its `uses` names, else `ports[port]`.
+	*/
+	const providerOf = (key, port) => {
+		const keys = Object.keys(blocks).filter((each) => each !== key && blocks[each]?.provides[port] !== void 0);
+		if (keys.length <= 1) return keys[0];
+		const uses = Object.values(entryOf(key)?.uses ?? {});
+		const used = keys.filter((each) => uses.includes(each));
+		if (used.length === 1) return used[0];
+		const named = bound?.[port];
+		if (named !== void 0 && keys.includes(named)) return named;
+		throw new TypeError(`createBlocks: ${keys.map((each) => `"${each}"`).join(" and ")} all provide the ${port} port "${key}" consumes; set blocks.${key}.uses or pass ports.${port}`);
+	};
+	for (const [key, block] of Object.entries(blocks)) for (const port of UNIQUE_PORTS) {
+		const need = block.consumes[port];
+		if (need === void 0) continue;
+		if (providerOf(key, port) === void 0 && need === "required") throw new TypeError(`createBlocks: "${key}" needs a block that provides the ${port} port`);
+	}
+	const built = /* @__PURE__ */ new Map();
+	const building = /* @__PURE__ */ new Set();
+	/**
+	* The options `key`'s creator gets: shared, then its generated config, then
+	* ports, then `with` settings.
+	*/
+	const optionsOf = (key) => {
+		const ports = {};
+		for (const port of UNIQUE_PORTS) {
+			if (blockOf(key).consumes[port] === void 0) continue;
+			const provider = providerOf(key, port);
+			if (provider === void 0) continue;
+			const value = portOf(provider, port);
+			if (value !== void 0) ports[port] = value;
+		}
+		const block = blockOf(key);
+		const entry = entryOf(key);
+		return {
+			...shared,
+			...entry === void 0 ? {} : generatedOptions(entry),
+			...entry?.names === void 0 ? {} : renamedTransports(entry.names),
+			...ports,
+			...block.settings
+		};
+	};
+	/**
+	* `shared`'s transports, calling the block functions by the names the SQL
+	* gave them.
+	*/
+	function renamedTransports(naming) {
+		const middleware = blockNames(naming);
+		return {
+			transport: wrapTransport(shared.transport, middleware),
+			...shared.service === void 0 ? {} : { service: wrapTransport(shared.service, middleware) }
+		};
+	}
+	function portOf(key, port) {
+		const provide = blockOf(key).provides[port];
+		if (provide === void 0) return;
+		return provide(build(key), optionsOf(key));
+	}
+	function build(key) {
+		if (built.has(key)) return built.get(key);
+		const block = blockOf(key);
+		if (block.create === void 0) throw new TypeError(`The "${block.name}" block has only SQL; it has no client to build`);
+		if (building.has(key)) throw new TypeError(`The "${key}" block depends on itself`);
+		building.add(key);
+		try {
+			const create = block.create;
+			const created = create(optionsOf(key));
+			const blockHooks = hooksOf(hooks, key);
+			const client = blockHooks !== void 0 && isRecord(created) ? withBlockHooks(created, blockHooks, {
+				block: key,
+				...shared.events === void 0 ? {} : { logger: shared.events.logger }
+			}) : created;
+			built.set(key, client);
+			return client;
+		} finally {
+			building.delete(key);
+		}
+	}
+	return {
+		build,
+		portOf
+	};
+}
+function buildBlocks(options, blocks) {
+	const { audit, events } = options;
+	if (audit !== void 0 && events === void 0) throw new TypeError("createBlocks: `audit` needs `events` to forward");
+	const { build, portOf } = blockBuilder(options, blocks);
+	const result = {};
+	const sinks = {};
+	for (const [key, block] of Object.entries(blocks)) {
+		if (block.create === void 0) continue;
+		result[key] = build(key);
+		const sink = portOf(key, "sink");
+		if (sink !== void 0) sinks[key] = sink;
+	}
+	result["sinks"] = sinks;
+	const stop = audit === void 0 || events === void 0 ? void 0 : forwardBlockEvents({ events }, audit, { source: BLOCK_EVENT_SOURCE });
+	result["close"] = () => stop?.();
+	return result;
+}
+//#endregion
+export { fillTopic as a, renameKeys as c, defineBlocks as i, createBlockClient as n, generatedOptions as o, createBlocks as r, blockNames as s, BLOCK_EVENT_SOURCE as t };

package/dist/credentials/index.d.ts

@@ -1,8 +1,8 @@
-import { t as AsyncResult } from "../result-mijqfoJN.js";
-import { F as CredentialEventData, wt as Events } from "../events-DhGgwqQA.js";
-import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-Dmsbl8ug.js";
-import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-DBPhgF3W.js";
-import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-BQThkbws.js";
+import { t as AsyncResult } from "../result-DZeA5KS6.js";
+import { Ct as Events, P as CredentialEventData } from "../events-vcqenSYU.js";
+import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-CqwEOLCA.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-DWZSJrwN.js";
+import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-O-YlAyHb.js";
 //#region src/credentials/compose.d.ts
 /**
  * One provider over several: each call goes to the provider whose `name` is the

package/dist/credentials/index.js

@@ -1,12 +1,11 @@
-import { n as dbError } from "../errors-D7u24ZJH.js";
-import { a as ok, r as err, t as AsyncResult } from "../result-DIT_qp4G.js";
-import { a as tenantCredentialRef, i as subjectFor, n as credentialRefInTenant, r as foreignCredentialRef } from "../provider-BhIkKBOh.js";
+import { n as dbError } from "../errors-BVFgt8BZ.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-ntFBW2p2.js";
+import { B as dbTransport, H as rpcTransport, U as sqlTransport, o as blockCall } from "../block-helpers-CtBdjgO4.js";
+import { a as tenantCredentialRef, i as subjectFor, n as credentialRefInTenant, r as foreignCredentialRef } from "../provider-B6g7rBZX.js";
 import { n as event, t as defineEvents } from "../event-map-CtPFhcOp.js";
 import { n as hmacHex, r as timingSafeEqual } from "../hmac-B3CTTlfv.js";
-import { o as verifySharedSecret, s as verifyWebhook } from "../signatures-D8IoN3Rw.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-Ds0C2mUf.js";
-import { o as blockCall } from "../block-helpers-DwE32_gT.js";
-import { n as revokeIfConfigured, t as credentialRouter } from "../compose-VBQL7zIO.js";
+import { o as verifySharedSecret, s as verifyWebhook } from "../signatures-CNcoq392.js";
+import { n as revokeIfConfigured, t as credentialRouter } from "../compose-DKW0Tr3e.js";
 //#region src/credentials/vault.ts
 const MAX_CACHED = 256;
 const invalidRef = (message) => err(dbError("invalid_input", message, { hint: "CREDENTIAL_REF_INVALID" }));

package/dist/cron-CgHTKwYG.js

@@ -0,0 +1,148 @@
+import { t as temporal } from "./temporal-required-Dy0GGD8E.js";
+//#region src/blocks/queue/cron.ts
+const MACROS = {
+	"@yearly": "0 0 1 1 *",
+	"@annually": "0 0 1 1 *",
+	"@monthly": "0 0 1 * *",
+	"@weekly": "0 0 * * 0",
+	"@daily": "0 0 * * *",
+	"@midnight": "0 0 * * *",
+	"@hourly": "0 * * * *"
+};
+const MONTHS = [
+	"jan",
+	"feb",
+	"mar",
+	"apr",
+	"may",
+	"jun",
+	"jul",
+	"aug",
+	"sep",
+	"oct",
+	"nov",
+	"dec"
+];
+const WEEKDAYS = [
+	"sun",
+	"mon",
+	"tue",
+	"wed",
+	"thu",
+	"fri",
+	"sat"
+];
+/** Replaces `JAN` or `MON` style names with their numbers. */
+function named(text, names, first) {
+	return text.replaceAll(/[a-z]{3}/gi, (name) => {
+		const index = names.indexOf(name.toLowerCase());
+		return index === -1 ? name : String(index + first);
+	});
+}
+const INTERVAL = /^(\d+)\s+(second|minute|hour)s?$/i;
+/** Gives up when no minute matches within this many days (`0 0 30 2 *`). */
+const SEARCH_DAYS = 1830;
+function invalid(expression, reason) {
+	return /* @__PURE__ */ new TypeError(`Invalid cron "${expression}": ${reason}`);
+}
+function field(expression, text, min, max) {
+	const values = /* @__PURE__ */ new Set();
+	for (const part of text.split(",")) {
+		const match = /^(\*|\d+(?:-\d+)?)(?:\/(\d+))?$/.exec(part);
+		if (!match) throw invalid(expression, `"${part}" is not a cron field`);
+		const [, range = "", stepText] = match;
+		const step = stepText === void 0 ? 1 : Number(stepText);
+		let from = min;
+		let to = max;
+		if (range !== "*") {
+			const [start = "", end] = range.split("-");
+			from = Number(start);
+			to = end === void 0 ? stepText === void 0 ? from : max : Number(end);
+		}
+		if (step < 1 || from < min || to > max || from > to) throw invalid(expression, `"${part}" is outside ${String(min)}-${String(max)}`);
+		for (let value = from; value <= to; value += step) values.add(value);
+	}
+	return [...values].toSorted((a, b) => a - b);
+}
+function parse(expression) {
+	const parts = (MACROS[expression.trim().toLowerCase()] ?? expression).trim().split(/\s+/);
+	if (parts.length !== 5) throw invalid(expression, "expected 5 fields (minute hour day month weekday)");
+	const [minute = "", hour = "", day = "", monthText = "", weekdayText = ""] = parts;
+	const month = named(monthText, MONTHS, 1);
+	const weekday = named(weekdayText, WEEKDAYS, 0);
+	return {
+		minutes: field(expression, minute, 0, 59),
+		hours: field(expression, hour, 0, 23),
+		days: new Set(field(expression, day, 1, 31)),
+		months: new Set(field(expression, month, 1, 12)),
+		weekdays: new Set(field(expression, weekday, 0, 7).map((value) => value === 0 ? 7 : value)),
+		daysRestricted: day !== "*",
+		weekdaysRestricted: weekday !== "*"
+	};
+}
+function dayMatches(fields, date) {
+	if (!fields.months.has(date.month)) return false;
+	const day = fields.days.has(date.day);
+	const weekday = fields.weekdays.has(date.dayOfWeek);
+	if (fields.daysRestricted && fields.weekdaysRestricted) return day || weekday;
+	if (fields.daysRestricted) return day;
+	if (fields.weekdaysRestricted) return weekday;
+	return true;
+}
+/**
+* The first matching minute of `date` after `after`, from `start` on its first
+* day.
+*/
+function firstRunOn(fields, date, start, timeZone, after) {
+	for (const hour of fields.hours) {
+		if (start && hour < start.hour) continue;
+		for (const minute of fields.minutes) {
+			if (hour === start?.hour && minute < start.minute) continue;
+			const instant = date.toPlainDateTime({
+				hour,
+				minute
+			}).toZonedDateTime(timeZone, { disambiguation: "compatible" }).toInstant();
+			if (temporal().Instant.compare(instant, after) > 0) return instant;
+		}
+	}
+}
+/**
+* Throws a `TypeError` unless `expression` is a schedule `nextCronRun`
+* understands: five cron fields, a macro such as `@daily`, or an interval such
+* as `30 seconds`.
+*/
+function assertCron(expression) {
+	if (!INTERVAL.test(expression.trim())) parse(expression);
+}
+/**
+* The first run of `expression` after `after`, in `timeZone`.
+*
+* Accepts five cron fields (lists, ranges and steps; a restricted day of month
+* and day of week match either, as in cron), the macros `@hourly`, `@daily`,
+* `@weekly`, `@monthly` and `@yearly`, and intervals such as `30 seconds`, `5
+* minutes` or `2 hours`, counted from `after`. A local time that a DST change
+* skips runs at the same offset after the gap.
+*/
+function nextCronRun(expression, timeZone, after) {
+	const interval = INTERVAL.exec(expression.trim());
+	if (interval) {
+		const amount = Number(interval[1]);
+		if (amount < 1) throw invalid(expression, "the interval must be positive");
+		const unit = interval[2].toLowerCase();
+		return after.add(unit === "second" ? { seconds: amount } : unit === "minute" ? { minutes: amount } : { hours: amount });
+	}
+	const fields = parse(expression);
+	const start = after.toZonedDateTimeISO(timeZone).toPlainDateTime().round({
+		smallestUnit: "minute",
+		roundingMode: "floor"
+	}).add({ minutes: 1 });
+	let date = start.toPlainDate();
+	for (let offset = 0; offset < SEARCH_DAYS; offset += 1) {
+		const found = dayMatches(fields, date) && firstRunOn(fields, date, offset === 0 ? start : void 0, timeZone, after);
+		if (found) return found;
+		date = date.add({ days: 1 });
+	}
+	throw invalid(expression, "it never matches a date");
+}
+//#endregion
+export { nextCronRun as n, assertCron as t };

package/dist/cron-route-UU9i5i9J.js

@@ -0,0 +1,24 @@
+import { n as dbError } from "./errors-BVFgt8BZ.js";
+import { a as methodNotAllowed, o as problemResponse } from "./problem-Bf0cJ7tk.js";
+import { o as verifySharedSecret } from "./signatures-CNcoq392.js";
+//#region src/core/cron-route.ts
+/**
+* A `GET` or `POST` handler for a cron caller such as Vercel Cron. It throws
+* when the secret is missing, answers 405 to other methods and 401 without the
+* bearer secret, and only then calls `handle` with the request path.
+*/
+function cronRoute(guard, handle) {
+	const { name, secret } = guard;
+	if (!secret) throw new TypeError(`${name}Route needs a secret, such as process.env.CRON_SECRET`);
+	return async (request) => {
+		const instance = new URL(request.url).pathname;
+		if (request.method !== "GET" && request.method !== "POST") return methodNotAllowed(["GET", "POST"]);
+		if (!verifySharedSecret(request, secret)) return problemResponse(dbError("unauthorized", `The ${name} route needs its bearer secret`), {
+			instance,
+			format: guard.problem
+		});
+		return handle(request, instance);
+	};
+}
+//#endregion
+export { cronRoute as t };