better-supabase 0.13.0 → 0.15.0

package/dist/next/index.js

@@ -1,23 +1,28 @@
-import { t as DbException } from "../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../errors-D7u24ZJH.js";
-import { r as err } from "../result-DIT_qp4G.js";
+import { t as DbException } from "../db-exception-Lngc1W49.js";
+import { n as dbError } from "../errors-BVFgt8BZ.js";
 import { t as isList } from "../guards-6F2bCtQR.js";
-import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-Bt1RyT-F.js";
-import { o as isReadSet } from "../read-set-DP6fm21F.js";
-import { n as validate } from "../standard-l10kE0yS.js";
-import { o as problemResponse } from "../problem-D0KDiYPk.js";
+import { r as err } from "../result-ntFBW2p2.js";
+import { o as isReadSet } from "../read-set-BnKnofIj.js";
+import { n as validate } from "../standard-BA3mLh6w.js";
+import { n as StatsRecorder, t as EMPTY_STATS } from "../stats-BHl1-zj9.js";
+import { o as problemResponse } from "../problem-Bf0cJ7tk.js";
 import { i as claimsOf } from "../claims-Bp9My7XP.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { t as tenantOf } from "../tenant-DnMqeNIM.js";
-import { T as serverCore, b as isPrefetch, c as extendServer, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as outageResponse } from "../adapter-D8dW6p2A.js";
-import { a as checkAal, n as toSession } from "../view-CfUd5vI9.js";
-import { o as settle, r as guard, t as defaultExpose } from "../respond-DjEmE_DN.js";
-import { t as supportSessions } from "../support-CWVTM2AB.js";
-import { r as defineAction } from "../resource-BVvIiuX_.js";
-import { r as tagFor, t as cacheTagsOf } from "../tags-C_ym1yDM.js";
-import { i as requireCaller, n as formDataObject, t as authorizeCaller } from "../kit-BeXTrlZn.js";
+import { n as createBlockClient } from "../create-blocks-Bu4H5TXw.js";
+import { a as recordCan, c as recordWriteInput, i as plainData, l as runBindingWrite, o as recordPermissionKeys, p as loadBindings, r as findBindingWrite, s as recordSubject, t as bindingWrites } from "../record-type-DRbnlj5q.js";
+import { n as methodOf } from "../block-method-C9hWdHom.js";
+import { t as tenantOf } from "../tenant-BgIiMQpo.js";
+import { t as loadTimeline } from "../timeline--VU3A1e4.js";
+import { T as serverCore, b as isPrefetch, c as extendServer, n as flushEvents, p as supportCookieMaxAge, r as handle, s as createServer, t as bearerRequest, v as outageResponse } from "../adapter-B0b6MXYS.js";
+import { g as sessionCookieName, t as clientIp, v as writeSession } from "../resolve-B0mW2m7f.js";
+import { a as isSessionSnapshot, f as checkAal, i as authzVersionOf, n as toSession, o as issuedAtOf, s as sessionCacheKey } from "../view-C8Ve14ja.js";
+import { o as settle, r as guard, t as defaultExpose } from "../respond-C3CcOZlA.js";
+import { i as supportSessions, n as passwordGrant, r as safeRedirectPath, t as needsMfa } from "../sign-in-DNCdrk05.js";
+import { i as defineAction } from "../resource-DV2GC2dB.js";
+import { r as tagFor, t as cacheTagsOf } from "../tags-CIZTqtlY.js";
+import { i as requireCaller, n as formDataObject, t as authorizeCaller } from "../kit-5l-o8RxL.js";
 import { t as withExtra } from "../extra-CGQ2_q3S.js";
-import { n as resourceRouter } from "../resources-CIi7sw1T.js";
+import { n as resourceRouter } from "../resources-C02l_YBJ.js";
 import { cache } from "react";
 import { cacheLife, cacheTag, io, revalidateTag, updateTag } from "next/cache.js";
 import { cookies, headers } from "next/headers.js";
@@ -26,9 +31,9 @@ import { forbidden } from "next/dist/client/components/forbidden.js";
 import { notFound } from "next/dist/client/components/not-found.js";
 import { unauthorized } from "next/dist/client/components/unauthorized.js";
 //#region src/next/cache.ts
-/** The tag `bs.cached()` adds to entries rendered in a support session. */
+/** The tag `bsb.cached()` adds to entries rendered in a support session. */
 function supportTag(sessionId) {
-	return `bs:support:${sessionId}`;
+	return `bsb:support:${sessionId}`;
 }
 /** The shortest time the Next.js client router keeps a prefetched entry. */
 const MIN_CLIENT_STALE = 30;
@@ -55,9 +60,16 @@ function sessionStale(session, options = {}, now = Date.now()) {
 		default: return session;
 	}
 }
-/** The tag `bs.cached()` puts on a user's entries. */
+/** The tag `bsb.cached()` puts on a user's entries. */
 function sessionTag(userId) {
-	return `bs:session:${userId}`;
+	return `bsb:session:${userId}`;
+}
+/**
+* The tag `bsb.cached()` puts on the entries of one Auth session
+* (`SessionSnapshot.sessionId`): invalidate it to drop one device's entries.
+*/
+function sessionIdTag(sessionId) {
+	return `bsb:session-id:${sessionId}`;
 }
 /**
 * The table tags of a read: the tenant's and every tenant's, or the table's. A
@@ -86,9 +98,9 @@ function invalidateAll(tags, profile = EXPIRE_NOW) {
 	} catch {}
 }
 /**
-* Invalidates `bs:<table>` for every table in the target, the tenant's
-* `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has no
-* tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
+* Invalidates `bsb:<table>` for every table in the target, the tenant's
+* `bsb:<table>@<tenant>` (every tenant's `bsb:<table>@*` when the mutation has
+* no tenant) and `bsb:<table>:<id>` for the changed rows. Reads another tenant
 * tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
 */
 function nextCache(options = {}) {
@@ -109,7 +121,7 @@ const nextCacheAttached = /* @__PURE__ */ new WeakSet();
 //#endregion
 //#region src/next/collector.ts
 /** Forwarded by the proxy so every scope of one render shares an id. */
-const REQUEST_ID_HEADER = "x-bs-request-id";
+const REQUEST_ID_HEADER = "x-bsb-request-id";
 var CollectedRecorder = class extends StatsRecorder {
 	#onIdle;
 	constructor(onIdle) {
@@ -259,8 +271,8 @@ const REQUEST_PREFIX = "x-middleware-request-";
 /** A response whose headers can be changed (`Response.redirect()`'s cannot). */
 function mutableResponse(response) {
 	try {
-		response.headers.append("x-bs-probe", "1");
-		response.headers.delete("x-bs-probe");
+		response.headers.append("x-bsb-probe", "1");
+		response.headers.delete("x-bsb-probe");
 		return response;
 	} catch {
 		return new NextResponse(response.body, {
@@ -291,11 +303,160 @@ function overrideRequestHeaders(response, request, set) {
 	response.headers.set(OVERRIDE, [...current.keys()].join(","));
 	for (const [name, value] of current) response.headers.set(`${REQUEST_PREFIX}${name}`, value);
 }
-/** `bs-proxy;dur=1.2, bs-verify;dur=0.4`, per W3C Server Timing. */
+/** `bsb-proxy;dur=1.2, bsb-verify;dur=0.4`, per W3C Server Timing. */
 function serverTimingValue(metrics) {
 	return Object.entries(metrics).map(([name, ms]) => `${name};dur=${ms.toFixed(1)}`).join(", ");
 }
 //#endregion
+//#region src/next/records.ts
+/**
+* The cache tag of a record's header and tab badges (`record_summary`):
+* `bsb:record@<tenant>:<type>:<id>`, or `bsb:record:<type>:<id>` without a
+* tenant.
+*/
+function recordTag(subject, options = {}) {
+	return `bsb:record${options.tenant === void 0 || options.tenant === null ? "" : `@${options.tenant}`}:${subject.type}:${subject.id}`;
+}
+/** The cache tag of one binding of a record, such as its comments. */
+function bindingTag(subject, binding, options = {}) {
+	return `${recordTag(subject, options)}#${binding}`;
+}
+/**
+* Drops the cached binding and the record's header, whose counts change with
+* it: `updateTag` in a Server Action, else `revalidateTag`.
+*/
+function invalidateBinding(subject, binding, options = {}) {
+	invalidateAll([bindingTag(subject, binding, options), recordTag(subject, options)], options.revalidate);
+}
+//#endregion
+//#region src/next/record.ts
+/**
+* The options every block client of the record type is built with: the
+* generated config, and the caller's storage for the blocks that keep files.
+*/
+function clientOptions(feature, ctx) {
+	const storage = ctx.supabase?.storage;
+	return {
+		...feature.config === void 0 ? {} : { config: feature.config },
+		...storage === void 0 ? {} : { storage }
+	};
+}
+function clientsOf(feature, ctx) {
+	const options = clientOptions(feature, ctx);
+	return Object.fromEntries(Object.entries(feature.blocks).map(([key, block]) => [key, createBlockClient(ctx.db, block, options)]));
+}
+async function permissionsOf(feature, db) {
+	const keys = recordPermissionKeys(feature);
+	if (feature.access === void 0 || keys.length === 0) return { set: void 0 };
+	const result = await createBlockClient(db, feature.access, feature.config === void 0 ? {} : { config: feature.config }).permissions(keys);
+	return result.ok ? { set: result.data } : {
+		set: null,
+		error: result.error
+	};
+}
+function readableSections(can) {
+	return new Map(Object.entries(can).map(([name, entry]) => [name, entry.read]));
+}
+/**
+* The server half of a generated record type for Next.js: a loader for Server
+* Components and one Server Action per binding write. Each action builds the
+* block's client over the caller's `Db` (its tenant), runs the write, and drops
+* the binding's and the record's cache tags (`invalidateBinding`).
+*
+* ```ts
+* const customer = bsb.record(customerRecord);
+* const view = await customer.load(id, { bindings: ["comments"] });
+* ```
+*/
+function recordServer(bsb, feature) {
+	const actionOf = (binding, write) => {
+		const found = findBindingWrite(feature, binding, write);
+		const block = found === void 0 ? void 0 : feature.blocks[found.key];
+		if (found === void 0 || block === void 0) throw new TypeError(`bsb.record: binding "${binding}" has no write "${write}"`);
+		return bsb.action({
+			input: recordWriteInput(found.write.input),
+			requireOrganization: true
+		}, async ({ id, input }, ctx) => {
+			const subject = recordSubject(feature, id);
+			const result = await runBindingWrite(feature, { [found.key]: createBlockClient(ctx.db, block, clientOptions(feature, ctx)) }, binding, write, subject, input);
+			if (!result.ok) return result;
+			invalidateBinding(subject, binding, { tenant: ctx.tenant });
+			return {
+				...result,
+				data: plainData(result.data)
+			};
+		});
+	};
+	return {
+		async load(id, options = {}) {
+			const ctx = await bsb.context();
+			const subject = recordSubject(feature, id);
+			const permissions = await permissionsOf(feature, ctx.db);
+			const can = recordCan(feature, permissions.set);
+			const readable = readableSections(can);
+			const names = options.bindings ?? feature.bindings;
+			const loaded = await loadBindings({
+				blocks: feature.blocks,
+				clients: clientsOf(feature, ctx)
+			}, subject, names, {
+				can: ({ binding }) => readable.get(binding) ?? true,
+				...options.options === void 0 ? {} : { options: options.options }
+			});
+			return {
+				subject,
+				bindings: plainData(loaded),
+				can,
+				...permissions.error === void 0 ? {} : { permissionsError: permissions.error }
+			};
+		},
+		async timeline(id, options = {}) {
+			const ctx = await bsb.context();
+			const permissions = await permissionsOf(feature, ctx.db);
+			const readable = readableSections(recordCan(feature, permissions.set));
+			const timeline = await loadTimeline({
+				blocks: feature.blocks,
+				clients: clientsOf(feature, ctx)
+			}, recordSubject(feature, id), {
+				...options,
+				can: ({ binding }) => readable.get(binding) ?? true
+			});
+			return plainData(timeline);
+		},
+		actions: Object.fromEntries(bindingWrites(feature).map(([binding, writes]) => [binding, Object.fromEntries(writes.map((write) => [write, actionOf(binding, write)]))])),
+		tags(id, tenant) {
+			const subject = recordSubject(feature, id);
+			const scope = { tenant };
+			return [recordTag(subject, scope), ...feature.bindings.map((binding) => bindingTag(subject, binding, scope))];
+		}
+	};
+}
+/**
+* The server half of a `defineRecordList` for Next.js: it builds the record
+* type's block clients and the caller's permissions, then runs
+* `recordList.load`.
+*
+* ```ts
+* const customers = recordListServer(bsb, customerRecordList);
+* const view = await customers.load(await searchParams);
+* ```
+*/
+function recordListServer(bsb, recordList) {
+	const { feature } = recordList;
+	return { async load(input, options) {
+		const ctx = await bsb.context();
+		const permissions = await permissionsOf(feature, ctx.db);
+		const result = await recordList.load({
+			db: ctx.db,
+			clients: clientsOf(feature, ctx),
+			...permissions.set === void 0 ? {} : { permissions: permissions.set }
+		}, input, options);
+		return result.ok ? {
+			...result,
+			data: plainData(result.data)
+		} : result;
+	} };
+}
+//#endregion
 //#region src/next/resources.ts
 /** One handler for every method; the resource router picks the operation. */
 function resourceRoutes(serve) {
@@ -308,9 +469,45 @@ function resourceRoutes(serve) {
 	};
 }
 //#endregion
+//#region src/next/sign-in.ts
+/**
+* Signs in on the server, writes the session cookies through the request's
+* cookie jar and returns the same-origin path to go to next.
+*/
+async function signInWithPassword(credentials, options, deps) {
+	const { env, auth } = deps;
+	const secretKey = env.secretKey;
+	const ip = secretKey && auth?.clientIp !== false ? (auth?.clientIp ?? clientIp)(deps.request) : void 0;
+	const granted = await passwordGrant({
+		email: credentials.email,
+		password: credentials.password
+	}, {
+		url: env.url,
+		publishableKey: env.publishableKey,
+		...secretKey && ip ? { forwardedFor: {
+			ip,
+			secretKey
+		} } : {},
+		...auth?.fetch ? { fetch: auth.fetch } : {},
+		...auth?.refreshTimeoutMs === void 0 ? {} : { timeoutMs: auth.refreshTimeoutMs }
+	});
+	if (!granted.ok) return granted;
+	const writes = writeSession(deps.jar.getAll(), auth?.cookie?.name ?? sessionCookieName(env.url), granted.data, auth?.cookie?.options, auth?.cookie?.encode === void 0 ? {} : { encode: auth.cookie.encode });
+	for (const write of writes) deps.jar.set(write.name, write.value, write.options);
+	await deps.seed(granted.data.access_token);
+	return {
+		ok: true,
+		data: {
+			redirectTo: safeRedirectPath(credentials.next, options.fallback ?? "/"),
+			mfa: needsMfa(granted.data)
+		},
+		error: null
+	};
+}
+//#endregion
 //#region src/next/support.ts
-/** Response header with the URL of the request's totals on `bs.debugRoute()`. */
-const STATS_URL_HEADER = "x-bs-stats";
+/** Response header with the URL of the request's totals on `bsb.debugRoute()`. */
+const STATS_URL_HEADER = "x-bsb-stats";
 function endedRedirect(request, path, reason) {
 	const target = new URL(path, request.url);
 	target.searchParams.set("reason", reason);
@@ -318,9 +515,16 @@ function endedRedirect(request, path, reason) {
 }
 function shouldCheckSession(request, options = {}) {
 	if (request.method !== "GET" && request.method !== "HEAD") return false;
-	if (isPrefetch(request)) return false;
-	if (request.headers.get("sec-fetch-dest") === "document") return true;
-	return options.paths?.includes(request.nextUrl.pathname) ?? false;
+	if (isPrefetch(request) || !isDocument(request)) return false;
+	return options.paths?.includes(request.nextUrl.pathname) ?? true;
+}
+/** A top-level page load, not an RSC request, a fetch or an iframe. */
+function isDocument(request) {
+	const h = request.headers;
+	if (h.get("rsc") === "1") return false;
+	const dest = h.get("sec-fetch-dest");
+	if (dest) return dest === "document";
+	return h.get("accept")?.includes("text/html") ?? false;
 }
 /**
 * Page loads, client navigations and server actions; never prefetches or
@@ -342,7 +546,7 @@ function shouldRefresh(request) {
 * it with your sign-in redirect.
 *
 * ```ts
-* bs.proxy(request, {
+* bsb.proxy(request, {
 *   protect: requireAal("aal2", {
 *     redirect: "/mfa",
 *     match: (path) => path.startsWith("/settings"),
@@ -370,7 +574,7 @@ function requireAal(level, options = {}) {
 * and cache tags, on top of `createServer`.
 *
 * ```ts
-* export const bs = createNext(betterSupabase);
+* export const bsb = createNext(betterSupabase);
 * ```
 */
 function createNext(betterSupabase, options = {}) {
@@ -382,8 +586,8 @@ function createNext(betterSupabase, options = {}) {
 		betterSupabase.cache(nextCache());
 	}
 	const debug = options.debug;
-	const statsHeader = debug?.header ?? "x-bs-db-calls";
-	const statsRoute = debug?.route ?? "/api/bs-stats";
+	const statsHeader = debug?.header ?? "x-bsb-db-calls";
+	const statsRoute = debug?.route ?? "/api/bsb-stats";
 	const development = process.env["NODE_ENV"] === "development";
 	const collector = debug?.enabled ? sharedCollector({
 		logger: betterSupabase.events.logger,
@@ -391,7 +595,7 @@ function createNext(betterSupabase, options = {}) {
 		...debug.budget ? { budget: debug.budget } : {}
 	}) : void 0;
 	const statsFor = (request) => {
-		const id = collector && request.headers.get("x-bs-request-id");
+		const id = collector && request.headers.get("x-bsb-request-id");
 		return id ? { stats: collector.recorderFor(id) } : {};
 	};
 	const waitUntil = (work) => {
@@ -414,26 +618,43 @@ function createNext(betterSupabase, options = {}) {
 	};
 	const incomingRequest = async () => new Request("http://next.local/", { headers: new Headers(await headers()) });
 	/**
+	* The incoming request, once its dynamic APIs are awaited. Auth reads cookies
+	* and then the clock: `io()` marks that as I/O for Cache Components without
+	* blocking a prefetch the way `connection()` does, and awaiting `cookies()`
+	* first keeps the clock read out of the static shell.
+	*/
+	const requestScope = async () => {
+		await io();
+		await cookies();
+		return incomingRequest();
+	};
+	const forget = (userId) => {
+		base.forgetSession(userId).catch((cause) => {
+			betterSupabase.events.logger.warn("Could not evict the user's session", { cause });
+		});
+	};
+	/**
 	* One token verification per render scope backs `context()`, `session()` and
 	* `cached()`.
 	*/
 	const incoming = cache(async () => {
-		await io();
-		const request = await incomingRequest();
+		const request = await requestScope();
+		await base.snapshot(request);
 		return {
 			request,
 			resolution: await base.resolve(request, { refresh: false })
 		};
 	});
+	const getRequestSession = cache(async () => base.snapshot(await requestScope()));
 	const tenantClaim = claimsOf(betterSupabase.meta).tenant;
 	/** The tenant `scoped` resolved for a context, when it wasn't the claim. */
 	const scopedTenants = /* @__PURE__ */ new WeakMap();
 	const tenantFor = (ctx, view) => scopedTenants.get(ctx) ?? tenantOf(view, tenantClaim);
 	/**
-	* `requireTenant`, `roles`, `permission` and `authorize`, for the context's
-	* tenant.
+	* `requireOrganization`, `roles`, `permission` and `authorize`, for the
+	* context's tenant.
 	*/
-	const authorizeCaller$1 = (ctx, checks, input) => authorizeCaller(ctx.auth, checks, input, tenantFor(ctx, toSession(ctx.auth)), options.authorizer, ctx);
+	const authorizeCaller$1 = (ctx, checks, input) => authorizeCaller(ctx.auth, checks, input, tenantFor(ctx, toSession(ctx.auth)), base.authorizer, ctx);
 	/** `null` runs `NextOptions.tenant`; a string is the caller's explicit tenant. */
 	const scoped = cache(async (explicit) => {
 		const { request, resolution } = await incoming();
@@ -449,7 +670,7 @@ function createNext(betterSupabase, options = {}) {
 	const context = (first, contextOptions) => first instanceof Request ? base.context(first, contextOptions) : current(first?.tenant ?? contextOptions?.tenant);
 	/** In a support session, the target's view: `impersonator` names the admin. */
 	const session = cache(async () => toSession(options.support ? (await current()).auth : (await incoming()).resolution.auth));
-	const supportCookieName = options.support?.options.cookie?.name ?? "bs-support";
+	const supportCookieName = options.support?.options.cookie?.name ?? "bsb-support";
 	const supportCookieOptions = {
 		httpOnly: true,
 		sameSite: "lax",
@@ -470,19 +691,23 @@ function createNext(betterSupabase, options = {}) {
 		context,
 		deleteAccount: ((userId, deleteOptions) => base.deleteAccount(userId, deleteOptions).map((result) => {
 			invalidateAll([sessionTag(userId)]);
+			forget(userId);
 			return result;
 		})),
 		endSessions: ((userId) => base.endSessions(userId).map((result) => {
 			invalidateAll([sessionTag(userId)]);
+			forget(userId);
 			return result;
 		})),
 		suspendAccount: ((userId, suspendOptions) => base.suspendAccount(userId, suspendOptions).map((result) => {
 			invalidateAll([sessionTag(userId)]);
+			forget(userId);
 			return result;
 		}))
 	});
-	return extendServer(withAccounts, {
+	const next = extendServer(withAccounts, {
 		session,
+		getRequestSession,
 		contextForSession,
 		async cached(cachedOptions = {}) {
 			const [view, ctx] = await Promise.all([session(), current(cachedOptions.tenant)]);
@@ -496,8 +721,11 @@ function createNext(betterSupabase, options = {}) {
 			const tables = cachedOptions.tables ?? [];
 			const tenant = tables.length > 0 ? tenantFor(ctx, view) : void 0;
 			const first = tables[0];
+			const claimed = ctx.auth.kind === "user" ? ctx.auth.claims["session_id"] : void 0;
+			const sessionId = typeof claimed === "string" ? claimed : void 0;
 			const tags = [
 				...view.kind === "user" ? [sessionTag(view.user.id)] : [],
+				...sessionId === void 0 ? [] : [sessionIdTag(sessionId)],
 				...ctx.support ? [supportTag(ctx.support.session.id)] : [],
 				...cachedOptions.tags ?? [],
 				...tables.flatMap((table) => tableTags(table, tenant === void 0 ? {} : { tenant })),
@@ -508,6 +736,7 @@ function createNext(betterSupabase, options = {}) {
 		},
 		invalidateSession(userId, invalidateOptions = {}) {
 			invalidateAll([sessionTag(userId), ...invalidateOptions.tags ?? []]);
+			forget(userId);
 		},
 		async liveCount(spec, db) {
 			const result = await (db ?? (await current()).db).$run(spec);
@@ -520,16 +749,22 @@ function createNext(betterSupabase, options = {}) {
 		async proxy(request, proxyOptions = {}) {
 			const started = performance.now();
 			const id = collector ? crypto.randomUUID() : void 0;
-			let verifyMs = 0;
+			let authMs = 0;
+			const phases = {};
 			const sessionCheck = proxyOptions.endedSession === true ? {} : proxyOptions.endedSession;
 			const checkSession = sessionCheck !== void 0 && shouldCheckSession(request, sessionCheck);
 			const [early, resolution] = await Promise.all([proxyOptions.before?.(request), base.resolve(request, {
 				refresh: shouldRefresh(request),
-				...checkSession ? { checkSession } : {}
+				...checkSession ? { checkSession } : {},
+				...proxyOptions.refreshSkewSeconds === void 0 ? {} : { leeway: proxyOptions.refreshSkewSeconds },
+				...proxyOptions.serverTiming ? { onTiming: (phase, ms) => {
+					phases[phase] = (phases[phase] ?? 0) + ms;
+				} } : {}
 			}).then((resolved) => {
-				verifyMs = performance.now() - started;
+				authMs = performance.now() - started;
 				return resolved;
 			})]);
+			if (resolution.cookies.length > 0) await base.sessions.seed(resolution.auth);
 			const rendersSignedOut = proxyOptions.expiredPrefetch === "render" && resolution.auth.kind === "anon" && resolution.auth.reason === "expired" && isPrefetch(request);
 			const protectMethods = proxyOptions.protectMethods;
 			const runsProtect = protectMethods === true ? true : (protectMethods ?? ["GET", "HEAD"]).includes(request.method);
@@ -555,8 +790,9 @@ function createNext(betterSupabase, options = {}) {
 				if (replaced) response = mutableResponse(replaced);
 			}
 			if (proxyOptions.serverTiming) response.headers.append("server-timing", serverTimingValue({
-				"bs-proxy": performance.now() - started,
-				"bs-verify": verifyMs
+				"bsb-proxy": performance.now() - started,
+				"bsb-auth": authMs,
+				...Object.fromEntries(Object.entries(phases).map(([phase, ms]) => [`bsb-${phase}`, ms]))
 			}));
 			flushAfter();
 			return response;
@@ -598,7 +834,7 @@ function createNext(betterSupabase, options = {}) {
 			const { basePath, ...guardOptions } = resourcesOptions;
 			const router = resourceRouter(betterSupabase, map, {
 				...basePath === void 0 ? {} : { basePath },
-				...options.authorizer === void 0 ? {} : { authorizer: options.authorizer }
+				...base.authorizer === void 0 ? {} : { authorizer: base.authorizer }
 			});
 			return resourceRoutes(async (request) => {
 				const route = router.match(request);
@@ -678,7 +914,7 @@ function createNext(betterSupabase, options = {}) {
 		},
 		require: async (requireOptions = {}) => {
 			const ctx = await current(requireOptions.tenant);
-			const caller = await requireCaller(ctx.auth, requireOptions, tenantFor(ctx, toSession(ctx.auth)), options.authorizer, ctx);
+			const caller = await requireCaller(ctx.auth, requireOptions, tenantFor(ctx, toSession(ctx.auth)), base.authorizer, ctx);
 			if ("kind" in caller) interrupt(caller);
 			return withExtra(ctx, caller);
 		},
@@ -734,6 +970,19 @@ function createNext(betterSupabase, options = {}) {
 				error: stopped.error
 			};
 		},
+		async signIn(credentials, signInOptions = {}) {
+			const request = await incomingRequest();
+			return signInWithPassword(credentials, signInOptions, {
+				env: base.env,
+				auth: options.auth,
+				request,
+				jar: await cookies(),
+				seed: async (accessToken) => {
+					const verified = await base.resolve(bearerRequest(accessToken));
+					await base.sessions.seed(verified.auth);
+				}
+			});
+		},
 		cacheTag(table, id, tagOptions = {}) {
 			cacheTag(...tableTags(table, tagOptions), ...id === void 0 ? [] : [tagFor(table, id)]);
 		},
@@ -743,11 +992,18 @@ function createNext(betterSupabase, options = {}) {
 			for (const spec of specs) {
 				for (const table of betterSupabase.tablesOf(spec)) for (const tag of tableTags(table, tagOptions)) tags.add(tag);
 				const [id] = spec.args;
-				if (spec.method === "findById" && (typeof id === "string" || typeof id === "number")) tags.add(tagFor(spec.table, id));
+				if (spec.method === "get" && (typeof id === "string" || typeof id === "number")) tags.add(tagFor(spec.table, id));
 			}
 			cacheTag(...tags);
-		}
+		},
+		blockAction: (client, method, blockOptions) => {
+			return next.action(blockOptions, async (input, ctx) => {
+				return methodOf(client(ctx), method)(...blockOptions.args?.(input, ctx) ?? [input]);
+			});
+		},
+		record: (type) => recordServer(next, type)
 	});
+	return next;
 }
 //#endregion
-export { REQUEST_ID_HEADER, STATS_URL_HEADER, createNext, defineAction, nextCache, requireAal, sessionStale, sessionTag, shouldCheckSession, shouldRefresh, supportOf, supportSessions, supportTag, tagFor, tenantOf, toSession };
+export { REQUEST_ID_HEADER, STATS_URL_HEADER, authzVersionOf, bindingTag, createNext, defineAction, invalidateBinding, isSessionSnapshot, issuedAtOf, nextCache, recordListServer, recordTag, requireAal, safeRedirectPath, sessionCacheKey, sessionIdTag, sessionStale, sessionTag, shouldCheckSession, shouldRefresh, supportOf, supportSessions, supportTag, tagFor, tenantOf, toSession };

package/dist/node/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../refusal-BEyNVFy7.js";
+import { n as RouteGuardOptions } from "../refusal-CSntB_x8.js";
 import { i as toWebHeaders, r as applyWebHeaders, t as NodeHeaderTarget } from "../node-headers-BPtMP4_V.js";
-import { _ as toNodeHandler, a as FastifyReplyLike, b as toWebRequest, c as KoaMiddleware, d as guard, f as koaGuard, g as toKoa, h as toFastify, i as FastifyHook, l as ToNodeOptions, m as toExpress, n as ExpressMiddleware, o as FastifyRequestLike, p as problemErrorHandler, r as ExpressResponse, s as KoaContextLike, t as ExpressErrorHandler, u as fastifyGuard, v as WebRequestOptions, y as sendWebResponse } from "../index-CcpGT2GI.js";
+import { _ as toNodeHandler, a as FastifyReplyLike, b as toWebRequest, c as KoaMiddleware, d as guard, f as koaGuard, g as toKoa, h as toFastify, i as FastifyHook, l as ToNodeOptions, m as toExpress, n as ExpressMiddleware, o as FastifyRequestLike, p as problemErrorHandler, r as ExpressResponse, s as KoaContextLike, t as ExpressErrorHandler, u as fastifyGuard, v as WebRequestOptions, y as sendWebResponse } from "../index-BxYOB1Oc.js";
 export { ExpressErrorHandler, ExpressMiddleware, ExpressResponse, FastifyHook, FastifyReplyLike, FastifyRequestLike, KoaContextLike, KoaMiddleware, type NodeHeaderTarget, type RouteGuardOptions, ToNodeOptions, type WebRequestOptions, applyWebHeaders, fastifyGuard, guard, koaGuard, problemErrorHandler, sendWebResponse, toExpress, toFastify, toKoa, toNodeHandler, toWebHeaders, toWebRequest };

package/dist/node/index.js

@@ -1,5 +1,5 @@
 import { a as toResponse, t as around } from "../shared-Bf-I13Ht.js";
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-Ce2p81VW.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-ByBZcm0V.js";
 import { t as beforeRoute } from "../before-route-B23K2zYU.js";
 import { i as toWebHeaders, t as applyWebHeaders } from "../node-headers-C71zNQHe.js";
 import { n as toWebRequest, t as sendWebResponse } from "../http-BjjojWg3.js";
@@ -12,7 +12,7 @@ import { n as toWebRequest, t as sendWebResponse } from "../http-BjjojWg3.js";
 * ```ts
 * createServer(
 *   toNodeHandler([withBetterSupabase(server)], (request, { db }) =>
-*     db.notes.findMany(),
+*     db.notes.list(),
 *   ),
 * );
 * ```
@@ -38,12 +38,12 @@ async function continueWith(step, next) {
 }
 /**
 * Express middleware that puts every contribution on `res.locals`
-* (`res.locals.db`, `res.locals.bs`). Mount it before the routes.
+* (`res.locals.db`, `res.locals.bsb`). Mount it before the routes.
 *
 * ```ts
 * app.use(toExpress([withBetterSupabase(server)]));
 * app.get("/notes", async (req, res) =>
-*   res.json(await res.locals.db.notes.findMany().orThrow()),
+*   res.json(await res.locals.db.notes.list().orThrow()),
 * );
 * ```
 */
@@ -121,9 +121,7 @@ async function sendReply(reply, response) {
 * ```ts
 * app.decorateRequest("locals", null);
 * app.addHook("onRequest", toFastify([withBetterSupabase(server)]));
-* app.get("/notes", (request) =>
-*   request.locals.db.notes.findMany().orThrow(),
-* );
+* app.get("/notes", (request) => request.locals.db.notes.list().orThrow());
 * ```
 */
 function toFastify(entries, options = {}) {
@@ -178,7 +176,7 @@ async function sendKoa(ctx, response) {
 * ```ts
 * app.use(toKoa([withBetterSupabase(server)]));
 * app.use(async (ctx) => {
-*   ctx.body = await ctx.state.db.notes.findMany().orThrow();
+*   ctx.body = await ctx.state.db.notes.list().orThrow();
 * });
 * ```
 */

package/dist/operations-CSc_IsHO.d.ts

@@ -0,0 +1,6 @@
+import { r as AuthorizationOperation } from "./authorization-HZdJCaVm.js";
+//#region src/core/operations.d.ts
+/** Operations by name, as `authorization.operations` or a module's own defaults. */
+type OperationTable = Readonly<Record<string, AuthorizationOperation>>;
+//#endregion
+export { OperationTable as t };

package/dist/options-0qvUckqt.js

@@ -0,0 +1,9 @@
+import { n as blockOptions, r as option } from "./options-BMjcVuaI.js";
+//#region src/blocks/tasks/options.ts
+const tasksSqlOptions = blockOptions({
+	prefix: option.string({ default: "TASK-" }),
+	maxAssignees: option.number({ default: 0 }),
+	extraColumns: option.unknown()
+});
+//#endregion
+export { tasksSqlOptions as t };

package/dist/options-1GgseJq5.js

@@ -0,0 +1,10 @@
+import { n as blockOptions, r as option } from "./options-BMjcVuaI.js";
+//#region src/blocks/content/options.ts
+const contentSqlOptions = blockOptions({
+	types: option.strings({ default: ["page", "post"] }),
+	locales: option.strings({ default: ["en"] }),
+	requireApproval: option.boolean({ default: false }),
+	publishPolicy: option.unknown()
+});
+//#endregion
+export { contentSqlOptions as t };