better-supabase 0.13.0 → 0.15.0

package/dist/signing-keys-BNDUxpQL.d.ts

@@ -0,0 +1,119 @@
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult } from "./result-DZeA5KS6.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { n as BlockOptions } from "./block-helpers-CRpAHrp_.js";
+import { n as BlockHooks } from "./block-hooks-DZN2w69m.js";
+import { i as JwsAlgorithm, n as Jwks, o as SigningAlgorithm, t as Jwk } from "./jws-D0toeQlA.js";
+//#region src/blocks/signing-keys/signing-keys.d.ts
+interface SigningKeysOptions extends BlockOptions {
+  /**
+   * The JWS `alg` an Ed25519 key signs with: `EdDSA` (RFC 8037), which most
+   * verifiers read, or the fully specified `Ed25519` (RFC 9864). Default:
+   * `EdDSA`.
+   */
+  readonly ed25519Alg?: "EdDSA" | "Ed25519";
+  /** How long a signer keeps the imported private key, in seconds. Default: 300. */
+  readonly cacheSeconds?: number;
+  /** `withBlockHooks` hooks around the client's methods. */
+  readonly hooks?: NoInfer<BlockHooks<SigningKeys>>;
+  /** Receives the errors `after` hooks throw. Default: `console`. */
+  readonly logger?: Logger;
+}
+/** Who a key belongs to: an organization, an app, a stream. */
+interface SigningKeyOwner {
+  /** Lowercase letters, digits, `-` and `_`, such as `organization`. */
+  readonly type: string;
+  readonly id: string;
+}
+/**
+ * The owner of the platform's own keys, for a single authorization server that
+ * signs for every tenant. A key per tenant uses `{ type, id }` of the tenant
+ * instead, such as `{ type: "environment", id: environment.id }`.
+ */
+declare const PLATFORM_OWNER: SigningKeyOwner;
+/**
+ * The `typ` header for a token kind of your own: `jwtType("invite")` is
+ * `vnd.invite+jwt`. Sign with `{ typ }` and verify with `verifyCompact(..., {
+ * typ })` so a token of one kind can't be replayed as another (RFC 8725 section
+ * 3.11). Throws a `TypeError` for a name outside lower-case letters, digits and
+ * `-`.
+ */
+declare function jwtType(name: string): string;
+/** What `create` and `rotate` return. The private key never leaves Vault again. */
+interface CreatedSigningKey {
+  readonly kid: string;
+  readonly alg: SigningAlgorithm;
+  readonly publicKey: Jwk;
+  /**
+   * The kid the new key replaced, which stays in the JWKS until its tokens
+   * expire.
+   */
+  readonly retired: string | null;
+}
+/** What `sign` returns. */
+interface Signature {
+  readonly kid: string;
+  readonly alg: JwsAlgorithm;
+  readonly signature: Uint8Array;
+}
+/** Signs with an owner's active key. */
+interface Signer {
+  readonly owner: SigningKeyOwner;
+  /** The raw signature of `data` with the active key. */
+  sign(data: Uint8Array): AsyncResult<Signature>;
+  /**
+   * A compact JWS over `claims`, with `alg`, `kid` and `typ: "JWT"` in the
+   * header unless `header` sets them. A custom `typ` has to be `JWT` or end in
+   * `+jwt` (see `jwtType`); anything else fails with `SIGNING_TYP_INVALID`. A
+   * numeric `exp` keeps the key in the JWKS until then
+   * (`note_signing_key_exp`), so a rotation can't strand the token.
+   */
+  signJwt(claims: Readonly<Record<string, unknown>>, header?: Readonly<Record<string, unknown>>): AsyncResult<string>;
+}
+interface JwksOptions {
+  /**
+   * How long a retired key stays published past its last `exp`. Default:
+   * `blocks.signing-keys.options.jwksGrace`.
+   */
+  readonly grace?: Temporal.Duration;
+}
+interface JwksResponseOptions extends JwksOptions {
+  /** The `Cache-Control` max-age, in seconds. Default: 300. */
+  readonly maxAge?: number;
+}
+interface SignerOptions {
+  /**
+   * Creates a key of this type when the owner has none, instead of failing with
+   * `SIGNING_KEY_MISSING`.
+   */
+  readonly create?: SigningAlgorithm;
+}
+interface SigningKeys {
+  /**
+   * Generates a key for the owner and makes it active; the previous key is
+   * retired.
+   */
+  create(owner: SigningKeyOwner, alg?: SigningAlgorithm): AsyncResult<CreatedSigningKey>;
+  /** `create` with the active key's type, or `alg` when given. */
+  rotate(owner: SigningKeyOwner, alg?: SigningAlgorithm): AsyncResult<CreatedSigningKey>;
+  /** Retires a key without a replacement. `false` when it was not active. */
+  retire(kid: string): AsyncResult<boolean>;
+  /** Keeps a key published until at least `exp`. `false` for an unknown kid. */
+  noteExp(kid: string, exp: Temporal.Instant): AsyncResult<boolean>;
+  /** The owner's public keys still in use, as a JWK Set. */
+  jwks(owner: SigningKeyOwner, options?: JwksOptions): AsyncResult<Jwks>;
+  /** `jwks` as an `application/jwk-set+json` response with `Cache-Control`. */
+  jwksResponse(owner: SigningKeyOwner, options?: JwksResponseOptions): Promise<Response>;
+  /** Deletes every key of the owner. */
+  remove(owner: SigningKeyOwner): AsyncResult<number>;
+  /** Deletes retired keys no token can still need. */
+  purge(options?: JwksOptions): AsyncResult<number>;
+  signer(owner: SigningKeyOwner, options?: SignerOptions): Signer;
+}
+/**
+ * The `signing-keys` SQL module as typed calls: keys are generated and used
+ * with WebCrypto here, kept in Supabase Vault there. Service role only.
+ */
+declare function createSigningKeys(options: SigningKeysOptions): SigningKeys;
+//#endregion
+export { Signature as a, SigningKeyOwner as c, createSigningKeys as d, jwtType as f, PLATFORM_OWNER as i, SigningKeys as l, JwksOptions as n, Signer as o, JwksResponseOptions as r, SignerOptions as s, CreatedSigningKey as t, SigningKeysOptions as u };

package/dist/signing-keys-wGKh4vtt.js

@@ -0,0 +1,164 @@
+import { n as dbError } from "./errors-BVFgt8BZ.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { t as temporal } from "./temporal-required-Dy0GGD8E.js";
+import { t as AsyncResult } from "./result-ntFBW2p2.js";
+import { D as recordOf, I as textOf, d as enumOrThrow, j as run, n as applyTemporal, o as blockCall } from "./block-helpers-CtBdjgO4.js";
+import { r as withBlockHooks } from "./block-hooks-BfxX3682.js";
+import { a as jwksOf, n as generateSigningKey, o as signBytes, r as importSigningKey, s as signCompact } from "./jws-DOgHJKHb.js";
+//#region src/blocks/signing-keys/signing-keys.ts
+const ALGORITHMS = ["Ed25519", "ES256"];
+/**
+* The owner of the platform's own keys, for a single authorization server that
+* signs for every tenant. A key per tenant uses `{ type, id }` of the tenant
+* instead, such as `{ type: "environment", id: environment.id }`.
+*/
+const PLATFORM_OWNER = {
+	type: "platform",
+	id: "default"
+};
+const TYPE_NAME = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const JWT_TYPE = /^(?:JWT|[a-z0-9][a-z0-9.-]{0,126}\+jwt)$/i;
+/**
+* The `typ` header for a token kind of your own: `jwtType("invite")` is
+* `vnd.invite+jwt`. Sign with `{ typ }` and verify with `verifyCompact(..., {
+* typ })` so a token of one kind can't be replayed as another (RFC 8725 section
+* 3.11). Throws a `TypeError` for a name outside lower-case letters, digits and
+* `-`.
+*/
+function jwtType(name) {
+	if (!TYPE_NAME.test(name)) throw new TypeError(`jwtType name must be lower-case letters, digits and "-", got ${JSON.stringify(name)}`);
+	return `vnd.${name}+jwt`;
+}
+const HOUR = 3600;
+const interval = (duration) => duration === void 0 ? null : `${String(duration.total({ unit: "seconds" }))} seconds`;
+const ownerArgs = (owner) => ({
+	owner_type: owner.type,
+	owner_id: owner.id
+});
+/**
+* The `signing-keys` SQL module as typed calls: keys are generated and used
+* with WebCrypto here, kept in Supabase Vault there. Service role only.
+*/
+function createSigningKeys(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const ed25519Alg = options.ed25519Alg ?? "EdDSA";
+	const cacheMs = (options.cacheSeconds ?? 300) * 1e3;
+	const keys = /* @__PURE__ */ new Map();
+	const noted = /* @__PURE__ */ new Map();
+	const jwsAlg = (alg) => alg === "Ed25519" ? ed25519Alg : "ES256";
+	const add = (owner, alg) => run(() => generateSigningKey(alg)).andThen((generated) => call("add_signing_key", {
+		...ownerArgs(owner),
+		kid: generated.kid,
+		alg,
+		public_jwk: generated.publicKey,
+		private_jwk: JSON.stringify(generated.privateKey)
+	}, (value) => {
+		const row = recordOf(value, "add_signing_key");
+		keys.delete(`${owner.type}:${owner.id}`);
+		return {
+			kid: generated.kid,
+			alg,
+			publicKey: generated.publicKey,
+			retired: typeof row["retired"] === "string" ? row["retired"] : null
+		};
+	}));
+	const stored = (owner) => call("signing_key", ownerArgs(owner), (value) => {
+		if (value === null || value === void 0) return null;
+		const row = recordOf(value, "signing_key");
+		return {
+			kid: textOf(row["kid"]),
+			alg: enumOrThrow(row["alg"], ALGORITHMS, "signing key alg"),
+			privateKey: textOf(row["privateKey"])
+		};
+	});
+	const active = (owner, create) => {
+		const cacheKey = `${owner.type}:${owner.id}`;
+		const cached = keys.get(cacheKey);
+		if (cached && Date.now() - cached.at < cacheMs) return AsyncResult.ok(cached);
+		return stored(owner).andThen((found) => {
+			if (found) return run(async () => {
+				const parsed = JSON.parse(found.privateKey);
+				if (!isRecord(parsed) || typeof parsed["kty"] !== "string") throw new TypeError("The stored signing key is not a JWK");
+				const key = await importSigningKey(parsed);
+				const entry = {
+					kid: found.kid,
+					alg: found.alg,
+					key,
+					at: Date.now()
+				};
+				keys.set(cacheKey, entry);
+				return entry;
+			});
+			if (create === void 0) return AsyncResult.err(dbError("not_found", `${cacheKey} has no signing key`, { hint: "SIGNING_KEY_MISSING" }));
+			return add(owner, create).andThen(() => active(owner, void 0));
+		});
+	};
+	const noteExp = (kid, exp) => call("note_signing_key_exp", {
+		kid,
+		exp: exp.toString()
+	}, (value) => value === true);
+	const client = {
+		create: (owner, alg = "Ed25519") => add(owner, alg),
+		rotate: (owner, alg) => alg === void 0 ? stored(owner).andThen((found) => add(owner, found?.alg ?? "Ed25519")) : add(owner, alg),
+		retire: (kid) => call("retire_signing_key", { kid }, (value) => {
+			for (const [owner, entry] of keys) if (entry.kid === kid) keys.delete(owner);
+			return value === true;
+		}),
+		noteExp,
+		jwks: (owner, jwksOptions = {}) => call("signing_jwks", {
+			...ownerArgs(owner),
+			grace: interval(jwksOptions.grace)
+		}, jwksOf),
+		jwksResponse: async (owner, responseOptions = {}) => {
+			const result = await client.jwks(owner, responseOptions);
+			if (!result.ok) return Response.json({
+				title: "The key set is unavailable",
+				status: 503
+			}, {
+				status: 503,
+				headers: { "content-type": "application/problem+json" }
+			});
+			return Response.json(result.data, { headers: {
+				"content-type": "application/jwk-set+json",
+				"cache-control": `public, max-age=${String(responseOptions.maxAge ?? 300)}`
+			} });
+		},
+		remove: (owner) => call("delete_signing_keys", ownerArgs(owner), (value) => {
+			keys.delete(`${owner.type}:${owner.id}`);
+			return Number(value);
+		}),
+		purge: (purgeOptions = {}) => call("purge_signing_keys", { grace: interval(purgeOptions.grace) }, Number),
+		signer: (owner, signerOptions = {}) => ({
+			owner,
+			sign: (data) => active(owner, signerOptions.create).andThen((key) => run(async () => ({
+				kid: key.kid,
+				alg: jwsAlg(key.alg),
+				signature: await signBytes(key.key, key.alg, data)
+			}))),
+			signJwt: (claims, header = {}) => {
+				const typ = header["typ"];
+				if (typ !== void 0 && (typeof typ !== "string" || !JWT_TYPE.test(typ))) return AsyncResult.err(dbError("invalid_input", "The typ header is not a JWT media type", { hint: "SIGNING_TYP_INVALID" }));
+				return active(owner, signerOptions.create).andThen((key) => {
+					const exp = claims["exp"];
+					const until = typeof exp === "number" && Number.isFinite(exp) ? Math.ceil(exp / HOUR) * HOUR : void 0;
+					return (until !== void 0 && until > (noted.get(key.kid) ?? 0) ? noteExp(key.kid, temporal().Instant.fromEpochMilliseconds(until * 1e3)).map((known) => {
+						noted.set(key.kid, until);
+						return known;
+					}) : AsyncResult.ok(true)).andThen(() => run(() => signCompact(key.key, key.alg, {
+						alg: jwsAlg(key.alg),
+						kid: key.kid,
+						typ: "JWT",
+						...header
+					}, claims)));
+				});
+			}
+		})
+	};
+	return withBlockHooks(client, options.hooks, {
+		block: "signing-keys",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+//#endregion
+export { createSigningKeys as n, jwtType as r, PLATFORM_OWNER as t };

package/dist/solid/index.d.ts

@@ -1,14 +1,66 @@
-import { b as DbError } from "../result-mijqfoJN.js";
-import { J as QuerySpec } from "../define-D0LSXmUP.js";
-import { $ as TemplateValues } from "../bucket-DBay-ICp.js";
-import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-CZvLXFND.js";
-import { t as AuthSnapshot } from "../bind-DcXLU1ul.js";
-import { t as AuthSession } from "../view-CKzCp8FW.js";
-import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-CKEqR38q.js";
-import { t as SupportView } from "../support-view-BOJJSZKv.js";
+import { b as DbError } from "../result-DZeA5KS6.js";
+import { Ct as Events, D as BlockEventPattern, T as BlockEvent, bt as EventMap, k as BlockEventsMatching } from "../events-vcqenSYU.js";
+import { pt as QuerySpec } from "../define-DFBnQyYg.js";
+import { $ as TemplateValues } from "../bucket-CiNi8sIw.js";
+import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-CJrQZQaa.js";
+import { t as AuthSnapshot } from "../bind-CrMBwrPN.js";
+import { t as AuthSession } from "../view-DyFdMCqg.js";
+import { n as Controller } from "../controller-BrP0gn47.js";
+import { C as LiveCountSource, D as ProfileOf, E as PresenceTopic, O as UseActionOptions, S as LiveCountHookOptions, T as PresenceHookOptions, _ as ActionResultOf, a as DataRows, b as ClaimsOf, c as DataWrites, d as BlockMutationState, f as BlockQueryActions, g as ActionInputOf, h as BlockRefetchOn, i as DataRow, l as BlockEventSource, m as BlockQueryState, n as DataId, o as DataSource, p as BlockQueryOptions, r as DataListArgs, s as DataState, t as fieldErrorsOf, u as BlockMutationActions, v as ActionState, w as LiveQueryHookOptions, x as ClientLike, y as BroadcastOptions } from "../field-errors-fsbFktYF.js";
+import { n as BlockOptions } from "../block-env-B_uEM2xz.js";
+import { n as BlockDataOf, r as BlockMethodName, t as BlockArgsOf } from "../block-method-CiVa2G-J.js";
+import { t as SupportView } from "../support-view-BYOgwXsJ.js";
 import { SupabaseClient } from "@supabase/supabase-js";
-import { Accessor, JSX } from "solid-js";
 import { QueryClient } from "@tanstack/query-core";
+import { Accessor, JSX } from "solid-js";
+//#region src/blocks/solid-bind.d.ts
+/** A block controller in a Solid component: `state` follows the controller. */
+interface SolidController<S, A> {
+  readonly state: Accessor<S>;
+  readonly actions: A;
+  readonly controller: Controller<S, A>;
+}
+//#endregion
+//#region src/solid/block-hooks.d.ts
+/**
+ * Calls a read method of any block client (`blocks.tasks.list`, renamed or not)
+ * from mount. `refetchOn` calls it again on block events.
+ */
+export declare function useBlockQuery<C extends object, const K extends BlockMethodName<C>>(client: C, method: K, args: BlockArgsOf<C, K>, options?: BlockQueryOptions): SolidController<BlockQueryState<BlockDataOf<C, K>>, BlockQueryActions>;
+/** Calls a write method of any block client and tracks its state. */
+export declare function useBlockMutation<C extends object, const K extends BlockMethodName<C>>(client: C, method: K): SolidController<BlockMutationState<BlockDataOf<C, K>>, BlockMutationActions<BlockArgsOf<C, K>, BlockDataOf<C, K>>>;
+/**
+ * Calls `handler` for each block event matching `pattern` (`"task.*"`), typed
+ * by `events` (`blockEvents` from `blocks.generated.ts`), from mount until the
+ * component goes away. `source` is the client's `betterSupabase`.
+ */
+export declare function useBlockEvent<M extends EventMap, const P extends BlockEventPattern<M>>(source: BlockEventSource, events: Events<M>, pattern: P, handler: (event: BlockEvent<M, BlockEventsMatching<M, P>>) => void): void;
+//#endregion
+//#region src/blocks/solid-controller.d.ts
+/**
+ * Makes a controller once and reads it through `from`. Its work starts on mount
+ * (never during server rendering), and the controller is disposed with the
+ * owner.
+ */
+export declare function useBlockController<O, S, A>(create: (options: O) => Controller<S, A>, options: BlockOptions<O>, usesEnv?: boolean): SolidController<S, A>;
+//#endregion
+//#region src/solid/data-hooks.d.ts
+/** What `useList` and `useOne` return: `state` and the writes. */
+type DataView<S extends DataSource, T> = SolidController<DataState<T>, DataWrites<S>>;
+/** The primitives `defineDataHooks` makes for one table or block instance. */
+interface DataHooks<S extends DataSource> {
+  /** `source.list(args)`, kept fresh after every write. */
+  readonly useList: (args?: DataListArgs<S>) => DataView<S, DataRows<S>>;
+  /** `source.get(id)`, kept fresh after every write. */
+  readonly useOne: (id: DataId<S>) => DataView<S, DataRow<S>>;
+}
+/**
+ * The list and record primitives for one table or block instance. The generated
+ * `hooks.ts` calls it once per table; `select` picks the source from the
+ * provider's `db`.
+ */
+export declare function defineDataHooks<D, S extends DataSource>(name: string, select: (db: D) => S): DataHooks<S>;
+//#endregion
 //#region src/solid/index.d.ts
 /** A value, or an accessor Solid tracks. */
 export type MaybeAccessor<T> = T | Accessor<T>;
@@ -43,7 +95,7 @@ export interface BetterPrimitives<B extends ClientLike> {
   readonly useDb: () => B["db"];
   /**
    * TanStack Query option factories: `useQuery(() =>
-   * useQueries().customers.findMany())`.
+   * useQueries().customers.list())`.
    */
   readonly useQueries: () => B["queries"];
   readonly useSupabase: () => SupabaseClient;
@@ -55,7 +107,7 @@ export interface BetterPrimitives<B extends ClientLike> {
  *
  * ```ts
  * export const { useDb, useQueries, useAuth } =
- *   createBindings<typeof bs>();
+ *   createBindings<typeof bsb>();
  * ```
  */
 export declare function createBindings<B extends ClientLike>(): BetterPrimitives<B>;
@@ -79,7 +131,7 @@ export declare function useBroadcast<P extends string, E extends EventSchemas>(t
  *
  * ```ts
  * useLiveQuery(() =>
- *   betterSupabase.spec.customers.findMany({ where: { orgId: org() } }),
+ *   betterSupabase.spec.customers.list({ where: { orgId: org() } }),
  * );
  * ```
  */
@@ -93,7 +145,7 @@ export interface LiveCount {
 }
 /**
  * A count that stays current: refetches only the `count` spec after each
- * debounced change to a table it reads. Takes a spec or a `bs.liveCount()`
+ * debounced change to a table it reads. Takes a spec or a `bsb.liveCount()`
  * seed; `null` pauses. The returned object's fields are reactive.
  *
  * ```tsx
@@ -132,7 +184,7 @@ export interface ActionHandle<I, T> extends ActionState<I, T> {
   readonly reset: () => void;
 }
 /**
- * Calls a server action (`action()` from SolidStart, or a `bs.action()`) from
+ * Calls a server action (`action()` from SolidStart, or a `bsb.action()`) from
  * an event handler: tracks pending inputs and the last result, and calls
  * `onSuccess` or `onError`. The returned object's fields are reactive.
  *
@@ -146,4 +198,4 @@ export interface ActionHandle<I, T> extends ActionState<I, T> {
  */
 export declare function useAction<I, T>(action: (input: I) => Promise<ActionResultOf<T>>, options?: UseActionOptions<ActionInputOf<I>, T>): ActionHandle<ActionInputOf<I>, T>;
 //#endregion
-export { type ActionInputOf, type ActionResultOf, type ActionState, type AuthSession, type AuthSnapshot, type BroadcastOptions, type ClaimsOf, type ClientLike, type LiveCountHookOptions, type LiveCountSource, type LiveQueryHookOptions, type PresenceHookOptions, type PresenceTopic, type ProfileOf, type SupportView, type UseActionOptions, fieldErrorsOf };
+export { type ActionInputOf, type ActionResultOf, type ActionState, type AuthSession, type AuthSnapshot, type BlockEventSource, type BlockMutationActions, type BlockMutationState, type BlockOptions, type BlockQueryActions, type BlockQueryOptions, type BlockQueryState, type BlockRefetchOn, type BroadcastOptions, type ClaimsOf, type ClientLike, type DataHooks, type DataSource, type DataState, type DataView, type DataWrites, type LiveCountHookOptions, type LiveCountSource, type LiveQueryHookOptions, type PresenceHookOptions, type PresenceTopic, type ProfileOf, type SolidController, type SupportView, type UseActionOptions, fieldErrorsOf };

package/dist/solid/index.js

@@ -1,9 +1,91 @@
-import { t as clearOnUserChange } from "../user-change-CSR_prhd.js";
-import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-YASsOslj.js";
+import { t as clearOnUserChange } from "../user-change-DgWC6RRC.js";
+import { a as createActionRunner, c as liveKey, d as shownCount, f as startBroadcast, i as countSource, l as notJoined, m as startLiveQuery, n as assertInvalidateClient, o as joinPresence, p as startLiveCount, r as callerOf, s as keyed, t as NO_COUNT, u as plainCaller } from "../client-BAEbEA7t.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
-import { t as fieldErrorsOf } from "../field-errors-DZVRWRkf.js";
-import { n as useContext$1, t as ClientContext } from "../context-B8_p3MXo.js";
-import { createComponent, createEffect, createMemo, createSignal, onCleanup, onMount, untrack, useContext } from "solid-js";
+import { c as listenToBlockEvents, d as fieldErrorsOf, i as dataTarget, l as blockEnv, n as createDataOne, o as createBlockMutation, s as createBlockQuery, t as createDataList, u as withEnv } from "../data-hooks-tgF1Ct0F.js";
+import { createComponent, createContext, createEffect, createMemo, createSignal, from, onCleanup, onMount, untrack, useContext } from "solid-js";
+//#region src/solid/context.ts
+const ClientContext = createContext();
+/** What `<BetterSupabaseProvider>` provides. */
+function useContext$1() {
+	const context = useContext(ClientContext);
+	if (!context) throw new Error("better-supabase: wrap your app in <BetterSupabaseProvider client={bsb}>");
+	return context;
+}
+//#endregion
+//#region src/blocks/solid-bind.ts
+/**
+* Reads a controller through `from`. Its work starts on mount (never during
+* server rendering), and the controller is disposed with the owner.
+*/
+function bindSolidController(controller) {
+	const state = from({ subscribe: (next) => {
+		next(controller.getSnapshot());
+		let stop;
+		onMount(() => {
+			stop = controller.subscribe(() => {
+				next(controller.getSnapshot());
+			});
+			next(controller.getSnapshot());
+		});
+		return () => stop?.();
+	} }, controller.getSnapshot());
+	onCleanup(() => {
+		controller.dispose();
+	});
+	return {
+		state,
+		actions: controller.actions,
+		controller
+	};
+}
+//#endregion
+//#region src/solid/block-hooks.ts
+/**
+* Calls a read method of any block client (`blocks.tasks.list`, renamed or not)
+* from mount. `refetchOn` calls it again on block events.
+*/
+function useBlockQuery(client, method, args, options = {}) {
+	return bindSolidController(createBlockQuery(client, method, args, options));
+}
+/** Calls a write method of any block client and tracks its state. */
+function useBlockMutation(client, method) {
+	return bindSolidController(createBlockMutation(client, method));
+}
+/**
+* Calls `handler` for each block event matching `pattern` (`"task.*"`), typed
+* by `events` (`blockEvents` from `blocks.generated.ts`), from mount until the
+* component goes away. `source` is the client's `betterSupabase`.
+*/
+function useBlockEvent(source, events, pattern, handler) {
+	onMount(() => {
+		const stop = listenToBlockEvents(source, events, pattern, () => handler);
+		onCleanup(stop);
+	});
+}
+//#endregion
+//#region src/blocks/solid-controller.ts
+/**
+* Makes a controller once and reads it through `from`. Its work starts on mount
+* (never during server rendering), and the controller is disposed with the
+* owner.
+*/
+function useBlockController(create, options, usesEnv = true) {
+	return bindSolidController(create(withEnv(options, usesEnv ? () => blockEnv(useContext$1().client) : void 0)));
+}
+//#endregion
+//#region src/solid/data-hooks.ts
+/**
+* The list and record primitives for one table or block instance. The generated
+* `hooks.ts` calls it once per table; `select` picks the source from the
+* provider's `db`.
+*/
+function defineDataHooks(name, select) {
+	return {
+		useList: (args) => bindSolidController(createDataList(dataTarget(useContext$1().client, name, select), args)),
+		useOne: (id) => bindSolidController(createDataOne(dataTarget(useContext$1().client, name, select), id))
+	};
+}
+//#endregion
 //#region src/solid/index.ts
 function read(value) {
 	return typeof value === "function" ? value() : value;
@@ -64,7 +146,7 @@ function useSupportSession() {
 *
 * ```ts
 * export const { useDb, useQueries, useAuth } =
-*   createBindings<typeof bs>();
+*   createBindings<typeof bsb>();
 * ```
 */
 function createBindings() {
@@ -102,7 +184,7 @@ function useCaller(context, client) {
 }
 function supabaseFor(hook, context, client) {
 	const supabase = client ?? context?.client.supabase;
-	if (!supabase) throw new Error(`better-supabase: ${hook} needs <BetterSupabaseProvider client={bs}> or { client: supabase }`);
+	if (!supabase) throw new Error(`better-supabase: ${hook} needs <BetterSupabaseProvider client={bsb}> or { client: supabase }`);
 	return supabase;
 }
 /**
@@ -158,7 +240,7 @@ function useBroadcast(topic, values, handlers, options) {
 *
 * ```ts
 * useLiveQuery(() =>
-*   betterSupabase.spec.customers.findMany({ where: { orgId: org() } }),
+*   betterSupabase.spec.customers.list({ where: { orgId: org() } }),
 * );
 * ```
 */
@@ -192,7 +274,7 @@ function useLiveQuery(spec, options = {}) {
 }
 /**
 * A count that stays current: refetches only the `count` spec after each
-* debounced change to a table it reads. Takes a spec or a `bs.liveCount()`
+* debounced change to a table it reads. Takes a spec or a `bsb.liveCount()`
 * seed; `null` pauses. The returned object's fields are reactive.
 *
 * ```tsx
@@ -314,7 +396,7 @@ function usePresence(topic, values, options = {}) {
 	};
 }
 /**
-* Calls a server action (`action()` from SolidStart, or a `bs.action()`) from
+* Calls a server action (`action()` from SolidStart, or a `bsb.action()`) from
 * an event handler: tracks pending inputs and the last result, and calls
 * `onSuccess` or `onError`. The returned object's fields are reactive.
 *
@@ -357,4 +439,4 @@ function useAction(action, options = {}) {
 	};
 }
 //#endregion
-export { BetterSupabaseProvider, createBindings, fieldErrorsOf, useAction, useAuth, useBroadcast, useLiveCount, useLiveQuery, usePresence, useSession, useSupabase, useSupportSession };
+export { BetterSupabaseProvider, createBindings, defineDataHooks, fieldErrorsOf, useAction, useAuth, useBlockController, useBlockEvent, useBlockMutation, useBlockQuery, useBroadcast, useLiveCount, useLiveQuery, usePresence, useSession, useSupabase, useSupportSession };

package/dist/solid-start/index.d.ts

@@ -1,9 +1,10 @@
-import { a as AnyModels, i as AnyFunctions } from "../types-DmshMaXz.js";
-import { t as BetterSupabase } from "../define-D0LSXmUP.js";
-import { n as BetterServer } from "../server-types-D_cQ6OxZ.js";
-import { a as AuthorizedContext, l as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-LeQGMzLH.js";
-import { t as RefusalRedirects } from "../refusal-BEyNVFy7.js";
-import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-CMeAuJts.js";
+import { O as AnyFunctions, k as AnyModels } from "../types-DFdg_4yN.js";
+import { l as PermissionRef, t as AnyAuthorizer } from "../authorizer-B6X09otb.js";
+import { t as BetterSupabase } from "../define-DFBnQyYg.js";
+import { n as BetterServer } from "../server-types-CFtehAsr.js";
+import { a as AuthorizedContext, l as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-DOwKpSkA.js";
+import { t as RefusalRedirects } from "../refusal-CSntB_x8.js";
+import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-BKyTeS-j.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/solid-start/index.d.ts
 /** The part of a SolidStart `FetchEvent` the integration reads and writes. */
@@ -35,15 +36,15 @@ export interface SolidStartMiddleware {
   readonly onRequest: (event: SolidFetchEvent) => Promise<Response | undefined>;
   readonly onBeforeResponse: (event: SolidFetchEvent) => void;
 }
-export interface BetterSolidStart<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> extends BetterServer<M, F, E, C, P, B> {
+export interface BetterSolidStart<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Ref = string, B = unknown> extends BetterServer<M, F, E, C, P, B> {
   /**
    * Verifies the caller, refreshes the session cookie on navigations and form
-   * posts, and puts `db`, `bs`, `auth`, `tenant` and `session` on
+   * posts, and puts `db`, `bsb`, `auth`, `tenant` and `session` on
    * `event.locals`.
    *
    * ```ts
    * // src/middleware.ts
-   * export default createMiddleware(bs.middleware);
+   * export default createMiddleware(bsb.middleware);
    * ```
    */
   readonly middleware: SolidStartMiddleware;
@@ -57,19 +58,21 @@ export interface BetterSolidStart<M extends AnyModels, F extends AnyFunctions, E
    * ```ts
    * const notes = query(async () => {
    *   "use server";
-   *   const { db } = await bs.require();
-   *   return db.notes.findMany().orThrow();
+   *   const { db } = await bsb.require();
+   *   return db.notes.list().orThrow();
    * }, "notes");
    * ```
    */
-  require<R extends boolean = false>(options?: BlockRequireOptions<C, P, R, unknown, LocalsResource<M, F, E, C, P, B>>): Promise<FrameworkLocals<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>;
+  require<R extends boolean = false>(options?: BlockRequireOptions<C, P, R, Ref, LocalsResource<M, F, E, C, P, B>>): Promise<FrameworkLocals<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>;
   /**
    * A server function returning an `ActionResult`, for `action()` from
    * `@solidjs/router`: `FormData` or a plain object, validated by `input`.
    */
-  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: BlockActionOptions<S, C, P, R, unknown, LocalsResource<M, F, E, C, P, B>>, fn: (input: ActionParsed<S>, ctx: FrameworkLocals<M, F, E, C, P, B> & AuthorizedContext<C, P, R>) => T): (input: unknown) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: BlockActionOptions<S, C, P, R, Ref, LocalsResource<M, F, E, C, P, B>>, fn: (input: ActionParsed<S>, ctx: FrameworkLocals<M, F, E, C, P, B> & AuthorizedContext<C, P, R>) => T): (input: unknown) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
 }
 /** SolidStart integration: middleware, guards and server function actions. */
-export declare function createSolidStart<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, options: SolidStartOptions): BetterSolidStart<M, F, E, C, P, B>;
+export declare function createSolidStart<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, A extends AnyAuthorizer | undefined = undefined, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, options: SolidStartOptions & {
+  readonly authorizer?: A;
+}): BetterSolidStart<M, F, E, C, P, PermissionRef<A>, B>;
 //#endregion
 export type { ActionResult, RefusalRedirects };