better-supabase 0.13.0 → 0.15.0

package/dist/sso-d2S4x_f9.js

@@ -0,0 +1,217 @@
+import { n as dbError } from "./errors-BVFgt8BZ.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-ntFBW2p2.js";
+import { C as optionalText, D as recordOf, F as stringsOf, I as textOf, R as toInstant, S as optionalInstant, f as errorText, k as recordsOf, n as applyTemporal, o as blockCall } from "./block-helpers-CtBdjgO4.js";
+import { r as withBlockHooks } from "./block-hooks-BfxX3682.js";
+//#region src/blocks/sso/sso.ts
+function recordOfDomain(value) {
+	const row = recordOf(value, "organization_domains.record");
+	return {
+		type: "TXT",
+		name: textOf(row["name"]),
+		value: textOf(row["value"])
+	};
+}
+function domainOf(value) {
+	const row = recordOf(value, "organization_domains");
+	return {
+		id: textOf(row["id"]),
+		organizationId: textOf(row["organization_id"]),
+		domain: textOf(row["domain"]),
+		verifiedAt: optionalInstant(row["verified_at"]),
+		autoJoinRole: optionalText(row["auto_join_role"]),
+		enforceSso: row["enforce_sso"] === true,
+		createdBy: optionalText(row["created_by"]),
+		createdAt: toInstant(textOf(row["created_at"])),
+		record: recordOfDomain(row["record"])
+	};
+}
+function providerOf(value) {
+	const row = recordOf(value, "organization_sso_providers");
+	return {
+		id: textOf(row["id"]),
+		organizationId: textOf(row["organization_id"]),
+		type: "saml",
+		metadataUrl: optionalText(row["metadata_url"]),
+		domains: stringsOf(row["domains"]),
+		createdAt: toInstant(textOf(row["created_at"]))
+	};
+}
+function ssoDomainOf(value) {
+	if (!isRecord(value)) return;
+	return {
+		domain: textOf(value["domain"]),
+		organizationId: textOf(value["organizationId"]),
+		providerId: textOf(value["providerId"]),
+		enforceSso: value["enforceSso"] === true
+	};
+}
+/** Organization domains and SSO lookups as the caller. */
+function createSso(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	return withBlockHooks({
+		addDomain: (organizationId, domain) => call("add_organization_domain", {
+			tenant: organizationId,
+			domain
+		}, domainOf),
+		domains: (organizationId) => call("list_organization_domains", { tenant: organizationId }, (value) => recordsOf(value, "list_organization_domains").map(domainOf)),
+		updateDomain: (domainId, settings) => call("organization_domain", { id: domainId }, (value) => isRecord(value) ? domainOf(value) : void 0).andThen(async (current) => current === void 0 ? err(dbError("not_found", "No domain you manage has this id", { hint: "SSO_DOMAIN_NOT_FOUND" })) : call("update_organization_domain", {
+			id: domainId,
+			auto_join_role: settings.autoJoinRole === void 0 ? current.autoJoinRole ?? null : settings.autoJoinRole,
+			enforce_sso: settings.enforceSso ?? current.enforceSso
+		}, domainOf)),
+		removeDomain: (domainId) => call("remove_organization_domain", { id: domainId }, (value) => value === true),
+		providers: (organizationId) => call("list_sso_providers", { tenant: organizationId }, (value) => recordsOf(value, "list_sso_providers").map(providerOf)),
+		domainFor: (email) => call("sso_domain_for", { email }, ssoDomainOf)
+	}, options.hooks, {
+		block: "sso",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+const NXDOMAIN = 3;
+const TXT = 16;
+/** TXT lookups over DNS-over-HTTPS (the `application/dns-json` API). */
+function dohResolver(options = {}) {
+	const endpoint = options.endpoint ?? "https://cloudflare-dns.com/dns-query";
+	const fetcher = options.fetch ?? fetch;
+	return async (name, signal) => {
+		const url = new URL(endpoint);
+		url.searchParams.set("name", name);
+		url.searchParams.set("type", "TXT");
+		const response = await fetcher(url, {
+			headers: { accept: "application/dns-json" },
+			...signal ? { signal } : {}
+		});
+		if (!response.ok) throw new Error(`DNS lookup of ${name} failed with ${response.status}`);
+		const body = await response.json();
+		if (!isRecord(body)) throw new Error(`DNS lookup of ${name} returned no JSON`);
+		if (body["Status"] === NXDOMAIN) return [];
+		if (body["Status"] !== 0) throw new Error(`DNS lookup of ${name} failed with status ${String(body["Status"])}`);
+		return (Array.isArray(body["Answer"]) ? body["Answer"] : []).filter((answer) => isRecord(answer) && answer["type"] === TXT).map((answer) => txtValue(textOf(isRecord(answer) ? answer["data"] : "")));
+	};
+}
+/** `"abc" "def"` (one record split into strings) gives `abcdef`. */
+function txtValue(data) {
+	const parts = [...data.matchAll(/"((?:[^"\\]|\\.)*)"/g)].map((match) => (match[1] ?? "").replaceAll(/\\(.)/g, "$1"));
+	return parts.length === 0 ? data : parts.join("");
+}
+function authStatusError(status, message) {
+	if (status === 400 || status === 422) return dbError("invalid_input", message);
+	if (status === 401) return dbError("unauthorized", message);
+	if (status === 403) return dbError("forbidden", message);
+	if (status === 404) return dbError("not_found", message);
+	if (status === 409) return dbError("conflict", message);
+	if (status === 429) return dbError("rate_limited", message);
+	return dbError("network", message);
+}
+/** Domain verification and SAML providers with a service-role client. */
+function createSsoAdmin(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const resolver = options.resolver ?? dohResolver();
+	const auth = (method, path, body) => AsyncResult.from(async () => {
+		const admin = options.auth;
+		if (!admin) return err(dbError("invalid_request", "Pass auth to createSsoAdmin to manage SAML providers"));
+		const fetcher = admin.fetch ?? fetch;
+		let response;
+		try {
+			response = await fetcher(`${admin.url.replace(/\/+$/, "")}/auth/v1/admin/sso/providers${path}`, {
+				method,
+				headers: {
+					apikey: admin.secretKey,
+					authorization: `Bearer ${admin.secretKey}`,
+					"content-type": "application/json"
+				},
+				...body === void 0 ? {} : { body: JSON.stringify(body) }
+			});
+		} catch (cause) {
+			return err(dbError("network", errorText(cause)));
+		}
+		const text = await response.text();
+		let json;
+		try {
+			json = text.length > 0 ? JSON.parse(text) : {};
+		} catch {
+			json = {};
+		}
+		if (!response.ok) {
+			const message = isRecord(json) ? optionalText(json["msg"]) ?? optionalText(json["message"]) ?? optionalText(json["error_description"]) : void 0;
+			return err(authStatusError(response.status, message ?? `Supabase Auth answered ${response.status}`));
+		}
+		return ok(isRecord(json) ? json : {});
+	});
+	const providerBody = (input) => ({
+		type: "saml",
+		...input.metadataUrl === void 0 ? {} : { metadata_url: input.metadataUrl },
+		...input.metadataXml === void 0 ? {} : { metadata_xml: input.metadataXml },
+		...input.domains === void 0 ? {} : { domains: [...input.domains] },
+		...input.attributeMapping === void 0 ? {} : { attribute_mapping: input.attributeMapping },
+		...input.nameIdFormat === void 0 ? {} : { name_id_format: input.nameIdFormat }
+	});
+	const register = (organizationId, providerId, domains, metadataUrl, actor) => call("register_sso_provider", {
+		tenant: organizationId,
+		provider: providerId,
+		domains,
+		metadata_url: metadataUrl ?? null,
+		actor: actor.actorId ?? null
+	}, providerOf);
+	const providerFor = (providerId, actor) => call("sso_provider", {
+		provider: providerId,
+		actor: actor.actorId ?? null
+	}, (value) => isRecord(value) ? providerOf(value) : void 0);
+	const missing = () => err(dbError("not_found", "No SSO provider has this id", { hint: "SSO_PROVIDER_NOT_FOUND" }));
+	const path = (providerId) => `/${encodeURIComponent(providerId)}`;
+	return {
+		verifyDomain: (domainId, request = {}) => call("organization_domain", { id: domainId }, (value) => isRecord(value) ? domainOf(value) : void 0).andThen(async (found) => {
+			if (found === void 0) return err(dbError("not_found", "No domain has this id", { hint: "SSO_DOMAIN_NOT_FOUND" }));
+			if (found.verifiedAt === void 0) {
+				let values;
+				try {
+					values = await resolver(found.record.name, request.signal);
+				} catch (cause) {
+					return err(dbError("network", errorText(cause)));
+				}
+				if (!values.includes(found.record.value)) return err(dbError("invalid_request", `No TXT record ${found.record.name} with the verification value yet`, { hint: "SSO_DOMAIN_RECORD_MISSING" }));
+			}
+			return call("verify_organization_domain", {
+				id: domainId,
+				actor: request.actorId ?? null
+			}, domainOf);
+		}),
+		addSamlProvider: (organizationId, input, actor = {}) => call("check_sso_provider", {
+			tenant: organizationId,
+			domains: input.domains,
+			actor: actor.actorId ?? null
+		}, () => void 0).andThen(() => auth("POST", "", providerBody(input))).andThen(async (created) => {
+			const providerId = textOf(created["id"]);
+			const recorded = await register(organizationId, providerId, input.domains, input.metadataUrl, actor);
+			if (!recorded.ok) await auth("DELETE", path(providerId));
+			return recorded;
+		}),
+		updateSamlProvider: (providerId, input, actor = {}) => providerFor(providerId, actor).andThen(async (found) => {
+			if (found === void 0) return missing();
+			const checked = await call("check_sso_provider", {
+				tenant: found.organizationId,
+				domains: input.domains,
+				actor: actor.actorId ?? null
+			}, () => void 0);
+			if (!checked.ok) return checked;
+			const updated = await auth("PUT", path(providerId), providerBody(input));
+			if (!updated.ok) return updated;
+			const metadataUrl = input.metadataXml === void 0 ? input.metadataUrl ?? found.metadataUrl : void 0;
+			return register(found.organizationId, providerId, input.domains, metadataUrl, actor);
+		}),
+		removeSamlProvider: (providerId, actor = {}) => providerFor(providerId, actor).andThen(async (found) => {
+			if (found === void 0) return ok(void 0);
+			const deleted = await auth("DELETE", path(providerId));
+			if (!deleted.ok && deleted.error.kind !== "not_found") return deleted;
+			return call("unregister_sso_provider", {
+				provider: providerId,
+				actor: actor.actorId ?? null
+			}, () => found);
+		})
+	};
+}
+//#endregion
+export { createSsoAdmin as n, dohResolver as r, createSso as t };

package/dist/ssr/index.d.ts

@@ -1,5 +1,6 @@
-import { C as serializeCookie, E as writeSession, S as readSession, T as sessionEncoding, _ as WriteSessionOptions, a as ResolveAuthOptions, b as parseCookies, c as resolveAuth, d as CookieRecord, f as CookieScope, g as StoredSession, h as SessionEncoding, l as AUTH_CACHE_HEADERS, m as DEFAULT_SESSION_ENCODING, n as AuthResolver, p as CookieWrite, r as AuthState, t as AuthResolution, u as CookieOptions, v as applyCookieWrites, w as sessionCookieName, x as pruneSessionChunks, y as clearSessionAtScopes } from "../resolve-D57oDWNr.js";
-import { n as toSession, t as AuthSession } from "../view-CKzCp8FW.js";
-import { r as MembershipClaim } from "../entitlements-CMGsO4gL.js";
-import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, s as RefreshOptions, t as ClearSessionCookiesOptions } from "../ended-D_Twxl8v.js";
+import { C as readSession, D as writeSession, E as sessionEncoding, S as pruneSessionChunks, T as sessionCookieName, _ as StoredSession, a as ResolveAuthOptions, b as clearSessionAtScopes, d as CookieOptions, f as CookieRecord, g as SessionEncoding, h as DEFAULT_SESSION_ENCODING, l as resolveAuth, m as CookieWrite, n as AuthResolver, p as CookieScope, r as AuthState, t as AuthResolution, u as AUTH_CACHE_HEADERS, v as WriteSessionOptions, w as serializeCookie, x as parseCookies, y as applyCookieWrites } from "../resolve-CXX6DHv3.js";
+import { n as toSession, t as AuthSession } from "../view-DyFdMCqg.js";
+import { r as MembershipClaim } from "../entitlements-CJpYQXeE.js";
+import { n as RefreshOutcome, r as refreshSession, t as RefreshOptions } from "../refresh-DT_ICaK-.js";
+import { a as sessionStatus, i as clearSessionCookies, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-gUsMZVNg.js";
 export { AUTH_CACHE_HEADERS, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type ClearSessionCookiesOptions, type CookieOptions, type CookieRecord, type CookieScope, type CookieWrite, DEFAULT_SESSION_ENCODING, type MembershipClaim, type RefreshOptions, type RefreshOutcome, type ResolveAuthOptions, type SessionEncoding, type SessionStatus, type SessionStatusOptions, type StoredSession, type WriteSessionOptions, applyCookieWrites, authContext, clearSessionAtScopes, clearSessionCookies, parseCookies, pruneSessionChunks, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, sessionEncoding, sessionStatus, toSession, writeSession };

package/dist/ssr/index.js

@@ -1,4 +1,4 @@
-import { t as authContext } from "../context-CrojkPNC.js";
-import { _ as writeSession, a as clearSessionCookies, c as DEFAULT_SESSION_ENCODING, d as parseCookies, f as pruneSessionChunks, g as sessionEncoding, h as sessionCookieName, i as refreshSession, l as applyCookieWrites, m as serializeCookie, o as sessionStatus, p as readSession, r as resolveAuth, s as AUTH_CACHE_HEADERS, u as clearSessionAtScopes } from "../resolve-sy3_Gz0i.js";
-import { n as toSession } from "../view-CfUd5vI9.js";
+import { t as authContext } from "../context-DBicfUNz.js";
+import { _ as sessionEncoding, a as refreshSession, c as AUTH_CACHE_HEADERS, d as clearSessionAtScopes, f as parseCookies, g as sessionCookieName, h as serializeCookie, i as resolveAuth, l as DEFAULT_SESSION_ENCODING, m as readSession, o as clearSessionCookies, p as pruneSessionChunks, s as sessionStatus, u as applyCookieWrites, v as writeSession } from "../resolve-B0mW2m7f.js";
+import { n as toSession } from "../view-C8Ve14ja.js";
 export { AUTH_CACHE_HEADERS, DEFAULT_SESSION_ENCODING, applyCookieWrites, authContext, clearSessionAtScopes, clearSessionCookies, parseCookies, pruneSessionChunks, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, sessionEncoding, sessionStatus, toSession, writeSession };

package/dist/standard-BA3mLh6w.js

@@ -0,0 +1,25 @@
+import { n as dbError } from "./errors-BVFgt8BZ.js";
+import { a as ok, r as err } from "./result-ntFBW2p2.js";
+//#region src/core/standard.ts
+/** Validates with any Standard Schema (zod, valibot, arktype, ...). */
+async function validate(schema, value, label = "value") {
+	let outcome = schema["~standard"].validate(value);
+	if (outcome instanceof Promise) outcome = await outcome;
+	if (outcome.issues) return err(dbError("validation", `Invalid ${label}`, { issues: toIssues(outcome.issues) }));
+	return ok(outcome.value);
+}
+/** Standard Schema issues as JSON-safe `ValidationIssue`s. */
+function toIssues(issues) {
+	return issues.map((issue) => {
+		const path = issue.path?.map((segment) => {
+			const key = typeof segment === "object" ? segment.key : segment;
+			return typeof key === "symbol" ? String(key) : key;
+		});
+		return path && path.length > 0 ? {
+			message: issue.message,
+			path
+		} : { message: issue.message };
+	});
+}
+//#endregion
+export { validate as n, toIssues as t };

package/dist/standard-DBV730sF.d.ts

@@ -0,0 +1,7 @@
+import { f as Result } from "./result-DZeA5KS6.js";
+import { StandardSchemaV1 as StandardSchemaV1$1 } from "@standard-schema/spec";
+//#region src/core/standard.d.ts
+/** Validates with any Standard Schema (zod, valibot, arktype, ...). */
+declare function validate<S extends StandardSchemaV1$1>(schema: S, value: unknown, label?: string): Promise<Result<StandardSchemaV1$1.InferOutput<S>>>;
+//#endregion
+export { validate as n, StandardSchemaV1$1 as t };

package/dist/stats-BHl1-zj9.js

@@ -0,0 +1,83 @@
+//#region src/core/stats.ts
+const EMPTY_STATS = {
+	calls: 0,
+	waves: 0,
+	tables: [],
+	ms: 0
+};
+/**
+* Counts calls and waves. A recorder with a `parent` also reports to it, so a
+* request-wide recorder sees every scope's calls.
+*/
+var StatsRecorder = class {
+	#parent;
+	#now;
+	#tables = /* @__PURE__ */ new Set();
+	#calls = 0;
+	#waves = 0;
+	#inFlight = 0;
+	#first;
+	#last;
+	constructor(parent, now = () => performance.now()) {
+		this.#parent = parent;
+		this.#now = now;
+	}
+	/** Records a call to `table`; the returned function ends it. */
+	begin(table) {
+		const end = this.#parent?.begin(table);
+		const started = this.#now();
+		if (this.#inFlight === 0) this.#waves += 1;
+		this.#inFlight += 1;
+		this.#calls += 1;
+		this.#tables.add(table);
+		this.#first ??= started;
+		let ended = false;
+		return () => {
+			if (ended) return;
+			ended = true;
+			this.#inFlight -= 1;
+			this.#last = Math.max(this.#last ?? 0, this.#now());
+			end?.();
+		};
+	}
+	/** The totals so far. */
+	snapshot() {
+		return {
+			calls: this.#calls,
+			waves: this.#waves,
+			tables: [...this.#tables],
+			ms: this.#first === void 0 || this.#last === void 0 ? 0 : Math.round((this.#last - this.#first) * 100) / 100
+		};
+	}
+};
+/** Wraps an executor so every call is recorded. */
+function recordStats(executor, recorder) {
+	const wrapped = {
+		name: executor.name,
+		async execute(op, context) {
+			const end = recorder.begin(op.table.key);
+			try {
+				return await executor.execute(op, context);
+			} finally {
+				end();
+			}
+		}
+	};
+	if (executor.rpc) {
+		const rpc = executor.rpc.bind(executor);
+		return {
+			...wrapped,
+			async rpc(name, args, context) {
+				const end = recorder.begin(`${name}()`);
+				try {
+					return await rpc(name, args, context);
+				} finally {
+					end();
+				}
+			}
+		};
+	}
+	return wrapped;
+}
+//#endregion
+export { StatsRecorder as n, recordStats as r, EMPTY_STATS as t };

package/dist/statuses-DMMDwXpZ.js

@@ -0,0 +1,29 @@
+import { n as blockOptions, r as option } from "./options-BMjcVuaI.js";
+//#region src/blocks/dispatch/options.ts
+const dispatchSqlOptions = blockOptions({
+	extraColumns: option.unknown(),
+	timeZone: option.string({
+		default: "UTC",
+		client: true
+	}),
+	defaultDuration: option.string({ default: "1 hour" })
+});
+//#endregion
+//#region src/blocks/dispatch/statuses.ts
+/** Where a work order is in its life. */
+const WORK_ORDER_STATUSES = [
+	"unscheduled",
+	"scheduled",
+	"en_route",
+	"on_site",
+	"done",
+	"cancelled"
+];
+const WORK_ORDER_PRIORITIES = [
+	"low",
+	"normal",
+	"high",
+	"urgent"
+];
+//#endregion
+export { WORK_ORDER_STATUSES as n, dispatchSqlOptions as r, WORK_ORDER_PRIORITIES as t };

package/dist/statuses-zRcc2TeZ.js

@@ -0,0 +1,28 @@
+//#region src/blocks/shipments/statuses.ts
+const LABEL_FORMATS = [
+	"pdf",
+	"png",
+	"zpl"
+];
+/** The stages a carrier reports, in the order a parcel goes through them. */
+const TRACKING_STATUSES = [
+	"label_created",
+	"in_transit",
+	"out_for_delivery",
+	"delivered",
+	"exception",
+	"returned"
+];
+/** Where a shipment is: a draft, then the status of its latest tracking event. */
+const SHIPMENT_STATUSES = [
+	"draft",
+	"label_created",
+	"in_transit",
+	"out_for_delivery",
+	"delivered",
+	"exception",
+	"returned",
+	"cancelled"
+];
+//#endregion
+export { SHIPMENT_STATUSES as n, TRACKING_STATUSES as r, LABEL_FORMATS as t };

package/dist/storage/index.d.ts

@@ -1,4 +1,4 @@
-import { J as BucketLifecycleRule, X as VersioningStatus, Y as ObjectVersion, n as AccessPolicySql, q as BucketLifecycle, t as AccessBucketPolicy } from "../types-DmshMaXz.js";
-import { $ as TemplateValues, A as StorageBucketApi, B as StorageListV2Result, C as UploadOptions, D as TTL, E as parseSize, F as StorageFetchParameters, G as StorageSearchV2Options, H as StorageRemoveEntry, I as StorageFileOptions, J as StorageUrlOptions, K as StorageSignedUrlEntry, L as StorageListEntry, M as StorageDestinationOptions, N as StorageDownloadOptions, O as TtlPreset, P as StorageFailure, Q as TemplateParams, R as StorageListV2Folder, S as UploadBody, T as defineBucket, U as StorageResponse, V as StorageObjectInfo, W as StorageSearchOptions, X as StoragePath, Y as PathIn, Z as AppliedBucket, _ as StoredObject, a as BucketConnectOptions, b as TransferOptions, c as DownloadOptions, d as PathValues, f as PurgeCacheOptions, g as StorageAdminClient, h as Reservation, i as BucketConfig, j as StorageClient, k as StorageApi, l as ImageTransform, m as ReplaceResult, n as Bucket, o as BucketDrift, p as ReplaceOptions, q as StorageTransform, r as BucketClient, s as BucketPolicy, t as ActualBucket, u as ObjectTarget, v as SweepOptions, w as UrlOptions, x as TransformOptions, y as SweepResult, z as StorageListV2Object } from "../bucket-DBay-ICp.js";
-import { A as StoredRef, C as AnyBucket, D as Buckets, E as BucketWithId, F as storageImageUrl, I as fromStorageError, M as StorageImageOptions, N as StorageImageSize, O as ConnectedRef, P as storageImageSrcSet, S as organizationLogoBucket, T as BucketMap, _ as IMAGE_TYPES, a as VectorHit, b as OrganizationLogoBucketOptions, c as VectorMetadata, d as defineVectorBucket, f as AnalyticsBucket, g as AvatarBucketOptions, h as defineAnalyticsBucket, i as VectorDistance, j as defineBuckets, k as ResolvedRef, l as VectorQueryOptions, m as AnalyticsCatalog, n as VectorBucketClient, o as VectorIndexClient, p as AnalyticsBucketClient, r as VectorBucketConfig, s as VectorIndexConfig, t as VectorBucket, u as VectorRecord, v as ImageBucketOptions, w as BucketIdOf, x as avatarBucket, y as ImageVariant } from "../index-CrAKHNJF.js";
+import { E as AccessPolicySql, T as AccessBucketPolicy, _t as BucketLifecycle, bt as VersioningStatus, vt as BucketLifecycleRule, yt as ObjectVersion } from "../types-DFdg_4yN.js";
+import { $ as TemplateValues, A as StorageBucketApi, B as StorageListV2Result, C as UploadOptions, D as TTL, E as parseSize, F as StorageFetchParameters, G as StorageSearchV2Options, H as StorageRemoveEntry, I as StorageFileOptions, J as StorageUrlOptions, K as StorageSignedUrlEntry, L as StorageListEntry, M as StorageDestinationOptions, N as StorageDownloadOptions, O as TtlPreset, P as StorageFailure, Q as TemplateParams, R as StorageListV2Folder, S as UploadBody, T as defineBucket, U as StorageResponse, V as StorageObjectInfo, W as StorageSearchOptions, X as StoragePath, Y as PathIn, Z as AppliedBucket, _ as StoredObject, a as BucketConnectOptions, b as TransferOptions, c as DownloadOptions, d as PathValues, f as PurgeCacheOptions, g as StorageAdminClient, h as Reservation, i as BucketConfig, j as StorageClient, k as StorageApi, l as ImageTransform, m as ReplaceResult, n as Bucket, o as BucketDrift, p as ReplaceOptions, q as StorageTransform, r as BucketClient, s as BucketPolicy, t as ActualBucket, u as ObjectTarget, v as SweepOptions, w as UrlOptions, x as TransformOptions, y as SweepResult, z as StorageListV2Object } from "../bucket-CiNi8sIw.js";
+import { A as StoredRef, C as AnyBucket, D as Buckets, E as BucketWithId, F as storageImageUrl, I as fromStorageError, M as StorageImageOptions, N as StorageImageSize, O as ConnectedRef, P as storageImageSrcSet, S as organizationLogoBucket, T as BucketMap, _ as IMAGE_TYPES, a as VectorHit, b as OrganizationLogoBucketOptions, c as VectorMetadata, d as defineVectorBucket, f as AnalyticsBucket, g as AvatarBucketOptions, h as defineAnalyticsBucket, i as VectorDistance, j as defineBuckets, k as ResolvedRef, l as VectorQueryOptions, m as AnalyticsCatalog, n as VectorBucketClient, o as VectorIndexClient, p as AnalyticsBucketClient, r as VectorBucketConfig, s as VectorIndexConfig, t as VectorBucket, u as VectorRecord, v as ImageBucketOptions, w as BucketIdOf, x as avatarBucket, y as ImageVariant } from "../index-Do2ChN_y.js";
 export { type AccessBucketPolicy, type AccessPolicySql, type ActualBucket, type AnalyticsBucket, type AnalyticsBucketClient, type AnalyticsCatalog, type AnyBucket, type AppliedBucket, type AvatarBucketOptions, type Bucket, type BucketClient, type BucketConfig, type BucketConnectOptions, type BucketDrift, type BucketIdOf, type BucketLifecycle, type BucketLifecycleRule, type BucketMap, type BucketPolicy, type BucketWithId, type Buckets, type ConnectedRef, type DownloadOptions, IMAGE_TYPES, type ImageBucketOptions, type ImageTransform, type ImageVariant, type ObjectTarget, type ObjectVersion, type OrganizationLogoBucketOptions, type PathIn, type PathValues, type PurgeCacheOptions, type ReplaceOptions, type ReplaceResult, type Reservation, type ResolvedRef, type StorageAdminClient, type StorageApi, type StorageBucketApi, type StorageClient, type StorageDestinationOptions, type StorageDownloadOptions, type StorageFailure, type StorageFetchParameters, type StorageFileOptions, type StorageImageOptions, type StorageImageSize, type StorageListEntry, type StorageListV2Folder, type StorageListV2Object, type StorageListV2Result, type StorageObjectInfo, type StoragePath, type StorageRemoveEntry, type StorageResponse, type StorageSearchOptions, type StorageSearchV2Options, type StorageSignedUrlEntry, type StorageTransform, type StorageUrlOptions, type StoredObject, type StoredRef, type SweepOptions, type SweepResult, TTL, type TemplateParams, type TemplateValues, type TransferOptions, type TransformOptions, type TtlPreset, type UploadBody, type UploadOptions, type UrlOptions, type VectorBucket, type VectorBucketClient, type VectorBucketConfig, type VectorDistance, type VectorHit, type VectorIndexClient, type VectorIndexConfig, type VectorMetadata, type VectorQueryOptions, type VectorRecord, type VersioningStatus, avatarBucket, defineAnalyticsBucket, defineBucket, defineBuckets, defineVectorBucket, fromStorageError, organizationLogoBucket, parseSize, storageImageSrcSet, storageImageUrl };

package/dist/storage/index.js

@@ -1,14 +1,14 @@
-import { t as DbException } from "../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../errors-D7u24ZJH.js";
+import { t as DbException } from "../db-exception-Lngc1W49.js";
+import { n as dbError } from "../errors-BVFgt8BZ.js";
 import { c as optionalTemporal, n as isInstant } from "../temporal-DLZlWbOi.js";
-import { n as temporalMissing } from "../temporal-required-Dt4mcPsi.js";
-import { a as ok, r as err, s as toDbError, t as AsyncResult } from "../result-DIT_qp4G.js";
-import { a as spansAllTenants } from "../plugin-D9bYbYli.js";
+import { n as temporalMissing } from "../temporal-required-Dy0GGD8E.js";
+import { a as ok, r as err, s as toDbError, t as AsyncResult } from "../result-ntFBW2p2.js";
+import { a as spansAllTenants } from "../plugin-AKwwe2gF.js";
 import { a as tenantClaimPaths, o as tenantFrom, s as tenantPathsFor } from "../claims-Bp9My7XP.js";
-import { a as sqlString, i as sqlIdent, n as parseTemplate, r as slug, t as claimSql } from "../template-DXsGm_R0.js";
-import { r as accessCheck } from "../access-sql-BpOdJvfj.js";
-import { t as fromStorageError } from "../errors-Cq72lONT.js";
-import { a as ttlSeconds, i as TTL, r as transformFor, t as checkVariants } from "../variants-Bat9zU8l.js";
+import { a as sqlString, i as sqlIdent, n as parseTemplate, r as slug, t as claimSql } from "../template-Drgg3v2J.js";
+import { r as accessCheck } from "../access-sql-B-MkVARa.js";
+import { t as fromStorageError } from "../errors-CyxMxzlu.js";
+import { a as ttlSeconds, i as TTL, r as transformFor, t as checkVariants } from "../variants-Cy--Ub-a.js";
 import { i as storageImageUrl, r as storageImageSrcSet } from "../image-url-_d7xYsXK.js";
 //#region src/storage/versioning.ts
 const MAX_DAYS = 2147483647;
@@ -1008,10 +1008,10 @@ function defineBucket(config) {
 				]);
 			}
 			for (const [suffix, command, roles, using, withCheck] of policies) {
-				const policyName = sqlIdent(`bs_${name}_${suffix}`);
+				const policyName = sqlIdent(`bsb_${name}_${suffix}`);
 				lines.push("", `drop policy if exists ${policyName} on storage.objects;`, `create policy ${policyName} on storage.objects for ${command} to ${roles}${using ? `\n  using (${using})` : ""}${withCheck ? `\n  with check (${withCheck})` : ""};`);
 			}
-			if (permission && !permission.list) lines.push("", `drop policy if exists ${sqlIdent(`bs_${name}_list`)} on storage.objects;`);
+			if (permission && !permission.list) lines.push("", `drop policy if exists ${sqlIdent(`bsb_${name}_list`)} on storage.objects;`);
 			return `${lines.join("\n")}\n`;
 		},
 		toml() {

package/dist/store-CpheI-lN.d.ts

@@ -0,0 +1,83 @@
+import { t as AsyncResult } from "./result-DZeA5KS6.js";
+//#region src/streams/store.d.ts
+/** How a stream is opened. */
+interface StreamOpenOptions {
+  /** The user who may read the stream and cancel it. */
+  readonly owner?: string;
+  readonly tenant?: string;
+  /**
+   * What the stream carries, such as `chat` or `workflow`. Defaults to
+   * `default`.
+   */
+  readonly kind?: string;
+  /**
+   * Seconds the stream lives, or a Postgres interval such as `"2 hours"`.
+   * Defaults to one day.
+   */
+  readonly ttl?: number | string;
+}
+interface StreamAppendResult {
+  /** The index the next chunk gets. */
+  readonly next: number;
+  /** Someone asked the writer to stop. */
+  readonly cancelled: boolean;
+}
+interface StreamStatus {
+  /** The number of chunks stored. */
+  readonly next: number;
+  readonly closed: boolean;
+  readonly cancelled: boolean;
+}
+interface StreamReadOptions {
+  /** Ends the stream early. */
+  readonly signal?: AbortSignal;
+}
+interface StreamPurgeOptions {
+  /**
+   * How long a closed stream is kept: seconds or an interval. Defaults to one
+   * day.
+   */
+  readonly olderThan?: number | string;
+}
+/**
+ * Durable, resumable output: one writer appends ordered text chunks and any
+ * number of readers read from a chunk index, live or after a reconnect. Chunks
+ * keep the index they were appended at, so a reader that counted `n` chunks
+ * resumes with `read(id, n)`.
+ */
+interface StreamStore {
+  readonly apiVersion: 1;
+  readonly name: string;
+  /** Creates the stream; `true` when it was new, `false` when it existed. */
+  open(id: string, options?: StreamOpenOptions): AsyncResult<boolean>;
+  /**
+   * Stores `chunks` at `fromIdx`, `fromIdx + 1`, ... Indexes already stored are
+   * skipped, so a retried batch is harmless. Fails with the hint
+   * `STREAM_NOT_FOUND`, `STREAM_CLOSED` or `STREAM_GAP` (`fromIdx` past the
+   * end).
+   */
+  append(id: string, fromIdx: number, chunks: readonly string[]): AsyncResult<StreamAppendResult>;
+  /**
+   * The chunks from `fromIdx` on, waiting for new ones until the stream is
+   * closed. A stream that doesn't exist (or that the caller can't read) ends at
+   * once. A read error errors the stream with the `DbError`.
+   */
+  read(id: string, fromIdx?: number, options?: StreamReadOptions): ReadableStream<string>;
+  /** The stream's state, or `undefined` when it doesn't exist. */
+  status(id: string): AsyncResult<StreamStatus | undefined>;
+  isCancelled(id: string): AsyncResult<boolean>;
+  /**
+   * Marks the stream finished; `false` when it was closed already or doesn't
+   * exist.
+   */
+  close(id: string): AsyncResult<boolean>;
+  /** Asks the writer to stop; it learns on its next append. */
+  cancel(id: string): AsyncResult<boolean>;
+  /**
+   * Deletes expired streams and closed ones past `olderThan`; resolves with the
+   * count.
+   */
+  purge(options?: StreamPurgeOptions): AsyncResult<number>;
+}
+//#endregion
+export { StreamStatus as a, StreamReadOptions as i, StreamOpenOptions as n, StreamStore as o, StreamPurgeOptions as r, StreamAppendResult as t };

package/dist/streams/index.d.ts

@@ -1,6 +1,6 @@
-import { T as ErrorMapper, t as AsyncResult } from "../result-mijqfoJN.js";
-import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-DBPhgF3W.js";
-import { a as StreamStatus, i as StreamReadOptions, n as StreamOpenOptions, o as StreamStore, r as StreamPurgeOptions, t as StreamAppendResult } from "../store-DKqbuNvw.js";
+import { T as ErrorMapper, t as AsyncResult } from "../result-DZeA5KS6.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-DWZSJrwN.js";
+import { a as StreamStatus, i as StreamReadOptions, n as StreamOpenOptions, o as StreamStore, r as StreamPurgeOptions, t as StreamAppendResult } from "../store-CpheI-lN.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 //#region src/streams/postgres.d.ts
 interface PostgresStreamStoreOptions {

package/dist/streams/index.js

@@ -1,7 +1,6 @@
 import { n as isRecord } from "../guards-6F2bCtQR.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-Ds0C2mUf.js";
-import { D as recordOf, F as stringsOf, M as seconds, o as blockCall } from "../block-helpers-DwE32_gT.js";
-import { n as teeToStore, r as writeToStore, t as resumeFromStore } from "../tee-1fsH3bEz.js";
+import { B as dbTransport, D as recordOf, F as stringsOf, H as rpcTransport, M as seconds, U as sqlTransport, o as blockCall } from "../block-helpers-CtBdjgO4.js";
+import { n as teeToStore, r as writeToStore, t as resumeFromStore } from "../tee-V97_v1ZS.js";
 import { t as pollingRead } from "../store-McN-2esd.js";
 //#region src/streams/postgres.ts
 function statusOf(value) {

package/dist/streams/redis/index.d.ts

@@ -1,4 +1,4 @@
-import { o as StreamStore } from "../../store-DKqbuNvw.js";
+import { o as StreamStore } from "../../store-CpheI-lN.js";
 //#region src/streams/redis/redis.d.ts
 /**
  * The commands the store sends, as node-redis 5 and 6 (`createClient()`) name
@@ -20,7 +20,7 @@ interface RedisStreamSubscriber {
   unsubscribe(channel: string, listener: (message: string) => void): Promise<unknown>;
 }
 interface RedisStreamSharedOptions {
-  /** Key and channel prefix. Defaults to `bs:stream`. */
+  /** Key and channel prefix. Defaults to `bsb:stream`. */
   readonly keyPrefix?: string;
   /** How long a stream opened without a `ttl` lives. Defaults to `'1 day'`. */
   readonly ttl?: number | string;

package/dist/streams/redis/index.js

@@ -1,6 +1,6 @@
-import { n as dbError } from "../../errors-D7u24ZJH.js";
-import { a as ok, r as err, t as AsyncResult } from "../../result-DIT_qp4G.js";
+import { n as dbError } from "../../errors-BVFgt8BZ.js";
 import { n as isRecord } from "../../guards-6F2bCtQR.js";
+import { a as ok, r as err, t as AsyncResult } from "../../result-ntFBW2p2.js";
 import { t as importOptionalPeer } from "../../optional-peer-C1NbBRJm.js";
 import { t as pollingRead } from "../../store-McN-2esd.js";
 //#region src/streams/redis/redis.ts
@@ -59,7 +59,7 @@ function redisStreamStore(options, load = loadRedis) {
 		return pending;
 	};
 	const redis = async () => (await connection()).client;
-	const prefix = options.keyPrefix ?? "bs:stream";
+	const prefix = options.keyPrefix ?? "bsb:stream";
 	const defaultTtl = ttlSeconds(options.ttl ?? DAY);
 	const wakes = "url" in options || options.subscriber !== void 0;
 	const pollMs = options.pollMs ?? (wakes ? 2e3 : 250);

package/dist/stripe/index.d.ts

@@ -1,4 +1,4 @@
-import { t as StripeClient } from "../stripe-BSEwKCni.js";
+import { t as StripeClient } from "../stripe-X22LjuH-.js";
 //#region src/stripe/stripe.d.ts
 /**
  * The secret key and, optionally, the API version of the Stripe client to