better-supabase 0.14.0 → 0.15.0

package/dist/delegation--93jRsVO.js

@@ -0,0 +1,146 @@
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { n as actorOf } from "./actor-go7p9-CJ.js";
+import { n as impersonatorClaim, t as actClaim } from "./impersonation-DM3oWNoD.js";
+//#region src/auth/delegation.ts
+/**
+* The claim `forContext({ permissions })` sets: the permission keys the work
+* may use. `better_supabase.cap_allows` refuses every other key, and a job
+* queued under a cap keeps it.
+*/
+const PERMISSION_CAP_CLAIM = "bsb_permission_cap";
+/**
+* The claims a delegated token adds; `contextClaims` never takes them from
+* `claimsFor`.
+*/
+const DELEGATION_CLAIMS = [
+	"act",
+	"client_id",
+	"scope",
+	"authorization_details",
+	PERMISSION_CAP_CLAIM
+];
+/**
+* `*` grants every key and `prefix.*` every key under prefix, as
+* `permission_matches` in SQL.
+*/
+function permissionMatches(granted, wanted) {
+	return granted === "*" || granted === wanted || granted.endsWith(".*") && wanted.startsWith(granted.slice(0, -1));
+}
+/**
+* The permission cap in `claims`: `undefined` without one, `false` for a cap
+* that is not a list of strings.
+*/
+function permissionCapOf(claims) {
+	const cap = claims[PERMISSION_CAP_CLAIM];
+	if (cap === void 0) return;
+	return Array.isArray(cap) && cap.every((key) => typeof key === "string") ? cap : false;
+}
+/**
+* The keys of `wanted` that `inherited` allows, so a cap only ever narrows.
+* Either side alone is the cap; neither is no cap.
+*/
+function narrowCap(inherited, wanted) {
+	if (wanted === void 0) return inherited;
+	if (inherited === void 0) return wanted;
+	return wanted.filter((key) => inherited.some((granted) => permissionMatches(granted, key)));
+}
+const INVALID = {
+	ok: false,
+	reason: "invalid-delegation"
+};
+function isDetail(value) {
+	return isRecord(value) && typeof value["type"] === "string" && value["type"] !== "";
+}
+function scopeOf(value) {
+	if (value === void 0) return;
+	const scopes = typeof value === "string" ? value.split(/\s+/u) : Array.isArray(value) && value.every((item) => typeof item === "string") ? value : void 0;
+	if (scopes === void 0) return false;
+	const joined = scopes.filter(Boolean).join(" ");
+	return joined === "" ? void 0 : joined;
+}
+/**
+* The delegation in `claims`, for a token an OAuth client or agent acts with: a
+* `client_id`, or an `act` chain that is not a support or impersonation level.
+* `{ ok: true }` without `delegation` for any other session. An invalid `act`
+* chain, a `client_id` that is not a non-empty string, a `scope` that is
+* neither a string nor a list of strings, and `authorization_details` that are
+* not objects with a `type` are `{ ok: false }`: the work must not run as the
+* user alone.
+*/
+function delegatedClaims(claims) {
+	const outcome = actorOf(claims);
+	if (!outcome.ok) return {
+		ok: false,
+		reason: "invalid-chain"
+	};
+	const client = claims["client_id"];
+	if (client !== void 0 && (typeof client !== "string" || client === "")) return INVALID;
+	const actor = outcome.actor;
+	const chain = actor?.kind === "oauth-client" || actor?.kind === "agent" ? actor.chain : void 0;
+	if (client === void 0 && chain === void 0) return { ok: true };
+	const scope = scopeOf(claims["scope"]);
+	if (scope === false) return INVALID;
+	const details = claims["authorization_details"];
+	if (details !== void 0 && !(Array.isArray(details) && details.every(isDetail))) return INVALID;
+	return {
+		ok: true,
+		delegation: {
+			...client === void 0 ? {} : { client_id: client },
+			...scope === void 0 ? {} : { scope },
+			...details === void 0 ? {} : { authorization_details: details },
+			...chain === void 0 ? {} : { act: chain }
+		}
+	};
+}
+/**
+* The SQL claims for the user in a recorded context: the user as
+* `authenticated`, the tenant as `tenant_id`, and the context's delegation, so
+* the access functions (through `cap_allows`), `token_scope_allows` and the
+* TypeScript scope checks narrow the work to what the queuing token held, and
+* to its permission cap. The `act` claim is the support session, else the OAuth
+* client chain, else the impersonating admin.
+*/
+function contextClaims(context, options = {}) {
+	const { actor, tenant } = context;
+	if (actor?.kind !== "user") return {
+		ok: false,
+		message: `forContext needs a user actor, got ${actor ? actor.kind : "none"}: use admin() for service work`
+	};
+	const claims = context.claims ?? {};
+	const recorded = actorOf(claims);
+	const delegated = delegatedClaims(claims);
+	const inherited = permissionCapOf(claims);
+	if (inherited === false) return {
+		ok: false,
+		message: "forContext got an invalid permission cap"
+	};
+	const cap = narrowCap(inherited, options.permissions);
+	if (!recorded.ok || !delegated.ok) return {
+		ok: false,
+		message: !recorded.ok || !delegated.ok && delegated.reason === "invalid-chain" ? "forContext got an invalid act claim" : "forContext got invalid delegation claims"
+	};
+	const support = recorded.actor?.kind === "support" ? recorded.actor : void 0;
+	const delegation = delegated.delegation ?? {};
+	const act = support ? impersonatorClaim(support) : delegation.act ?? (actor.impersonator ? actClaim({
+		actor: actor.impersonator,
+		reason: options.reason ?? "job"
+	}) : void 0);
+	const extra = Object.fromEntries(Object.entries(options.extra ?? {}).filter(([key]) => !DELEGATION_CLAIMS.includes(key)));
+	const impersonator = support?.id ?? actor.impersonator;
+	return {
+		ok: true,
+		claims: {
+			...extra,
+			role: "authenticated",
+			sub: actor.id,
+			...tenant === void 0 ? {} : { tenant_id: tenant },
+			...delegation,
+			...act === void 0 ? {} : { act },
+			...cap === void 0 ? {} : { [PERMISSION_CAP_CLAIM]: cap }
+		},
+		...impersonator === void 0 ? {} : { impersonator },
+		...support?.readOnly ? { readOnly: true } : {}
+	};
+}
+//#endregion
+export { narrowCap as a, delegatedClaims as i, PERMISSION_CAP_CLAIM as n, permissionCapOf as o, contextClaims as r, DELEGATION_CLAIMS as t };

package/dist/documents-Cup1rpjF.d.ts

@@ -0,0 +1,152 @@
+/// <reference lib="esnext.temporal" />
+import { T as ErrorMapper, t as AsyncResult } from "./result-DZeA5KS6.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { r as BlockTemporalOptions } from "./block-helpers-CRpAHrp_.js";
+import { t as BlockTransport } from "./block-transport-DWZSJrwN.js";
+import { n as BlockHooks } from "./block-hooks-DZN2w69m.js";
+//#region src/blocks/documents/documents.d.ts
+interface DocumentsOptions extends BlockTemporalOptions {
+  readonly transport: BlockTransport;
+  /**
+   * The module schema, or its API schema: `defineBlocks` passes it from
+   * `blocks.generated.ts`.
+   */
+  readonly schema?: string;
+  /** `withBlockHooks` hooks around the client's methods. */
+  readonly hooks?: BlockHooks<Documents>;
+  /** Receives the errors `after` hooks throw. Default: `console`. */
+  readonly logger?: Logger;
+  readonly mappers?: readonly ErrorMapper[];
+}
+/** Which document to open: one per subject and name. */
+interface DocumentRef {
+  readonly organizationId: string;
+  readonly subjectType: string;
+  readonly subjectId: string;
+  /** Default: `body`. */
+  readonly name?: string;
+}
+/** A Yjs update and its place in the document's log. */
+interface DocumentUpdate {
+  readonly seq: number;
+  readonly update: Uint8Array;
+}
+interface DocumentInfo {
+  readonly id: string;
+  readonly organizationId: string;
+  readonly subjectType: string;
+  readonly subjectId: string;
+  readonly name: string;
+  /** The private realtime topic for updates and presence. */
+  readonly topic: string;
+  readonly createdAt: Temporal.Instant;
+  readonly updatedAt: Temporal.Instant;
+}
+/** What a client needs to rebuild the document. */
+interface DocumentState {
+  /** The compacted state; unset before the first compaction. */
+  readonly snapshot?: Uint8Array;
+  /** The last update the snapshot contains, `0` without one. */
+  readonly snapshotSeq: number;
+  /** The updates after the snapshot, oldest first. */
+  readonly updates: readonly DocumentUpdate[];
+}
+interface OpenedDocument extends DocumentInfo, DocumentState {
+  /** Whether the caller may push updates. */
+  readonly canWrite: boolean;
+  /**
+   * Whether the caller may suggest changes: editors, and readers who hold
+   * `documents.suggest`.
+   */
+  readonly canSuggest: boolean;
+}
+interface DocumentVersion {
+  readonly id: string;
+  readonly number: number;
+  /** The version's name; a named version is kept out of retention. */
+  readonly label?: string;
+  /** `manual` for a saved version, `auto` for one the app took. */
+  readonly source: string;
+  /** A frozen version keeps its name. */
+  readonly frozen: boolean;
+  readonly createdBy?: string;
+  readonly createdAt: Temporal.Instant;
+}
+type DocumentSuggestionStatus = "open" | "accepted" | "rejected" | "withdrawn";
+/** A suggested change: a Yjs update that is not in the log yet. */
+interface DocumentSuggestion {
+  readonly id: string;
+  readonly documentId: string;
+  readonly update: Uint8Array;
+  readonly summary?: string;
+  readonly status: DocumentSuggestionStatus;
+  readonly createdBy?: string;
+  readonly createdAt: Temporal.Instant;
+  readonly decidedBy?: string;
+  readonly decidedAt?: Temporal.Instant;
+  readonly note?: string;
+}
+interface DecidedSuggestion extends DocumentSuggestion {
+  /** The update's place in the log, when the suggestion was accepted. */
+  readonly seq?: number;
+}
+type SuggestionDecision = "accepted" | "rejected" | "withdrawn";
+interface Documents {
+  /** The document's state; creates it on first open for an editor. */
+  open(ref: DocumentRef): AsyncResult<OpenedDocument>;
+  /** Appends an update and returns its sequence number. */
+  push(documentId: string, update: Uint8Array): AsyncResult<number>;
+  /**
+   * Updates after `afterSeq`. When compaction dropped some of them, the result
+   * carries the snapshot to start from instead.
+   */
+  pull(documentId: string, afterSeq: number): AsyncResult<DocumentState>;
+  /**
+   * Stores `state` as the snapshot through `throughSeq` and drops those
+   * updates. Returns false when a newer snapshot exists. The service role or
+   * `documents.manage`.
+   */
+  compact(documentId: string, state: Uint8Array, throughSeq: number): AsyncResult<boolean>;
+  /** Saves the merged state as a version; needs the versions module. */
+  saveVersion(documentId: string, state: Uint8Array, label?: string): AsyncResult<{
+    readonly id: string;
+    readonly number: number;
+  }>;
+  /**
+   * Newest first; needs the versions module. `named: true` keeps the versions
+   * with a name.
+   */
+  versions(documentId: string, options?: {
+    readonly named?: boolean;
+  }): AsyncResult<readonly DocumentVersion[]>;
+  /**
+   * Names a version, or removes its name with `null`. A named version is kept
+   * out of retention. Editors; needs the versions module.
+   */
+  nameVersion(documentId: string, versionId: string, label: string | null): AsyncResult<boolean>;
+  /**
+   * Stores an update as a suggestion instead of appending it. Editors, and
+   * readers who hold `documents.suggest`.
+   */
+  suggest(documentId: string, update: Uint8Array, summary?: string): AsyncResult<DocumentSuggestion>;
+  /** Oldest first. Default status: `open`. */
+  suggestions(documentId: string, options?: {
+    readonly status?: DocumentSuggestionStatus | "all";
+  }): AsyncResult<readonly DocumentSuggestion[]>;
+  /**
+   * Accepts or rejects a suggestion (editors), or withdraws it (its author).
+   * Accepting appends the update to the log.
+   */
+  decideSuggestion(suggestionId: string, decision: SuggestionDecision, note?: string): AsyncResult<DecidedSuggestion>;
+  /** A saved state; needs the versions module. */
+  version(documentId: string, versionId: string): AsyncResult<Uint8Array>;
+  /** Documents with at least `minUpdates` uncompacted updates. Service role. */
+  toCompact(options?: {
+    readonly minUpdates?: number;
+    readonly limit?: number;
+  }): AsyncResult<readonly string[]>;
+}
+/** The `documents` SQL module as typed calls, with updates as bytes. */
+declare function createDocuments(options: DocumentsOptions): Documents;
+//#endregion
+export { DocumentSuggestion as a, DocumentVersion as c, OpenedDocument as d, SuggestionDecision as f, DocumentState as i, Documents as l, DocumentInfo as n, DocumentSuggestionStatus as o, createDocuments as p, DocumentRef as r, DocumentUpdate as s, DecidedSuggestion as t, DocumentsOptions as u };

package/dist/edge/index.d.ts

@@ -1,18 +1,18 @@
-import { f as Result } from "../result-C6jDfedy.js";
-import { t as StandardSchemaV1 } from "../standard-DbQsD2xZ.js";
-import { M as AnyFunctions, N as AnyModels } from "../executor-CPyrQdjh.js";
-import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-DFP3gHv8.js";
-import { t as BetterSupabase } from "../define-Dw7pRO4h.js";
-import { t as AuthSession } from "../view-2_I-2ukO.js";
-import { a as ServerContext, c as ServerOptions, n as BetterServer } from "../server-types-BOs-eFpo.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-CZYibxUx.js";
-import { c as ResourceLoaderContext, s as BlockRequireOptions } from "../kit-DKfbNTAA.js";
-import { n as FunctionContract, t as DescribedFunction } from "../function-contract-vPqwt1j4.js";
+import { f as Result } from "../result-DZeA5KS6.js";
+import { t as StandardSchemaV1 } from "../standard-DBV730sF.js";
+import { O as AnyFunctions, k as AnyModels } from "../types-DFdg_4yN.js";
+import { l as PermissionRef, t as AnyAuthorizer } from "../authorizer-B6X09otb.js";
+import { t as BetterSupabase } from "../define-DFBnQyYg.js";
+import { a as ServerContext, c as ServerOptions, n as BetterServer } from "../server-types-CFtehAsr.js";
+import { t as AuthSession } from "../view-DyFdMCqg.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-Dn1_YhC1.js";
+import { c as ResourceLoaderContext, s as BlockRequireOptions } from "../kit-DOwKpSkA.js";
+import { n as FunctionContract, t as DescribedFunction } from "../function-contract-DxFNOmsm.js";
 import { t as Validated } from "../shared-CRRfQAKG.js";
 import { n as SUPABASE_CORS_HEADERS, r as corsConfig, t as CorsOptions } from "../cors-kLq6VM06.js";
-import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-Bzt_bpR5.js";
-import { t as ResourceMap } from "../resources-Du5wcL3f.js";
-import { t as defineAction } from "../resource-execute-bT9ltHVT.js";
+import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-DnKiH4G2.js";
+import { t as ResourceMap } from "../resources-B9cQxhjw.js";
+import { t as defineAction } from "../resource-execute-CzHuDsil.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 //#region src/bridges/edge.d.ts
 /** The platform context Workers pass as the third `fetch` argument. */
@@ -32,7 +32,7 @@ type EdgeHandler = (request: Request, env?: unknown, executionContext?: EdgeExec
  * ```ts
  * Deno.serve(
  *   toEdge([withBetterSupabase(server)], async (req, ctx) =>
- *     Response.json(await ctx.db.notes.findMany().orThrow()),
+ *     Response.json(await ctx.db.notes.list().orThrow()),
  *   ),
  * );
  * ```
@@ -79,7 +79,7 @@ interface FunctionDefinition<I extends StandardSchemaV1, Out, M extends AnyModel
  * it through `functions<Contracts>()` from `better-supabase/client`.
  *
  * ```ts
- * const sendInvite = defineFunction(bs, {
+ * const sendInvite = defineFunction(bsb, {
  *   input: z.object({ email: z.email() }),
  *   handler: (input, ctx) => ctx.db.invites.create({ data: input }),
  * });
@@ -123,7 +123,7 @@ export type EdgeRouteHandler<M extends AnyModels, F extends AnyFunctions, E, C =
   readonly tenant: string | undefined;
 }) => unknown;
 /**
- * A route with its own guard: `allow`, `aal`, `scopes`, `requireTenant`,
+ * A route with its own guard: `allow`, `aal`, `scopes`, `requireOrganization`,
  * `authorize`.
  */
 export interface EdgeRoute<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Params = Readonly<Record<string, string>>, B = unknown, Ref = unknown> extends BlockRequireOptions<C, P, boolean, Ref, ServerContext<M, F, E, C, P, B> & ResourceLoaderContext<C, P>> {
@@ -148,13 +148,13 @@ export interface BetterEdge<M extends AnyModels, F extends AnyFunctions, E, C =
    *
    * ```ts
    * Deno.serve(
-   *   bs.routes(
+   *   bsb.routes(
    *     {
-   *       "GET /customers": (req, ctx) => ctx.db.customers.findMany(),
+   *       "GET /customers": (req, ctx) => ctx.db.customers.list(),
    *       "GET /customers/:id": (req, ctx) =>
    *         ctx.db.customers.find(ctx.params.id),
    *       "POST /invites": {
-   *         requireTenant: true,
+   *         requireOrganization: true,
    *         handler: (req, ctx) => invite(req, ctx),
    *       },
    *     },
@@ -165,7 +165,7 @@ export interface BetterEdge<M extends AnyModels, F extends AnyFunctions, E, C =
    */
   routes<K extends string>(routes: { readonly [Key in K]: EdgeRouteHandler<M, F, E, C, P, RouteParams<Key>, B> | EdgeRoute<M, F, E, C, P, RouteParams<Key>, B, Ref>; }, options?: ResourcesOptions): EdgeHandler;
   /**
-   * REST resources matching the API model, e.g. `Deno.serve(bs.resources({
+   * REST resources matching the API model, e.g. `Deno.serve(bsb.resources({
    * customers: true }))`: collection, item and action paths. An unknown path
    * answers 404 before auth resolves.
    */

package/dist/edge/index.js

@@ -1,16 +1,16 @@
-import { n as dbError } from "../errors-03ysrOt4.js";
-import { a as ok, r as err } from "../result-B3m7xtRY.js";
-import { n as validate } from "../standard-DtkpFGkS.js";
-import { o as problemResponse } from "../problem-BWElIgIb.js";
-import { a as unexpectedResponse, c as extendServer, o as withFlush, s as createServer } from "../adapter-BCFAg58A.js";
-import { a as respond, o as settle, t as defaultExpose } from "../respond-z_yfyitp.js";
-import { t as withBetterSupabase } from "../composite-Dv6o2BSw.js";
-import { r as defineAction } from "../resource-Dk_JYsOt.js";
-import { i as requireCaller } from "../kit-Ct4Z6GIO.js";
+import { n as dbError } from "../errors-BVFgt8BZ.js";
+import { a as ok, r as err } from "../result-ntFBW2p2.js";
+import { n as validate } from "../standard-BA3mLh6w.js";
+import { o as problemResponse } from "../problem-Bf0cJ7tk.js";
+import { a as unexpectedResponse, c as extendServer, o as withFlush, s as createServer } from "../adapter-B0b6MXYS.js";
+import { a as respond, o as settle, t as defaultExpose } from "../respond-C3CcOZlA.js";
+import { t as withBetterSupabase } from "../composite-BARuBEDE.js";
+import { i as defineAction } from "../resource-DV2GC2dB.js";
+import { i as requireCaller } from "../kit-5l-o8RxL.js";
 import { t as withExtra } from "../extra-CGQ2_q3S.js";
-import { n as resourceRouter } from "../resources-BV6j5TTD.js";
+import { n as resourceRouter } from "../resources-C02l_YBJ.js";
 import { n as corsConfig, t as SUPABASE_CORS_HEADERS } from "../cors-h_v7TPxl.js";
-import { t as EVERY_CALLER } from "../framework-CXoyWGgd.js";
+import { t as EVERY_CALLER } from "../framework-DDdkR7FX.js";
 import { t as FUNCTION_DESCRIPTOR } from "../function-contract-pEmsaUIf.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { withCors } from "@supabase/middleware/cors";
@@ -23,7 +23,7 @@ import { withCors } from "@supabase/middleware/cors";
 * ```ts
 * Deno.serve(
 *   toEdge([withBetterSupabase(server)], async (req, ctx) =>
-*     Response.json(await ctx.db.notes.findMany().orThrow()),
+*     Response.json(await ctx.db.notes.list().orThrow()),
 *   ),
 * );
 * ```
@@ -125,7 +125,7 @@ async function readInput(request) {
 * it through `functions<Contracts>()` from `better-supabase/client`.
 *
 * ```ts
-* const sendInvite = defineFunction(bs, {
+* const sendInvite = defineFunction(bsb, {
 *   input: z.object({ email: z.email() }),
 *   handler: (input, ctx) => ctx.db.invites.create({ data: input }),
 * });
@@ -169,7 +169,7 @@ function createEdge(betterSupabase, options = {}) {
 		})], async (request, ctx) => {
 			const instance = new URL(request.url).pathname;
 			try {
-				return await respond(() => run(request, ctx.bs, ctx.tenant), {
+				return await respond(() => run(request, ctx.bsb, ctx.tenant), {
 					instance,
 					expose
 				});

package/dist/elysia/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../refusal-efy5bZMd.js";
+import { n as RouteGuardOptions } from "../refusal-CSntB_x8.js";
 import { t as Validated } from "../shared-CRRfQAKG.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 //#region src/bridges/elysia.d.ts

package/dist/elysia/index.js

@@ -1,5 +1,5 @@
 import { t as around } from "../shared-Bf-I13Ht.js";
-import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-DXydjgsS.js";
+import { a as routeRefusal, n as guardedLocals, t as errorResponse } from "../refusal-ByBZcm0V.js";
 import { bufferRequest } from "@supabase/middleware";
 //#region src/bridges/elysia.ts
 /**

package/dist/embeddings-kFbRvuic.d.ts

@@ -0,0 +1,78 @@
+import { d as KnowledgeSearchOptions, n as Embedder, o as KnowledgeHit, r as Knowledge } from "./knowledge-CtL-Vfgy.js";
+import { EmbeddingModel, RerankingModel, SourceDocumentUIPart, Tool, embedMany } from "ai";
+//#region src/ai-sdk/embeddings/embeddings.d.ts
+type ProviderOptions = Parameters<typeof embedMany>[0]["providerOptions"];
+interface EmbedWithOptions {
+  /** Concurrent calls when the values need more than one. Default 4. */
+  readonly maxParallelCalls?: number;
+  readonly providerOptions?: ProviderOptions;
+  /** The name stored with each embedding; the provider and model id by default. */
+  readonly name?: string;
+}
+/** The name of an SDK model: the string itself, or `provider/modelId`. */
+declare function modelName(model: string | {
+  readonly provider: string;
+  readonly modelId: string;
+}): string;
+/** An `Embedder` for the knowledge and memory blocks over `embedMany`. */
+declare function embedWith(model: EmbeddingModel, options?: EmbedWithOptions): Embedder;
+type Reranker = (query: string, hits: readonly KnowledgeHit[], options?: {
+  readonly signal?: AbortSignal;
+}) => Promise<readonly KnowledgeHit[]>;
+/** Reorders search hits with a reranking model, keeping the best `topN`. */
+declare function rerankWith(model: RerankingModel, options?: {
+  readonly topN?: number;
+}): Reranker;
+/**
+ * Keeps the items of a search the caller may read. A tool applies it before
+ * anything else sees the items: the reranker, `onHits` and the model. A throw
+ * fails the tool call, so no items reach the model.
+ */
+type ResultsFilter<T, C = {
+  readonly query: string;
+}> = (items: readonly T[], context: C) => readonly T[] | PromiseLike<readonly T[]>;
+interface SearchToolOptions extends Omit<KnowledgeSearchOptions, "signal"> {
+  readonly description?: string;
+  /** Drops the hits the caller may not read, such as by a permission. */
+  readonly results?: ResultsFilter<KnowledgeHit>;
+  /** Reranks the hits before the model sees them. */
+  readonly rerank?: Reranker;
+  /** Called with the hits, to stream them as source parts. */
+  readonly onHits?: (hits: readonly KnowledgeHit[]) => void;
+}
+interface SearchToolResult {
+  readonly results: readonly {
+    readonly id: string;
+    readonly title: string;
+    readonly content: string;
+  }[];
+}
+/**
+ * A tool that searches the knowledge base as the caller. Each result id is
+ * `documentId#index`, the `sourceId` that `toSourceParts` gives it.
+ */
+declare function searchTool(knowledge: Knowledge, organizationId: string, options?: SearchToolOptions): Tool<{
+  query: string;
+}, SearchToolResult>;
+/** One `source-document` part per document among the hits, in hit order. */
+declare function toSourceParts(hits: readonly KnowledgeHit[]): SourceDocumentUIPart[];
+/** `Supabase.ai.Session` in Supabase Edge Functions, typed structurally. */
+interface SupabaseAiSession {
+  run(input: string, options: {
+    readonly mean_pool: boolean;
+    readonly normalize: boolean;
+  }): Promise<unknown>;
+}
+interface SupabaseEmbedOptions {
+  /** The built-in model. Default `gte-small` (384 dimensions). */
+  readonly model?: string;
+  /** A session to use instead of `new Supabase.ai.Session(model)`. */
+  readonly session?: SupabaseAiSession;
+}
+/**
+ * An `Embedder` over the model built into Supabase Edge Functions. Set the
+ * module's `dimensions` option to the model's size (384 for `gte-small`).
+ */
+declare function supabaseEmbed(options?: SupabaseEmbedOptions): Embedder;
+//#endregion
+export { SearchToolResult as a, embedWith as c, searchTool as d, supabaseEmbed as f, SearchToolOptions as i, modelName as l, Reranker as n, SupabaseAiSession as o, toSourceParts as p, ResultsFilter as r, SupabaseEmbedOptions as s, EmbedWithOptions as t, rerankWith as u };

package/dist/ended-gUsMZVNg.d.ts

@@ -0,0 +1,26 @@
+import { Ft as RequestContext } from "./types-DFdg_4yN.js";
+import { d as CookieOptions, r as AuthState } from "./resolve-CXX6DHv3.js";
+//#region src/auth/context.d.ts
+/** The repository context (`actor`, `claims`) for an auth state. */
+declare function authContext(auth: AuthState): RequestContext;
+//#endregion
+//#region src/auth/ended.d.ts
+/** `banned`: Auth rejected the token with `error_code: "user_banned"`. */
+type SessionStatus = "active" | "ended" | "banned" | "unknown";
+interface SessionStatusOptions {
+  readonly url: string;
+  readonly publishableKey: string;
+  readonly cookieName?: string;
+  readonly fetch?: typeof fetch;
+  readonly timeoutMs?: number;
+  readonly now?: () => number;
+}
+interface ClearSessionCookiesOptions {
+  readonly url: string;
+  readonly cookieName?: string;
+  readonly cookie?: CookieOptions;
+}
+declare function sessionStatus(input: Request | string, options: SessionStatusOptions): Promise<SessionStatus>;
+declare function clearSessionCookies<R extends Response>(request: Request, response: R, options: ClearSessionCookiesOptions): R;
+//#endregion
+export { sessionStatus as a, clearSessionCookies as i, SessionStatus as n, authContext as o, SessionStatusOptions as r, ClearSessionCookiesOptions as t };

package/dist/entitlements-CJpYQXeE.d.ts

@@ -0,0 +1,54 @@
+import { t as AuthSnapshot } from "./bind-CrMBwrPN.js";
+import { t as AuthSession } from "./view-DyFdMCqg.js";
+//#region src/auth/entitlements.d.ts
+/**
+ * One entry of the `memberships` claim when a hook writes it as a list. Hooks
+ * strip `null`s, so optional fields are absent rather than `null`.
+ */
+interface MembershipClaim {
+  /** The scope the membership is in, e.g. `tenant` or `organization`. */
+  readonly scope: string;
+  readonly id: string;
+  /** Parent scopes, e.g. `{ organization: '...' }` for a project membership. */
+  readonly within?: Readonly<Record<string, string>>;
+  readonly roles: readonly string[];
+  readonly via?: string;
+  /** Unix seconds. */
+  readonly expiresAt?: number;
+  readonly grantedBy?: string;
+  readonly reason?: string;
+  readonly member?: {
+    readonly group: string;
+  };
+  readonly managedBy?: "idp";
+  /** Seats, not plan features: those are in the `features` claim. */
+  readonly entitlements?: readonly string[];
+}
+/**
+ * Entitlement keys of the `features` claim: the literal union when
+ * `betterSupabase.claims(schema)` declares one (`z.enum([...])`), otherwise
+ * `string`.
+ */
+type EntitlementKey<C> = C extends {
+  readonly features?: infer F;
+} ? NonNullable<F> extends Readonly<Record<string, readonly (infer K)[]>> ? K extends string ? K : string : string : string;
+/** Where `hasEntitlement` reads the features claim, and its short codes. */
+interface EntitlementClaimOptions {
+  /** `config.claims.features`, default `features`. */
+  readonly claim?: string;
+  /** `entitlements.claim.keys`: the short code written for each feature key. */
+  readonly keys?: Readonly<Record<string, string>>;
+}
+/**
+ * Whether the session's plan-features claim grants `key` in `tenantId`. `claim`
+ * is `config.claims.features` (default `features`), the claim
+ * `better_supabase.feature_claims()` fills, or `{ claim, keys }` when
+ * `entitlements.claim.keys` writes short codes. The claim is as fresh as the
+ * token: enforce it in RLS with `better_supabase.has_entitlement()`, and
+ * refresh the session after checkout. A tenant left out by
+ * `entitlements.claim.maxTenants` reads as not granted. Takes a server session
+ * or the client's `useAuth()` snapshot.
+ */
+declare function hasEntitlement<C>(session: AuthSession<C> | AuthSnapshot, tenantId: string, key: EntitlementKey<C>, claim?: string | EntitlementClaimOptions): boolean;
+//#endregion
+export { hasEntitlement as i, EntitlementKey as n, MembershipClaim as r, EntitlementClaimOptions as t };

package/dist/entitlements-NZAE_vLj.js

@@ -0,0 +1,45 @@
+import { t as AsyncResult } from "./result-ntFBW2p2.js";
+import { j as run, o as blockCall } from "./block-helpers-CtBdjgO4.js";
+import { r as withBlockHooks } from "./block-hooks-BfxX3682.js";
+//#region src/blocks/entitlements/entitlements.ts
+/** The Stripe event sent when a customer's active entitlements change. */
+const ENTITLEMENTS_UPDATED = "entitlements.active_entitlement_summary.updated";
+function stripeCustomerOf(payload) {
+	if (typeof payload !== "object" || payload === null) return;
+	const customer = (payload.data?.object)?.customer;
+	if (typeof customer === "string") return customer;
+	const id = customer?.id;
+	return typeof id === "string" ? id : void 0;
+}
+/**
+* Users whose `memberships` claim carries the entitlements of the Stripe
+* customer in an `entitlements.active_entitlement_summary.updated` event, so a
+* job can invalidate their sessions. Empty for other payloads.
+*/
+function entitlementMembers(sql, payload) {
+	const customer = stripeCustomerOf(payload);
+	if (customer === void 0) return AsyncResult.ok([]);
+	return run(() => sql.queryRaw("select user_id from better_supabase.entitlement_members($1) as user_id", [customer])).map((rows) => rows.map((row) => row.user_id));
+}
+/**
+* Reads the caller's entitlements through the `entitlements` module's
+* `has_entitlement` and `entitlement_value`, which check membership.
+*/
+function createEntitlements(options) {
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	return withBlockHooks({
+		has: (organizationId, key) => call("has_entitlement", {
+			tenant: organizationId,
+			key
+		}, (value) => value === true),
+		value: (organizationId, key) => call("entitlement_value", {
+			tenant: organizationId,
+			key
+		}, (value) => value === null ? void 0 : value)
+	}, options.hooks, {
+		block: "entitlements",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+//#endregion
+export { createEntitlements as n, entitlementMembers as r, ENTITLEMENTS_UPDATED as t };