better-supabase 0.14.0 → 0.15.0

package/dist/app-tables-C5aoI5rZ.js

@@ -1,959 +0,0 @@
-import { i as FIELD_FORMAT_NAMES, r as FIELD_FORMATS } from "./field-formats-C6QKA3UR.js";
-//#region src/config/blocks.ts
-const BLOCK_SCOPES = [
-	"tenant",
-	"user",
-	"none"
-];
-/**
-* URL tenancy: the tenant comes from the request (a slug), not a stored
-* setting.
-*/
-const DEFAULT_ACTIVE_TENANT = "resolver";
-/**
-* Block configs built at runtime (a preset, a `/create` design) as the typed
-* `BlocksConfig`. `resolveConfig` checks every module, table, column, function
-* and entity name, so nothing this skips at compile time goes unchecked.
-*/
-function asBlocksConfig(blocks) {
-	return blocks;
-}
-/**
-* The tenant's new singular name (`blocks.tenant.entities.organization`), or
-* `undefined` while it is `organization`. `blocks` may be the config's list of
-* block names, which renames nothing.
-*/
-function tenantNameOf(blocks) {
-	if (blocks === void 0 || isNameList(blocks)) return;
-	const entities = blocks["tenant"]?.entities;
-	if (entities === void 0 || typeof entities === "string") return;
-	const value = entities["organization"];
-	return typeof value === "string" ? value : value?.name;
-}
-function isNameList(blocks) {
-	return Array.isArray(blocks);
-}
-const MODULE_SCHEMA = "better_supabase";
-/** `record` without the keys a typed config leaves `undefined`. */
-function defined(record) {
-	return Object.fromEntries(Object.entries(record ?? {}).filter((entry) => entry[1] !== void 0));
-}
-function resolveModule(config = {}) {
-	return {
-		mode: config.mode ?? "managed",
-		schema: config.schema ?? MODULE_SCHEMA,
-		tables: defined(config.tables),
-		columns: Object.fromEntries(Object.entries(defined(config.columns)).map(([table, columns]) => [table, defined(columns)])),
-		...config.idType === void 0 ? {} : { idType: config.idType },
-		...config.scope === void 0 ? {} : { scope: config.scope },
-		functions: defined(config.functions),
-		permissions: defined(config.permissions),
-		options: config.options ?? {},
-		hooks: {
-			schema: config.hooks?.schema ?? "public",
-			functions: defined(config.hooks?.functions)
-		},
-		events: config.events ?? true,
-		audit: config.audit ?? true,
-		...config.api === void 0 || config.api === false ? {} : { api: typeof config.api === "string" ? { schema: config.api } : config.api }
-	};
-}
-//#endregion
-//#region src/config/types/app-tables.ts
-/**
-* The column types an app table may use. Money is a `bigint` of minor units
-* next to a `text` currency column (ADR 0024 and 0037), never `numeric`.
-*/
-const APP_COLUMN_TYPES = [
-	"text",
-	"uuid",
-	"integer",
-	"bigint",
-	"numeric",
-	"boolean",
-	"timestamptz",
-	"date",
-	"jsonb",
-	"text[]"
-];
-/**
-* What a reference does when the row it points at is deleted
-* (`references.onDelete`).
-*/
-const APP_ON_DELETE_ACTIONS = [
-	"cascade",
-	"restrict",
-	"set null",
-	"no action"
-];
-/**
-* What a column holds, beyond its Postgres type. `email`, `url`, `rating` and
-* `percent` add a check; the others tell the UI and `gen` how to show the
-* value. `FIELD_FORMATS` lists the types each fits and its input.
-*/
-const APP_COLUMN_FORMATS = FIELD_FORMAT_NAMES;
-const APP_COLUMN_ACCESS = ["read", "server"];
-const APP_TABLE_EVENT_KINDS = [
-	"created",
-	"updated",
-	"deleted"
-];
-const APP_ROLLUP_AGGREGATES = [
-	"count",
-	"sum",
-	"min",
-	"max",
-	"avg"
-];
-//#endregion
-//#region src/config/app-access.ts
-const PLACEHOLDER$1 = /\{([^}]*)\}/gu;
-/** `appTables.<t>.columns.<c>.access` checked. */
-function accessOf(where, value) {
-	if (value === void 0) return;
-	const access = APP_COLUMN_ACCESS.find((option) => option === value);
-	if (access === void 0) throw new TypeError(`${where} must be one of ${APP_COLUMN_ACCESS.join(", ")}`);
-	return access;
-}
-/** The own columns of `table` with `access` set to `access`, in config order. */
-function columnsWithAccess(table, access) {
-	return Object.entries(table.columns ?? {}).flatMap(([name, column]) => column.access === access ? [name] : []);
-}
-/** The own columns of `table` that are `encrypted`, in config order. */
-function encryptedColumns(table) {
-	return Object.entries(table.columns ?? {}).flatMap(([name, column]) => column.encrypted === true ? [name] : []);
-}
-/**
-* The own columns signed-in users can't select: `access: "server"` ones, and
-* encrypted ones, which they read through `<table>_reveal`.
-*/
-function hiddenColumns(table) {
-	return Object.entries(table.columns ?? {}).flatMap(([name, column]) => column.access === "server" || column.encrypted === true ? [name] : []);
-}
-/** Whether `table` grants by column: a column sets `access` or is encrypted. */
-function hasColumnAccess(table) {
-	return Object.values(table.columns ?? {}).some((column) => column.access !== void 0 || column.encrypted === true);
-}
-function urlColumns(url) {
-	return url === void 0 ? [] : [...url.matchAll(PLACEHOLDER$1)].flatMap((match) => match[1] === void 0 ? [] : [match[1]]);
-}
-/** Every place a table's config reads a column for signed-in users. */
-function readsOf(name, table, tables) {
-	const at = `appTables.${name}`;
-	const { subject } = table;
-	const versions = subject?.versions;
-	const rank = subject?.rank;
-	const own = (where, column) => ({
-		where: `${at}.${where}`,
-		table: name,
-		column
-	});
-	const lookupTarget = (via) => {
-		const reference = table.columns?.[via]?.references;
-		return reference === void 0 || "block" in reference ? void 0 : reference.table;
-	};
-	return [
-		own("subject.title", subject?.title),
-		own("subject.search.title", subject?.search?.title),
-		...(subject?.search?.body ?? []).map((column) => own("subject.search.body", column)),
-		...urlColumns(subject?.url).map((column) => own("subject.url", column)),
-		own("subject.rank.group", rank === true ? void 0 : rank?.group),
-		...versions === true || versions?.columns === void 0 ? [] : versions.columns.map((column) => own("subject.versions.columns", column)),
-		...(table.events === true ? [] : table.events?.include ?? []).map((column) => own("events.include", column)),
-		...Object.entries(table.rollups ?? {}).flatMap(([key, rollup]) => [
-			rollup.via,
-			rollup.column,
-			rollup.where?.column
-		].map((column) => ({
-			where: `${at}.rollups.${key}`,
-			table: rollup.table,
-			column
-		}))),
-		...Object.entries(table.lookups ?? {}).flatMap(([key, lookup]) => {
-			const target = lookupTarget(lookup.via);
-			return [own(`lookups.${key}.via`, lookup.via), {
-				where: `${at}.lookups.${key}.column`,
-				table: target ?? name,
-				column: target === void 0 ? void 0 : lookup.column
-			}];
-		})
-	].filter((use) => tables[use.table] !== void 0);
-}
-/**
-* Throws when a column with `access: "server"` or `encrypted` is read where
-* signed-in users see the value: a subject's title, search, url, rank group or
-* versioned columns, an event payload, or a rollup or lookup (ADR 0051). The
-* database sees an encrypted column as ciphertext, so these can't use it
-* either. Versions of every column (`versions: true`) would copy it into the
-* history, so such a table lists `subject.versions.columns`.
-*/
-function checkColumnAccess(tables) {
-	for (const [name, table] of Object.entries(tables)) {
-		const hidden = hiddenColumns(table);
-		const versions = table.subject?.versions;
-		if (hidden.length > 0 && (versions === true || versions !== void 0 && !versions.columns)) throw new TypeError(`appTables.${name}.subject.versions: the history would copy ${hidden.join(", ")}, which ${hidden.length === 1 ? "is" : "are"} hidden from signed-in users (access server or encrypted); list subject.versions.columns without it`);
-		for (const use of readsOf(name, table, tables)) {
-			const column = use.column === void 0 ? void 0 : tables[use.table]?.columns?.[use.column];
-			if (column?.encrypted === true) throw new TypeError(`${use.where}: ${use.table}.${String(use.column)} is encrypted, so the database only sees ciphertext here; drop it or drop encrypted`);
-			if (column?.access === "server") throw new TypeError(`${use.where}: ${use.table}.${String(use.column)} has access server, so signed-in users can't read it here; drop it or set access read`);
-		}
-	}
-}
-//#endregion
-//#region src/config/app-computed.ts
-const IDENT$1 = /^[a-z][a-z0-9_]{0,62}$/;
-/** Rollups and lookups together, per table. */
-const MAX_COMPUTED = 50;
-const ROLLUP_KEYS = /* @__PURE__ */ new Set([
-	"table",
-	"via",
-	"aggregate",
-	"column",
-	"where"
-]);
-const WHERE_KEYS = /* @__PURE__ */ new Set(["column", "equals"]);
-const LOOKUP_KEYS = /* @__PURE__ */ new Set(["via", "column"]);
-const AGGREGATES = new Set(APP_ROLLUP_AGGREGATES);
-const NUMBERS = /* @__PURE__ */ new Set([
-	"integer",
-	"bigint",
-	"numeric"
-]);
-const ORDERED = /* @__PURE__ */ new Set([
-	...NUMBERS,
-	"date",
-	"timestamptz",
-	"text"
-]);
-function isObject$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isAggregate(value) {
-	return typeof value === "string" && AGGREGATES.has(value);
-}
-function checkKeys$1(where, value, allowed) {
-	for (const key of Object.keys(value)) if (!allowed.has(key)) throw new TypeError(`${where}: unknown key "${key}" (use ${[...allowed].join(", ")})`);
-}
-/** The columns of `table` a rollup or lookup may read, with their types. */
-function readable(table) {
-	return new Map([...Object.entries(table.columns ?? {}).map(([name, column]) => [name, column.type]), ...table.timestamps === false ? [] : [["created_at", "timestamptz"], ["updated_at", "timestamptz"]]]);
-}
-function listOf(names) {
-	const list = [...names].join(", ");
-	return list === "" ? "none" : list;
-}
-/** The columns of `child` that reference the app table `parent`. */
-function referencesTo(child, parent) {
-	return Object.entries(child.columns ?? {}).filter(([, column]) => column.references !== void 0 && !("block" in column.references) && column.references.table === parent).map(([name]) => name);
-}
-function whereOf(where, value, child, table) {
-	if (value === void 0) return;
-	if (!isObject$1(value)) throw new TypeError(`${where} must be { column, equals }`);
-	checkKeys$1(where, value, WHERE_KEYS);
-	const { column, equals } = value;
-	const selects = Object.entries(table.columns ?? {}).filter(([, each]) => each.type === "text" && each.options !== void 0);
-	const found = selects.find(([name]) => name === column)?.[1];
-	if (typeof column !== "string" || found?.options === void 0) throw new TypeError(`${where}.column must name a select column of ${child} (${listOf(selects.map(([name]) => name))})`);
-	if (typeof equals !== "string" || !found.options.includes(equals)) throw new TypeError(`${where}.equals must be an option of ${child}.${column} (${listOf(found.options)})`);
-	return {
-		column,
-		equals
-	};
-}
-function rollupOf(where, value, parent, tables) {
-	if (!isObject$1(value)) throw new TypeError(`${where} must be an object`);
-	checkKeys$1(where, value, ROLLUP_KEYS);
-	const { table, via, aggregate, column } = value;
-	const child = typeof table === "string" ? tables[table] : void 0;
-	if (typeof table !== "string" || child === void 0) throw new TypeError(`${where}.table must name an app table (${listOf(Object.keys(tables))})`);
-	const vias = referencesTo(child, parent);
-	if (typeof via !== "string" || !vias.includes(via)) throw new TypeError(`${where}.via must name a column of ${table} that references ${parent} (${listOf(vias)})`);
-	if (!isAggregate(aggregate)) throw new TypeError(`${where}.aggregate must be one of ${APP_ROLLUP_AGGREGATES.join(", ")}`);
-	const filter = whereOf(`${where}.where`, value["where"], table, child);
-	const base = {
-		table,
-		via,
-		aggregate,
-		...filter ? { where: filter } : {}
-	};
-	if (aggregate === "count") {
-		if (column !== void 0) throw new TypeError(`${where}.column: count counts rows; drop column`);
-		return base;
-	}
-	const fits = aggregate === "sum" || aggregate === "avg" ? NUMBERS : ORDERED;
-	const candidates = [...readable(child)].filter(([, type]) => fits.has(type)).map(([name]) => name);
-	if (typeof column !== "string" || !candidates.includes(column)) throw new TypeError(`${where}.column: ${aggregate} needs a ${fits === NUMBERS ? "number" : "number, date, time or text"} column of ${table} (${listOf(candidates)})`);
-	return {
-		...base,
-		column
-	};
-}
-function lookupOf(where, value, name, tables) {
-	if (!isObject$1(value)) throw new TypeError(`${where} must be an object`);
-	checkKeys$1(where, value, LOOKUP_KEYS);
-	const { via, column } = value;
-	const own = tables[name]?.columns ?? {};
-	const vias = Object.entries(own).filter(([, each]) => each.references !== void 0 && !("block" in each.references) && Object.hasOwn(tables, each.references.table));
-	const reference = vias.find(([each]) => each === via)?.[1].references;
-	if (typeof via !== "string" || reference === void 0 || "block" in reference) throw new TypeError(`${where}.via must name a column of ${name} that references another app table (${listOf(vias.map(([each]) => each))})`);
-	const target = tables[reference.table];
-	const columns = target === void 0 ? /* @__PURE__ */ new Map() : readable(target);
-	if (typeof column !== "string" || !columns.has(column)) throw new TypeError(`${where}.column must name a column of ${reference.table} (${listOf(columns.keys())})`);
-	return {
-		via,
-		column
-	};
-}
-function entriesOf(where, value) {
-	if (value === void 0) return [];
-	if (!isObject$1(value)) throw new TypeError(`${where} must be an object keyed by column name`);
-	return Object.entries(value);
-}
-/**
-* The `rollups` and `lookups` of the app table `name`, checked against every
-* resolved app table. `taken` holds the columns the table already has, which a
-* computed column may not reuse.
-*/
-function computedOf(where, value, name, tables, taken) {
-	if (!isObject$1(value)) return {};
-	const rollups = entriesOf(`${where}.rollups`, value["rollups"]);
-	const lookups = entriesOf(`${where}.lookups`, value["lookups"]);
-	if (rollups.length + lookups.length > MAX_COMPUTED) throw new TypeError(`${where}: at most ${String(MAX_COMPUTED)} rollups and lookups together`);
-	const used = new Set(taken);
-	const named = (key, column) => {
-		const at = `${where}.${key}.${column}`;
-		if (!IDENT$1.test(column)) throw new TypeError(`${at}: "${column}" is not a lower snake identifier (a-z, 0-9 and _, starting with a letter)`);
-		if (used.has(column)) throw new TypeError(`${at}: "${column}" is already a column of ${name}; choose another name`);
-		used.add(column);
-		return at;
-	};
-	const resolvedRollups = rollups.map(([column, rollup]) => [column, rollupOf(named("rollups", column), rollup, name, tables)]);
-	const resolvedLookups = lookups.map(([column, lookup]) => [column, lookupOf(named("lookups", column), lookup, name, tables)]);
-	return {
-		...value["rollups"] === void 0 ? {} : { rollups: Object.fromEntries(resolvedRollups) },
-		...value["lookups"] === void 0 ? {} : { lookups: Object.fromEntries(resolvedLookups) }
-	};
-}
-/** Whether a table has a rollup or a lookup, and so a `<table>_view`. */
-function hasComputed(table) {
-	return Object.keys(table.rollups ?? {}).length > 0 || Object.keys(table.lookups ?? {}).length > 0;
-}
-//#endregion
-//#region src/config/app-defaults.ts
-const TEXT_LITERAL = /^'(?:[^'\\]|'')*'$/;
-const INTEGER = /^-?\d{1,18}$/;
-const NUMBER = /^-?\d{1,30}(?:\.\d{1,30})?$/;
-const MAX_LITERAL = 200;
-/** The defaults `isAppDefault` accepts, per type, as a message names them. */
-const DEFAULT_EXAMPLES = {
-	text: "a 'quoted' text",
-	integer: "a whole number",
-	bigint: "a whole number",
-	numeric: "a number",
-	boolean: "true or false",
-	uuid: "gen_random_uuid(), auth.uid() or a 'quoted' value",
-	timestamptz: "now() or a 'quoted' value",
-	date: "now() or a 'quoted' value",
-	jsonb: "'{}' or '[]'",
-	"text[]": "'{}'"
-};
-/**
-* Why `value` can't be the default of `column`, or `undefined` when it can: it
-* must be on the `isAppDefault` allowlist, one of the column's `options`, and
-* inside its bounds (`min`, `max`, or those of its format).
-*/
-function appDefaultError(column, value) {
-	const { type } = column;
-	if (!isAppDefault(type, value)) return `A ${type} column takes ${DEFAULT_EXAMPLES[type]} as its default.`;
-	const literal = TEXT_LITERAL.test(value) ? value.slice(1, -1).replaceAll("''", "'") : void 0;
-	if (type === "text" && column.options !== void 0 && literal !== void 0 && !column.options.includes(literal)) return `The default must be one of the options: ${column.options.join(", ")}.`;
-	const bounds = column.format === void 0 ? void 0 : FIELD_FORMATS[column.format].bounds;
-	const min = column.min ?? bounds?.[0];
-	const max = column.max ?? bounds?.[1];
-	const size = type === "text" ? literal?.length : NUMBER.test(value) ? Number(value) : void 0;
-	if (size === void 0) return;
-	const what = type === "text" ? "length" : "value";
-	if (min !== void 0 && size < min) return `The default's ${what} is below the minimum of ${String(min)}.`;
-	if (max !== void 0 && size > max) return `The default's ${what} is above the maximum of ${String(max)}.`;
-}
-/** Whether `value` is a default `type` accepts; see `AppColumnConfig.default`. */
-function isAppDefault(type, value) {
-	switch (value) {
-		case "now()": return type === "timestamptz" || type === "date";
-		case "gen_random_uuid()":
-		case "auth.uid()": return type === "uuid";
-		case "true":
-		case "false": return type === "boolean";
-		case "'{}'": return type === "jsonb" || type === "text[]" || type === "text";
-		case "'[]'": return type === "jsonb" || type === "text";
-	}
-	if (INTEGER.test(value)) return type === "integer" || type === "bigint" || type === "numeric";
-	if (NUMBER.test(value)) return type === "numeric";
-	return value.length <= MAX_LITERAL && TEXT_LITERAL.test(value) && (type === "text" || type === "uuid" || type === "date" || type === "timestamptz");
-}
-//#endregion
-//#region src/config/app-encryption.ts
-function booleanOf(where, value) {
-	if (value !== void 0 && typeof value !== "boolean") throw new TypeError(`${where} must be true or false`);
-	return value;
-}
-/**
-* `appTables.<t>.columns.<c>.encrypted` checked: the database stores
-* ciphertext, so it can't compare, index or reference the value.
-*/
-function encryptedOf(where, value, column) {
-	const encrypted = booleanOf(`${where}.encrypted`, value);
-	if (encrypted !== true) return encrypted;
-	const refused = column.type === "text[]" ? "a text[] column" : column.unique === true ? "a unique column" : column.references === void 0 ? column.identity === true ? "an identity" : void 0 : "a reference";
-	if (refused !== void 0) throw new TypeError(`${where}.encrypted: ${refused} can't be encrypted, since the database only sees ciphertext; drop encrypted or the other key`);
-	return encrypted;
-}
-/**
-* `appTables.<t>.auditReads` checked: reads are audited where they are
-* decrypted, so the table needs an encrypted column.
-*/
-function auditReadsOf(where, value, columns) {
-	const audited = booleanOf(`${where}.auditReads`, value);
-	if (audited === true && !Object.values(columns).some((column) => column.encrypted === true)) throw new TypeError(`${where}.auditReads: reads are audited through ${where.replace("appTables.", "")}_reveal, which needs an encrypted column; set encrypted on one`);
-	return audited;
-}
-/** Throws when a `unique` or `indexes` key names an encrypted column. */
-function checkEncryptedKeys(where, columns, keys) {
-	for (const [key, sets] of Object.entries(keys)) {
-		const column = (sets ?? []).flat().find((name) => columns[name]?.encrypted === true);
-		if (column !== void 0) throw new TypeError(`${where}.${key}: ${column} is encrypted, so the database can't compare it; drop it from the key`);
-	}
-}
-//#endregion
-//#region src/config/app-tables.ts
-const IDENT = /^[a-z][a-z0-9_]{0,62}$/;
-const BLOCK_NAME = /^[a-z][a-z0-9-]{0,62}$/;
-const MAX_OPTIONS = 100;
-const MAX_OPTION = 100;
-const MAX_COMMENT = 1e3;
-const MAX_KEY_SETS = 20;
-/** Postgres keeps at most 32 columns in an index. */
-const MAX_KEY_COLUMNS = 32;
-const CONTROL = /\p{Cc}/u;
-const TABLE_KEYS = /* @__PURE__ */ new Set([
-	"columns",
-	"scope",
-	"timestamps",
-	"id",
-	"unique",
-	"indexes",
-	"comment",
-	"subject",
-	"rollups",
-	"lookups",
-	"events",
-	"auditReads"
-]);
-const SUBJECT_KEYS = /* @__PURE__ */ new Set([
-	"type",
-	"title",
-	"url",
-	"search",
-	"permissions",
-	"rank",
-	"softDelete",
-	"versions"
-]);
-/** The columns `subject.rank` and `subject.softDelete` add. */
-const APP_RANK_COLUMN = "rank";
-const APP_DELETED_AT_COLUMN = "deleted_at";
-const PLACEHOLDER = /\{([^}]*)\}/gu;
-const COLUMN_KEYS = /* @__PURE__ */ new Set([
-	"type",
-	"nullable",
-	"default",
-	"unique",
-	"references",
-	"format",
-	"options",
-	"min",
-	"max",
-	"comment",
-	"identity",
-	"access",
-	"encrypted"
-]);
-const NUMBER_TYPES = /* @__PURE__ */ new Set([
-	"integer",
-	"bigint",
-	"numeric"
-]);
-const FORMATS = new Set(APP_COLUMN_FORMATS);
-const REFERENCE_KEYS = /* @__PURE__ */ new Set([
-	"table",
-	"block",
-	"onDelete"
-]);
-const SCOPES = /* @__PURE__ */ new Set([
-	"inherit",
-	"user",
-	"none"
-]);
-const ON_DELETE = new Set(APP_ON_DELETE_ACTIONS);
-const COLUMN_TYPES = new Set(APP_COLUMN_TYPES);
-/** The table every `auth.users` reference points at. */
-const AUTH_USERS = "auth.users";
-function isObject(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isOnDelete(value) {
-	return typeof value === "string" && ON_DELETE.has(value);
-}
-function isScope(value) {
-	return typeof value === "string" && SCOPES.has(value);
-}
-function isColumnType(value) {
-	return typeof value === "string" && COLUMN_TYPES.has(value);
-}
-function isFormat(value) {
-	return typeof value === "string" && FORMATS.has(value);
-}
-function commentOf(where, value) {
-	if (value === void 0) return;
-	if (typeof value !== "string" || value.length === 0 || value.length > MAX_COMMENT || value.includes("\0")) throw new TypeError(`${where} must be text of 1 to ${String(MAX_COMMENT)} characters`);
-	return value;
-}
-function formatOf(where, value, type) {
-	if (value === void 0) return;
-	if (!isFormat(value)) throw new TypeError(`${where} must be one of ${APP_COLUMN_FORMATS.join(", ")}`);
-	const types = FIELD_FORMATS[value].types;
-	if (!types.includes(type)) throw new TypeError(`${where}: ${value} fits a ${types.join(" or ")} column, not ${type}`);
-	return value;
-}
-function optionsOf(where, value, type) {
-	if (value === void 0) return;
-	if (type !== "text" && type !== "text[]") throw new TypeError(`${where}: options fit a text (single select) or text[] (multi-select) column, not ${type}`);
-	if (!Array.isArray(value) || value.length === 0 || value.length > MAX_OPTIONS) throw new TypeError(`${where} must list 1 to ${String(MAX_OPTIONS)} values`);
-	const seen = /* @__PURE__ */ new Set();
-	for (const option of value) {
-		if (typeof option !== "string" || option.length === 0 || option.length > MAX_OPTION || CONTROL.test(option)) throw new TypeError(`${where}: each option is text of 1 to ${String(MAX_OPTION)} characters without control characters`);
-		if (seen.has(option)) throw new TypeError(`${where}: "${option}" is listed twice`);
-		seen.add(option);
-	}
-	return [...seen];
-}
-function boundOf(where, value, type) {
-	if (value === void 0) return;
-	if (typeof value !== "number" || !Number.isFinite(value)) throw new TypeError(`${where} must be a number`);
-	if (type === "text") {
-		if (!Number.isSafeInteger(value) || value < 0) throw new TypeError(`${where}: a text length is a whole number of 0 or more`);
-		return value;
-	}
-	if (!NUMBER_TYPES.has(type)) throw new TypeError(`${where}: min and max fit a number or text column, not ${type}`);
-	if (type !== "numeric" && !Number.isSafeInteger(value)) throw new TypeError(`${where}: an ${type} bound is a whole number`);
-	return value;
-}
-function identityOf(where, value, column, type) {
-	const identity = optionalBoolean(where, value);
-	if (identity !== true) return identity;
-	if (type !== "integer" && type !== "bigint") throw new TypeError(`${where}: an identity is an integer or bigint, not ${type}`);
-	for (const key of [
-		"default",
-		"references",
-		"options"
-	]) if (column[key] !== void 0) throw new TypeError(`${where}: an identity takes no ${key}`);
-	if (column["nullable"] === true) throw new TypeError(`${where}: an identity is never null`);
-	return identity;
-}
-/**
-* The sets of columns of a composite `unique` or `indexes` key. Whether each
-* name is a column of the table is checked when the SQL renders, where the
-* scope column is known.
-*/
-function keySetsOf(where, value) {
-	if (value === void 0) return;
-	if (!Array.isArray(value) || value.length > MAX_KEY_SETS) throw new TypeError(`${where} must list at most ${String(MAX_KEY_SETS)} sets of columns`);
-	return value.map((set, index) => {
-		const at = `${where}[${String(index)}]`;
-		if (!Array.isArray(set) || set.length === 0 || set.length > MAX_KEY_COLUMNS) throw new TypeError(`${at} must list 1 to ${String(MAX_KEY_COLUMNS)} column names`);
-		const columns = set.map((column) => {
-			if (typeof column !== "string" || !IDENT.test(column)) throw new TypeError(`${at}: ${JSON.stringify(column)} is not a column name`);
-			return column;
-		});
-		if (new Set(columns).size !== columns.length) throw new TypeError(`${at} names a column twice`);
-		return columns;
-	});
-}
-function checkKeys(where, value, allowed) {
-	for (const key of Object.keys(value)) if (!allowed.has(key)) throw new TypeError(`${where}: unknown key "${key}" (use ${[...allowed].join(", ")})`);
-}
-function optionalBoolean(where, value) {
-	if (value !== void 0 && typeof value !== "boolean") throw new TypeError(`${where} must be true or false`);
-	return value;
-}
-/**
-* The columns every app table gets, which `columns` may not name: `id`,
-* `created_at`, `updated_at`, `user_id` and the tenant column
-* (`organization_id`, or `<blocks.tenant.entities.organization>_id`), whatever
-* the table's scope, so changing the scope never collides with a column.
-*/
-function appReservedColumns(tenant = "organization") {
-	return [
-		"id",
-		"created_at",
-		"updated_at",
-		"user_id",
-		`${tenant}_id`
-	];
-}
-/**
-* Postgres truncates identifiers past 63 bytes, so longer generated names
-* collide.
-*/
-const MAX_IDENTIFIER = 63;
-/** The longest app table or column name: `<table>_view` still fits in 63 bytes. */
-const APP_NAME_MAX = 58;
-/**
-* Why `name` can't name an app table or column, or `undefined` when it can:
-* lower snake case starting with a letter, not `pg_`, and at most
-* `APP_NAME_MAX` characters.
-*/
-function appIdentifierError(name) {
-	if (name === "") return "Enter a name.";
-	if (name.length > 58) return `Use at most ${String(58)} characters.`;
-	if (!IDENT.test(name)) return "Use lower-case letters, digits and underscores, starting with a letter.";
-	if (name.startsWith("pg_")) return "Names starting with pg_ are reserved by Postgres.";
-}
-/**
-* The first constraint or index name the SQL derives for `table` that is longer
-* than 63 bytes, which Postgres would truncate into a collision, as a message;
-* `undefined` when every name fits.
-*/
-function appNameLengthError(table, config) {
-	const long = [
-		...Object.entries(config.columns ?? {}).flatMap(([column, each]) => each.references !== void 0 || each.format !== void 0 || each.options !== void 0 || each.min !== void 0 || each.max !== void 0 ? [`${table}_${column}_check`] : []),
-		...Object.values(config.columns ?? {}).some((column) => column.encrypted === true) ? [`${table}_reveal`] : [],
-		...(config.unique ?? []).map((set) => `${table}_${set.join("_")}_key`),
-		...(config.indexes ?? []).map((set) => `${table}_${set.join("_")}_idx`)
-	].find((name) => name.length > MAX_IDENTIFIER);
-	return long === void 0 ? void 0 : `${long} is longer than ${String(MAX_IDENTIFIER)} characters; use shorter table or column names`;
-}
-function referenceOf(where, value, type, nullable, tables) {
-	if (!isObject(value)) throw new TypeError(`${where} must be an object`);
-	checkKeys(where, value, REFERENCE_KEYS);
-	const { table, block, onDelete } = value;
-	if (typeof table !== "string") throw new TypeError(`${where}.table must be a string`);
-	if (onDelete !== void 0 && !isOnDelete(onDelete)) throw new TypeError(`${where}.onDelete must be one of ${[...ON_DELETE].join(", ")}`);
-	if (onDelete === "set null" && !nullable) throw new TypeError(`${where}.onDelete: "set null" needs a nullable column`);
-	const deletes = onDelete === void 0 ? {} : { onDelete };
-	if (block !== void 0) {
-		if (typeof block !== "string" || !BLOCK_NAME.test(block)) throw new TypeError(`${where}.block must be a block name`);
-		if (!IDENT.test(table)) throw new TypeError(`${where}.table: "${table}" is not a logical table name of the ${block} block`);
-		return {
-			block,
-			table,
-			...deletes
-		};
-	}
-	const id = table === "auth.users" ? "uuid" : tables.get(table);
-	if (id === void 0) throw new TypeError(`${where}.table: "${table}" is neither an app table nor ${AUTH_USERS}; reference a block table with { block, table }`);
-	if (type !== id) throw new TypeError(`${where}: a reference to ${table} needs a ${id} column, not ${type}`);
-	return {
-		table,
-		...deletes
-	};
-}
-function columnOf(where, value, tables) {
-	if (!isObject(value)) throw new TypeError(`${where} must be an object`);
-	checkKeys(where, value, COLUMN_KEYS);
-	const { type } = value;
-	if (!isColumnType(type)) throw new TypeError(`${where}.type must be one of ${APP_COLUMN_TYPES.join(", ")}${type === "money" ? " (store money as bigint minor units next to a text currency column)" : ""}`);
-	const nullable = optionalBoolean(`${where}.nullable`, value["nullable"]);
-	const unique = optionalBoolean(`${where}.unique`, value["unique"]);
-	const fallback = value["default"];
-	if (fallback !== void 0 && (typeof fallback !== "string" || !isAppDefault(type, fallback))) throw new TypeError(`${where}.default: ${JSON.stringify(fallback)} is not an allowed ${type} default (now(), gen_random_uuid(), auth.uid(), true, false, a number, a 'quoted' literal, '{}' or '[]')`);
-	const references = value["references"] === void 0 ? void 0 : referenceOf(`${where}.references`, value["references"], type, nullable !== false, tables);
-	const format = formatOf(`${where}.format`, value["format"], type);
-	const options = optionsOf(`${where}.options`, value["options"], type);
-	const min = boundOf(`${where}.min`, value["min"], type);
-	const max = boundOf(`${where}.max`, value["max"], type);
-	const comment = commentOf(`${where}.comment`, value["comment"]);
-	const identity = identityOf(`${where}.identity`, value["identity"], value, type);
-	const access = accessOf(`${where}.access`, value["access"]);
-	if (access !== void 0 && nullable === false && fallback === void 0 && identity !== true) throw new TypeError(`${where}: signed-in users can't write a column with access ${access}, so a required one needs a default`);
-	if (options !== void 0 && format !== void 0) throw new TypeError(`${where}: options make a select; drop the format ${format}`);
-	const encrypted = encryptedOf(where, value["encrypted"], {
-		type,
-		unique,
-		references,
-		identity
-	});
-	if (min !== void 0 && max !== void 0 && min > max) throw new TypeError(`${where}: min ${String(min)} is above max ${String(max)}`);
-	const outside = typeof fallback === "string" ? appDefaultError({
-		type,
-		...options === void 0 ? {} : { options },
-		...min === void 0 ? {} : { min },
-		...max === void 0 ? {} : { max },
-		...format === void 0 ? {} : { format }
-	}, fallback) : void 0;
-	if (outside !== void 0) throw new TypeError(`${where}.default: ${outside}`);
-	return {
-		type,
-		...nullable === void 0 ? {} : { nullable },
-		...fallback === void 0 ? {} : { default: fallback },
-		...unique === void 0 ? {} : { unique },
-		...references === void 0 ? {} : { references },
-		...format === void 0 ? {} : { format },
-		...options === void 0 ? {} : { options },
-		...min === void 0 ? {} : { min },
-		...max === void 0 ? {} : { max },
-		...comment === void 0 ? {} : { comment },
-		...identity === void 0 ? {} : { identity },
-		...access === void 0 ? {} : { access },
-		...encrypted === void 0 ? {} : { encrypted }
-	};
-}
-function namedColumn(where, value, columns) {
-	if (typeof value !== "string" || !columns.has(value)) throw new TypeError(`${where} must name a column of the table (${[...columns].join(", ")})`);
-	return value;
-}
-function searchOf(where, value, columns) {
-	if (value === void 0) return;
-	if (!isObject(value)) throw new TypeError(`${where} must be an object`);
-	checkKeys(where, value, /* @__PURE__ */ new Set(["title", "body"]));
-	const { title, body } = value;
-	if (body !== void 0 && !Array.isArray(body)) throw new TypeError(`${where}.body must be a list of columns`);
-	return {
-		...title === void 0 ? {} : { title: namedColumn(`${where}.title`, title, columns) },
-		...body === void 0 ? {} : { body: body.map((each) => namedColumn(`${where}.body`, each, columns)) }
-	};
-}
-function permissionsOf(where, value) {
-	if (value === void 0) return;
-	if (!isObject(value) || Object.values(value).some((key) => typeof key !== "string" || key === "")) throw new TypeError(`${where} must map each action to a permission key`);
-	return Object.fromEntries(Object.entries(value).map(([action, key]) => [action, String(key)]));
-}
-function rankOf(where, value, columns) {
-	if (value === void 0 || value === true) return value;
-	if (!isObject(value)) throw new TypeError(`${where} must be true or { group }`);
-	checkKeys(where, value, /* @__PURE__ */ new Set(["group"]));
-	return value["group"] === void 0 ? {} : { group: namedColumn(`${where}.group`, value["group"], columns) };
-}
-/**
-* `subject.versions` checked: `true`, or `columns` from the table's own columns
-* (not its id, scope or timestamps, which a restore must not write) and
-* `auto`.
-*/
-function versionsOf(where, value, editable) {
-	if (value === void 0 || value === true) return value;
-	if (!isObject(value)) throw new TypeError(`${where} must be true or { columns, auto }`);
-	checkKeys(where, value, /* @__PURE__ */ new Set(["columns", "auto"]));
-	const { columns } = value;
-	if (columns !== void 0 && (!Array.isArray(columns) || columns.length === 0)) throw new TypeError(`${where}.columns must list one or more columns`);
-	const listed = columns?.map((name, index) => namedColumn(`${where}.columns[${index}]`, name, editable));
-	const auto = optionalBoolean(`${where}.auto`, value["auto"]);
-	return {
-		...listed === void 0 ? {} : { columns: [...new Set(listed)] },
-		...auto === void 0 ? {} : { auto }
-	};
-}
-/**
-* The columns and snapshot mode `subject.versions` registers with the versions
-* block.
-*/
-function appTableVersions(table) {
-	const versions = table.subject?.versions;
-	if (versions === void 0) return;
-	const options = versions === true ? {} : versions;
-	return {
-		columns: options.columns ?? Object.keys(table.columns ?? {}),
-		auto: options.auto ?? true
-	};
-}
-/**
-* `subject` checked against the table's columns. `columns` holds every column
-* the table has, the ones `rank` and `softDelete` add included; `editable`
-* holds the table's own columns.
-*/
-function subjectOf(where, value, columns, editable) {
-	if (value === void 0) return;
-	if (!isObject(value)) throw new TypeError(`${where} must be an object`);
-	checkKeys(where, value, SUBJECT_KEYS);
-	const { type, title, url } = value;
-	if (typeof type !== "string" || !IDENT.test(type)) throw new TypeError(`${where}.type must be lowercase letters, digits and underscores, starting with a letter`);
-	if (url !== void 0) {
-		if (typeof url !== "string" || !url.startsWith("/")) throw new TypeError(`${where}.url must be a path starting with /`);
-		for (const [, name] of url.matchAll(PLACEHOLDER)) namedColumn(`${where}.url {${name ?? ""}}`, name, columns);
-	}
-	const search = searchOf(`${where}.search`, value["search"], columns);
-	const permissions = permissionsOf(`${where}.permissions`, value["permissions"]);
-	const rank = rankOf(`${where}.rank`, value["rank"], columns);
-	const softDelete = optionalBoolean(`${where}.softDelete`, value["softDelete"]);
-	const versions = versionsOf(`${where}.versions`, value["versions"], editable);
-	return {
-		type,
-		...title === void 0 ? {} : { title: namedColumn(`${where}.title`, title, columns) },
-		...url === void 0 ? {} : { url },
-		...search === void 0 ? {} : { search },
-		...permissions === void 0 ? {} : { permissions },
-		...rank === void 0 ? {} : { rank },
-		...softDelete === void 0 ? {} : { softDelete },
-		...versions === void 0 ? {} : { versions }
-	};
-}
-/** The columns the subject adds, which `columns` may not name. */
-function subjectColumnsOf(value) {
-	if (!isObject(value)) return [];
-	return [...value["rank"] === void 0 ? [] : [APP_RANK_COLUMN], ...value["softDelete"] === true ? [APP_DELETED_AT_COLUMN] : []];
-}
-/** The event kinds `events` turns on; empty without it. */
-function appTableEventKinds(table) {
-	const events = table.events;
-	if (events === void 0) return [];
-	return events === true ? APP_TABLE_EVENT_KINDS : events.on ?? APP_TABLE_EVENT_KINDS;
-}
-/** The event types an app table emits: `<subject type or table>.<kind>`. */
-function appTableEventTypes(name, table) {
-	const base = table.subject?.type ?? name;
-	return appTableEventKinds(table).map((kind) => `${base}.${kind}`);
-}
-function isEventKind(value) {
-	return APP_TABLE_EVENT_KINDS.some((kind) => kind === value);
-}
-/**
-* `events` checked: `true`, or `on` from the event kinds and `include` from the
-* table's columns.
-*/
-function eventsOf(where, value, columns) {
-	if (value === void 0 || value === true) return value;
-	if (!isObject(value)) throw new TypeError(`${where} must be true or { on, include }`);
-	checkKeys(where, value, /* @__PURE__ */ new Set(["on", "include"]));
-	const { on, include } = value;
-	if (on !== void 0 && (!Array.isArray(on) || on.length === 0 || !on.every(isEventKind))) throw new TypeError(`${where}.on must list one or more of ${APP_TABLE_EVENT_KINDS.join(", ")}`);
-	if (include !== void 0 && !Array.isArray(include)) throw new TypeError(`${where}.include must be a list of columns`);
-	const included = include?.map((name, index) => namedColumn(`${where}.include[${index}]`, name, columns));
-	return {
-		...on === void 0 ? {} : { on: [...new Set(on)] },
-		...included === void 0 ? {} : { include: [...new Set(included)] }
-	};
-}
-function tableOf(where, value, tables, reserved) {
-	if (!isObject(value)) throw new TypeError(`${where} must be an object`);
-	checkKeys(where, value, TABLE_KEYS);
-	const { scope, columns, id } = value;
-	if (scope !== void 0 && !isScope(scope)) throw new TypeError(`${where}.scope must be inherit, user or none`);
-	if (id !== void 0 && id !== "uuid" && id !== "bigint") throw new TypeError(`${where}.id must be uuid or bigint`);
-	const unique = keySetsOf(`${where}.unique`, value["unique"]);
-	const indexes = keySetsOf(`${where}.indexes`, value["indexes"]);
-	const comment = commentOf(`${where}.comment`, value["comment"]);
-	const timestamps = optionalBoolean(`${where}.timestamps`, value["timestamps"]);
-	if (columns !== void 0 && !isObject(columns)) throw new TypeError(`${where}.columns must be an object keyed by column`);
-	const added = subjectColumnsOf(value["subject"]);
-	const resolved = Object.entries(columns ?? {}).map(([name, column]) => {
-		const at = `${where}.columns.${name}`;
-		const invalid = appIdentifierError(name);
-		if (invalid !== void 0) throw new TypeError(`${at}: "${name}" is not a column name. ${invalid}`);
-		if (reserved.has(name)) throw new TypeError(`${at}: "${name}" is a column every app table gets (${[...reserved].join(", ")})`);
-		if (added.includes(name)) throw new TypeError(`${at}: "${name}" is the column ${where}.subject adds; remove it from columns`);
-		return [name, columnOf(at, column, tables)];
-	});
-	const subject = subjectOf(`${where}.subject`, value["subject"], /* @__PURE__ */ new Set([
-		...reserved,
-		...added,
-		...resolved.map(([name]) => name)
-	]), new Set(resolved.map(([name]) => name)));
-	const events = eventsOf(`${where}.events`, value["events"], /* @__PURE__ */ new Set([
-		...reserved,
-		...added,
-		...resolved.map(([name]) => name)
-	]));
-	const own = Object.fromEntries(resolved);
-	checkEncryptedKeys(where, own, {
-		unique,
-		indexes
-	});
-	const auditReads = auditReadsOf(where, value["auditReads"], own);
-	return {
-		...columns === void 0 ? {} : { columns: Object.fromEntries(resolved) },
-		...scope === void 0 ? {} : { scope },
-		...timestamps === void 0 ? {} : { timestamps },
-		...id === void 0 ? {} : { id },
-		...unique === void 0 ? {} : { unique },
-		...indexes === void 0 ? {} : { indexes },
-		...comment === void 0 ? {} : { comment },
-		...subject === void 0 ? {} : { subject },
-		...events === void 0 ? {} : { events },
-		...auditReads === void 0 ? {} : { auditReads }
-	};
-}
-/**
-* `appTables` checked: lower snake table and column names, column types from
-* `APP_COLUMN_TYPES`, defaults from the allowlist, no reserved columns, and
-* references to another app table, `auth.users` or a block's logical table.
-* Whether a referenced block is installed, and whether a name clashes with a
-* block table, is checked when the SQL renders, where the block registry is
-* known. Throws a `TypeError` naming the key.
-*/
-function appTablesOf(value, tenant) {
-	if (value === void 0) return {};
-	if (!isObject(value)) throw new TypeError("appTables must be an object keyed by table name");
-	const tables = new Map(Object.entries(value).map(([name, table]) => [name, isObject(table) && table["id"] === "bigint" ? "bigint" : "uuid"]));
-	const reserved = new Set(appReservedColumns(tenant));
-	const resolved = Object.fromEntries(Object.entries(value).map(([name, table]) => {
-		const invalid = appIdentifierError(name);
-		if (invalid !== void 0) throw new TypeError(`appTables.${name}: "${name}" is not a table name. ${invalid}`);
-		const checked = tableOf(`appTables.${name}`, table, tables, reserved);
-		const long = appNameLengthError(name, checked);
-		if (long !== void 0) throw new TypeError(`appTables.${name}: ${long}`);
-		return [name, checked];
-	}));
-	const checked = Object.fromEntries(Object.entries(resolved).map(([name, table]) => {
-		const where = `appTables.${name}`;
-		const computed = computedOf(where, value[name], name, resolved, /* @__PURE__ */ new Set([
-			...reserved,
-			...Object.keys(table.columns ?? {}),
-			...subjectColumnsOf(table.subject)
-		]));
-		const withComputed = {
-			...table,
-			...computed
-		};
-		if (hasComputed(withComputed) && Object.hasOwn(resolved, `${name}_view`)) throw new TypeError(`${where}: its rollups and lookups go in the view ${name}_view, which is also an app table; rename one`);
-		return [name, withComputed];
-	}));
-	checkColumnAccess(checked);
-	return checked;
-}
-/**
-* `subjects` with the subject of every app table that sets one (ADR 0043): the
-* table in `public`, its id type, and its tenant column, or `false` for a table
-* kept per user or shared. `scope` is `sql.scope` and `tenant` is
-* `blocks.tenant.entities.organization`. Throws when a type is taken twice.
-*/
-function withAppTableSubjects(subjects, appTables, scope, tenant = "organization") {
-	const merged = { ...subjects };
-	for (const [name, table] of Object.entries(appTables)) {
-		const subject = table.subject;
-		if (subject === void 0) continue;
-		const where = `appTables.${name}.subject`;
-		if (Object.hasOwn(merged, subject.type)) throw new TypeError(`${where}.type: "${subject.type}" is already a subject type; choose another type or remove subjects.${subject.type}`);
-		const kept = table.scope === void 0 || table.scope === "inherit" ? scope ?? "tenant" : table.scope;
-		merged[subject.type] = {
-			table: `public.${name}`,
-			idType: table.id ?? "uuid",
-			tenant: kept === "tenant" ? `${tenant}_id` : false,
-			...subject.title === void 0 ? {} : { title: subject.title },
-			...subject.url === void 0 ? {} : { url: subject.url },
-			...subject.search === void 0 ? {} : { search: subject.search },
-			...subject.permissions === void 0 ? {} : { permissions: subject.permissions },
-			...subject.softDelete === true ? { deletedAt: APP_DELETED_AT_COLUMN } : {},
-			...versionsEntry(table),
-			...subject.rank === void 0 ? {} : { rank: {
-				column: APP_RANK_COLUMN,
-				...subject.rank === true || subject.rank.group === void 0 ? {} : { group: subject.rank.group }
-			} }
-		};
-	}
-	return merged;
-}
-function versionsEntry(table) {
-	const versions = appTableVersions(table);
-	return versions === void 0 ? {} : { versions };
-}
-//#endregion
-export { tenantNameOf as A, APP_ON_DELETE_ACTIONS as C, DEFAULT_ACTIVE_TENANT as D, BLOCK_SCOPES as E, asBlocksConfig as O, APP_COLUMN_TYPES as S, APP_TABLE_EVENT_KINDS as T, encryptedColumns as _, appIdentifierError as a, APP_COLUMN_ACCESS as b, appTableEventKinds as c, appTablesOf as d, withAppTableSubjects as f, columnsWithAccess as g, hasComputed as h, AUTH_USERS as i, resolveModule as k, appTableEventTypes as l, isAppDefault as m, APP_NAME_MAX as n, appNameLengthError as o, appDefaultError as p, APP_RANK_COLUMN as r, appReservedColumns as s, APP_DELETED_AT_COLUMN as t, appTableVersions as u, hasColumnAccess as v, APP_ROLLUP_AGGREGATES as w, APP_COLUMN_FORMATS as x, hiddenColumns as y };