better-supabase 0.14.0 → 0.15.0

package/dist/blocks/segments/index.d.ts

@@ -1,14 +1,14 @@
 /// <reference lib="esnext.temporal" />
-import { T as ErrorMapper, t as AsyncResult } from "../../result-C6jDfedy.js";
-import { Ct as Events } from "../../events-DbLjvxDX.js";
-import { T as SegmentMemberEventData, w as SegmentEventData } from "../../block-events-records-BGVyoz57.js";
+import { T as ErrorMapper, t as AsyncResult } from "../../result-DZeA5KS6.js";
+import { Ct as Events } from "../../events-vcqenSYU.js";
+import { F as SegmentEventData, I as SegmentMemberEventData } from "../../index-CG9rA8H8.js";
 import { n as Logger } from "../../logger-DWVYUmwi.js";
-import { r as BlockTemporalOptions } from "../../block-helpers-BaugZlJV.js";
-import { a as dbTransport, i as RpcClient, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-d53POsem.js";
-import { a as BlockTransportMiddleware, d as extendBlock, f as withBlockHooks, n as BlockHooks, p as wrapTransport } from "../../block-hooks-CmjPKqQ_.js";
-import { n as segmentsSqlOptions, t as SegmentsSqlOptions } from "../../options-OMAUVcKK.js";
-import { c as BlockOf, rn as EntitySchema } from "../../define-block-COpcS6aT.js";
-import { h as FilterQuery } from "../../filter-query-o3b_GuyC.js";
+import { r as BlockTemporalOptions } from "../../block-helpers-CRpAHrp_.js";
+import { a as dbTransport, i as RpcClient, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DWZSJrwN.js";
+import { a as BlockTransportMiddleware, d as extendBlock, f as withBlockHooks, n as BlockHooks, p as wrapTransport } from "../../block-hooks-DZN2w69m.js";
+import { n as segmentsSqlOptions, t as SegmentsSqlOptions } from "../../options-pOVWwbAK.js";
+import { h as FilterQuery } from "../../filter-query-BXLs72G9.js";
+import { Sn as EntitySchema, c as BlockOf } from "../../define-block-BVcLQ3DF.js";
 //#region src/blocks/segments/segments.d.ts
 /** A saved filter over one subject type, with its materialized members. */
 interface Segment {
@@ -16,7 +16,7 @@ interface Segment {
   readonly organizationId: string;
   readonly name: string;
   readonly description: string | undefined;
-  /** A type in `config.subjects`, such as `company` or `deal`. */
+  /** A type in `config.records`, such as `company` or `deal`. */
   readonly subjectType: string;
   /** The filter tree over the subject type's rule fields. */
   readonly conditions: FilterQuery;
@@ -31,7 +31,7 @@ interface Segment {
   readonly createdAt: Temporal.Instant;
   readonly updatedAt: Temporal.Instant;
 }
-/** What `save` takes. Leave `id` out to create a segment. */
+/** What `upsert` takes. Leave `id` out to create a segment. */
 interface SegmentInput {
   readonly id?: string;
   /** Required to create; a segment's subject type can't change. */
@@ -65,7 +65,7 @@ interface SegmentRefreshReport {
 }
 interface Segments {
   /** Creates or changes a segment. Changing its conditions marks it due. */
-  save(organizationId: string, segment: SegmentInput): AsyncResult<Segment>;
+  upsert(organizationId: string, segment: SegmentInput): AsyncResult<Segment>;
   /** Deletes a segment and its members. False when there was none. */
   remove(segmentId: string): AsyncResult<boolean>;
   list(organizationId: string, options?: {
@@ -124,7 +124,7 @@ export declare const segmentsEvents: Events<SegmentsEvents>;
 export declare const segmentsBlock: BlockOf<"segments", typeof createSegments, SegmentsEvents>;
 //#endregion
 //#region src/blocks/segments/schemas.d.ts
-/** What `save` takes. The SQL checks the conditions against the rule fields. */
+/** What `upsert` takes. The SQL checks the conditions against the rule fields. */
 export declare const segmentInputSchema: EntitySchema<SegmentInput>;
 //#endregion
 export { type BlockHooks, type BlockTransport, type BlockTransportMiddleware, type RpcClient, type Segment, type SegmentInput, type SegmentMember, type SegmentMembership, type SegmentRefresh, type SegmentRefreshReport, type Segments, type SegmentsOptions, type SegmentsSqlOptions, dbTransport, extendBlock, rpcTransport, segmentsSqlOptions, sqlTransport, withBlockHooks, wrapTransport };

package/dist/blocks/segments/index.js

@@ -1,10 +1,10 @@
 import { t as segmentsSqlOptions } from "../../options-CF7nRWXS.js";
-import { A as requiredInstant, B as dbTransport, C as optionalText, D as recordOf, H as rpcTransport, I as textOf, S as optionalInstant, U as sqlTransport, k as recordsOf, m as instantArg, n as applyTemporal, o as blockCall } from "../../block-helpers-CiKtrb6g.js";
-import { i as wrapTransport, n as extendBlock, r as withBlockHooks } from "../../block-hooks-BymdcD0V.js";
-import { n as entitySchema } from "../../entity-schema-BXXC1NnT.js";
+import { A as requiredInstant, B as dbTransport, C as optionalText, D as recordOf, H as rpcTransport, I as textOf, S as optionalInstant, U as sqlTransport, k as recordsOf, m as instantArg, n as applyTemporal, o as blockCall } from "../../block-helpers-CtBdjgO4.js";
+import { i as wrapTransport, n as extendBlock, r as withBlockHooks } from "../../block-hooks-BfxX3682.js";
+import { n as entitySchema } from "../../entity-schema-BDv6w-OQ.js";
 import { n as event, t as defineEvents } from "../../event-map-CtPFhcOp.js";
-import { n as defineBlock } from "../../define-block-Dze77QTw.js";
-import { t as conditionsOf } from "../../rules-DcW5mj1r.js";
+import { n as defineBlock } from "../../define-block-BGqOO8B3.js";
+import { t as conditionsOf } from "../../automations-BYsz43AG.js";
 //#region src/blocks/segments/segments.ts
 function segmentOf(value) {
 	const row = recordOf(value, "segment");
@@ -26,7 +26,7 @@ function createSegments(options) {
 	applyTemporal(options);
 	const call = blockCall(options.transport, options.schema, options.mappers);
 	return withBlockHooks({
-		save: (organizationId, segment) => call("save_segment", {
+		upsert: (organizationId, segment) => call("save_segment", {
 			tenant: organizationId,
 			segment
 		}, segmentOf),
@@ -87,7 +87,7 @@ const segmentsEvents = defineEvents({
 });
 //#endregion
 //#region src/blocks/segments/schemas.ts
-/** What `save` takes. The SQL checks the conditions against the rule fields. */
+/** What `upsert` takes. The SQL checks the conditions against the rule fields. */
 const segmentInputSchema = entitySchema({
 	title: "SegmentInput",
 	fields: {

package/dist/blocks/sequences/index.d.ts

@@ -1,13 +1,13 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult } from "../../result-C6jDfedy.js";
-import { dt as SubjectRef } from "../../executor-CPyrQdjh.js";
-import { Ct as Events } from "../../events-DbLjvxDX.js";
+import { t as AsyncResult } from "../../result-DZeA5KS6.js";
+import { $ as RecordRef } from "../../types-DFdg_4yN.js";
+import { Ct as Events } from "../../events-vcqenSYU.js";
 import { n as Logger } from "../../logger-DWVYUmwi.js";
-import { n as BlockOptions } from "../../block-helpers-BaugZlJV.js";
-import { a as dbTransport, i as RpcClient, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-d53POsem.js";
-import { a as BlockTransportMiddleware, d as extendBlock, f as withBlockHooks, n as BlockHooks, p as wrapTransport } from "../../block-hooks-CmjPKqQ_.js";
-import { n as sequencesSqlOptions, t as SequencesSqlOptions } from "../../options-DXuA4JVa.js";
-import { S as MailSendDraft, c as BlockOf, g as BlockPorts, rn as EntitySchema } from "../../define-block-COpcS6aT.js";
+import { n as BlockOptions } from "../../block-helpers-CRpAHrp_.js";
+import { a as dbTransport, i as RpcClient, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DWZSJrwN.js";
+import { a as BlockTransportMiddleware, d as extendBlock, f as withBlockHooks, n as BlockHooks, p as wrapTransport } from "../../block-hooks-DZN2w69m.js";
+import { n as sequencesSqlOptions, t as SequencesSqlOptions } from "../../options-y_-AkVCs.js";
+import { F as BlockPorts, Sn as EntitySchema, V as MailSendDraft, c as BlockOf } from "../../define-block-BVcLQ3DF.js";
 //#region src/blocks/sequences/sequences.d.ts
 declare const SEQUENCE_STATUSES: readonly ["draft", "active", "paused", "archived"];
 declare const RUN_STATUSES: readonly ["active", "paused", "completed", "exited"];
@@ -82,7 +82,7 @@ interface Sequence {
   readonly createdAt: Temporal.Instant;
   readonly updatedAt: Temporal.Instant;
 }
-/** What `save` takes; keys left out keep their value. */
+/** What `upsert` takes; keys left out keep their value. */
 interface SequenceInput {
   readonly id?: string;
   readonly key?: string;
@@ -133,7 +133,7 @@ interface SequenceEnrollInput {
 /** What `enrollments` filters on. */
 interface SequenceEnrollmentsFilter {
   readonly sequenceId?: string;
-  readonly subject?: SubjectRef;
+  readonly subject?: RecordRef;
   readonly status?: SequenceEnrollmentStatus;
   /** 1 to 200. Default 50. */
   readonly limit?: number;
@@ -150,7 +150,7 @@ interface SequenceRunReport {
   readonly failed: number;
 }
 interface Sequences {
-  save(input: SequenceInput): AsyncResult<Sequence>;
+  upsert(input: SequenceInput): AsyncResult<Sequence>;
   /** The organization's sequences; archived ones only with that status. */
   list(filter?: {
     readonly status?: SequenceStatus;
@@ -162,7 +162,7 @@ interface Sequences {
    * Enrolls a record in an active sequence. Enrolling a record already running
    * returns its run; a finished or exited run starts over.
    */
-  enroll(sequenceId: string, subject: SubjectRef, input?: SequenceEnrollInput): AsyncResult<SequenceEnrollment>;
+  enroll(sequenceId: string, subject: RecordRef, input?: SequenceEnrollInput): AsyncResult<SequenceEnrollment>;
   pause(enrollmentId: string): AsyncResult<SequenceEnrollment>;
   resume(enrollmentId: string): AsyncResult<SequenceEnrollment>;
   /** Ends a run by hand; its completed steps stay. */
@@ -251,7 +251,7 @@ export declare const sequencesBlock: BlockOf<"sequences", typeof createSequences
 }>;
 //#endregion
 //#region src/blocks/sequences/schemas.d.ts
-/** What `save` takes, with the bounds the SQL checks. */
+/** What `upsert` takes, with the bounds the SQL checks. */
 export declare const sequenceInputSchema: EntitySchema<SequenceInput>;
 /** What `enroll` takes, with the bounds the SQL checks. */
 export declare const sequenceEnrollInputSchema: EntitySchema<SequenceEnrollInput>;

package/dist/blocks/sequences/index.js

@@ -1,13 +1,13 @@
-import { n as dbError } from "../../errors-03ysrOt4.js";
-import { a as ok, r as err } from "../../result-B3m7xtRY.js";
+import { n as dbError } from "../../errors-BVFgt8BZ.js";
 import { n as isRecord } from "../../guards-6F2bCtQR.js";
+import { a as ok, r as err } from "../../result-ntFBW2p2.js";
 import { t as sequencesSqlOptions } from "../../options-9gvPo1BC.js";
-import { A as requiredInstant, B as dbTransport, C as optionalText, D as recordOf, F as stringsOf, H as rpcTransport, I as textOf, S as optionalInstant, U as sqlTransport, d as enumOrThrow, f as errorText, k as recordsOf, m as instantArg, n as applyTemporal, o as blockCall } from "../../block-helpers-CiKtrb6g.js";
-import { i as wrapTransport, n as extendBlock, r as withBlockHooks } from "../../block-hooks-BymdcD0V.js";
-import { n as entitySchema } from "../../entity-schema-BXXC1NnT.js";
+import { A as requiredInstant, B as dbTransport, C as optionalText, D as recordOf, F as stringsOf, H as rpcTransport, I as textOf, S as optionalInstant, U as sqlTransport, d as enumOrThrow, f as errorText, k as recordsOf, m as instantArg, n as applyTemporal, o as blockCall } from "../../block-helpers-CtBdjgO4.js";
+import { i as wrapTransport, n as extendBlock, r as withBlockHooks } from "../../block-hooks-BfxX3682.js";
+import { n as entitySchema } from "../../entity-schema-BDv6w-OQ.js";
 import { n as event, t as defineEvents } from "../../event-map-CtPFhcOp.js";
-import { n as defineBlock } from "../../define-block-Dze77QTw.js";
-import { t as requireTenant } from "../../block-tenant-C1sNV8_4.js";
+import { n as defineBlock } from "../../define-block-BGqOO8B3.js";
+import { t as requireOrganization } from "../../block-tenant-DHp7subc.js";
 //#region src/blocks/sequences/sequences.ts
 const SEQUENCE_STATUSES = [
 	"draft",
@@ -183,7 +183,7 @@ function createSequences(options) {
 	applyTemporal(options);
 	const call = blockCall(options.transport, options.schema, options.mappers);
 	const service = blockCall(options.service ?? options.transport, options.schema, options.mappers);
-	const tenant = () => requireTenant(options.tenant);
+	const tenant = () => requireOrganization(options.tenant);
 	const enrollment = (fn) => (value) => enrollmentOf(value, fn);
 	const change = (enrollmentId, action) => call("change_sequence_enrollment", {
 		enrollment_id: enrollmentId,
@@ -196,7 +196,7 @@ function createSequences(options) {
 		return sent.ok ? ok(sent.data.id) : sent;
 	};
 	return withBlockHooks({
-		save: (input) => tenant().andThen((organizationId) => call("save_sequence", {
+		upsert: (input) => tenant().andThen((organizationId) => call("save_sequence", {
 			tenant: organizationId,
 			sequence: definedOf(input)
 		}, (value) => sequenceOf(value, "save_sequence"))),
@@ -270,7 +270,7 @@ const sequencesEvents = defineEvents({
 });
 //#endregion
 //#region src/blocks/sequences/schemas.ts
-/** What `save` takes, with the bounds the SQL checks. */
+/** What `upsert` takes, with the bounds the SQL checks. */
 const sequenceInputSchema = entitySchema({
 	title: "SequenceInput",
 	fields: {
@@ -354,6 +354,12 @@ const sequenceEnrollInputSchema = entitySchema({
 /** The `sequences` block's manifest (ADR 0029). */
 const sequencesBlock = defineBlock({
 	name: "sequences",
+	schedules: [{
+		name: "run-due",
+		cron: "* * * * *",
+		runs: "runDue()",
+		description: "Sends the due steps of every active enrollment and moves each to its next wait."
+	}],
 	sql: ["sequences"],
 	options: { sequences: sequencesSqlOptions },
 	events: sequencesEvents,

package/dist/blocks/service-accounts/index.d.ts

@@ -0,0 +1,132 @@
+/// <reference lib="esnext.temporal" />
+import { T as ErrorMapper, t as AsyncResult } from "../../result-DZeA5KS6.js";
+import { t as StandardSchemaV1 } from "../../standard-DBV730sF.js";
+import { i as RowFields, r as FieldsOf } from "../../block-fields-BE7pInWZ.js";
+import { $ as SaasEventData, Ct as Events } from "../../events-vcqenSYU.js";
+import { n as Logger } from "../../logger-DWVYUmwi.js";
+import { r as BlockTemporalOptions } from "../../block-helpers-CRpAHrp_.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DWZSJrwN.js";
+import { n as BlockHooks } from "../../block-hooks-DZN2w69m.js";
+import { c as BlockOf } from "../../define-block-BVcLQ3DF.js";
+//#region src/blocks/service-accounts/service-accounts.d.ts
+/** The `app_metadata` key that marks an `auth.users` row as a service principal. */
+export declare const SERVICE_PRINCIPAL_CLAIM = "bsb_service_principal";
+/**
+ * The part of `supabase.auth.admin` the block uses, typed structurally so any
+ * Supabase client fits.
+ */
+interface ServicePrincipalAuthAdmin {
+  createUser(attributes: {
+    email: string;
+    email_confirm: boolean;
+    ban_duration: string;
+    app_metadata: Record<string, unknown>;
+    user_metadata: Record<string, unknown>;
+  }): PromiseLike<{
+    data: {
+      user: {
+        id: string;
+      } | null;
+    };
+    error: {
+      message: string;
+    } | null;
+  }>;
+  deleteUser(id: string): PromiseLike<{
+    error: {
+      message: string;
+    } | null;
+  }>;
+}
+interface ServiceAccountsOptions<S extends StandardSchemaV1 | undefined = undefined> extends BlockTemporalOptions {
+  /** A service-role transport: every function but `list` is service only. */
+  readonly transport: BlockTransport;
+  /** `supabase.auth.admin` of a service-role client. */
+  readonly admin: ServicePrincipalAuthAdmin;
+  /**
+   * The module schema, or its API schema: `defineBlocks` passes it from
+   * `blocks.generated.ts`. Default `better_supabase`.
+   */
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+  /** `withBlockHooks` hooks around the client's methods. */
+  readonly hooks?: NoInfer<BlockHooks<ServiceAccounts<FieldsOf<S>>>>;
+  /**
+   * A Standard Schema for the extra columns of the principals table
+   * (`blocks["service-accounts"].options.extraColumns`): writes are validated,
+   * reads parsed.
+   */
+  readonly fields?: S;
+  /** Receives the errors `after` hooks throw. Default: `console`. */
+  readonly logger?: Logger;
+}
+interface ServicePrincipal<F extends object = Record<never, never>> {
+  readonly id: string;
+  readonly name: string;
+  readonly role: string;
+  readonly isDefault: boolean;
+  readonly createdBy: string | null;
+  readonly createdAt: Temporal.Instant;
+  readonly disabledAt: Temporal.Instant | null;
+  /** The app's extra columns (`options.extraColumns`), by column name. */
+  readonly fields: RowFields<F>;
+}
+/**
+ * Who asks for a change. With `createdBy`, that member needs
+ * `service_principals.manage` and may assign the role; without it the service
+ * acts on its own.
+ */
+interface ServicePrincipalActor {
+  readonly createdBy?: string;
+}
+interface CreateServicePrincipalOptions<F extends object = Record<never, never>> extends ServicePrincipalActor {
+  /** Makes it the tenant's default, which organization-owned work runs as. */
+  readonly default?: boolean;
+  /** Values for the app's extra columns (`options.extraColumns`). */
+  readonly fields?: Partial<F> & Readonly<Record<string, unknown>>;
+}
+interface CreatedServicePrincipal<F extends object = Record<never, never>> {
+  readonly id: string;
+  readonly organizationId: string;
+  readonly name: string;
+  readonly role: string;
+  readonly isDefault: boolean;
+  /** The app's extra columns (`options.extraColumns`), by column name. */
+  readonly fields: RowFields<F>;
+}
+/** The `service-accounts` SQL module as typed calls. */
+interface ServiceAccounts<F extends object = Record<never, never>> {
+  /**
+   * Creates an `auth.users` row that can't sign in (banned, no password, an
+   * address under `.invalid`), then registers it with `role` in the
+   * organization. A refused registration deletes the user again.
+   */
+  readonly create: (organizationId: string, name: string, role: string, options?: CreateServicePrincipalOptions<F>) => AsyncResult<CreatedServicePrincipal<F>>;
+  readonly setRole: (id: string, role: string, options?: ServicePrincipalActor) => AsyncResult<boolean>;
+  /** Removes its membership and default; `false` when it was already off. */
+  readonly disable: (id: string, options?: ServicePrincipalActor) => AsyncResult<boolean>;
+  /** The organization's default principal, or `null`. */
+  readonly defaultFor: (organizationId: string) => AsyncResult<string | null>;
+  /** The organization's principals, through the read policy. */
+  readonly list: (organizationId: string) => AsyncResult<readonly ServicePrincipal<F>[]>;
+}
+export declare function createServiceAccounts<S extends StandardSchemaV1 | undefined = undefined>(options: ServiceAccountsOptions<S>): ServiceAccounts<FieldsOf<S>>;
+//#endregion
+//#region src/blocks/service-accounts/events.d.ts
+/** The events of the `service-accounts` block: type to data. */
+type ServiceAccountsEvents = {
+  readonly "service_principal.created": SaasEventData;
+  readonly "service_principal.role_changed": SaasEventData;
+  readonly "service_principal.disabled": SaasEventData;
+};
+/**
+ * The `service-accounts` block's event types, for its manifest and
+ * `onBlockEvent`.
+ */
+export declare const serviceAccountsEvents: Events<ServiceAccountsEvents>;
+//#endregion
+//#region src/blocks/service-accounts/manifest.d.ts
+/** The `service-accounts` block's manifest (ADR 0029). */
+export declare const serviceAccountsBlock: BlockOf<"service-accounts", typeof createServiceAccounts, ServiceAccountsEvents>;
+//#endregion
+export { type BlockTransport, type CreateServicePrincipalOptions, type CreatedServicePrincipal, type ServiceAccounts, type ServiceAccountsEvents, type ServiceAccountsOptions, type ServicePrincipal, type ServicePrincipalActor, type ServicePrincipalAuthAdmin, dbTransport, rpcTransport, sqlTransport };

package/dist/blocks/service-accounts/index.js

@@ -0,0 +1,109 @@
+import { n as dbError } from "../../errors-BVFgt8BZ.js";
+import { a as ok, r as err, t as AsyncResult } from "../../result-ntFBW2p2.js";
+import { t as serviceAccountsSqlOptions } from "../../options-B0EJULm5.js";
+import { A as requiredInstant, B as dbTransport, D as recordOf, H as rpcTransport, I as textOf, U as sqlTransport, k as recordsOf, n as applyTemporal, o as blockCall, v as nullableInstant, y as nullableText } from "../../block-helpers-CtBdjgO4.js";
+import { r as withBlockHooks } from "../../block-hooks-BfxX3682.js";
+import { n as event, t as defineEvents } from "../../event-map-CtPFhcOp.js";
+import { a as readAllFields, n as blockFields, o as readFields, s as rowFields } from "../../block-fields-DE_FgpOU.js";
+import { n as defineBlock } from "../../define-block-BGqOO8B3.js";
+//#region src/blocks/service-accounts/service-accounts.ts
+/** The `app_metadata` key that marks an `auth.users` row as a service principal. */
+const SERVICE_PRINCIPAL_CLAIM = "bsb_service_principal";
+/** About 100 years: GoTrue refuses every sign-in while the user is banned. */
+const BAN_DURATION = "876000h";
+function createServiceAccounts(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const fields = blockFields(options.fields, "service principal fields");
+	const { admin } = options;
+	return withBlockHooks({
+		create: (organizationId, name, role, extra = {}) => AsyncResult.from(async () => {
+			const checked = extra.fields === void 0 ? ok(void 0) : await fields.write({ ...extra.fields });
+			if (!checked.ok) return checked;
+			const created = await admin.createUser({
+				email: `${crypto.randomUUID()}@service-accounts.invalid`,
+				email_confirm: true,
+				ban_duration: BAN_DURATION,
+				app_metadata: {
+					[SERVICE_PRINCIPAL_CLAIM]: true,
+					organization_id: organizationId
+				},
+				user_metadata: { name }
+			});
+			const user = created.data.user;
+			if (created.error !== null || user === null) return err(dbError("unexpected", `Auth refused the service principal user: ${created.error?.message ?? "no user returned"}`));
+			const registered = await call("register_service_principal", {
+				principal: user.id,
+				tenant: organizationId,
+				name,
+				role,
+				is_default: extra.default ?? false,
+				created_by: extra.createdBy ?? null,
+				fields: checked.data
+			}, (value) => {
+				const row = recordOf(value, "register_service_principal");
+				return {
+					id: textOf(row["id"]),
+					organizationId: textOf(row["tenant"]),
+					name: textOf(row["name"]),
+					role: textOf(row["role"]),
+					isDefault: row["isDefault"] === true,
+					fields: rowFields(row["fields"])
+				};
+			});
+			if (!registered.ok) {
+				await admin.deleteUser(user.id);
+				return err(registered.error);
+			}
+			return readFields(fields, registered.data);
+		}),
+		setRole: (id, role, extra = {}) => call("set_service_principal_role", {
+			principal: id,
+			role,
+			created_by: extra.createdBy ?? null
+		}, (value) => value === true),
+		disable: (id, extra = {}) => call("disable_service_principal", {
+			principal: id,
+			created_by: extra.createdBy ?? null
+		}, (value) => value === true),
+		defaultFor: (organizationId) => call("default_service_principal", { tenant: organizationId }, (value) => nullableText(value)),
+		list: (organizationId) => call("service_principals_list", { tenant: organizationId }, (value) => recordsOf(value, "service_principals_list").map((row) => ({
+			id: textOf(row["id"]),
+			name: textOf(row["name"]),
+			role: textOf(row["role"]),
+			isDefault: row["isDefault"] === true,
+			createdBy: nullableText(row["createdBy"]),
+			createdAt: requiredInstant(row["createdAt"], "createdAt"),
+			disabledAt: nullableInstant(row["disabledAt"]),
+			fields: rowFields(row["fields"])
+		}))).andThen((principals) => readAllFields(fields, principals))
+	}, options.hooks, {
+		block: "service-accounts",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+//#endregion
+//#region src/blocks/service-accounts/events.ts
+/**
+* The `service-accounts` block's event types, for its manifest and
+* `onBlockEvent`.
+*/
+const serviceAccountsEvents = defineEvents({
+	"service_principal.created": event(),
+	"service_principal.role_changed": event(),
+	"service_principal.disabled": event()
+});
+//#endregion
+//#region src/blocks/service-accounts/manifest.ts
+/** The `service-accounts` block's manifest (ADR 0029). */
+const serviceAccountsBlock = defineBlock({
+	name: "service-accounts",
+	sql: ["service-accounts"],
+	options: { "service-accounts": serviceAccountsSqlOptions },
+	events: serviceAccountsEvents,
+	create: createServiceAccounts,
+	category: "developer",
+	recipes: ["service-principals-table"]
+});
+//#endregion
+export { SERVICE_PRINCIPAL_CLAIM, createServiceAccounts, dbTransport, rpcTransport, serviceAccountsBlock, serviceAccountsEvents, sqlTransport };

package/dist/blocks/sessions/index.d.ts

@@ -1,7 +1,142 @@
-import { r as Block } from "../../define-block-COpcS6aT.js";
-import { a as OAuthConsentControllerOptions, c as OAuthGrant, d as OAuthGrantsControllerOptions, f as OAuthGrantsSnapshot, h as createOAuthGrantsController, i as OAuthConsentController, l as OAuthGrantsActions, m as createOAuthConsentController, n as OAuthClientInfo, o as OAuthConsentRequest, p as RawOAuthClient, r as OAuthConsentActions, s as OAuthConsentSnapshot, t as OAuthApi, u as OAuthGrantsController } from "../../client-BYAY7lLs.js";
+/// <reference lib="esnext.temporal" />
+import { b as DbError, f as Result } from "../../result-DZeA5KS6.js";
+import { r as Block } from "../../define-block-BVcLQ3DF.js";
+import { n as Controller, t as AuthPort } from "../../controller-BrP0gn47.js";
+import { t as AuthReply } from "../../auth-reply-Dj124sbX.js";
+//#region src/blocks/sessions/client.d.ts
+/** An OAuth client as the Auth OAuth server describes it. */
+interface RawOAuthClient {
+  readonly id: string;
+  readonly name: string;
+  readonly uri?: string;
+  readonly logo_uri?: string;
+}
+/** The part of `supabase.auth.oauth` the consent controllers call. */
+interface OAuthApi {
+  getAuthorizationDetails(authorizationId: string): PromiseLike<AuthReply<{
+    readonly authorization_id: string;
+    readonly redirect_uri: string;
+    readonly client: RawOAuthClient;
+    readonly user: {
+      readonly id: string;
+      readonly email: string;
+    };
+    readonly scope: string;
+  } | {
+    readonly redirect_url: string;
+  }>>;
+  approveAuthorization(authorizationId: string, options?: {
+    skipBrowserRedirect?: boolean;
+  }): PromiseLike<AuthReply<{
+    readonly redirect_url: string;
+  }>>;
+  denyAuthorization(authorizationId: string, options?: {
+    skipBrowserRedirect?: boolean;
+  }): PromiseLike<AuthReply<{
+    readonly redirect_url: string;
+  }>>;
+  listGrants(): PromiseLike<AuthReply<readonly {
+    readonly client: RawOAuthClient;
+    readonly scopes: readonly string[];
+    readonly granted_at: string;
+  }[]>>;
+  revokeGrant(options: {
+    clientId: string;
+  }): PromiseLike<AuthReply<unknown>>;
+}
+interface OAuthClientInfo {
+  readonly id: string;
+  readonly name: string;
+  readonly uri: string | undefined;
+  readonly logoUri: string | undefined;
+}
+/** An authorization request waiting for the user's decision. */
+interface OAuthConsentRequest {
+  readonly authorizationId: string;
+  readonly client: OAuthClientInfo;
+  readonly user: {
+    readonly id: string;
+    readonly email: string;
+  };
+  readonly scopes: readonly string[];
+  /** The redirect URI the client registered. */
+  readonly redirectUri: string;
+  /** Its host, to show where approving sends the user. */
+  readonly redirectHost: string;
+}
+interface OAuthConsentControllerOptions {
+  /** `supabase.auth.oauth` of the browser client. */
+  readonly oauth: OAuthApi;
+  readonly auth: AuthPort;
+  /** `authorization_id` from the consent page's URL; `undefined` loads nothing. */
+  readonly authorizationId: string | undefined;
+  /**
+   * Leaves for a `redirect_url` that Auth returned: after a decision, or at
+   * once for a client the user approved before. Default:
+   * `window.location.assign`.
+   */
+  readonly redirect?: (url: string) => void;
+}
+interface OAuthConsentSnapshot {
+  /**
+   * The request to approve or deny; `undefined` while it loads or after a
+   * redirect.
+   */
+  readonly request: OAuthConsentRequest | undefined;
+  /** The URL the controller sent the browser to. */
+  readonly redirectUrl: string | undefined;
+  /** The decision in flight; it stays set while the browser leaves. */
+  readonly deciding: "approve" | "deny" | undefined;
+  readonly error: DbError | undefined;
+}
+interface OAuthConsentActions {
+  /** Approves the request and goes to the client with a code. */
+  readonly approve: () => Promise<Result<string>>;
+  /** Denies the request and goes to the client with `access_denied`. */
+  readonly deny: () => Promise<Result<string>>;
+}
+type OAuthConsentController = Controller<OAuthConsentSnapshot, OAuthConsentActions>;
+/**
+ * The consent page of the Supabase Auth OAuth server: it reads the request for
+ * `authorizationId`, and `approve` or `deny` send the browser to the
+ * `redirect_url` that Auth returns, never to a URL from the page.
+ */
+export declare function createOAuthConsentController(options: OAuthConsentControllerOptions): OAuthConsentController;
+/** A client the user approved. */
+interface OAuthGrant {
+  readonly client: OAuthClientInfo;
+  readonly scopes: readonly string[];
+  readonly grantedAt: Temporal.Instant;
+}
+interface OAuthGrantsControllerOptions {
+  /** `supabase.auth.oauth` of the browser client. */
+  readonly oauth: OAuthApi;
+  readonly auth: AuthPort;
+}
+interface OAuthGrantsSnapshot {
+  /** Newest first; `undefined` until the first load. */
+  readonly grants: readonly OAuthGrant[] | undefined;
+  /** The client ids with a revoke in flight. */
+  readonly revoking: readonly string[];
+  readonly error: DbError | undefined;
+}
+interface OAuthGrantsActions {
+  /**
+   * Disconnects a client: its sessions end and its refresh tokens stop working.
+   * An access token it holds stays valid until it expires.
+   */
+  readonly revoke: (clientId: string) => Promise<Result<boolean>>;
+  readonly refresh: () => Promise<void>;
+}
+type OAuthGrantsController = Controller<OAuthGrantsSnapshot, OAuthGrantsActions>;
+/**
+ * The OAuth clients (such as MCP clients) the user approved, for a connected
+ * agents list.
+ */
+export declare function createOAuthGrantsController(options: OAuthGrantsControllerOptions): OAuthGrantsController;
+//#endregion
 //#region src/blocks/sessions/manifest.d.ts
 /** The `sessions` block's manifest (ADR 0029). */
 export declare const sessionsBlock: Block<"sessions">;
 //#endregion
-export { type OAuthApi, type OAuthClientInfo, type OAuthConsentActions, type OAuthConsentController, type OAuthConsentControllerOptions, type OAuthConsentRequest, type OAuthConsentSnapshot, type OAuthGrant, type OAuthGrantsActions, type OAuthGrantsController, type OAuthGrantsControllerOptions, type OAuthGrantsSnapshot, type RawOAuthClient, createOAuthConsentController, createOAuthGrantsController };
+export type { OAuthApi, OAuthClientInfo, OAuthConsentActions, OAuthConsentController, OAuthConsentControllerOptions, OAuthConsentRequest, OAuthConsentSnapshot, OAuthGrant, OAuthGrantsActions, OAuthGrantsController, OAuthGrantsControllerOptions, OAuthGrantsSnapshot, RawOAuthClient };