better-supabase 0.14.0 → 0.15.1

package/dist/next/index.d.ts

@@ -1,38 +1,133 @@
-import { b as DbError, f as Result } from "../result-C6jDfedy.js";
-import { M as AnyFunctions, N as AnyModels, dt as SubjectRef } from "../executor-CPyrQdjh.js";
-import { r as AuthState } from "../resolve-CzUKTIMq.js";
-import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-DFP3gHv8.js";
-import { I as ReadSet, J as QuerySpec, Lt as DbStats, Ut as CacheAdapter, t as BetterSupabase } from "../define-Dw7pRO4h.js";
+import { b as DbError, f as Result } from "../result-DZeA5KS6.js";
+import { $ as RecordRef, O as AnyFunctions, k as AnyModels } from "../types-DFdg_4yN.js";
+import { r as AuthState } from "../resolve-CXX6DHv3.js";
+import { l as PermissionRef, t as AnyAuthorizer } from "../authorizer-B6X09otb.js";
+import { J as DbStats, Zt as CacheAdapter, pt as QuerySpec, t as BetterSupabase, tt as ReadSet } from "../define-DFBnQyYg.js";
+import { C as SupportSessions, S as SupportPolicy, T as supportSessions, a as ServerContext, c as ServerOptions, et as SessionSnapshot, it as sessionCacheKey, l as SharedServer, n as BetterServer, nt as isSessionSnapshot, r as ContextOptions, rt as issuedAtOf, tt as authzVersionOf, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions } from "../server-types-7QPzW2bF.js";
 import { n as Impersonator } from "../impersonation-YTa9dZUv.js";
-import { n as AmrEntry, t as Aal } from "../mfa-wrx1rqJT.js";
-import { Ct as BlockClientSource, Vt as SectionOptions } from "../define-block-COpcS6aT.js";
-import { F as SectionNamed, P as SectionName, S as SectionWritesOf, _ as PlainSections, d as FeatureBlocks, h as Plain, m as FeatureWriteOutput, p as FeatureWriteInput, v as RecordCan, x as RecordWriteInput, y as RecordFeature } from "../index-DbXWcrOI.js";
-import { t as tenantOf } from "../tenant-Bg4PDLkG.js";
-import { n as toSession, t as AuthSession } from "../view-2_I-2ukO.js";
-import { C as SupportSessions, S as SupportPolicy, T as supportSessions, a as ServerContext, c as ServerOptions, l as SharedServer, n as BetterServer, r as ContextOptions, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions } from "../server-types-BOs-eFpo.js";
-import { t as AuthOutageHook } from "../session-BgsOPGZs.js";
-import { n as AuthKind, r as GuardOptions } from "../respond-CZYibxUx.js";
-import { a as AuthorizedContext, c as ResourceLoaderContext, i as AuthorizeOptions, l as Unwrapped, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-DKfbNTAA.js";
-import { c as ListParseOptions, m as ListSearchParams } from "../list-query-BtluNnYk.js";
-import { r as LiveCountSeed, t as CountRunner } from "../index-eTY4kJzo.js";
-import { r as MembershipClaim } from "../entitlements-DDevu4ZE.js";
-import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-Bzt_bpR5.js";
-import { t as ResourceMap } from "../resources-Du5wcL3f.js";
-import { t as defineAction } from "../resource-execute-bT9ltHVT.js";
-import { i as BlockMethodName, n as BlockDataOf, t as BlockArgsOf } from "../block-method-hsPAGFi5.js";
-import { i as tagFor, t as TagOptions } from "../tags-CLXi2c6O.js";
-import { c as RecordListCells, n as Timeline, o as RecordList, u as RecordListPage } from "../timeline-DUUsPLv5.js";
-import { n as supportOf, t as SupportView } from "../support-view-vwJbRMpV.js";
+import { n as AmrEntry, t as Aal } from "../mfa-oIOYTpvc.js";
+import { S as BlockClientSource, on as RecordBindingOptions } from "../define-block-DvvcM54N.js";
+import { M as BindingName, N as BindingOf, S as RecordWriteInput, _ as RecordTypeBlocks, b as RecordTypeWriteInput, d as BindingWritesOf, f as Plain, g as RecordType, h as RecordCan, m as PlainBindings, x as RecordTypeWriteOutput } from "../index-BfkltrGJ.js";
+import { t as tenantOf } from "../tenant-DzFsg0Pc.js";
+import { n as toSession, t as AuthSession } from "../view-DyFdMCqg.js";
+import { t as AuthOutageHook } from "../session-CfBCJGgc.js";
+import { n as AuthKind, r as GuardOptions } from "../respond-Dn1_YhC1.js";
+import { a as AuthorizedContext, c as ResourceLoaderContext, i as AuthorizeOptions, l as Unwrapped, n as ActionParsed, r as ActionResult, t as ActionInput } from "../kit-DOwKpSkA.js";
+import { c as ListParseOptions, m as ListSearchParams } from "../list-query-BDVutLFr.js";
+import { r as LiveCountSeed, t as CountRunner } from "../index-DN9mfmhA.js";
+import { r as MembershipClaim } from "../entitlements-BnhDBxLW.js";
+import { i as ResourceContext, l as ResourceRouteOptions, o as ResourceHooks, r as ResourceAction, t as ActionArgs } from "../resource-types-DnKiH4G2.js";
+import { t as ResourceMap } from "../resources-B9cQxhjw.js";
+import { t as defineAction } from "../resource-execute-CzHuDsil.js";
+import { n as BlockDataOf, r as BlockMethodName, t as BlockArgsOf } from "../block-method-CiVa2G-J.js";
+import { i as tagFor, t as TagOptions } from "../tags-BjHflcHF.js";
+import { c as RecordListCells, n as Timeline, o as RecordList, u as RecordListPage } from "../timeline-WrFMgd3U.js";
+import { r as safeRedirectPath } from "../sign-in-BAjR49fq.js";
+import { n as supportOf, t as SupportView } from "../support-view-BYOgwXsJ.js";
 import { NextRequest } from "next/server.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/next/collector.d.ts
 /** Forwarded by the proxy so every scope of one render shares an id. */
-export declare const REQUEST_ID_HEADER = "x-bs-request-id";
+export declare const REQUEST_ID_HEADER = "x-bsb-request-id";
 interface DbBudget {
   readonly calls?: number;
   readonly waves?: number;
 }
 //#endregion
+//#region src/next/record.d.ts
+/**
+ * The context `recordServer` reads: the caller's `Db`, and its supabase-js
+ * client, whose `storage` the attachments block deletes files with.
+ */
+interface RecordServerContext {
+  readonly db: BlockClientSource;
+  readonly supabase?: {
+    readonly storage?: unknown;
+  };
+}
+/**
+ * What `recordServer` needs of `bsb` (`createNext`): its context and its
+ * actions, typed loosely so any app's `bsb` fits.
+ */
+interface RecordServerHost {
+  context(): Promise<RecordServerContext>;
+  action<S extends StandardSchemaV1, T>(options: {
+    readonly input: S;
+    readonly requireOrganization: true;
+  }, fn: (input: StandardSchemaV1.InferOutput<S>, ctx: RecordServerContext & {
+    readonly tenant: string;
+  }) => Promise<T>): (input: never) => Promise<ActionResult<unknown>>;
+}
+interface RecordLoadOptions<B extends RecordTypeBlocks, M extends BindingName<B>> {
+  /** The bindings to load. Default: every binding of the record type. */
+  readonly bindings?: readonly M[];
+  /** Options for each binding's `load`, such as `{ versions: { pageSize: 5 } }`. */
+  readonly options?: { readonly [K in M]?: RecordBindingOptions<BindingOf<B, K>>; };
+}
+/** What a generated loader resolves to, safe to pass to a Client Component. */
+interface RecordView<T extends string, B extends RecordTypeBlocks, N extends string, M extends N> {
+  readonly subject: RecordRef<T>;
+  /** Each requested binding settled: `ok`, `error` or `hidden`. */
+  readonly bindings: PlainBindings<B, M>;
+  /** What the caller may do on every binding of the record type. */
+  readonly can: RecordCan<B, N>;
+  /**
+   * Set when the caller's permissions failed to load; every flag is then
+   * `false`.
+   */
+  readonly permissionsError?: DbError;
+}
+interface RecordTimelineOptions<N extends string> {
+  /** Default: every binding of the record type with a `timeline`. */
+  readonly bindings?: readonly N[];
+  /** The most entries to return, newest first. */
+  readonly limit?: number;
+}
+/** One Server Action per write of each binding. */
+type RecordServerActions<B extends RecordTypeBlocks, N extends string> = { readonly [S in N]: { readonly [W in BindingWritesOf<B, S>]: (input: RecordWriteInput<RecordTypeWriteInput<B, S, W>>) => Promise<ActionResult<Plain<RecordTypeWriteOutput<B, S, W>>>>; }; };
+interface RecordServer<T extends string, B extends RecordTypeBlocks, N extends BindingName<B>> {
+  /**
+   * Loads one record's bindings and the caller's flags. It reads the request,
+   * so call it outside `"use cache"`: a cached binding error would stick.
+   */
+  load<const M extends N = N>(id: string, options?: RecordLoadOptions<B, M>): Promise<RecordView<T, B, N, M>>;
+  /**
+   * One record's history across its bindings, newest first, with the bindings
+   * the caller can't read skipped. Call it outside `"use cache"`, like `load`.
+   */
+  timeline(id: string, options?: RecordTimelineOptions<N>): Promise<Plain<Timeline>>;
+  /** The Server Actions; re-export them from a `"use server"` file. */
+  readonly actions: RecordServerActions<B, N>;
+  /** The record's cache tag and one per binding, scoped to `tenant`. */
+  tags(id: string, tenant?: string | null): readonly string[];
+}
+/** What `recordListServer(...).load` resolves to, safe for a Client Component. */
+type RecordListView<B extends RecordTypeBlocks, N extends string, Q, P extends {
+  readonly items: readonly unknown[];
+}, Cols> = Result<Plain<RecordListPage<Q, P, P["items"][number], RecordListCells<B, Cols>, RecordCan<B, N>>>>;
+interface RecordListServer<B extends RecordTypeBlocks, N extends string, Q, P extends {
+  readonly items: readonly unknown[];
+}, Cols> {
+  /**
+   * Parses the page's `searchParams` and loads the page with its binding
+   * columns, over the caller's `Db`. Call it outside `"use cache"`.
+   */
+  load(input: ListSearchParams | undefined, options?: ListParseOptions): Promise<RecordListView<B, N, Q, P, Cols>>;
+}
+/**
+ * The server half of a `defineRecordList` for Next.js: it builds the record
+ * type's block clients and the caller's permissions, then runs
+ * `recordList.load`.
+ *
+ * ```ts
+ * const customers = recordListServer(bsb, customerRecordList);
+ * const view = await customers.load(await searchParams);
+ * ```
+ */
+export declare function recordListServer<T extends string, B extends RecordTypeBlocks, N extends BindingName<B>, Q, P extends {
+  readonly items: readonly unknown[];
+}, Cols>(bsb: Pick<RecordServerHost, "context">, recordList: RecordList<T, B, N, Q, P, Cols>): RecordListServer<B, N, Q, P, Cols>;
+//#endregion
 //#region src/next/resources.d.ts
 interface NextResourcesOptions extends GuardOptions {
   /** The catch-all route's path, e.g. `/api` for `app/api/[...path]/route.ts`. */
@@ -47,7 +142,7 @@ interface NextResourcesOptions extends GuardOptions {
 type NextResourceHandler = (request: Request) => Promise<Response>;
 /**
  * The exports of `app/api/[...path]/route.ts`: `export const { GET, POST,
- * PATCH, PUT, DELETE } = bs.resources({ ... })`.
+ * PATCH, PUT, DELETE } = bsb.resources({ ... })`.
  */
 interface NextResourceRoutes {
   readonly GET: NextResourceHandler;
@@ -79,12 +174,12 @@ interface NextDebugOptions {
   readonly enabled?: boolean;
   /**
    * Header with `calls;waves;ms` on route handler responses. Defaults to
-   * `x-bs-db-calls`.
+   * `x-bsb-db-calls`.
    */
   readonly header?: string;
   /** Warns in development when one render goes over it. */
   readonly budget?: DbBudget;
-  /** Where `bs.debugRoute()` is mounted. Defaults to `/api/bs-stats`. */
+  /** Where `bsb.debugRoute()` is mounted. Defaults to `/api/bsb-stats`. */
   readonly route?: string;
 }
 interface ProxyOptions<C = unknown, P = unknown> {
@@ -117,10 +212,21 @@ interface ProxyOptions<C = unknown, P = unknown> {
   /** Post-processes the final response; return a new one to replace it. */
   readonly after?: (response: Response, auth: AuthState<C, P>) => Response | undefined | void | Promise<Response | undefined | void>;
   /**
-   * Adds `Server-Timing: bs-proxy;dur=..., bs-verify;dur=...` (ms): the whole
-   * proxy, and resolving the session (a local verify, or a refresh).
+   * Adds `Server-Timing` entries in ms: `bsb-proxy` (the whole proxy),
+   * `bsb-auth` (resolving the session), and `bsb-parse`, `bsb-verify`,
+   * `bsb-refresh` and `bsb-ended` for the phases that ran.
    */
   readonly serverTiming?: boolean;
+  /**
+   * Refresh a session whose token expires within this many seconds. A token
+   * outside the window is verified locally and never refreshed. Defaults to
+   * `auth.leeway`, else 60.
+   */
+  readonly refreshSkewSeconds?: number;
+  /**
+   * Ask Auth whether the session still exists (one network call), on top-level
+   * document loads only. `true` checks every document load.
+   */
   readonly endedSession?: true | EndedSessionOptions;
   /**
    * Called when a refresh failed because the Auth server was unreachable, timed
@@ -131,6 +237,11 @@ interface ProxyOptions<C = unknown, P = unknown> {
   readonly onAuthOutage?: AuthOutageHook;
 }
 interface EndedSessionOptions {
+  /**
+   * The paths whose document loads check the session, such as `/settings`.
+   * Defaults to every document load. Client navigations, prefetches and
+   * mutations never check.
+   */
   readonly paths?: readonly string[];
   readonly redirect?: string;
   /**
@@ -147,9 +258,9 @@ interface ActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P =
   readonly input?: S;
   /**
    * The active tenant for the action's context, from the validated input,
-   * instead of `NextOptions.tenant`. It is checked the same way: the `tenant()`
-   * plugin and `current_tenant_id()` only honor a tenant the caller belongs
-   * to.
+   * instead of `NextOptions.tenant`. It is checked the same way: the
+   * `membershipsExtension()` plugin and `current_tenant_id()` only honor a
+   * tenant the caller belongs to.
    */
   readonly tenant?: (input: ActionParsed<S>) => string | undefined;
 }
@@ -163,13 +274,6 @@ type BlockActionArgs<S, A, Ctx> = [ActionParsed<S>] extends A ? {
 } : {
   readonly args: (input: ActionParsed<S>, ctx: Ctx) => A;
 };
-/** The record and section a `sectionAction` writes to. */
-interface SectionActionTarget<S, Ctx> {
-  /** The section to invalidate after the write, such as `"comments"`. */
-  readonly section: string;
-  /** The record the write is on, from the validated input. */
-  readonly subject: (input: ActionParsed<S>, ctx: Ctx) => SubjectRef;
-}
 interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown, X = ResourceLoaderContext<C, P>> extends GuardOptions, AuthorizeOptions<NextRequest, C, P, R, Ref, X> {
   /**
    * Refresh an expired session cookie in the route and send the new cookies
@@ -179,15 +283,16 @@ interface RouteOptions<C = unknown, P = unknown, R extends boolean = boolean, Re
   readonly refresh?: boolean;
 }
 interface RequireOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown, X = ResourceLoaderContext<C, P>> extends GuardOptions, AuthorizeOptions<undefined, C, P, R, Ref, X> {
-  /** The active tenant, as for `bs.context({ tenant })`. */
+  /** The active tenant, as for `bsb.context({ tenant })`. */
   readonly tenant?: string;
 }
 interface ScopeOptions {
   /**
    * The active tenant, e.g. from route params, instead of `NextOptions.tenant`
    * (whose request has the incoming headers but no URL here). It goes where the
-   * resolver's result goes, so it gets the same checks: the `tenant()` plugin
-   * and `current_tenant_id()` only honor a tenant the caller belongs to.
+   * resolver's result goes, so it gets the same checks:
+   * `membershipsExtension()` and `current_tenant_id()` only honor a tenant the
+   * caller belongs to.
    */
   readonly tenant?: string;
 }
@@ -199,7 +304,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * reads the incoming headers and is memoized per request and tenant.
    *
    * ```ts
-   * const { db } = await bs.context({ tenant: organizationId });
+   * const { db } = await bsb.context({ tenant: organizationId });
    * ```
    */
   context(options?: ScopeOptions): Promise<ServerContext<M, F, E, C, P, B>>;
@@ -210,6 +315,23 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * Components and pass the promise to `<SessionProvider>`.
    */
   session(): Promise<AuthSession<C, P>>;
+  /**
+   * The verified session of the incoming request, shared by every cache scope
+   * of the render: the first scope verifies the token and the others await that
+   * verification, so ten `'use cache: private'` islands verify once. It awaits
+   * `cookies()` before reading the clock, so it is safe in a private cache and
+   * outside one. `null` for anyone but a signed-in user. Pass the snapshot to
+   * `contextFromSession()` inside an island.
+   *
+   * ```tsx
+   * async function Island() {
+   *   "use cache: private";
+   *   const session = await bsb.getRequestSession();
+   *   const { db } = await bsb.contextFromSession(session);
+   * }
+   * ```
+   */
+  getRequestSession(): Promise<SessionSnapshot<C> | null>;
   /**
    * The context for a session and its token, without reading the request. The
    * token is verified again (memoized, no network call); a token for another
@@ -221,20 +343,20 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
   /**
    * First statement of an app-authored `'use cache: private'` function: sets
    * `cacheLife` from the session's expiry (`sessionStale`, capped by
-   * `life.stale`), tags the entry `bs:session:<user id>` plus `tags`, and
+   * `life.stale`), tags the entry `bsb:session:<user id>` plus `tags`, and
    * returns the caller's context plus `session`.
    *
    * ```ts
    * async function getCustomers() {
    *   "use cache: private";
-   *   const { db } = await bs.cached();
-   *   return db.customers.findMany().orThrow();
+   *   const { db } = await bsb.cached();
+   *   return db.customers.list().orThrow();
    * }
    * ```
    */
   cached(options?: CachedOptions<Extract<keyof M, string>>): Promise<CachedContext<M, F, E, C, P, B>>;
   /**
-   * Drops every `bs.cached()` entry of a user, e.g. after a role change, and
+   * Drops every `bsb.cached()` entry of a user, e.g. after a role change, and
    * the entries tagged with `tags` (such as a permission snapshot's tag). In a
    * Server Action it also re-renders the caller's page, so no `refresh()` is
    * needed. It reaches server caches and the caller's router only: another
@@ -248,7 +370,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * Counts on the server and returns a serializable seed for
    * `useLiveCount(seed)`, so the badge renders with a number and the client
    * only refetches on changes. Pass `db` inside `'use cache: private'` (from
-   * `bs.cached()`); otherwise it uses `bs.context()`. A failed count gives
+   * `bsb.cached()`); otherwise it uses `bsb.context()`. A failed count gives
    * `count: null` instead of throwing.
    */
   liveCount<T extends Extract<keyof M, string>>(spec: QuerySpec<T, "count", number>, db?: CountRunner): Promise<LiveCountSeed<T>>;
@@ -262,8 +384,8 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * Server action returning a serializable `ActionResult`.
    *
    * ```ts
-   * export const invite = bs.action(
-   *   { input: Invite, requireTenant: true, roles: ["admin"] },
+   * export const invite = bsb.action(
+   *   { input: Invite, requireOrganization: true, roles: ["admin"] },
    *   async (input, { db, tenant }) =>
    *     db.invitations.create({ ...input, organizationId: tenant }),
    * );
@@ -275,8 +397,8 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * guard, validation and authorize checks as `action`.
    *
    * ```ts
-   * export const issueInvoice = bs.blockAction(
-   *   ({ supabase }) => blocks(supabase).invoices,
+   * export const issueInvoice = bsb.blockAction(
+   *   ({ db }) => db.invoices,
    *   "issue",
    *   {
    *     input: v.object({ invoiceId: v.pipe(v.string(), v.uuid()) }),
@@ -288,30 +410,22 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   blockAction<Cl extends object, const K extends string, S extends StandardSchemaV1 | undefined = undefined, R extends boolean = false>(client: (ctx: ServerContext<M, F, E, C, P, B>) => Cl, method: K & BlockMethodName<Cl>, options: ActionOptions<S, C, P, R, Ref, NextResource<M, F, E, C, P, B>> & BlockActionArgs<S, BlockArgsOf<Cl, K & BlockMethodName<Cl>>, ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>): (input: ActionInput<S>) => Promise<ActionResult<BlockDataOf<Cl, K & BlockMethodName<Cl>>>>;
   /**
-   * A `blockAction` on one record's section: after the write succeeds it
-   * invalidates the section's and the record's cache tags in the caller's
-   * tenant (`invalidateSection`).
+   * One record type's server binding (`defineRecordType`, which `gen` writes to
+   * `records/<type>.ts`): `load` settles each block's binding for a record in a
+   * Server Component, `actions` holds one Server Action per binding write, and
+   * `tags` lists the record's cache tags. Each write drops the binding's and
+   * the record's tags in the caller's organization.
    *
    * ```ts
-   * export const addComment = bs.sectionAction(
-   *   ({ db }) => blockSet.client(db, "comments"),
-   *   "create",
-   *   {
-   *     input: v.object({ customerId: v.string(), body: v.string() }),
-   *     section: "comments",
-   *     subject: ({ customerId }) => ({
-   *       type: "customer",
-   *       id: customerId,
-   *     }),
-   *     args: ({ customerId, body }) => [
-   *       { type: "customer", id: customerId },
-   *       { body },
-   *     ],
-   *   },
-   * );
+   * const customer = bsb.record(customerRecord);
+   * const { bindings, can } = await customer.load(id, {
+   *   bindings: ["tags"],
+   * });
    * ```
    */
-  sectionAction<Cl extends object, const K extends string, S extends StandardSchemaV1 | undefined = undefined, R extends boolean = false>(client: (ctx: ServerContext<M, F, E, C, P, B>) => Cl, method: K & BlockMethodName<Cl>, options: ActionOptions<S, C, P, R, Ref, NextResource<M, F, E, C, P, B>> & BlockActionArgs<S, BlockArgsOf<Cl, K & BlockMethodName<Cl>>, ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>> & SectionActionTarget<S, ServerContext<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>): (input: ActionInput<S>) => Promise<ActionResult<BlockDataOf<Cl, K & BlockMethodName<Cl>>>>;
+  record<T extends string, RB extends RecordTypeBlocks, N extends BindingName<RB>>(type: RecordType<T, RB> & {
+    readonly bindings: readonly N[];
+  }): RecordServer<T, RB, N>;
   /**
    * For Server Components: the caller's context, or the Next.js interrupt for a
    * refused caller. `unauthorized` calls `unauthorized()`, `forbidden` calls
@@ -319,8 +433,8 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * and `not_found` calls `notFound()`.
    *
    * ```ts
-   * const { db, tenant } = await bs.require({
-   *   requireTenant: true,
+   * const { db, tenant } = await bsb.require({
+   *   requireOrganization: true,
    *   roles: ["admin"],
    * });
    * ```
@@ -333,7 +447,7 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    *
    * ```ts
    * // app/api/[...path]/route.ts
-   * export const { GET, POST, PATCH, PUT, DELETE } = bs.resources(
+   * export const { GET, POST, PATCH, PUT, DELETE } = bsb.resources(
    *   { customers: true },
    *   { basePath: "/api" },
    * );
@@ -347,8 +461,8 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
   cacheTag(table: Extract<keyof M, string>, id?: string | number, options?: TagOptions): void;
   /**
    * Tags the current `"use cache"` scope with every table the specs (or a read
-   * set) read, plus the row of each `findById`, so any mutation that changes
-   * one revalidates it.
+   * set) read, plus the row of each `get`, so any mutation that changes one
+   * revalidates it.
    */
   cacheTags(target: QuerySpec<Extract<keyof M, string>> | readonly QuerySpec<Extract<keyof M, string>>[] | ReadSet, options?: TagOptions): void;
   /**
@@ -369,6 +483,33 @@ interface BetterNext<M extends AnyModels, F extends AnyFunctions, E, C = unknown
   stopSupport(): Promise<ActionResult<{
     readonly ended: boolean;
   }>>;
+  /**
+   * Signs in with an email and a password from a server action. It writes the
+   * session cookies, stores the verified session for the next render and
+   * returns `redirectTo`: `credentials.next` when it is a same-origin path,
+   * else `options.fallback` (`/`). The client then calls
+   * `router.replace(redirectTo)` once.
+   */
+  signIn(credentials: SignInCredentials, options?: SignInOptions): Promise<ActionResult<SignedIn>>;
+}
+interface SignInCredentials {
+  readonly email: string;
+  readonly password: string;
+  /** The `?next=` value from the sign-in URL; checked before use. */
+  readonly next?: string | null;
+}
+interface SignInOptions {
+  /** Where to go when `next` is missing or not a same-origin path. */
+  readonly fallback?: string;
+}
+/** What `signIn` returns: plain data, safe across the action boundary. */
+interface SignedIn {
+  readonly redirectTo: string;
+  /**
+   * The user has a verified MFA factor: send them to the challenge (with
+   * `redirectTo` as its `next`) before `redirectTo`.
+   */
+  readonly mfa: boolean;
 }
 /** What `startSupport` returns: plain data, safe across the action boundary. */
 interface SupportStarted {
@@ -391,7 +532,7 @@ interface SessionStaleOptions {
 }
 interface CachedOptions<T extends string = string> extends ScopeOptions {
   /**
-   * The active tenant, as for `bs.context({ tenant })`. Next.js keys the
+   * The active tenant, as for `bsb.context({ tenant })`. Next.js keys the
    * private cache on your function's arguments, so take the tenant as an
    * argument and pass it through; never read it from anywhere else.
    */
@@ -413,11 +554,11 @@ interface CachedOptions<T extends string = string> extends ScopeOptions {
   readonly tags?: readonly string[];
   /**
    * Tables the entry reads, so the `updateTag` after a mutation drops it:
-   * `bs:<table>`, or with an active tenant `bs:<table>@<tenant>` and
-   * `bs:<table>@*`, so other tenants' writes leave it cached.
+   * `bsb:<table>`, or with an active tenant `bsb:<table>@<tenant>` and
+   * `bsb:<table>@*`, so other tenants' writes leave it cached.
    */
   readonly tables?: readonly T[];
-  /** With `tables`, also tags the row `bs:<first table>:<id>`. */
+  /** With `tables`, also tags the row `bsb:<first table>:<id>`. */
   readonly id?: string | number;
 }
 type CachedContext<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> = ServerContext<M, F, E, C, P, B> & {
@@ -463,7 +604,7 @@ type NextResource<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P
  * and cache tags, on top of `createServer`.
  *
  * ```ts
- * export const bs = createNext(betterSupabase);
+ * export const bsb = createNext(betterSupabase);
  * ```
  */
 export declare function createNext<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, A extends AnyAuthorizer | undefined = undefined, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, options?: NextOptions & {
@@ -471,7 +612,7 @@ export declare function createNext<M extends AnyModels, D, F extends AnyFunction
 }): BetterNext<M, F, E, C, P, PermissionRef<A>, B>;
 //#endregion
 //#region src/next/cache.d.ts
-/** The tag `bs.cached()` adds to entries rendered in a support session. */
+/** The tag `bsb.cached()` adds to entries rendered in a support session. */
 export declare function supportTag(sessionId: string): string;
 /**
  * `cacheLife` `stale` seconds for a view of `session`: `max`, but never past
@@ -481,122 +622,20 @@ export declare function supportTag(sessionId: string): string;
  * Shell.
  */
 export declare function sessionStale(session: AuthSession, options?: SessionStaleOptions, now?: number): number;
-/** The tag `bs.cached()` puts on a user's entries. */
+/** The tag `bsb.cached()` puts on a user's entries. */
 export declare function sessionTag(userId: string): string;
 /**
- * Invalidates `bs:<table>` for every table in the target, the tenant's
- * `bs:<table>@<tenant>` (every tenant's `bs:<table>@*` when the mutation has no
- * tenant) and `bs:<table>:<id>` for the changed rows. Reads another tenant
- * tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
+ * The tag `bsb.cached()` puts on the entries of one Auth session
+ * (`SessionSnapshot.sessionId`): invalidate it to drop one device's entries.
  */
-export declare function nextCache(options?: NextCacheOptions): CacheAdapter;
-//#endregion
-//#region src/next/feature.d.ts
+export declare function sessionIdTag(sessionId: string): string;
 /**
- * The context `recordServer` reads: the caller's `Db`, and its supabase-js
- * client, whose `storage` the attachments block deletes files with.
- */
-interface RecordServerContext {
-  readonly db: BlockClientSource;
-  readonly supabase?: {
-    readonly storage?: unknown;
-  };
-}
-/**
- * What `recordServer` needs of `bs` (`createNext`): its context and its
- * actions, typed loosely so any app's `bs` fits.
- */
-interface RecordServerHost {
-  context(): Promise<RecordServerContext>;
-  action<S extends StandardSchemaV1, T>(options: {
-    readonly input: S;
-    readonly requireTenant: true;
-  }, fn: (input: StandardSchemaV1.InferOutput<S>, ctx: RecordServerContext & {
-    readonly tenant: string;
-  }) => Promise<T>): (input: never) => Promise<ActionResult<unknown>>;
-}
-interface RecordLoadOptions<B extends FeatureBlocks, M extends SectionName<B>> {
-  /** The sections to load. Default: every section of the feature. */
-  readonly sections?: readonly M[];
-  /** Options for each section's `load`, such as `{ versions: { pageSize: 5 } }`. */
-  readonly options?: { readonly [K in M]?: SectionOptions<SectionNamed<B, K>>; };
-}
-/** What a generated loader resolves to, safe to pass to a Client Component. */
-interface RecordView<T extends string, B extends FeatureBlocks, N extends string, M extends N> {
-  readonly subject: SubjectRef<T>;
-  /** Each requested section settled: `ok`, `error` or `hidden`. */
-  readonly sections: PlainSections<B, M>;
-  /** What the caller may do on every section of the feature. */
-  readonly can: RecordCan<B, N>;
-  /**
-   * Set when the caller's permissions failed to load; every flag is then
-   * `false`.
-   */
-  readonly permissionsError?: DbError;
-}
-interface RecordTimelineOptions<N extends string> {
-  /** Default: every section of the feature with a `timeline`. */
-  readonly sections?: readonly N[];
-  /** The most entries to return, newest first. */
-  readonly limit?: number;
-}
-/** One Server Action per write of each section. */
-type RecordServerActions<B extends FeatureBlocks, N extends string> = { readonly [S in N]: { readonly [W in SectionWritesOf<B, S>]: (input: RecordWriteInput<FeatureWriteInput<B, S, W>>) => Promise<ActionResult<Plain<FeatureWriteOutput<B, S, W>>>>; }; };
-interface RecordServer<T extends string, B extends FeatureBlocks, N extends SectionName<B>> {
-  /**
-   * Loads one record's sections and the caller's flags. It reads the request,
-   * so call it outside `"use cache"`: a cached section error would stick.
-   */
-  load<const M extends N = N>(id: string, options?: RecordLoadOptions<B, M>): Promise<RecordView<T, B, N, M>>;
-  /**
-   * One record's history across its sections, newest first, with the sections
-   * the caller can't read skipped. Call it outside `"use cache"`, like `load`.
-   */
-  timeline(id: string, options?: RecordTimelineOptions<N>): Promise<Plain<Timeline>>;
-  /** The Server Actions; re-export them from a `"use server"` file. */
-  readonly actions: RecordServerActions<B, N>;
-  /** The record's cache tag and one per section, scoped to `tenant`. */
-  tags(id: string, tenant?: string | null): readonly string[];
-}
-/**
- * The server half of a generated feature for Next.js: a loader for Server
- * Components and one Server Action per section write. Each action builds the
- * block's client over the caller's `Db` (its tenant), runs the write, and drops
- * the section's and the record's cache tags (`invalidateSection`).
- *
- * ```ts
- * const customer = recordServer(bs, customerFeature);
- * const view = await customer.load(id, { sections: ["comments"] });
- * ```
- */
-export declare function recordServer<T extends string, B extends FeatureBlocks, N extends SectionName<B>>(bs: RecordServerHost, feature: RecordFeature<T, B> & {
-  readonly sections: readonly N[];
-}): RecordServer<T, B, N>;
-/** What `recordListServer(...).load` resolves to, safe for a Client Component. */
-type RecordListView<B extends FeatureBlocks, N extends string, Q, P extends {
-  readonly items: readonly unknown[];
-}, Cols> = Result<Plain<RecordListPage<Q, P, P["items"][number], RecordListCells<B, Cols>, RecordCan<B, N>>>>;
-interface RecordListServer<B extends FeatureBlocks, N extends string, Q, P extends {
-  readonly items: readonly unknown[];
-}, Cols> {
-  /**
-   * Parses the page's `searchParams` and loads the page with its section
-   * columns, over the caller's `Db`. Call it outside `"use cache"`.
-   */
-  load(input: ListSearchParams | undefined, options?: ListParseOptions): Promise<RecordListView<B, N, Q, P, Cols>>;
-}
-/**
- * The server half of a `defineRecordList` for Next.js: it builds the feature's
- * block clients and the caller's permissions, then runs `recordList.load`.
- *
- * ```ts
- * const customers = recordListServer(bs, customerRecordList);
- * const view = await customers.load(await searchParams);
- * ```
+ * Invalidates `bsb:<table>` for every table in the target, the tenant's
+ * `bsb:<table>@<tenant>` (every tenant's `bsb:<table>@*` when the mutation has
+ * no tenant) and `bsb:<table>:<id>` for the changed rows. Reads another tenant
+ * tagged stay cached. `createNext` attaches it unless `cacheTags: false`.
  */
-export declare function recordListServer<T extends string, B extends FeatureBlocks, N extends SectionName<B>, Q, P extends {
-  readonly items: readonly unknown[];
-}, Cols>(bs: Pick<RecordServerHost, "context">, recordList: RecordList<T, B, N, Q, P, Cols>): RecordListServer<B, N, Q, P, Cols>;
+export declare function nextCache(options?: NextCacheOptions): CacheAdapter;
 //#endregion
 //#region src/next/records.d.ts
 interface RecordTagOptions {
@@ -605,23 +644,23 @@ interface RecordTagOptions {
 }
 /**
  * The cache tag of a record's header and tab badges (`record_summary`):
- * `bs:record@<tenant>:<type>:<id>`, or `bs:record:<type>:<id>` without a
+ * `bsb:record@<tenant>:<type>:<id>`, or `bsb:record:<type>:<id>` without a
  * tenant.
  */
-export declare function recordTag(subject: SubjectRef, options?: RecordTagOptions): string;
-/** The cache tag of one section of a record, such as its comments. */
-export declare function sectionTag(subject: SubjectRef, section: string, options?: RecordTagOptions): string;
+export declare function recordTag(subject: RecordRef, options?: RecordTagOptions): string;
+/** The cache tag of one binding of a record, such as its comments. */
+export declare function bindingTag(subject: RecordRef, binding: string, options?: RecordTagOptions): string;
 /**
- * Drops the cached section and the record's header, whose counts change with
+ * Drops the cached binding and the record's header, whose counts change with
  * it: `updateTag` in a Server Action, else `revalidateTag`.
  */
-export declare function invalidateSection(subject: SubjectRef, section: string, options?: RecordTagOptions & {
+export declare function invalidateBinding(subject: RecordRef, binding: string, options?: RecordTagOptions & {
   readonly revalidate?: RevalidateProfile;
 }): void;
 //#endregion
 //#region src/next/support.d.ts
-/** Response header with the URL of the request's totals on `bs.debugRoute()`. */
-export declare const STATS_URL_HEADER = "x-bs-stats";
+/** Response header with the URL of the request's totals on `bsb.debugRoute()`. */
+export declare const STATS_URL_HEADER = "x-bsb-stats";
 export declare function shouldCheckSession(request: NextRequest, options?: EndedSessionOptions): boolean;
 /**
  * Page loads, client navigations and server actions; never prefetches or
@@ -635,7 +674,7 @@ export declare function shouldRefresh(request: Request): boolean;
  * it with your sign-in redirect.
  *
  * ```ts
- * bs.proxy(request, {
+ * bsb.proxy(request, {
  *   protect: requireAal("aal2", {
  *     redirect: "/mfa",
  *     match: (path) => path.startsWith("/settings"),
@@ -645,4 +684,4 @@ export declare function shouldRefresh(request: Request): boolean;
  */
 export declare function requireAal(level: Aal, options?: RequireAalOptions): (auth: AuthState, request: NextRequest) => Response | undefined;
 //#endregion
-export { type Aal, type ActionArgs, type ActionOptions, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthSession, type AuthorizeOptions, type AuthorizedContext, type BetterNext, type BlockActionArgs, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EndedSessionOptions, type GuardOptions, type Impersonator, type LiveCountSeed, type MembershipClaim, type NextCacheOptions, type NextDebugOptions, type NextOptions, type NextResourceHandler, type NextResourceRoutes, type NextResourcesOptions, type ProxyOptions, type RecordListServer, type RecordListView, type RecordLoadOptions, type RecordServer, type RecordServerActions, type RecordServerContext, type RecordServerHost, type RecordTagOptions, type RecordTimelineOptions, type RecordView, type RequireAalOptions, type RequireOptions, type ResourceAction, type ResourceContext, type ResourceHooks, type ResourceLoaderContext, type ResourceMap, type ResourceRouteOptions, type RouteOptions, type ScopeOptions, type SessionStaleOptions, type SupportOptions, type SupportPolicy, type SupportSessions, type SupportStartRequest, type SupportStarted, type SupportView, type TagOptions, defineAction, supportOf, supportSessions, tagFor, tenantOf, toSession };
+export { type Aal, type ActionArgs, type ActionOptions, type ActionResult, type ActiveSupport, type AmrEntry, type AuthKind, type AuthSession, type AuthorizeOptions, type AuthorizedContext, type BetterNext, type BlockActionArgs, type CachedContext, type CachedOptions, type DbBudget, type DbStats, type EndedSessionOptions, type GuardOptions, type Impersonator, type LiveCountSeed, type MembershipClaim, type NextCacheOptions, type NextDebugOptions, type NextOptions, type NextResourceHandler, type NextResourceRoutes, type NextResourcesOptions, type ProxyOptions, type RecordListServer, type RecordListView, type RecordLoadOptions, type RecordServer, type RecordServerActions, type RecordServerContext, type RecordTagOptions, type RecordTimelineOptions, type RecordView, type RequireAalOptions, type RequireOptions, type ResourceAction, type ResourceContext, type ResourceHooks, type ResourceLoaderContext, type ResourceMap, type ResourceRouteOptions, type RouteOptions, type ScopeOptions, type SessionSnapshot, type SessionStaleOptions, type SignInCredentials, type SignInOptions, type SignedIn, type SupportOptions, type SupportPolicy, type SupportSessions, type SupportStartRequest, type SupportStarted, type SupportView, type TagOptions, authzVersionOf, defineAction, isSessionSnapshot, issuedAtOf, safeRedirectPath, sessionCacheKey, supportOf, supportSessions, tagFor, tenantOf, toSession };