better-supabase 0.14.0 → 0.15.1

package/dist/scores-B2BiNuVJ.d.ts

@@ -0,0 +1,174 @@
+/// <reference lib="esnext.temporal" />
+import { T as ErrorMapper, t as AsyncResult } from "./result-DZeA5KS6.js";
+import { $ as RecordRef } from "./types-DFdg_4yN.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { a as BlockTenantOptions, r as BlockTemporalOptions } from "./block-helpers-CRpAHrp_.js";
+import { t as BlockTransport } from "./block-transport-DWZSJrwN.js";
+import { n as BlockHooks } from "./block-hooks-DZN2w69m.js";
+import { h as FilterQuery } from "./filter-query-BXLs72G9.js";
+//#region src/blocks/scores/scores.d.ts
+interface ScoresOptions extends BlockTemporalOptions, BlockTenantOptions {
+  readonly transport: BlockTransport;
+  /**
+   * The module schema, or its API schema: `defineBlocks` passes it from
+   * `blocks.generated.ts`.
+   */
+  readonly schema?: string;
+  /** `withBlockHooks` hooks around the client's methods. */
+  readonly hooks?: NoInfer<BlockHooks<Scores>>;
+  /** Receives the errors `after` hooks throw. Default: `console`. */
+  readonly logger?: Logger;
+  readonly mappers?: readonly ErrorMapper[];
+}
+/** Points a subject earns when its fields match a filter tree. */
+interface ScoreRule {
+  readonly id: string;
+  readonly label?: string;
+  /** A filter tree over the rules field catalog of the model's subject type. */
+  readonly conditions: FilterQuery;
+  /** Negative to subtract. */
+  readonly points: number;
+}
+/**
+ * A number times a weight: a number field of the subject (`field`) or the
+ * record's vote score from the `reactions` block (`votes`).
+ */
+interface ScoreMetric {
+  readonly id: string;
+  readonly label?: string;
+  readonly source: "field" | "votes";
+  /** The rules field id, for `source: "field"`. */
+  readonly field?: string;
+  /** Default 1. */
+  readonly weight?: number;
+  /** The most points the metric adds or subtracts. */
+  readonly cap?: number;
+}
+/** A named range: the first band whose `min` the score reaches. */
+interface ScoreBand {
+  readonly label: string;
+  readonly min: number;
+}
+/** A scoring configuration, such as lead scoring or account health. */
+interface ScoreModel {
+  readonly id: string;
+  readonly organizationId: string;
+  readonly key: string;
+  readonly name: string;
+  readonly description?: string;
+  readonly subjectType: string;
+  readonly rules: readonly ScoreRule[];
+  readonly metrics: readonly ScoreMetric[];
+  /** Highest `min` first. */
+  readonly bands: readonly ScoreBand[];
+  readonly enabled: boolean;
+  /** Goes up when rules, metrics or bands change. */
+  readonly version: number;
+  readonly createdBy?: string;
+  readonly createdAt: Temporal.Instant;
+  readonly updatedAt: Temporal.Instant;
+}
+interface ScoreModelVersion {
+  readonly version: number;
+  readonly rules: readonly ScoreRule[];
+  readonly metrics: readonly ScoreMetric[];
+  readonly bands: readonly ScoreBand[];
+  readonly savedBy?: string;
+  readonly savedAt: Temporal.Instant;
+}
+interface ScoreModelDetail extends ScoreModel {
+  /** Newest first. */
+  readonly versions: readonly ScoreModelVersion[];
+}
+/**
+ * A new model (`key`, `name` and `subjectType`), or with `id`, the keys to
+ * change. `version`, when given, must be the stored one.
+ */
+interface ScoreModelInput {
+  readonly id?: string;
+  readonly version?: number;
+  readonly key?: string;
+  readonly name?: string;
+  readonly description?: string | null;
+  readonly subjectType?: string;
+  readonly rules?: readonly ScoreRule[];
+  readonly metrics?: readonly ScoreMetric[];
+  readonly bands?: readonly ScoreBand[];
+  readonly enabled?: boolean;
+}
+/** How a score adds up. */
+interface ScoreBreakdown {
+  readonly rules: readonly {
+    readonly id: string;
+    readonly label?: string;
+    readonly matched: boolean;
+    readonly points: number;
+  }[];
+  readonly metrics: readonly {
+    readonly id: string;
+    readonly label?: string;
+    /** `null` when the field was empty. */
+    readonly value: number | null;
+    readonly points: number;
+  }[];
+}
+/** A subject's score under one model, at one model version. */
+interface Score {
+  readonly id: string;
+  readonly organizationId: string;
+  readonly modelId: string;
+  readonly modelKey: string;
+  /** Set on the scores `list` returns. */
+  readonly modelName?: string;
+  readonly modelVersion: number;
+  readonly subject: RecordRef;
+  readonly score: number;
+  readonly band?: string;
+  readonly breakdown: ScoreBreakdown;
+  /** Whether this is the subject's latest score under the model. */
+  readonly current: boolean;
+  readonly computedAt: Temporal.Instant;
+}
+interface ComputedScore extends Score {
+  /** Whether this computation saved a new score. */
+  readonly changed: boolean;
+}
+/** The `scores` SQL module as typed calls. */
+interface Scores {
+  /** Needs `scores.manage`. Saves a version when rules, metrics or bands change. */
+  saveModel(input: ScoreModelInput): AsyncResult<ScoreModel>;
+  /** The block tenant's models, by key. */
+  models(options?: {
+    readonly subjectType?: string;
+  }): AsyncResult<readonly ScoreModel[]>;
+  /** One model with its versions; `not_found` when the caller can't read it. */
+  model(modelId: string): AsyncResult<ScoreModelDetail>;
+  /** Needs `scores.manage`. False when there was no such model. */
+  deleteModel(modelId: string): AsyncResult<boolean>;
+  /**
+   * Scores a record with the model `modelKey`. `fields` are the record's values
+   * the way the rules block reads them (the same object `run` takes). Needs
+   * `scores.compute` or the service role.
+   */
+  compute(modelKey: string, subject: RecordRef, fields: Readonly<Record<string, unknown>>, options?: {
+    readonly timeZone?: string;
+  }): AsyncResult<ComputedScore>;
+  /** The current scores of the record `on` names, one per model. */
+  list(params: {
+    readonly on: RecordRef;
+  }): AsyncResult<readonly Score[]>;
+  /** A record's scores under one model, newest first. */
+  history(modelKey: string, subject: RecordRef, options?: {
+    readonly pageSize?: number;
+  }): AsyncResult<readonly Score[]>;
+  /** The highest current scores under one model. */
+  top(modelKey: string, options?: {
+    readonly band?: string;
+    readonly minScore?: number;
+    readonly pageSize?: number;
+  }): AsyncResult<readonly Score[]>;
+}
+/** The `scores` SQL module as typed calls. */
+declare function createScores(options: ScoresOptions): Scores;
+//#endregion
+export { ScoreMetric as a, ScoreModelInput as c, Scores as d, ScoresOptions as f, ScoreBreakdown as i, ScoreModelVersion as l, Score as n, ScoreModel as o, createScores as p, ScoreBand as r, ScoreModelDetail as s, ComputedScore as t, ScoreRule as u };

package/dist/scores-CRp3vvQU.js

@@ -0,0 +1,177 @@
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { t as AsyncResult } from "./result-ntFBW2p2.js";
+import { A as requiredInstant, C as optionalText, D as recordOf, I as textOf, _ as notFoundError, k as recordsOf, n as applyTemporal, o as blockCall } from "./block-helpers-CtBdjgO4.js";
+import { r as withBlockHooks } from "./block-hooks-BfxX3682.js";
+import { t as requireOrganization } from "./block-tenant-DHp7subc.js";
+//#region src/blocks/scores/scores.ts
+function optional(key, value) {
+	return value === void 0 ? {} : { [key]: value };
+}
+const numberOf = (value) => Number(value ?? 0);
+const optionalNumber = (value) => typeof value === "number" ? value : void 0;
+function isGroup(value) {
+	return isRecord(value) && value["type"] === "group" && typeof value["id"] === "string" && (value["combinator"] === "and" || value["combinator"] === "or") && Array.isArray(value["rules"]);
+}
+function conditionsOf(value) {
+	if (!isGroup(value)) throw new TypeError(`a score rule's conditions are ${JSON.stringify(value)}`);
+	return value;
+}
+function rulesOf(value, fn) {
+	return recordsOf(value ?? [], fn).map((rule) => ({
+		id: textOf(rule["id"]),
+		conditions: conditionsOf(rule["conditions"]),
+		points: numberOf(rule["points"]),
+		...optional("label", optionalText(rule["label"]))
+	}));
+}
+function metricsOf(value, fn) {
+	return recordsOf(value ?? [], fn).map((metric) => ({
+		id: textOf(metric["id"]),
+		source: metric["source"] === "votes" ? "votes" : "field",
+		...optional("label", optionalText(metric["label"])),
+		...optional("field", optionalText(metric["field"])),
+		...optional("weight", optionalNumber(metric["weight"])),
+		...optional("cap", optionalNumber(metric["cap"]))
+	}));
+}
+function bandsOf(value, fn) {
+	return recordsOf(value ?? [], fn).map((band) => ({
+		label: textOf(band["label"]),
+		min: numberOf(band["min"])
+	}));
+}
+function modelOf(value, fn) {
+	const row = recordOf(value, fn);
+	return {
+		id: textOf(row["id"]),
+		organizationId: textOf(row["organizationId"]),
+		key: textOf(row["key"]),
+		name: textOf(row["name"]),
+		subjectType: textOf(row["subjectType"]),
+		rules: rulesOf(row["rules"], fn),
+		metrics: metricsOf(row["metrics"], fn),
+		bands: bandsOf(row["bands"], fn),
+		enabled: row["enabled"] !== false,
+		version: numberOf(row["version"]),
+		createdAt: requiredInstant(row["createdAt"], "createdAt"),
+		updatedAt: requiredInstant(row["updatedAt"], "updatedAt"),
+		...optional("description", optionalText(row["description"])),
+		...optional("createdBy", optionalText(row["createdBy"]))
+	};
+}
+function breakdownOf(value, fn) {
+	const row = isRecord(value) ? value : {};
+	return {
+		rules: recordsOf(row["rules"] ?? [], fn).map((rule) => ({
+			id: textOf(rule["id"]),
+			matched: rule["matched"] === true,
+			points: numberOf(rule["points"]),
+			...optional("label", optionalText(rule["label"]))
+		})),
+		metrics: recordsOf(row["metrics"] ?? [], fn).map((metric) => ({
+			id: textOf(metric["id"]),
+			value: optionalNumber(metric["value"]) ?? null,
+			points: numberOf(metric["points"]),
+			...optional("label", optionalText(metric["label"]))
+		}))
+	};
+}
+function scoreOf(value, fn) {
+	const row = recordOf(value, fn);
+	return {
+		id: textOf(row["id"]),
+		organizationId: textOf(row["organizationId"]),
+		modelId: textOf(row["modelId"]),
+		modelKey: textOf(row["modelKey"]),
+		modelVersion: numberOf(row["modelVersion"]),
+		subject: {
+			type: textOf(row["subjectType"]),
+			id: textOf(row["subjectId"])
+		},
+		score: numberOf(row["score"]),
+		breakdown: breakdownOf(row["breakdown"], fn),
+		current: row["current"] === true,
+		computedAt: requiredInstant(row["computedAt"], "computedAt"),
+		...optional("modelName", optionalText(row["modelName"])),
+		...optional("band", optionalText(row["band"]))
+	};
+}
+/** What `compute_score` returns, parsed; lead scoring shares it. */
+function computedScoreOf(value, fn) {
+	return {
+		...scoreOf(value, fn),
+		changed: recordOf(value, fn)["changed"] === true
+	};
+}
+const scoresOf = (value, fn) => recordsOf(value, fn).map((row) => scoreOf(row, fn));
+/** The input keys the SQL function reads; undefined keys stay out. */
+function modelArg(input) {
+	const out = {};
+	const entries = Object.entries(input);
+	for (const [key, value] of entries) if (value !== void 0) out[key] = value;
+	return out;
+}
+/** The `scores` SQL module as typed calls. */
+function createScores(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const tenant = () => requireOrganization(options.tenant);
+	return withBlockHooks({
+		saveModel: (input) => tenant().andThen((organizationId) => call("save_score_model", {
+			tenant: organizationId,
+			model: modelArg(input)
+		}, (value) => modelOf(value, "save_score_model"))),
+		models: (filter = {}) => tenant().andThen((organizationId) => call("list_score_models", {
+			tenant: organizationId,
+			subject_type: filter.subjectType ?? null
+		}, (value) => recordsOf(value, "list_score_models").map((row) => modelOf(row, "list_score_models")))),
+		model: (modelId) => call("get_score_model", { model_id: modelId }, (value) => value).andThen((value) => {
+			if (!isRecord(value)) return AsyncResult.err(notFoundError("No score model you can see has this id", "SCORES_MODEL_NOT_FOUND"));
+			const fn = "get_score_model";
+			return AsyncResult.ok({
+				...modelOf(value, fn),
+				versions: recordsOf(value["versions"] ?? [], fn).map((row) => ({
+					version: numberOf(row["version"]),
+					rules: rulesOf(row["rules"], fn),
+					metrics: metricsOf(row["metrics"], fn),
+					bands: bandsOf(row["bands"], fn),
+					savedAt: requiredInstant(row["savedAt"], "savedAt"),
+					...optional("savedBy", optionalText(row["savedBy"]))
+				}))
+			});
+		}),
+		deleteModel: (modelId) => call("delete_score_model", { model_id: modelId }, (value) => value === true),
+		compute: (modelKey, subject, fields, compute = {}) => tenant().andThen((organizationId) => call("compute_score", {
+			tenant: organizationId,
+			model_key: modelKey,
+			subject_type: subject.type,
+			subject_id: subject.id,
+			subject: fields,
+			time_zone: compute.timeZone ?? "UTC"
+		}, (value) => computedScoreOf(value, "compute_score"))),
+		list: ({ on }) => tenant().andThen((organizationId) => call("subject_scores", {
+			tenant: organizationId,
+			subject_type: on.type,
+			subject_id: on.id
+		}, (value) => scoresOf(value, "subject_scores"))),
+		history: (modelKey, subject, filter = {}) => tenant().andThen((organizationId) => call("score_history", {
+			tenant: organizationId,
+			model_key: modelKey,
+			subject_type: subject.type,
+			subject_id: subject.id,
+			page_size: filter.pageSize ?? null
+		}, (value) => scoresOf(value, "score_history"))),
+		top: (modelKey, filter = {}) => tenant().andThen((organizationId) => call("top_scores", {
+			tenant: organizationId,
+			model_key: modelKey,
+			band: filter.band ?? null,
+			min_score: filter.minScore ?? null,
+			page_size: filter.pageSize ?? null
+		}, (value) => scoresOf(value, "top_scores")))
+	}, options.hooks, {
+		block: "scores",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+//#endregion
+export { createScores as n, computedScoreOf as t };

package/dist/server/index.d.ts

@@ -1,31 +1,33 @@
-import { b as DbError, f as Result } from "../result-C6jDfedy.js";
-import { M as AnyFunctions, N as AnyModels, mt as TableKey } from "../executor-CPyrQdjh.js";
-import { Ct as Events, lt as SupportEventData } from "../events-DbLjvxDX.js";
-import { m as RequestContext } from "../plugin-Ar5546xh.js";
-import { E as writeSession, S as readSession, a as ResolveAuthOptions, c as resolveAuth, d as CookieRecord, g as StoredSession, i as InvalidReason, l as AUTH_CACHE_HEADERS, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as clientIp, t as AuthResolution, u as CookieOptions, w as sessionCookieName } from "../resolve-CzUKTIMq.js";
-import { n as SqlClient } from "../executor-CsTaO3AT.js";
+import { b as DbError, f as Result } from "../result-DZeA5KS6.js";
+import { Ft as RequestContext, O as AnyFunctions, k as AnyModels, ut as TableKey } from "../types-DFdg_4yN.js";
+import { Ct as Events, lt as SupportEventData } from "../events-vcqenSYU.js";
+import { C as readSession, D as writeSession, T as sessionCookieName, _ as StoredSession, a as ResolveAuthOptions, c as clientIp, d as CookieOptions, f as CookieRecord, i as InvalidReason, l as resolveAuth, m as CookieWrite, n as AuthResolver, r as AuthState, s as ResolvedState, t as AuthResolution, u as AUTH_CACHE_HEADERS } from "../resolve-CXX6DHv3.js";
+import { n as SqlClient } from "../executor-hGjrop3A.js";
 import { a as SessionActor, c as agentClaims, i as IDENTITY_SCOPES, l as delegationOf, n as ActorOutcome, o as SessionDelegation, r as AgentActOptions, s as actorOf, t as ActClaim } from "../actor-CoveJgya.js";
-import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DpHB7tWl.js";
-import { a as AuthorizationSubject, c as defineAuthorizer, i as AuthorizationResource, n as AuthorizationOutcome, o as Authorizer, r as AuthorizationRequest, s as PermissionRef, t as AnyAuthorizer } from "../authorizer-DFP3gHv8.js";
-import { i as ResourcePagination } from "../resource-DYDEnww-.js";
-import { Lt as DbStats, o as Db, t as BetterSupabase } from "../define-Dw7pRO4h.js";
-import { k as StorageApi } from "../bucket-TkB7_xv8.js";
+import { n as PERMISSION_CAP_CLAIM } from "../delegation-C7eWP2r8.js";
+import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-DNwN8iGz.js";
+import { a as AuthorizationSubject, c as AuthzVersionCache, d as bindAuthorizer, f as defineAuthorizer, i as AuthorizationResource, l as PermissionRef, n as AuthorizationOutcome, o as Authorizer, p as requestMemo, r as AuthorizationRequest, s as AuthorizerRuntime, t as AnyAuthorizer, u as RequestMemo } from "../authorizer-B6X09otb.js";
+import { J as DbStats, t as BetterSupabase, v as Db } from "../define-DFBnQyYg.js";
+import { k as StorageApi } from "../bucket-CiNi8sIw.js";
+import { $ as SessionMemoStats, A as supportCookieValue, B as SupportSessionStore, C as SupportSessions, D as SupportCookieOptions, E as SUPPORT_COOKIE, F as SupportEndedBy, G as PRIMARY_COOKIE, H as sqlSupportStore, I as SupportListFilter, J as DeleteAccountOptions, K as ReplicaState, L as SupportRequest, M as SupportApprovalQuery, N as SupportApprover, O as clearSupportCookie, P as SupportCallerClaims, Q as SessionMemoOptions, R as SupportRequestInput, S as SupportPolicy, T as supportSessions, U as supportClaims, V as SupportStartInput, W as RequestIdOptions, X as deleteAccount, Y as DeleteAccountResult, Z as SessionMemo, _ as suspendAccount, a as ServerContext, at as sessionMemo, b as SupportExpireRouteOptions, c as ServerOptions, d as EndSessionsResult, et as SessionSnapshot, f as LastSignIn, g as lastSignIns, h as endSessions, i as ForContextOptions, it as sessionCacheKey, j as SqlSupportStoreOptions, k as supportCookie, m as SuspendAccountResult, n as BetterServer, nt as isSessionSnapshot, o as ServerDbOptions, ot as snapshotOf, p as SuspendAccountOptions, q as LiteDriver, r as ContextOptions, rt as issuedAtOf, s as ServerKeys, t as AdminDb, tt as authzVersionOf, u as TENANT_HEADER, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions, y as SupportApi, z as SupportSession } from "../server-types-7QPzW2bF.js";
 import { n as Impersonator, r as impersonatorOf, t as ImpersonationOptions } from "../impersonation-YTa9dZUv.js";
-import { a as checkAal, i as amrOf, n as AmrEntry, r as aalOf, t as Aal } from "../mfa-wrx1rqJT.js";
-import { _ as SupportAuthorize, a as AutomationHooks, b as TicketSubject, c as ChatActionHook, d as IdentityRef, f as IdentityTarget, g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, l as DelegationPermissions, m as Subscriber, n as Approver, o as AutomationRef, p as PrincipalByIdentity, r as ApproverOf, s as ChatAction, t as ApprovalRequestRef, u as DelegationRef, v as SupportAuthorizeInput, x as defineAuthorizationHooks, y as SupportDecision } from "../authorization-hooks-dLmUO_PZ.js";
-import { n as toSession, t as AuthSession } from "../view-2_I-2ukO.js";
-import { A as supportCookieValue, B as SupportSessionStore, C as SupportSessions, D as SupportCookieOptions, E as SUPPORT_COOKIE, F as SupportEndedBy, G as PRIMARY_COOKIE, H as sqlSupportStore, I as SupportListFilter, J as DeleteAccountOptions, K as ReplicaState, L as SupportRequest, M as SupportApprovalQuery, N as SupportApprover, O as clearSupportCookie, P as SupportCallerClaims, R as SupportRequestInput, S as SupportPolicy, T as supportSessions, U as supportClaims, V as SupportStartInput, W as RequestIdOptions, X as deleteAccount, Y as DeleteAccountResult, _ as suspendAccount, a as ServerContext, b as SupportExpireRouteOptions, c as ServerOptions, d as EndSessionsResult, f as LastSignIn, g as lastSignIns, h as endSessions, i as ForContextOptions, j as SqlSupportStoreOptions, k as supportCookie, m as SuspendAccountResult, n as BetterServer, o as ServerDbOptions, p as SuspendAccountOptions, q as LiteDriver, r as ContextOptions, s as ServerKeys, t as AdminDb, u as TENANT_HEADER, v as ActiveSupport, w as SupportStartRequest, x as SupportOptions, y as SupportApi, z as SupportSession } from "../server-types-BOs-eFpo.js";
-import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-BgsOPGZs.js";
-import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-CZYibxUx.js";
-import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-KllwFim2.js";
-import { a as AuthorizedContext, c as ResourceLoaderContext, d as rolesAt, i as AuthorizeOptions, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as hasRole } from "../kit-DKfbNTAA.js";
-import { n as subjectReaders, t as SubjectReadersOptions } from "../subject-readers-DEZ45DQF.js";
+import { a as checkAal, i as amrOf, n as AmrEntry, r as aalOf, t as Aal } from "../mfa-oIOYTpvc.js";
+import { _ as SupportAuthorize, a as AutomationHooks, b as TicketSubject, c as ChatActionHook, d as IdentityRef, f as IdentityTarget, g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, l as DelegationPermissions, m as Subscriber, n as Approver, o as AutomationRef, p as PrincipalByIdentity, r as ApproverOf, s as ChatAction, t as ApprovalRequestRef, u as DelegationRef, v as SupportAuthorizeInput, x as defineAuthorizationHooks, y as SupportDecision } from "../authorization-hooks-D_pwXlBs.js";
+import { n as toSession, t as AuthSession } from "../view-DyFdMCqg.js";
+import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-CfBCJGgc.js";
+import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-Dn1_YhC1.js";
+import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-BZYXlVBN.js";
+import { a as AuthorizedContext, c as ResourceLoaderContext, d as rolesAt, i as AuthorizeOptions, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as hasRole } from "../kit-DOwKpSkA.js";
+import { n as subjectReaders, t as SubjectReadersOptions } from "../subject-readers-8GySC9Z8.js";
 import { i as toCsv, n as csvColumns, t as CsvOptions } from "../csv-DhHQS2x_.js";
 import { i as JwsAlgorithm, n as Jwks, r as JwksOfOptions } from "../jws-D0toeQlA.js";
-import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-Bzt_bpR5.js";
-import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-CLXi2c6O.js";
-import { n as supportOf, t as SupportView } from "../support-view-vwJbRMpV.js";
-import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended--Bd_Q6uL.js";
+import { i as ResourcePagination } from "../resource-D8pzB5Qf.js";
+import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-DnKiH4G2.js";
+import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-BjHflcHF.js";
+import { n as RefreshOutcome, r as refreshSession } from "../refresh-DT_ICaK-.js";
+import { n as passwordGrant, r as safeRedirectPath, t as PasswordGrantOptions } from "../sign-in-BAjR49fq.js";
+import { n as supportOf, t as SupportView } from "../support-view-BYOgwXsJ.js";
+import { a as sessionStatus, i as clearSessionCookies, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-gUsMZVNg.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware, SingleKeyEntry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
@@ -112,7 +114,7 @@ export declare function unexpectedResponse(cause: unknown, options: {
  * ```ts
  * export default {
  *   fetch: (request, env, ctx) =>
- *     handle(server, request, (c) => c.db.notes.findMany(), {
+ *     handle(server, request, (c) => c.db.notes.list(), {
  *       waitUntil: (p) => ctx.waitUntil(p),
  *     }),
  * };
@@ -125,18 +127,15 @@ export declare function handle<M extends AnyModels, F extends AnyFunctions, E, C
  */
 export declare function resolveToken<C, P>(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown, C, P>, "resolve">, token: string | null | undefined): Promise<AuthState<C, P>>;
 //#endregion
-//#region src/blocks/support-sessions/events.d.ts
-/** The events of the `support-sessions` block: type to data. */
-type SupportSessionsEvents = {
+//#region src/blocks/impersonation/events.d.ts
+/** The events of the `impersonation` block: type to data. */
+type ImpersonationEvents = {
   readonly "support.started": SupportEventData;
   readonly "support.ended": SupportEventData;
   readonly "support.denied": SupportEventData;
 };
-/**
- * The `support-sessions` block's event types, for its manifest and
- * `onBlockEvent`.
- */
-export declare const supportSessionsEvents: Events<SupportSessionsEvents>;
+/** The `impersonation` block's event types, for its manifest and `onBlockEvent`. */
+export declare const impersonationEvents: Events<ImpersonationEvents>;
 //#endregion
 //#region src/server/support-storage.d.ts
 interface SupportStorageOptions {
@@ -236,10 +235,10 @@ export declare function withBetterPostgres<M extends AnyModels, D, F extends Any
  * ```ts
  * pipeline(
  *   [
- *     withBetterSupabase(bs),
+ *     withBetterSupabase(bsb),
  *     withPostgresAdminClient(),
  *     withBlock("jobs", (ctx) =>
- *       createJobs({ sql: ctx.postgresAdmin, queues }),
+ *       createQueue({ sql: ctx.postgresAdmin, queues }),
  *     ),
  *   ],
  *   (req, ctx) => ctx.jobs.drainRoute({ secret, handlers })(req),
@@ -390,6 +389,69 @@ export declare function rateLimitHeader(states: readonly RateLimitState[]): stri
  */
 export declare function periodSeconds(period: number | string): number | undefined;
 //#endregion
+//#region src/server/authz-versions.d.ts
+/** The broadcast message shape Realtime delivers for `realtime.send()`. */
+interface BroadcastMessage {
+  readonly payload?: unknown;
+}
+/** The part of a supabase-js `RealtimeChannel` the subscriber uses. */
+interface AuthzVersionChannel {
+  on(type: "broadcast", filter: {
+    readonly event: string;
+  }, callback: (message: BroadcastMessage) => void): AuthzVersionChannel;
+  subscribe(callback?: (status: string, error?: Error) => void): AuthzVersionChannel;
+  unsubscribe(): Promise<unknown>;
+}
+/** The part of a supabase-js client the subscriber uses. */
+interface AuthzVersionClient {
+  channel(topic: string, options: {
+    readonly config: {
+      readonly private: boolean;
+    };
+  }): AuthzVersionChannel;
+}
+interface SubscribeAuthzVersionsOptions {
+  /**
+   * A service-role client. It reads the private channel without a
+   * `realtime.messages` policy, so no user can listen.
+   */
+  readonly client: AuthzVersionClient;
+  /** The private channel the database trigger sends on. */
+  readonly topic: string;
+  /** The broadcast event name the trigger uses. */
+  readonly event: string;
+  /** The payload key holding the user id whose authorization changed. */
+  readonly userIdKey: string;
+  /** The app's module-scope cache; each message evicts one user. */
+  readonly versions: AuthzVersionCache;
+  /** Called for a malformed message, a failed eviction or a channel error. */
+  readonly onError?: (error: Error) => void;
+}
+interface AuthzVersionSubscription {
+  /** Settles once the channel is subscribed; rejects when it can't join. */
+  readonly ready: Promise<void>;
+  /** Leaves the channel. A later `subscribeAuthzVersions` joins again. */
+  close(): Promise<void>;
+}
+/**
+ * Evicts a user from `versions` whenever the database broadcasts that their
+ * authorization changed, so the next check reads the new version. Call it once
+ * from the module that creates `versions`; a second call with the same cache
+ * returns the first subscription.
+ *
+ * ```ts
+ * export const versions = createVersionCache();
+ * subscribeAuthzVersions({
+ *   client: serviceClient,
+ *   topic: "authz-versions",
+ *   event: "changed",
+ *   userIdKey: "user_id",
+ *   versions,
+ * });
+ * ```
+ */
+export declare function subscribeAuthzVersions(options: SubscribeAuthzVersionsOptions): AuthzVersionSubscription;
+//#endregion
 //#region src/server/resource.d.ts
 /**
  * Operations over one table, matching the paths and responses of the API model:
@@ -404,7 +466,7 @@ export declare function defineResource<M extends AnyModels, D, F extends AnyFunc
 //#endregion
 //#region src/server/entries/timing.d.ts
 /** The header `withDbStats` sets: `calls;waves;ms`, what `expectDbBudget` reads. */
-export declare const DB_CALLS_HEADER = "x-bs-db-calls";
+export declare const DB_CALLS_HEADER = "x-bsb-db-calls";
 /**
  * Parses the stats header back into numbers, or `undefined` when it is
  * malformed.
@@ -419,23 +481,23 @@ interface ServerTiming {
 }
 /**
  * Entry contributing `ctx.timing`, and adding `Server-Timing` to the response:
- * `bs;dur=<ms>` for everything after it, plus the metrics handlers add with
+ * `bsb;dur=<ms>` for everything after it, plus the metrics handlers add with
  * `ctx.timing.add()` or `measure()`. Put it first, so it times the whole
  * request. Browsers show it in the network panel.
  */
 export declare function withServerTiming(now?: () => number): SingleKeyEntry<"timing", Record<never, never>, ServerTiming>;
 /**
  * Entry adding the request's database totals to the response, after the handler
- * ran: `x-bs-db-calls: calls;waves;ms`, which `expectDbBudget(response)` reads,
- * and a `bs-db` `Server-Timing` metric. Put it after `withBetterSupabase`,
- * which contributes `ctx.bs`.
+ * ran: `x-bsb-db-calls: calls;waves;ms`, which `expectDbBudget(response)`
+ * reads, and a `bsb-db` `Server-Timing` metric. Put it after
+ * `withBetterSupabase`, which contributes `ctx.bsb`.
  */
 export declare function withDbStats(options?: {
   readonly header?: string;
 }): SingleKeyEntry<"dbStats", {
-  readonly bs: {
+  readonly bsb: {
     stats(): DbStats;
   };
 }, () => DbStats>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AccessTokenResolverOptions, type AccessTokenRevocation, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type ActorOutcome, type AdminDb, type AgentActOptions, type AmrEntry, type AnyAuthorizer, type ApprovalRequestRef, type Approver, type ApproverOf, type AuthKind, type AuthOutageHook, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationHooks, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type AutomationHooks, type AutomationRef, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ChatAction, type ChatActionHook, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DelegationPermissions, type DelegationRef, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, IDENTITY_SCOPES, type IdentityRef, type IdentityTarget, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PermissionRef, type PrincipalByIdentity, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RateLimitPolicy, type RateLimitState, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourceLoaderContext, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SubjectReadersOptions, type Subscriber, type SubscriberEvent, type SubscriberPolicy, type SupabaseAuthContext, type SupportApi, type SupportApprovalQuery, type SupportApprover, type SupportAuthorize, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportDecision, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportRequest, type SupportRequestInput, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportSessionsEvents, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, type TicketSubject, aalOf, actorOf, agentClaims, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, csvColumns, defineAuthorizationHooks, defineAuthorizer, delegationOf, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, subjectReaders, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, type Aal, type AccessTokenResolverOptions, type AccessTokenRevocation, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type ActorOutcome, type AdminDb, type AgentActOptions, type AmrEntry, type AnyAuthorizer, type ApprovalRequestRef, type Approver, type ApproverOf, type AuthKind, type AuthOutageHook, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationHooks, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type AuthorizerRuntime, type AuthzVersionCache, type AuthzVersionChannel, type AuthzVersionClient, type AuthzVersionSubscription, type AutomationHooks, type AutomationRef, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ChatAction, type ChatActionHook, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DelegationPermissions, type DelegationRef, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, IDENTITY_SCOPES, type IdentityRef, type IdentityTarget, type ImpersonationEvents, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PERMISSION_CAP_CLAIM, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PasswordGrantOptions, type PermissionRef, type PrincipalByIdentity, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RateLimitPolicy, type RateLimitState, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type RequestMemo, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourceLoaderContext, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionMemo, type SessionMemoOptions, type SessionMemoStats, type SessionSnapshot, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SubjectReadersOptions, type SubscribeAuthzVersionsOptions, type Subscriber, type SubscriberEvent, type SubscriberPolicy, type SupabaseAuthContext, type SupportApi, type SupportApprovalQuery, type SupportApprover, type SupportAuthorize, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportDecision, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportRequest, type SupportRequestInput, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, type TicketSubject, aalOf, actorOf, agentClaims, amrOf, authContext, authzVersionOf, bindAuthorizer, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, csvColumns, defineAuthorizationHooks, defineAuthorizer, delegationOf, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, isSessionSnapshot, issuedAtOf, lastSignIns, passwordGrant, problemResponse, readSession, refreshFor, refreshSession, requestMemo, resolveAuth, respond, rolesAt, safeRedirectPath, serverCore, sessionCacheKey, sessionCookieName, sessionMemo, sessionStatus, settle, shouldCheckSession, shouldRefresh, snapshotOf, sqlSupportStore, subjectReaders, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };