better-supabase 0.5.1 → 0.6.0

package/dist/types-DGs5L0VN.d.ts

@@ -0,0 +1,192 @@
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
+import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
+import { r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
+import { n as Embedder } from "./knowledge-BXBbT0Tr.js";
+//#region src/blocks/memory/types.d.ts
+type MemoryScope = "user" | "agent" | "chat" | "project" | "organization";
+type MemoryKind = "core" | "archival";
+/**
+ * Whose memory a call reads or changes. The default is the caller's own
+ * memory; `organization` memory is shared and only admins change it. The
+ * `project` scope takes a `projectId` (an ai-chat project) and no other
+ * scope does. The service role names the user in `ownerId`.
+ */
+interface MemoryNamespace {
+  readonly scope?: MemoryScope;
+  readonly agentId?: string;
+  readonly chatId?: string;
+  readonly projectId?: string;
+  readonly ownerId?: string;
+}
+interface MemoryRecord {
+  readonly id: string;
+  readonly organizationId: string;
+  readonly ownerId: string | undefined;
+  readonly scope: MemoryScope;
+  readonly agentId: string | undefined;
+  readonly chatId: string | undefined;
+  readonly projectId: string | undefined;
+  readonly kind: MemoryKind;
+  /** A path under `/memories`, for core memory. */
+  readonly path: string | undefined;
+  readonly content: string;
+  readonly version: number;
+  readonly embeddingModel: string | undefined;
+  readonly sourceMessageId: string | undefined;
+  readonly createdAt: Temporal.Instant;
+  readonly updatedAt: Temporal.Instant;
+}
+interface MemoryHit extends MemoryRecord {
+  readonly score: number;
+  /** Cosine similarity to the query embedding, when both have one. */
+  readonly similarity: number | undefined;
+}
+type MemoryView = {
+  readonly type: "file";
+  readonly path: string;
+  readonly content: string;
+  readonly version: number;
+} | {
+  readonly type: "directory";
+  readonly path: string;
+  readonly entries: readonly {
+    readonly path: string;
+    readonly size: number;
+  }[];
+};
+/** The commands of Anthropic's memory tool (`memory_20250818`). */
+type MemoryCommand = {
+  readonly command: "view";
+  readonly path: string;
+  readonly view_range?: readonly [number, number];
+} | {
+  readonly command: "create";
+  readonly path: string;
+  readonly file_text: string;
+} | {
+  readonly command: "str_replace";
+  readonly path: string;
+  readonly old_str: string;
+  readonly new_str?: string;
+} | {
+  readonly command: "insert";
+  readonly path: string;
+  readonly insert_line: number;
+  readonly insert_text: string;
+} | {
+  readonly command: "delete";
+  readonly path: string;
+} | {
+  readonly command: "rename";
+  readonly old_path: string;
+  readonly new_path: string;
+};
+interface RecalledMessage {
+  readonly chatId: string;
+  readonly messageId: string;
+  readonly similarity: number;
+}
+interface MemoryOptions extends BlockTemporalOptions {
+  /** Calls as the user: `rpcTransport(supabase)`. */
+  readonly transport: BlockTransport;
+  /** Calls as the service role, for embeddings and extracted memories. */
+  readonly service?: BlockTransport;
+  /** The module schema (`sql.modules.memory.schema`), default `better_supabase`. */
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+  /** Embeds archival memories, messages and queries. */
+  readonly embedder?: Embedder;
+  /** The most characters `render` returns. Default 8000. */
+  readonly maxRender?: number;
+  /** `saveExtracted` skips a fact this similar to a saved one. Default 0.92. */
+  readonly dedupeThreshold?: number;
+}
+interface Memory {
+  readonly core: {
+    view(organizationId: string, path?: string, ns?: MemoryNamespace): AsyncResult<MemoryView | undefined>;
+    /** Creates or overwrites a file; `expectedVersion` 0 means it must be new. */
+    write(organizationId: string, path: string, content: string, ns?: MemoryNamespace, options?: {
+      readonly expectedVersion?: number;
+    }): AsyncResult<MemoryRecord>;
+    strReplace(organizationId: string, path: string, oldText: string, newText: string, ns?: MemoryNamespace): AsyncResult<MemoryRecord>;
+    insert(organizationId: string, path: string, line: number, text: string, ns?: MemoryNamespace): AsyncResult<MemoryRecord>;
+    /** Deletes a file or a directory. Returns how many files. */
+    remove(organizationId: string, path: string, ns?: MemoryNamespace): AsyncResult<number>;
+    rename(organizationId: string, oldPath: string, newPath: string, ns?: MemoryNamespace): AsyncResult<number>;
+    list(organizationId: string, ns?: MemoryNamespace): AsyncResult<readonly MemoryRecord[]>;
+  };
+  /** Runs a memory tool command and returns the text for the model. */
+  run(organizationId: string, command: MemoryCommand, ns?: MemoryNamespace): AsyncResult<string>;
+  readonly archival: {
+    save(organizationId: string, content: string, ns?: MemoryNamespace, options?: {
+      readonly sourceMessageId?: string;
+    }): AsyncResult<MemoryRecord>;
+    search(organizationId: string, query: string, ns?: MemoryNamespace, options?: {
+      readonly k?: number;
+      readonly signal?: AbortSignal;
+    }): AsyncResult<readonly MemoryHit[]>;
+    list(organizationId: string, ns?: MemoryNamespace, options?: {
+      readonly limit?: number;
+    }): AsyncResult<readonly MemoryRecord[]>;
+    /** Deletes a memory, or marks it replaced by `supersededBy`. */
+    forget(memoryId: string, options?: {
+      readonly supersededBy?: string;
+    }): AsyncResult<boolean>;
+  };
+  readonly recall: {
+    /** Embeds a message so later chats can recall it (service role). */
+    index(message: {
+      readonly organizationId: string;
+      readonly chatId: string;
+      readonly messageId: string;
+      readonly userId: string;
+      readonly text: string;
+    }): AsyncResult<boolean>;
+    /** The caller's earlier messages closest to `query`. */
+    search(organizationId: string, query: string, options?: {
+      readonly k?: number;
+      readonly excludeChat?: string;
+      /** The service role only: whose messages. */
+      readonly ownerId?: string;
+      readonly signal?: AbortSignal;
+    }): AsyncResult<readonly RecalledMessage[]>;
+  };
+  /**
+   * Core memory as delimited text for a system prompt, cut at
+   * `maxRender` characters. Empty when there is none.
+   */
+  render(organizationId: string, ns?: MemoryNamespace): AsyncResult<string>;
+  /** Saves facts that aren't already remembered. Returns the new ones. */
+  saveExtracted(organizationId: string, facts: readonly string[], ns?: MemoryNamespace, options?: {
+    readonly sourceMessageId?: string;
+  }): AsyncResult<readonly MemoryRecord[]>;
+  /** Embeds memories edited since their last embedding (service role). Returns how many. */
+  embedPending(options?: {
+    readonly batch?: number;
+    readonly signal?: AbortSignal;
+  }): AsyncResult<number>;
+  /**
+   * Documents under an opaque scope key, for agent runtimes (service role).
+   * A write names the version it read; a stale one fails with the hint
+   * `MEMORY_DOCUMENT_CONFLICT`.
+   */
+  readonly documents: {
+    read(scopeKey: string, path: string): AsyncResult<MemoryDocument | undefined>;
+    /** `expectedVersion: null` means the document must not exist yet. */
+    write(scopeKey: string, path: string, content: string, options: {
+      readonly expectedVersion: string | null;
+      /** Seconds until the document expires. */
+      readonly expiresIn?: number;
+    }): AsyncResult<MemoryDocument>;
+    /** Deletes expired documents, at most `batch`. Returns how many. */
+    purge(batch?: number): AsyncResult<number>;
+  };
+}
+interface MemoryDocument {
+  readonly content: string;
+  /** Opaque; pass it back as `expectedVersion`. */
+  readonly version: string;
+}
+//#endregion
+export { MemoryKind as a, MemoryRecord as c, RecalledMessage as d, MemoryHit as i, MemoryScope as l, MemoryCommand as n, MemoryNamespace as o, MemoryDocument as r, MemoryOptions as s, Memory as t, MemoryView as u };

package/dist/types-TaiEeBGA.d.ts

@@ -0,0 +1,156 @@
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
+import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
+import { i as CredentialRef, r as CredentialProvider } from "./provider-BH5UWZJ6.js";
+import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
+//#region src/blocks/ai-providers/types.d.ts
+/** A tenant's own key for a provider. The key itself stays in the credential provider. */
+interface AiProviderKey {
+  readonly id: string;
+  readonly organizationId: string;
+  /** The AI Gateway's provider slug, such as `anthropic` or `openai`. */
+  readonly provider: string;
+  /** Tells several keys of one provider apart; `default` unless named. */
+  readonly name: string;
+  readonly credentialRef: CredentialRef;
+  /** The provider's other options, such as a region; never a secret. */
+  readonly settings: Readonly<Record<string, unknown>>;
+  readonly enabled: boolean;
+  readonly createdBy: string | undefined;
+  readonly createdAt: Temporal.Instant;
+  readonly updatedAt: Temporal.Instant;
+}
+interface AiProviderKeyInput {
+  readonly provider: string;
+  /** Store the key first, for example with `vaultCredentials().set(ref, apiKey)`. */
+  readonly credentialRef: CredentialRef;
+  readonly name?: string;
+  readonly settings?: Readonly<Record<string, unknown>>;
+  readonly enabled?: boolean;
+}
+/** A key resolved for one request. */
+interface ResolvedProviderKey {
+  readonly provider: string;
+  readonly name: string;
+  readonly token: string;
+  readonly headers: Readonly<Record<string, string>>;
+  readonly settings: Readonly<Record<string, unknown>>;
+}
+type AiBatchStatus = "pending" | "completed" | "failed" | "cancelled";
+interface AiBatchCounts {
+  readonly total?: number;
+  readonly pending?: number;
+  readonly completed?: number;
+  readonly failed?: number;
+}
+interface AiBatch {
+  readonly id: string;
+  readonly organizationId: string;
+  readonly userId: string | undefined;
+  readonly provider: string;
+  /** The SDK's batch reference, such as `{ version, id, provider }`. */
+  readonly reference: Readonly<Record<string, unknown>>;
+  readonly status: AiBatchStatus;
+  /** The provider's own status word. */
+  readonly rawStatus: string | undefined;
+  readonly itemCount: number;
+  readonly counts: AiBatchCounts;
+  readonly error: string | undefined;
+  readonly metadata: Readonly<Record<string, unknown>>;
+  /** The results are in `items`. */
+  readonly resultsSaved: boolean;
+  readonly polls: number;
+  readonly nextPollAt: Temporal.Instant | undefined;
+  readonly expiresAt: Temporal.Instant | undefined;
+  readonly completedAt: Temporal.Instant | undefined;
+  readonly createdAt: Temporal.Instant;
+  readonly updatedAt: Temporal.Instant;
+}
+interface NewAiBatch {
+  readonly provider: string;
+  readonly reference: Readonly<Record<string, unknown>>;
+  readonly itemCount?: number;
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  /** Service role only: the user the batch is for. */
+  readonly userId?: string;
+  readonly status?: AiBatchStatus;
+  readonly rawStatus?: string;
+  readonly counts?: AiBatchCounts;
+  readonly expiresAt?: Temporal.Instant;
+}
+interface AiBatchPatch {
+  readonly status?: AiBatchStatus;
+  readonly rawStatus?: string;
+  readonly counts?: AiBatchCounts;
+  readonly error?: string | null;
+  readonly expiresAt?: Temporal.Instant;
+  readonly resultsSaved?: boolean;
+  /** `null` stops polling. */
+  readonly nextPollAt?: Temporal.Instant | null;
+}
+type AiBatchItemStatus = "succeeded" | "failed" | "cancelled" | "expired";
+interface AiBatchItem {
+  readonly batchId: string;
+  readonly requestId: string;
+  readonly organizationId: string;
+  readonly status: AiBatchItemStatus;
+  readonly output: unknown;
+  readonly usage: unknown;
+  readonly error: string | undefined;
+  readonly createdAt: Temporal.Instant;
+}
+interface AiBatchItemInput {
+  readonly requestId: string;
+  readonly status: AiBatchItemStatus;
+  readonly output?: unknown;
+  readonly usage?: unknown;
+  readonly error?: string;
+}
+interface AiProvidersOptions extends BlockTemporalOptions {
+  /** Calls as the user: `rpcTransport(supabase)`. */
+  readonly transport: BlockTransport;
+  /** Calls as the service role, for resolving keys, polling and the idle stop. */
+  readonly service?: BlockTransport;
+  /** Resolves and revokes the keys' credential refs. */
+  readonly credentials?: CredentialProvider;
+  /** The module schema (`sql.modules.ai-providers.schema`), default `better_supabase`. */
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+}
+interface AiProviders {
+  readonly keys: {
+    list(organizationId: string): AsyncResult<readonly AiProviderKey[]>;
+    /** Adds or replaces a key (`ai.admin`), and revokes the credential it replaced. */
+    save(organizationId: string, key: AiProviderKeyInput): AsyncResult<AiProviderKey>;
+    /** Deletes a key and revokes its credential. `false` when there was none. */
+    remove(keyId: string): AsyncResult<boolean>;
+    /**
+     * Deletes every key of a tenant and revokes each credential (service
+     * role): the step to run when a tenant is deleted. Returns how many.
+     */
+    removeAll(organizationId: string): AsyncResult<number>;
+    /** The tenant's enabled keys with their tokens, for one request (service role). */
+    resolve(organizationId: string, options?: {
+      readonly providers?: readonly string[];
+      readonly signal?: AbortSignal;
+    }): AsyncResult<readonly ResolvedProviderKey[]>;
+  };
+  readonly batches: {
+    record(organizationId: string, batch: NewAiBatch): AsyncResult<AiBatch>;
+    get(batchId: string): AsyncResult<AiBatch | undefined>;
+    list(organizationId: string, options?: {
+      readonly status?: AiBatchStatus;
+      readonly limit?: number;
+    }): AsyncResult<readonly AiBatch[]>;
+    items(batchId: string, options?: CursorPageOptions<string>): AsyncResult<readonly AiBatchItem[]>;
+    /** Claims batches to poll for `leaseSeconds` (service role). */
+    due(options?: {
+      readonly batch?: number;
+      readonly leaseSeconds?: number;
+    }): AsyncResult<readonly AiBatch[]>;
+    update(batchId: string, patch: AiBatchPatch): AsyncResult<AiBatch>;
+    saveItems(batchId: string, items: readonly AiBatchItemInput[]): AsyncResult<number>;
+  };
+}
+//#endregion
+export { AiBatchItemStatus as a, AiProviderKey as c, AiProvidersOptions as d, NewAiBatch as f, AiBatchItemInput as i, AiProviderKeyInput as l, AiBatchCounts as n, AiBatchPatch as o, ResolvedProviderKey as p, AiBatchItem as r, AiBatchStatus as s, AiBatch as t, AiProviders as u };

package/dist/usage-CrvrL2vw.d.ts

@@ -0,0 +1,177 @@
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
+import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
+import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
+import { n as StripeSource } from "./stripe-D04h-QBT.js";
+//#region src/blocks/usage/usage.d.ts
+interface UsageOptions extends BlockTemporalOptions {
+  readonly transport: BlockTransport;
+  /** The module schema (`sql.modules.usage.schema`), default `better_supabase`. */
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+}
+interface RecordUsageOptions {
+  /** Default 1. */
+  readonly quantity?: number;
+  /** A retried call with the same key counts once. */
+  readonly idempotencyKey?: string;
+  /**
+   * What used it, such as `feature:summary` or `api:/v1/search`, kept in the
+   * history with `sql.modules.usage.options.history`.
+   */
+  readonly source?: string;
+  /** More detail for the history entry, such as a document id. */
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  /**
+   * Who used it, for a service transport recording on a user's behalf.
+   * Ignored for other callers, whose own user id is recorded.
+   */
+  readonly actor?: string;
+}
+/** One meter of a batch. */
+interface UsageEntry {
+  readonly meter: string;
+  /** Default 1. */
+  readonly quantity?: number;
+}
+interface UsageBatchRecorded {
+  /** False when the idempotency key was seen before for every meter. */
+  readonly recorded: boolean;
+  /** Today's usage per meter (UTC). */
+  readonly today: Readonly<Record<string, number>>;
+  /** Usage per meter in its quota's current period, as `current()` reports it. */
+  readonly used: Readonly<Record<string, number>>;
+}
+/** One entry of the usage history. */
+interface UsageHistoryEntry {
+  readonly id: number;
+  readonly meter: string;
+  readonly quantity: number;
+  /** The user who used it, or `undefined` for service usage without one. */
+  readonly actor: string | undefined;
+  readonly source: string | undefined;
+  readonly metadata: Readonly<Record<string, unknown>>;
+  readonly recordedAt: Temporal.Instant;
+}
+/** Usage of a meter in its current window per actor and source. */
+interface UsageBreakdownEntry {
+  readonly actor: string | undefined;
+  readonly source: string | undefined;
+  readonly quantity: number;
+}
+interface UsageHistoryOptions extends CursorPageOptions<number> {
+  readonly meter?: string;
+  /** Defaults to 100, at most 1000. */
+  readonly limit?: number;
+  /** Only entries with a lower id, for the next page. */
+  readonly cursor?: number;
+}
+interface UsageRecorded {
+  /** False when the idempotency key was seen before. */
+  readonly recorded: boolean;
+  /** Today's usage of the meter (UTC). */
+  readonly today: number;
+  /** Usage in the quota's current period, as `current()` reports it. */
+  readonly used: number;
+}
+/**
+ * A quota period: a UTC calendar period, or `billing` for the window the
+ * app's `usage_billing_period(tenant)` function returns.
+ */
+type UsagePeriod = "day" | "week" | "month" | "year" | "billing";
+/** One meter of `sql.modules.usage.options.meters`. */
+interface UsageMeterInfo {
+  readonly unit?: string;
+  readonly category?: string;
+  readonly label?: string;
+}
+interface UsageStatus {
+  readonly meter: string;
+  /** Usage in the current period. */
+  readonly used: number;
+  /** `undefined` without a quota and for an unlimited one. */
+  readonly limit: number | undefined;
+  readonly remaining: number | undefined;
+  readonly unlimited: boolean;
+  readonly period: UsagePeriod;
+  /** When the current period started. */
+  readonly startsAt: Temporal.Instant | undefined;
+  readonly resetsAt: Temporal.Instant;
+  /** From the meter catalog, when the module has one. */
+  readonly unit?: string;
+  readonly category?: string;
+  readonly label?: string;
+}
+interface Usage {
+  /** Adds usage without checking the quota (metering only). */
+  record(organizationId: string, meter: string, options?: RecordUsageOptions): AsyncResult<UsageRecorded>;
+  /** Adds usage when it fits the quota, or returns `quota_exceeded`. */
+  consume(organizationId: string, meter: string, options?: RecordUsageOptions): AsyncResult<UsageRecorded>;
+  /**
+   * Adds several meters in one transaction, all or none, such as input and
+   * output tokens of one call. The idempotency key covers the batch.
+   */
+  recordMany(organizationId: string, entries: readonly UsageEntry[], options?: Omit<RecordUsageOptions, "quantity">): AsyncResult<UsageBatchRecorded>;
+  /**
+   * Like `recordMany`, but checks each meter's quota first; when one doesn't
+   * fit, nothing is recorded and the result is `quota_exceeded`.
+   */
+  consumeMany(organizationId: string, entries: readonly UsageEntry[], options?: Omit<RecordUsageOptions, "quantity">): AsyncResult<UsageBatchRecorded>;
+  current(organizationId: string, meter: string): AsyncResult<UsageStatus>;
+  overview(organizationId: string): AsyncResult<readonly UsageStatus[]>;
+  /** Units left in the period, or `undefined` without a quota. */
+  remaining(organizationId: string, meter: string): AsyncResult<number | undefined>;
+  /** The meter catalog (`options.meters`), empty without one. */
+  meters(): AsyncResult<Readonly<Record<string, UsageMeterInfo>>>;
+  /**
+   * The tenant's usage entries, newest first, with who and what used each
+   * (`usage.read`). Empty without `sql.modules.usage.options.history`.
+   */
+  history(organizationId: string, options?: UsageHistoryOptions): AsyncResult<readonly UsageHistoryEntry[]>;
+  /**
+   * The meter's usage in its current quota window per actor and source,
+   * largest first (`usage.read`). Empty without the history option.
+   */
+  breakdown(organizationId: string, meter: string): AsyncResult<readonly UsageBreakdownEntry[]>;
+}
+/** Usage metering and quotas over the `usage` module's functions. */
+declare function createUsage(options: UsageOptions): Usage;
+interface ReportUsageOptions {
+  /** A service-role transport: the reporting functions are granted to `service_role` only. */
+  readonly transport: BlockTransport;
+  readonly stripe: StripeSource;
+  readonly schema?: string;
+  /** The Stripe meter's `event_name` for a meter; default the meter itself. */
+  readonly eventName?: (meter: string) => string | undefined;
+  /**
+   * The tenant's Stripe customer. Default: `tenant_stripe_customer()` from
+   * the `entitlements` module (`config.entitlements.customer`).
+   */
+  readonly customer?: (organizationId: string) => Promise<string | undefined>;
+  /** Counters per run, default 500. */
+  readonly batch?: number;
+  /**
+   * Send only the usage above the tenant's quota (the allowance its plan
+   * includes) in each quota window, instead of every unit. A meter without
+   * a quota sends everything, and one with an unlimited quota sends nothing.
+   */
+  readonly overage?: boolean;
+}
+interface ReportUsageResult {
+  /** Meter events sent; usage inside the quota with `overage` is marked without one. */
+  readonly reported: number;
+  /**
+   * Counters left for a later run: no customer, or no event name. They don't
+   * hold up the other counters of the batch.
+   */
+  readonly skipped: number;
+}
+/**
+ * Sends unreported usage to Stripe as meter events, one per counter and
+ * delta. The event `identifier` is the tenant, meter, day and new total, so
+ * a run that fails after sending and before marking resends the same event,
+ * and Stripe drops the duplicate. Run it from a job or a cron route.
+ */
+declare function reportUsageToStripe(options: ReportUsageOptions): Promise<ReportUsageResult>;
+//#endregion
+export { UsageBatchRecorded as a, UsageHistoryEntry as c, UsageOptions as d, UsagePeriod as f, reportUsageToStripe as g, createUsage as h, Usage as i, UsageHistoryOptions as l, UsageStatus as m, ReportUsageOptions as n, UsageBreakdownEntry as o, UsageRecorded as p, ReportUsageResult as r, UsageEntry as s, RecordUsageOptions as t, UsageMeterInfo as u };

package/dist/user-change-XzvgafU4.js

@@ -0,0 +1,130 @@
+//#region src/query/invalidate.ts
+function isString(value) {
+	return typeof value === "string";
+}
+function queryTables(query) {
+	const tables = query.meta?.["bsTables"];
+	if (Array.isArray(tables)) {
+		const list = tables;
+		return list.every(isString) ? list : list.filter(isString);
+	}
+	const [prefix, table] = query.queryKey;
+	return prefix === "bs" && typeof table === "string" ? [table] : void 0;
+}
+const indexes = /* @__PURE__ */ new WeakMap();
+function indexOf(cache) {
+	const existing = indexes.get(cache);
+	if (existing) return existing;
+	const index = {
+		byTable: /* @__PURE__ */ new Map(),
+		tablesOf: /* @__PURE__ */ new Map()
+	};
+	const remove = (hash) => {
+		for (const table of index.tablesOf.get(hash) ?? []) {
+			const set = index.byTable.get(table);
+			set?.delete(hash);
+			if (set?.size === 0) index.byTable.delete(table);
+		}
+		index.tablesOf.delete(hash);
+	};
+	const add = (hash) => {
+		const query = cache.get(hash);
+		const tables = query ? queryTables(query) : void 0;
+		const known = index.tablesOf.get(hash);
+		if (known !== void 0 && tables !== void 0 && known.length === tables.length && known.every((table, at) => table === tables[at])) return;
+		remove(hash);
+		if (!tables || tables.length === 0) return;
+		index.tablesOf.set(hash, tables);
+		for (const table of tables) {
+			let set = index.byTable.get(table);
+			if (!set) index.byTable.set(table, set = /* @__PURE__ */ new Set());
+			set.add(hash);
+		}
+	};
+	for (const query of cache.getAll()) add(query.queryHash);
+	cache.subscribe((event) => {
+		const hash = event.query.queryHash;
+		if (event.type === "removed") remove(hash);
+		else if (event.type === "added" || event.type === "observerAdded" || event.type === "observerOptionsUpdated" || event.type === "updated" && event.action.type === "fetch") add(hash);
+	});
+	indexes.set(cache, index);
+	return index;
+}
+/**
+* Invalidates every query that read one of `tables`: better-supabase queries
+* by their `meta.bsTables`, and other `['bs', table, ...]` keys by prefix.
+* An index from table to queries finds them, so a write to a table nothing
+* read skips the cache scan.
+*/
+function invalidateTables(client, tables) {
+	if (tables.length === 0) return Promise.resolve();
+	const { byTable } = indexOf(client.getQueryCache());
+	const matched = /* @__PURE__ */ new Set();
+	for (const table of tables) for (const hash of byTable.get(table) ?? []) matched.add(hash);
+	if (matched.size === 0) return Promise.resolve();
+	return client.invalidateQueries({ predicate: (query) => matched.has(query.queryHash) });
+}
+//#endregion
+//#region src/query/user-change.ts
+/** Claims every refresh changes; the rest says who the caller is and what RLS lets them read. */
+const TIME_CLAIMS = /* @__PURE__ */ new Set([
+	"exp",
+	"iat",
+	"nbf",
+	"jti"
+]);
+/**
+* The user plus every claim except the time claims, so a token refresh keeps
+* the identity and an organization switch, a role change or a second factor
+* (a new `tenant_id`, `role` or `aal`) changes it.
+*/
+function identityKey(snapshot) {
+	if (!snapshot.user) return null;
+	const claims = Object.entries(snapshot.claims ?? {}).filter(([key]) => !TIME_CLAIMS.has(key)).toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	return JSON.stringify([snapshot.user.id, claims]);
+}
+/**
+* Resets every `['bs', ...]` query when the caller changes: another user,
+* signing out, or new claims for the same user (an organization switch, a
+* role change). Mounted queries refetch, so no one sees the previous
+* identity's rows. Returns the function that stops listening.
+* `BetterSupabaseProvider` calls it for React; call it yourself with Vue,
+* Solid, Svelte or Angular Query.
+*
+* Queries that fetched while the session was still loading ran as anon, so
+* they are reset when a user arrives. Data already in the cache when loading
+* started (hydrated from the server) stays.
+*
+* ```ts
+* const stop = clearOnUserChange(queryClient, bs.auth);
+* ```
+*/
+function clearOnUserChange(queryClient, auth) {
+	let identity;
+	let before;
+	const bsQueries = () => queryClient.getQueryCache().findAll({ queryKey: ["bs"] });
+	const check = () => {
+		const snapshot = auth.current();
+		if (snapshot.status === "loading") {
+			before ??= new Map(bsQueries().map((query) => [query.queryHash, query.state.dataUpdatedAt]));
+			return;
+		}
+		const next = identityKey(snapshot);
+		if (identity !== void 0 && identity !== next) queryClient.resetQueries({ queryKey: ["bs"] });
+		else if (identity === void 0 && next !== null && before) {
+			const known = before;
+			const fetchedAsAnon = new Set(bsQueries().filter((query) => query.state.dataUpdatedAt > 0 && known.get(query.queryHash) !== query.state.dataUpdatedAt).map((query) => query.queryHash));
+			if (fetchedAsAnon.size > 0) queryClient.resetQueries({
+				queryKey: ["bs"],
+				predicate: (query) => fetchedAsAnon.has(query.queryHash)
+			});
+		}
+		before = void 0;
+		identity = next;
+	};
+	const stop = auth.subscribe(check);
+	check();
+	return stop;
+}
+//#endregion
+export { identityKey as n, invalidateTables as r, clearOnUserChange as t };