better-supabase 0.6.0 → 0.7.0

package/dist/{adapter-Bc1o3zyy.js → adapter-B-tL8hqg.js}

@@ -1,4 +1,5 @@
-import { c as mapDbError, n as dbError, o as isDbError } from "./errors-B11Duf73.js";
+import { c as mapDbError, n as dbError, o as isDbError, r as dbErrorOf } from "./errors-B11Duf73.js";
+import { t as temporal } from "./temporal-required-BVvW7SYJ.js";
 import { a as ok, r as err, t as AsyncResult } from "./result-DzUbqgdW.js";
 import { a as postgrestExecutor, n as StatsRecorder } from "./stats-D_AD9GGu.js";
 import { a as problemResponse } from "./problem-BreOl8b8.js";
@@ -7,7 +8,7 @@ import { a as actorOf, i as userContext, n as impersonatorClaim, t as actClaim }
 import { t as fromPgError } from "./executor-De1Of3m3.js";
 import { n as forwardBlockEvents } from "./cloud-event-BnmD5fb9.js";
 import { a as replicaState, i as primaryCookieWrite, o as routedExecutor, r as pinnedUntil, s as withPrimaryPin } from "./replicas-CwrYp5Zj.js";
-import { c as AUTH_CACHE_HEADERS, d as clearSessionAtScopes, f as parseCookies, h as sessionCookieName, i as resolveAuth, m as serializeCookie, r as prefetchJwks, t as authContext } from "./resolve-D_IcnvFd.js";
+import { c as AUTH_CACHE_HEADERS, d as clearSessionAtScopes, f as parseCookies, h as sessionCookieName, i as resolveAuth, m as serializeCookie, r as prefetchJwks, t as authContext } from "./resolve-tJZY3FEa.js";
 import { t as credentialProviderOf } from "./provider-Di3sRutW.js";
 import { a as respond, n as defaultPrefetchJwks, r as guard, t as defaultExpose } from "./respond-BUgsXNgk.js";
 import { createClient } from "@supabase/supabase-js";
@@ -137,7 +138,8 @@ function invalidUser(userId) {
 	return dbError("invalid_request", `"${userId}" is not a user id`, { table: "auth.users" });
 }
 function fromSqlError(cause) {
-	if (isDbError(cause)) return cause;
+	const known = dbErrorOf(cause);
+	if (known) return known;
 	const raw = fromPgError(cause);
 	if (raw) return {
 		...mapDbError(raw),
@@ -162,6 +164,29 @@ function endSessions(sql, userId) {
 		}
 	});
 }
+const LAST_SIGN_INS = `select user_id, last_sign_in_at
+from better_supabase.last_sign_ins($1::uuid[])`;
+/**
+* The last sign-in of each user, in one query (`better_supabase.last_sign_ins`
+* from the `sessions` module, which only the service role may call). Users
+* that don't exist are missing from the map.
+*/
+function lastSignIns(sql, userIds) {
+	return AsyncResult.from(async () => {
+		const invalid = userIds.find((userId) => !UUID.test(userId));
+		if (invalid !== void 0) return err(invalidUser(invalid));
+		if (userIds.length === 0) return ok(/* @__PURE__ */ new Map());
+		try {
+			const rows = await sql.queryRaw(LAST_SIGN_INS, [[...new Set(userIds)]]);
+			return ok(new Map(rows.map((row) => [row.user_id, {
+				userId: row.user_id,
+				lastSignInAt: row.last_sign_in_at === null ? null : temporal().Instant.from(row.last_sign_in_at instanceof Date ? row.last_sign_in_at.toISOString() : row.last_sign_in_at)
+			}])));
+		} catch (cause) {
+			return err(fromSqlError(cause));
+		}
+	});
+}
 async function ban(client, userId, duration) {
 	try {
 		const { error } = await client.auth.admin.updateUserById(userId, { ban_duration: duration });
@@ -426,6 +451,57 @@ function withTenant(core) {
 	})();
 }
 //#endregion
+//#region src/server/request-ids.ts
+const REQUEST_ID_PATTERN = /^[A-Za-z0-9._:;,@/+=-]{1,128}$/;
+function requestIdOrUndefined(value) {
+	return typeof value === "string" && REQUEST_ID_PATTERN.test(value) ? value : void 0;
+}
+function sessionWith(ids, tenant, readOnly = false) {
+	const settings = {
+		...ids.requestId === void 0 ? {} : { "better_supabase.request_id": ids.requestId },
+		...ids.correlationId === void 0 ? {} : { "better_supabase.correlation_id": ids.correlationId },
+		...tenant === void 0 ? {} : { "better_supabase.tenant": tenant }
+	};
+	const hasSettings = Object.keys(settings).length > 0;
+	if (!hasSettings && !readOnly) return void 0;
+	return {
+		...readOnly ? { readOnly: true } : {},
+		...hasSettings ? { settings } : {}
+	};
+}
+function requestIdPolicy(options = {}) {
+	const on = options !== false;
+	const settings = on ? options : {};
+	const requestHeader = (settings.requestHeader ?? "x-request-id").toLowerCase();
+	const correlationHeader = (settings.correlationHeader ?? "x-correlation-id").toLowerCase();
+	const incoming = on && (settings.incoming ?? true);
+	const generate = on && (settings.generate ?? true);
+	const generated = /* @__PURE__ */ new WeakMap();
+	const fromHeader = (request, name) => incoming && request ? requestIdOrUndefined(request.headers.get(name)) : void 0;
+	const generatedFor = (request) => {
+		if (!generate || !request) return void 0;
+		const known = generated.get(request);
+		if (known !== void 0) return known;
+		const id = crypto.randomUUID();
+		generated.set(request, id);
+		return id;
+	};
+	return {
+		forRequest(request, explicit) {
+			const requestId = requestIdOrUndefined(explicit.requestId) ?? fromHeader(request, requestHeader) ?? generatedFor(request);
+			const correlationId = requestIdOrUndefined(explicit.correlationId) ?? fromHeader(request, correlationHeader) ?? requestId;
+			return {
+				...requestId === void 0 ? {} : { requestId },
+				...correlationId === void 0 ? {} : { correlationId }
+			};
+		},
+		headers: (ids) => ({
+			...ids.requestId === void 0 ? {} : { [requestHeader]: ids.requestId },
+			...ids.correlationId === void 0 ? {} : { [correlationHeader]: ids.correlationId }
+		})
+	};
+}
+//#endregion
 //#region src/auth/support-cookie.ts
 /** The cookie that carries the support session id. */
 const SUPPORT_COOKIE = "bs-support";
@@ -674,6 +750,7 @@ function createServer(betterSupabase, options = {}) {
 		return tenant;
 	};
 	const pinMs = options.replicas?.pinMs ?? 5e3;
+	const idPolicy = requestIdPolicy(options.requestIds);
 	if (options.support && !options.postgres) throw new TypeError("Support sessions need createServer(betterSupabase, { postgres: createPostgres(), support })");
 	const audit = serverAudit(betterSupabase, options.audit);
 	const support = options.support ? options.support.create(betterSupabase.events, options.auth?.claims ?? betterSupabase.claimsSchema) : supportOff;
@@ -682,7 +759,7 @@ function createServer(betterSupabase, options = {}) {
 	* Postgres with the target's claims plus `act`, read-only unless the
 	* session allows writes; nothing reaches Supabase with the admin's token.
 	*/
-	const supportContextFor = (resolution, active, parent, tenant) => {
+	const supportContextFor = (resolution, active, parent, tenant, ids) => {
 		const { session, claims } = active;
 		const record = (key) => {
 			const value = claims[key];
@@ -711,10 +788,7 @@ function createServer(betterSupabase, options = {}) {
 			...base,
 			tenant: scope
 		};
-		const sessionOptions = {
-			...session.readOnly ? { readOnly: true } : {},
-			...scope === void 0 ? {} : { settings: { "better_supabase.tenant": scope } }
-		};
+		const sessionOptions = sessionWith(ids, scope, session.readOnly);
 		const recorder = new StatsRecorder(parent);
 		const sqlClaims = claims;
 		const unavailable = () => {
@@ -724,6 +798,7 @@ function createServer(betterSupabase, options = {}) {
 		let sql;
 		return {
 			...credentials,
+			...ids,
 			auth,
 			resolution,
 			support: active,
@@ -753,19 +828,20 @@ function createServer(betterSupabase, options = {}) {
 	* `ctx.sql` run over direct Postgres with the key's synthesized claims,
 	* scoped to its organization unless the tenant option names another.
 	*/
-	const apiKeyContextFor = (resolution, auth, parent, tenant) => {
+	const apiKeyContextFor = (resolution, auth, parent, tenant, ids) => {
 		const scope = tenant ?? auth.organizationId;
 		const base = authContext(auth);
 		const context = scope === void 0 ? base : {
 			...base,
 			tenant: scope
 		};
-		const session = scope === void 0 ? void 0 : { settings: { "better_supabase.tenant": scope } };
+		const session = sessionWith(ids, scope);
 		const recorder = new StatsRecorder(parent);
 		let db;
 		let sql;
 		return {
 			...credentials,
+			...ids,
 			auth: resolution.auth,
 			resolution,
 			get supabase() {
@@ -790,25 +866,30 @@ function createServer(betterSupabase, options = {}) {
 		};
 	};
 	/** Clients and repositories are built on first access: most scopes use one of them. */
-	const contextFor = (resolution, requestHeaders, parent, until = 0, tenant, active) => {
-		if (active) return supportContextFor(resolution, active, parent, tenant);
+	const contextFor = (resolution, requestHeaders, parent, until = 0, tenant, active, ids = {}) => {
+		if (active) return supportContextFor(resolution, active, parent, tenant, ids);
 		const { auth } = resolution;
-		if (auth.kind === "apiKey") return apiKeyContextFor(resolution, auth, parent, tenant);
+		if (auth.kind === "apiKey") return apiKeyContextFor(resolution, auth, parent, tenant, ids);
 		const context = tenant === void 0 ? authContext(auth) : {
 			...authContext(auth),
 			tenant
 		};
-		const headers = tenant === void 0 ? requestHeaders : {
+		const clientHeaders = tenant === void 0 ? requestHeaders : {
 			...requestHeaders,
 			[TENANT_HEADER]: tenant
 		};
-		const session = tenant === void 0 ? void 0 : { settings: { "better_supabase.tenant": tenant } };
+		const headers = {
+			...idPolicy.headers(ids),
+			...clientHeaders
+		};
+		const sharesClient = auth.kind !== "user";
+		const session = sessionWith(ids, tenant);
 		const recorder = new StatsRecorder(parent);
 		let supabase;
 		let db;
 		let sql;
 		const sqlClaims = auth.kind === "user" ? auth.claims : auth.kind === "anon" ? { role: "anon" } : void 0;
-		const client = () => supabase ??= supabaseFor(auth, headers);
+		const client = () => supabase ??= supabaseFor(auth, sharesClient ? clientHeaders : headers);
 		let replica;
 		const replicaUrl = () => {
 			const url = readUrl();
@@ -817,6 +898,7 @@ function createServer(betterSupabase, options = {}) {
 		};
 		return {
 			...credentials,
+			...ids,
 			auth,
 			resolution,
 			get supabase() {
@@ -825,7 +907,7 @@ function createServer(betterSupabase, options = {}) {
 			get db() {
 				if (db) return db;
 				const url = replicaUrl();
-				const rest = supabase ?? restAt(env().url, auth, headers);
+				const rest = (sharesClient ? void 0 : supabase) ?? restAt(env().url, auth, headers);
 				const connected = betterSupabase.connect(rest, context, {
 					stats: recorder,
 					...url && replica ? { executor: routedExecutor(postgrestExecutor(rest, executorOptions), postgrestExecutor(restAt(url, auth, headers), executorOptions), replica) } : tunedExecutor ? { executor: postgrestExecutor(rest, executorOptions) } : {}
@@ -850,7 +932,7 @@ function createServer(betterSupabase, options = {}) {
 			}
 		};
 	};
-	const fromResolution = (resolution, request, contextOptions, tenant) => contextFor(resolution, options.headers?.(request) ?? {}, contextOptions.stats, contextOptions.pinnedUntil ?? (readUrl() ? pinnedUntil(resolution.requestCookies) : 0), tenant, contextOptions.support);
+	const fromResolution = (resolution, request, contextOptions, tenant) => contextFor(resolution, options.headers?.(request) ?? {}, contextOptions.stats, contextOptions.pinnedUntil ?? (readUrl() ? pinnedUntil(resolution.requestCookies) : 0), tenant, contextOptions.support, idPolicy.forRequest(request, contextOptions));
 	const resolve = async (request, resolveOptions = {}) => {
 		const claims = options.auth?.claims ?? betterSupabase.claimsSchema;
 		const userMetadata = betterSupabase.userMetadataSchema;
@@ -902,7 +984,7 @@ function createServer(betterSupabase, options = {}) {
 			headers: {},
 			requestCookies: [],
 			apply: (response) => response
-		}, {}, contextOptions.stats, contextOptions.pinnedUntil, contextOptions.tenant, contextOptions.support),
+		}, {}, contextOptions.stats, contextOptions.pinnedUntil, contextOptions.tenant, contextOptions.support, idPolicy.forRequest(void 0, contextOptions)),
 		context(request, contextOptions = {}) {
 			const { refresh, cookies, ...rest } = contextOptions;
 			const key = Object.keys(rest).length === 0 ? `${String(refresh ?? false)}:${String(cookies ?? true)}` : void 0;
@@ -998,10 +1080,7 @@ function createServer(betterSupabase, options = {}) {
 						reason: forOptions.reason ?? "job"
 					}) } : {}
 				};
-				const session = {
-					...support?.readOnly ? { readOnly: true } : {},
-					...tenant === void 0 ? {} : { settings: { "better_supabase.tenant": tenant } }
-				};
+				const session = sessionWith({}, tenant, support?.readOnly);
 				return ok(sqlFor(claims, {
 					actor: {
 						id: actor.id,
@@ -1011,7 +1090,7 @@ function createServer(betterSupabase, options = {}) {
 					},
 					claims,
 					...tenant === void 0 ? {} : { tenant }
-				}, void 0, Object.keys(session).length === 0 ? void 0 : session));
+				}, void 0, session));
 			});
 		}
 	};
@@ -1103,4 +1182,4 @@ async function resolveToken(server, token) {
 	return auth;
 }
 //#endregion
-export { serverCore as C, deleteAccount as D, suspendAccount as E, withServerContext as S, endSessions as T, withSession as _, unexpectedResponse as a, shouldCheckSession as b, extendServer as c, clearSupportCookie as d, supportCookie as f, withSupport as g, withTenant as h, resolveToken as i, withExtra as l, supportCookieValue as m, flushEvents as n, TENANT_HEADER as o, supportCookieMaxAge as p, handle as r, createServer as s, bearerRequest as t, SUPPORT_COOKIE as u, isPrefetch as v, SERVER_EVENT_SOURCE as w, shouldRefresh as x, refreshFor as y };
+export { serverCore as C, suspendAccount as D, lastSignIns as E, deleteAccount as O, withServerContext as S, endSessions as T, withSession as _, unexpectedResponse as a, shouldCheckSession as b, extendServer as c, clearSupportCookie as d, supportCookie as f, withSupport as g, withTenant as h, resolveToken as i, withExtra as l, supportCookieValue as m, flushEvents as n, TENANT_HEADER as o, supportCookieMaxAge as p, handle as r, createServer as s, bearerRequest as t, SUPPORT_COOKIE as u, isPrefetch as v, SERVER_EVENT_SOURCE as w, shouldRefresh as x, refreshFor as y };

package/dist/ai-sdk/batches/index.d.ts

@@ -1,7 +1,7 @@
 import { t as AsyncResult } from "../../result-D7y2fT87.js";
 import { i as CursorPageOptions } from "../../block-helpers-CKtbFcRv.js";
 import { m as JobHandler } from "../../queue-CLJurhdy.js";
-import { i as AiBatchItemInput, r as AiBatchItem, t as AiBatch, u as AiProviders } from "../../types-TaiEeBGA.js";
+import { i as AiBatchItemInput, r as AiBatchItem, t as AiBatch, u as AiProviders } from "../../types-6rocye-y.js";
 import { Experimental_BatchItemResult, Experimental_BatchProvider, Experimental_BatchReference, Experimental_BatchStatus, Experimental_StartBatchOptions, Experimental_StartBatchResult } from "ai";
 //#region src/ai-sdk/batches/batches.d.ts
 /** The AI SDK batch calls, replaceable in tests. */

package/dist/ai-sdk/index.d.ts

@@ -2,7 +2,7 @@
 import { b as DbError, t as AsyncResult } from "../result-D7y2fT87.js";
 import { m as JobHandler } from "../queue-CLJurhdy.js";
 import { U as AiSandboxes } from "../ai-chat-7amvXjmQ.js";
-import { p as ResolvedProviderKey, u as AiProviders } from "../types-TaiEeBGA.js";
+import { p as ResolvedProviderKey, u as AiProviders } from "../types-6rocye-y.js";
 import { i as Usage } from "../usage-CrvrL2vw.js";
 import { _ as usageOf, a as GatewayClient, c as GatewayOptions, d as costBackfill, f as gatewayOptions, g as usageEntries, h as problem429, i as CostBackfillPayload, l as ModelCatalogRefreshOptions, m as modelInputOf, n as AiUsageMeters, o as GatewayContext, p as modelCatalogRefresh, r as CostBackfillOptions, s as GatewayModelEntry, t as AiUsage, u as UsageSource, v as usageQuota } from "../gateway-C1ssRHnf.js";
 import { a as ModelSource, c as isUIMessage, i as ModelApproval, l as toUIMessage, n as DENIED_TOOL_OUTPUT, o as fromModelMessages, r as FromModelMessagesOptions, s as fromUIMessage, t as AI_SDK_UI_FORMAT, u as toUIMessages } from "../messages-DYP0sUTe.js";

package/dist/ai-sdk/mcp/index.d.ts

@@ -1,7 +1,7 @@
 import { b as DbError, t as AsyncResult } from "../../result-D7y2fT87.js";
-import { i as CredentialRef, r as CredentialProvider } from "../../provider-BH5UWZJ6.js";
-import { r as ConnectorServer, s as Connectors } from "../../connectors-hkLCwyEz.js";
-import { n as VaultCredentials } from "../../vault-CSO7ss5C.js";
+import { i as CredentialRef, r as CredentialProvider } from "../../provider-D-UEMvSD.js";
+import { r as ConnectorServer, s as Connectors } from "../../connectors-CrpknU0P.js";
+import { n as VaultCredentials } from "../../vault-wlbBhqm7.js";
 import { ToolSet } from "ai";
 import { ElicitResult, ElicitationRequest, MCPClient, OAuthClientMetadata, OAuthClientProvider } from "@ai-sdk/mcp";
 //#region src/ai-sdk/mcp/mcp.d.ts

package/dist/{api-keys-rCGtKaZA.d.ts → api-keys-CIjghYjV.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult } from "./result-D7y2fT87.js";
 import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { n as AuthResolver } from "./resolve-KW8nCeL6.js";
+import { n as AuthResolver } from "./resolve-ChTYeTEl.js";
 import { r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
 import { JWTClaims } from "@supabase/server";
 //#region src/blocks/api-keys/api-keys.d.ts

package/dist/astro/index.d.ts

@@ -1,10 +1,10 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { t as BetterServer } from "../server-CeVeeXwz.js";
+import { t as BetterServer } from "../server-ZSJ9rCcV.js";
 import { j as StorageImageOptions } from "../index-D48jVS-N.js";
-import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-B5tid-q5.js";
-import { t as RefusalRedirects } from "../refusal-D1rgbzNq.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-DuVb4Xa8.js";
+import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
+import { t as RefusalRedirects } from "../refusal-DhSU2Vvr.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-KIPvRQJU.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/astro/index.d.ts
 /** The part of Astro's `APIContext` (middleware, pages, endpoints, actions) the integration uses. */

package/dist/astro/index.js

@@ -1,9 +1,9 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-B-tL8hqg.js";
 import { t as defaultExpose } from "../respond-BUgsXNgk.js";
 import { i as requireCaller, o as runAction } from "../kit-Fm-Fv7q5.js";
 import { t as storageImageUrl } from "../image-url-pIVlO6R1.js";
 import { t as around } from "../shared-CBxosKK3.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-CONDyPYx.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-BDCpJI7o.js";
 import { r as refusalResponse } from "../refusal-CeJWxmkH.js";
 //#region src/astro/index.ts
 function runtimeEnv(locals) {

package/dist/blocks/ai-providers/index.d.ts

@@ -1,5 +1,5 @@
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
-import { a as AiBatchItemStatus, c as AiProviderKey, d as AiProvidersOptions, f as NewAiBatch, i as AiBatchItemInput, l as AiProviderKeyInput, n as AiBatchCounts, o as AiBatchPatch, p as ResolvedProviderKey, r as AiBatchItem, s as AiBatchStatus, t as AiBatch, u as AiProviders } from "../../types-TaiEeBGA.js";
+import { a as AiBatchItemStatus, c as AiProviderKey, d as AiProvidersOptions, f as NewAiBatch, i as AiBatchItemInput, l as AiProviderKeyInput, n as AiBatchCounts, o as AiBatchPatch, p as ResolvedProviderKey, r as AiBatchItem, s as AiBatchStatus, t as AiBatch, u as AiProviders } from "../../types-6rocye-y.js";
 //#region src/blocks/ai-providers/ai-providers.d.ts
 /** Per-tenant provider keys and provider batch jobs. */
 export declare function createAiProviders(options: AiProvidersOptions): AiProviders;

package/dist/blocks/api-keys/index.d.ts

@@ -1,7 +1,7 @@
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
-import { r as AuthState } from "../../resolve-KW8nCeL6.js";
+import { r as AuthState } from "../../resolve-ChTYeTEl.js";
 import { t as BlockProblemOptions } from "../../problem-DD8LZFjc.js";
-import { a as ApiKeyResolverOptions, c as ApiKeysOptions, d as ParsedApiKey, f as apiKeyChecksum, g as parseApiKey, h as createApiKeys, i as ApiKeyExtraClaim, l as CreateApiKeyInput, m as apiKeyResolver, n as ApiKeyCheck, o as ApiKeyState, p as apiKeyClaims, r as ApiKeyClaimsOptions, s as ApiKeys, t as ApiKey, u as CreatedApiKey } from "../../api-keys-rCGtKaZA.js";
+import { a as ApiKeyResolverOptions, c as ApiKeysOptions, d as ParsedApiKey, f as apiKeyChecksum, g as parseApiKey, h as createApiKeys, i as ApiKeyExtraClaim, l as CreateApiKeyInput, m as apiKeyResolver, n as ApiKeyCheck, o as ApiKeyState, p as apiKeyClaims, r as ApiKeyClaimsOptions, s as ApiKeys, t as ApiKey, u as CreatedApiKey } from "../../api-keys-CIjghYjV.js";
 import { Entry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
 //#region src/blocks/api-keys/pipeline.d.ts

package/dist/blocks/attachments/index.d.ts

@@ -152,9 +152,16 @@ interface AttachmentScanJob {
 interface AttachmentScanner {
   /** Scans one uploaded file and records the verdict. */
   scan(id: string, signal?: AbortSignal): AsyncResult<Attachment>;
-  /** A jobs handler: `queue.work('attachment-scans', scanner.job)`. */
+  /**
+   * A jobs handler: `queue.work('attachment-scans', scanner.job)`. A deleted
+   * attachment completes the job; other errors throw so the queue retries.
+   */
   readonly job: JobHandler<AttachmentScanJob>;
-  /** An outbox sink that scans each `attachment.uploaded` event's file. */
+  /**
+   * An outbox sink that scans each `attachment.uploaded` event's file. An
+   * event for a deleted attachment is skipped, so it never holds up the
+   * events behind it; other errors throw so the relay retries the batch.
+   */
   sink(): EventSink;
 }
 /**
@@ -193,9 +200,16 @@ interface ObjectScanJob {
 interface ObjectScanner {
   /** Scans one object and records the verdict; a clean or infected object is not scanned again. */
   scan(bucket: string, path: string, signal?: AbortSignal): AsyncResult<ScannedObject>;
-  /** A jobs handler: `queue.work('object-scans', scanner.job)`. */
+  /**
+   * A jobs handler: `queue.work('object-scans', scanner.job)`. An object
+   * deleted from storage completes the job; other errors throw.
+   */
   readonly job: JobHandler<ObjectScanJob>;
-  /** An outbox sink that scans each `object.uploaded` event's object. */
+  /**
+   * An outbox sink that scans each `object.uploaded` event's object. An
+   * event for an object deleted from storage is skipped; other errors throw
+   * so the relay retries the batch.
+   */
   sink(): EventSink;
 }
 /**

package/dist/blocks/attachments/index.js

@@ -49,6 +49,18 @@ function stored(reply) {
 		}
 	});
 }
+/**
+* Waits for a scan from a job or an event. A scan whose target is gone (the
+* attachment row, or for an object the stored object) is done, not a
+* failure, so the job or event is not retried; every other error throws.
+*/
+async function settle(scanned, gone) {
+	const result = await scanned;
+	if (result.ok || gone(result.error)) return;
+	await scanned.orThrow();
+}
+const attachmentGone = (error) => error.kind === "not_found" && error.hint === "ATTACHMENT_NOT_FOUND";
+const objectGone = (error) => error.kind === "not_found" && error.code === "NoSuchKey";
 function lookup(call, id) {
 	return call("get_attachment", { id }, (value) => value).andThen((value) => Promise.resolve(isRecord(value) ? ok(attachmentOf(value)) : err(notFound())));
 }
@@ -145,13 +157,13 @@ function createAttachmentScanner(options) {
 	return {
 		scan,
 		job: async (payload, _job, signal) => {
-			await scan(payload.attachmentId, signal).orThrow();
+			await settle(scan(payload.attachmentId, signal), attachmentGone);
 		},
 		sink: () => ({ async send(events) {
 			for (const event of events) {
 				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "attachment.uploaded" || !isRecord(event.data)) continue;
 				const id = optionalText(event.data["attachmentId"]);
-				if (id !== void 0) await scan(id).orThrow();
+				if (id !== void 0) await settle(scan(id), attachmentGone);
 			}
 		} })
 	};
@@ -206,14 +218,14 @@ function createObjectScanner(options) {
 	return {
 		scan,
 		job: async (payload, _job, signal) => {
-			await scan(payload.bucket, payload.path, signal).orThrow();
+			await settle(scan(payload.bucket, payload.path, signal), objectGone);
 		},
 		sink: () => ({ async send(events) {
 			for (const event of events) {
 				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "object.uploaded" || !isRecord(event.data)) continue;
 				const bucket = optionalText(event.data["bucket"]);
 				const path = optionalText(event.data["path"]);
-				if (bucket !== void 0 && path !== void 0) await scan(bucket, path).orThrow();
+				if (bucket !== void 0 && path !== void 0) await settle(scan(bucket, path), objectGone);
 			}
 		} })
 	};

package/dist/blocks/audit/index.js

@@ -3,11 +3,11 @@ import { n as dbError } from "../../errors-B11Duf73.js";
 import { t as temporal } from "../../temporal-required-BVvW7SYJ.js";
 import { a as ok, r as err, t as AsyncResult } from "../../result-DzUbqgdW.js";
 import { t as SPEC_PINS } from "../../spec-pins--j6mTok4.js";
+import { n as toCsv } from "../../csv-DCK-PT1n.js";
 import { r as sqlIdent } from "../../template--jDkl3UP.js";
 import { n as rpcTransport, r as sqlTransport } from "../../block-transport-BLr-ZgLc.js";
 import { C as run, D as stringsOf, O as textOf, d as isRecord, g as pageOf, h as optionalText, i as blockCall, m as optionalInstant, n as applyTemporal, u as instantArg, w as seconds } from "../../block-helpers-DWHxHsEQ.js";
 import { n as defineListQuery } from "../../list-query-gl808ac1.js";
-import { t as toCsv } from "../../csv-CPAzEmB6.js";
 //#region src/blocks/audit/audit.ts
 const RETENTION_MANY = /* @__PURE__ */ new WeakMap();
 /**

package/dist/blocks/connectors/index.d.ts

@@ -1,3 +1,3 @@
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
-import { a as ConnectorSession, c as ConnectorsOptions, i as ConnectorServerFields, l as FingerprintStatus, n as ConnectorGrant, o as ConnectorTransport, r as ConnectorServer, s as Connectors, t as ConnectorAuth, u as createConnectors } from "../../connectors-hkLCwyEz.js";
+import { a as ConnectorSession, c as ConnectorsOptions, i as ConnectorServerFields, l as FingerprintStatus, n as ConnectorGrant, o as ConnectorTransport, r as ConnectorServer, s as Connectors, t as ConnectorAuth, u as createConnectors } from "../../connectors-CrpknU0P.js";
 export { type BlockTransport, type ConnectorAuth, type ConnectorGrant, type ConnectorServer, type ConnectorServerFields, type ConnectorSession, type ConnectorTransport, type Connectors, type ConnectorsOptions, type FingerprintStatus, createConnectors, rpcTransport, sqlTransport };

package/dist/blocks/data-lifecycle/index.d.ts

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult, w as ErrorMapper } from "../../result-D7y2fT87.js";
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
-import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } from "../../provider-BH5UWZJ6.js";
+import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } from "../../provider-D-UEMvSD.js";
 import { r as BlockTemporalOptions } from "../../block-helpers-CKtbFcRv.js";
 import { m as JobHandler } from "../../queue-CLJurhdy.js";
 import { r as EventSink } from "../../cloud-event-C1JCc1bH.js";
@@ -132,9 +132,17 @@ interface DataExporter {
    * emits `data_export.completed`). A failure marks it failed and returns the error.
    */
   run(exportId: string, signal?: AbortSignal): AsyncResult<DataExport>;
-  /** A jobs handler: `queue.work('data-exports', exporter.job)`. */
+  /**
+   * A jobs handler: `queue.work('data-exports', exporter.job)`. An export
+   * that is no longer pending or failed (cancelled, deleted, running or
+   * ready) completes the job; other errors throw so the queue retries.
+   */
   readonly job: JobHandler<DataExportJob>;
-  /** An outbox sink that runs each `data_export.requested` export. */
+  /**
+   * An outbox sink that runs each `data_export.requested` export. An event
+   * for an export that is no longer pending or failed is skipped, so it never
+   * holds up the events behind it; other errors throw so the relay retries.
+   */
   sink(): EventSink;
 }
 /** Runs requested exports with a service-role client. */

package/dist/blocks/data-lifecycle/index.js

@@ -1,9 +1,9 @@
 import { n as dbError } from "../../errors-B11Duf73.js";
 import { a as ok, r as err, t as AsyncResult } from "../../result-DzUbqgdW.js";
+import { n as toCsv } from "../../csv-DCK-PT1n.js";
 import { n as credentialRefInTenant } from "../../provider-Di3sRutW.js";
 import { n as rpcTransport, r as sqlTransport } from "../../block-transport-BLr-ZgLc.js";
 import { D as stringsOf, O as textOf, c as errorText, d as isRecord, h as optionalText, i as blockCall, k as toInstant, m as optionalInstant, n as applyTemporal, x as recordsOf, y as recordOf } from "../../block-helpers-DWHxHsEQ.js";
-import { t as toCsv } from "../../csv-CPAzEmB6.js";
 import { t as fromStorageError } from "../../errors-DLjJHPLK.js";
 //#region src/blocks/data-lifecycle/data-lifecycle.ts
 const EXPORT_STATUSES = [
@@ -180,16 +180,21 @@ function createDataExporter(options) {
 			files: written.data
 		}, exportOf);
 	});
+	const settle = async (ran) => {
+		const result = await ran;
+		if (result.ok || result.error.hint === "DATA_EXPORT_NOT_FOUND") return;
+		await ran.orThrow();
+	};
 	return {
 		run,
 		job: async (payload, _job, signal) => {
-			await run(payload.exportId, signal).orThrow();
+			await settle(run(payload.exportId, signal));
 		},
 		sink: () => ({ async send(events) {
 			for (const event of events) {
 				if ((event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type) !== "data_export.requested" || !isRecord(event.data)) continue;
 				const id = optionalText(event.data["exportId"]);
-				if (id !== void 0) await run(id).orThrow();
+				if (id !== void 0) await settle(run(id));
 			}
 		} })
 	};

package/dist/blocks/entitlements/index.d.ts

@@ -1,6 +1,6 @@
 import { t as AsyncResult } from "../../result-D7y2fT87.js";
 import { t as SqlClient } from "../../executor-DbvExCFC.js";
-import { i as hasEntitlement, n as EntitlementKey, t as EntitlementClaimOptions } from "../../entitlements-DHrY2UDZ.js";
+import { i as hasEntitlement, n as EntitlementKey, t as EntitlementClaimOptions } from "../../entitlements-BKSVGtrG.js";
 //#region src/blocks/entitlements/entitlements.d.ts
 /** The Stripe event sent when a customer's active entitlements change. */
 export declare const ENTITLEMENTS_UPDATED = "entitlements.active_entitlement_summary.updated";

package/dist/blocks/index.d.ts

@@ -1,6 +1,6 @@
 import { i as sqlTransport, n as RpcClient, r as rpcTransport, t as BlockTransport } from "../block-transport-DvaoPuZ9.js";
 import { a as EventHub } from "../events-DWDhx77e.js";
-import { r as CredentialProvider } from "../provider-BH5UWZJ6.js";
+import { r as CredentialProvider } from "../provider-D-UEMvSD.js";
 import { i as CursorPageOptions, n as BlockOptions } from "../block-helpers-CKtbFcRv.js";
 import { f as AiFiles } from "../types-C05bxW-W.js";
 import { n as FinalRunState, r as RunState, t as FINAL_RUN_STATES } from "../run-state-CPo-1X2B.js";

package/dist/blocks/sso/index.d.ts

@@ -2,7 +2,7 @@
 import { t as AsyncResult, w as ErrorMapper } from "../../result-D7y2fT87.js";
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
 import { r as BlockTemporalOptions } from "../../block-helpers-CKtbFcRv.js";
-import { s as ApiKeys } from "../../api-keys-rCGtKaZA.js";
+import { s as ApiKeys } from "../../api-keys-CIjghYjV.js";
 //#region src/blocks/sso/sso.d.ts
 /** The DNS record that proves a domain belongs to the organization. */
 interface DomainRecord {

package/dist/blocks/workflow-builder/index.d.ts

@@ -1,6 +1,6 @@
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../../block-transport-DvaoPuZ9.js";
-import { A as approved, C as WorkflowCondition, D as WorkflowGraphEdge, E as WorkflowGraphDiff, F as validateGraph, M as durationMs, N as evaluateCondition, O as WorkflowGraphNode, P as topologicalOrder, S as WorkflowVersionStatus, T as WorkflowGraph, _ as WorkflowNodeRunStatus, a as CredentialInput, b as WorkflowTriggerKind, c as NodeRunRecord, d as TriggerInput, f as WorkflowAlert, g as WorkflowNodeRun, h as WorkflowDefinition, i as BuilderStarter, j as diffGraphs, k as WorkflowNodeKind, l as OutboxLikeEvent, m as WorkflowCredential, n as BuilderOptions, o as DefinitionInput, p as WorkflowBuilder, r as BuilderStartCall, s as GraphCompiler, t as AlertInput, u as RunInput, v as WorkflowStepInfo, w as WorkflowConditionOperator, x as WorkflowVersion, y as WorkflowTrigger } from "../../types-BI-0Sl2v.js";
-import { i as executeGraph, n as GraphStepCall, r as approvalToken, t as GraphRuntime } from "../../executor-D14tGopJ.js";
+import { A as approved, C as WorkflowCondition, D as WorkflowGraphEdge, E as WorkflowGraphDiff, F as validateGraph, M as durationMs, N as evaluateCondition, O as WorkflowGraphNode, P as topologicalOrder, S as WorkflowVersionStatus, T as WorkflowGraph, _ as WorkflowNodeRunStatus, a as CredentialInput, b as WorkflowTriggerKind, c as NodeRunRecord, d as TriggerInput, f as WorkflowAlert, g as WorkflowNodeRun, h as WorkflowDefinition, i as BuilderStarter, j as diffGraphs, k as WorkflowNodeKind, l as OutboxLikeEvent, m as WorkflowCredential, n as BuilderOptions, o as DefinitionInput, p as WorkflowBuilder, r as BuilderStartCall, s as GraphCompiler, t as AlertInput, u as RunInput, v as WorkflowStepInfo, w as WorkflowConditionOperator, x as WorkflowVersion, y as WorkflowTrigger } from "../../types-AYOvcyep.js";
+import { i as executeGraph, n as GraphStepCall, r as approvalToken, t as GraphRuntime } from "../../executor-BVBFM86G.js";
 //#region src/blocks/workflow-builder/workflow-builder.d.ts
 /**
  * The `workflow-builder` module's definitions, versions, triggers,

package/dist/blocks/workflow-builder/react/index.d.ts

@@ -1,7 +1,7 @@
 import { b as DbError } from "../../../result-D7y2fT87.js";
 import { x as SubscriptionStatus } from "../../../index-DunNRdnT.js";
 import { t as WorkflowRun } from "../../../workflows-B0j9WKPu.js";
-import { g as WorkflowNodeRun, h as WorkflowDefinition, p as WorkflowBuilder, v as WorkflowStepInfo } from "../../../types-BI-0Sl2v.js";
+import { g as WorkflowNodeRun, h as WorkflowDefinition, p as WorkflowBuilder, v as WorkflowStepInfo } from "../../../types-AYOvcyep.js";
 //#region src/blocks/workflow-builder/react/index.d.ts
 export interface UseWorkflowBuilderOptions {
   /** The tenant whose definitions to list. */

package/dist/chat-sdk/index.d.ts

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult, w as ErrorMapper } from "../result-D7y2fT87.js";
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../block-transport-DvaoPuZ9.js";
-import { a as CredentialSubject, i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "../provider-BH5UWZJ6.js";
+import { a as CredentialSubject, i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "../provider-D-UEMvSD.js";
 import { o as StreamStore } from "../store-CGjgWu5n.js";
 import { C as InboxMessage, T as MessageAttachment, a as Inbox, b as InboundResult, h as Conversation, j as StoredInboundEvent, y as DeliveryStatus } from "../inbox-i7E1ppo6.js";
 import { Adapter, AdapterPostableMessage, Attachment, Message, RawMessage, StateAdapter, WebhookOptions } from "chat";

package/dist/cli/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as run } from "./run-DNWxHynX.js";
+import { i as run } from "./run-BO052mki.js";
 import { t as colorEnabled } from "./style-C0NFdJRL.js";
 import { text } from "node:stream/consumers";
 //#region src/cli/bin.ts