better-supabase 0.7.0 → 0.8.0

package/dist/authorizer-ayxUDXXP.js

@@ -0,0 +1,126 @@
+import { n as deepFreeze, r as isPlainObject, t as cloneValue } from "./clone-dN9XOL1K.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
+import { a as ok, r as err } from "./result-DEqHCMKP.js";
+//#region src/core/authorizer.ts
+/** Identity helper that fixes `apiVersion` and infers `Ref`. */
+function defineAuthorizer(authorizer) {
+	return {
+		...authorizer,
+		apiVersion: 1
+	};
+}
+const ANONYMOUS = {
+	type: "anon",
+	id: "anonymous"
+};
+function scopesOf(claims) {
+	const scope = claims?.["scope"];
+	return typeof scope === "string" ? scope.split(" ").filter(Boolean) : [];
+}
+/** A frozen copy of the verified claims, so an authorizer cannot change them. */
+function claimsProperty(claims) {
+	if (!isPlainObject(claims)) return {};
+	return { claims: deepFreeze(cloneValue(claims)) };
+}
+/** The subject and context of a request, from the verified context only. */
+function requestOf(context) {
+	const actor = context?.actor;
+	const claims = context?.claims;
+	const act = claims?.["act"];
+	const subject = actor ? {
+		type: typeof act === "object" && act !== null && actor.kind === "user" ? "agent" : actor.kind,
+		id: actor.id,
+		properties: {
+			...actor.role === void 0 ? {} : { role: actor.role },
+			...actor.email === void 0 ? {} : { email: actor.email },
+			...actor.impersonator === void 0 ? {} : { impersonator: actor.impersonator },
+			...claimsProperty(claims)
+		}
+	} : ANONYMOUS;
+	const aal = claims?.["aal"];
+	return {
+		subject,
+		context: {
+			...context?.tenant === void 0 ? {} : { tenant: context.tenant },
+			...typeof aal === "string" ? { aal } : {},
+			scopes: scopesOf(claims)
+		}
+	};
+}
+function isOutcome(value) {
+	if (typeof value !== "object" || value === null || !("outcome" in value)) return false;
+	const { outcome } = value;
+	return outcome === "granted" || outcome === "denied" || outcome === "approval-required";
+}
+/** The `forbidden` error for an outcome other than `granted`, or `undefined`. */
+function outcomeError(outcome, permission) {
+	if (!isOutcome(outcome)) return dbError("forbidden", `The authorizer gave no decision for ${permission}`, {
+		code: "PERMISSION_DENIED",
+		permission
+	});
+	switch (outcome.outcome) {
+		case "granted": return;
+		case "denied": return dbError("forbidden", outcome.reason ?? `Permission ${permission} is required`, {
+			code: "PERMISSION_DENIED",
+			permission
+		});
+		case "approval-required": return dbError("forbidden", `${permission} needs an approval`, {
+			code: "APPROVAL_REQUIRED",
+			permission,
+			...outcome.approval ? { approval: { id: outcome.approval.id } } : {}
+		});
+		default: return outcome;
+	}
+}
+/**
+* Checks one permission and fails closed: a missing authorizer, a throw or
+* an unknown outcome all deny. Never throws (invariant 4).
+*/
+async function checkPermission(options) {
+	const { authorizer, permission } = options;
+	if (!authorizer) return err(dbError("forbidden", "A permission is declared, but no authorizer is set", { code: "PERMISSION_DENIED" }));
+	let key;
+	try {
+		key = authorizer.key(permission);
+	} catch {
+		return err(dbError("forbidden", "Unknown permission", { code: "PERMISSION_DENIED" }));
+	}
+	const { subject, context } = requestOf(options.context);
+	try {
+		const error = outcomeError(await authorizer.evaluate({
+			subject,
+			action: permission,
+			resource: options.resource,
+			context
+		}), key);
+		return error ? err(error) : ok(void 0);
+	} catch {
+		return err(dbError("forbidden", `The authorizer failed for ${key}`, {
+			code: "PERMISSION_DENIED",
+			permission: key
+		}));
+	}
+}
+/**
+* Checks one permission per resource, with `evaluations` when the
+* authorizer has it. Returns whether each one is granted, in order; any
+* failure denies.
+*/
+async function checkEach(authorizer, permission, resources, context) {
+	if (!authorizer || resources.length === 0) return resources.map(() => false);
+	const { subject, context: requestContext } = requestOf(context);
+	const requests = resources.map((resource) => ({
+		subject,
+		action: permission,
+		resource,
+		context: requestContext
+	}));
+	try {
+		const outcomes = authorizer.evaluations ? await authorizer.evaluations(requests) : await Promise.all(requests.map((request) => Promise.resolve(authorizer.evaluate(request))));
+		return requests.map((_, index) => isOutcome(outcomes[index]) && outcomes[index].outcome === "granted");
+	} catch {
+		return resources.map(() => false);
+	}
+}
+//#endregion
+export { requestOf as i, checkPermission as n, defineAuthorizer as r, checkEach as t };

package/dist/authorizer-eiOjo-3l.d.ts

@@ -0,0 +1,73 @@
+//#region src/core/authorizer.d.ts
+type JsonObject = Readonly<Record<string, unknown>>;
+/** Who asks (AuthZEN Subject). Always built from the verified request context. */
+interface AuthorizationSubject {
+  /** `user`, `service`, `anon`, or `agent` for a delegated token with an `act` chain. */
+  readonly type: string;
+  readonly id: string;
+  /**
+   * `role`, `email` and `impersonator` when set, and `claims`: the verified
+   * access-token claims (a frozen copy, including what a token hook wrote,
+   * such as `memberships`, `roles` and `act`). The client never supplies
+   * them. Anonymous subjects have no properties.
+   */
+  readonly properties?: JsonObject;
+}
+/** What is acted on (AuthZEN Resource): a table, a topic or an action's target. */
+interface AuthorizationResource {
+  readonly type: string;
+  readonly id?: string;
+  /** The row, for decisions that read it (`get`, `update`, `delete`). */
+  readonly properties?: JsonObject;
+}
+/**
+ * One access request, in the AuthZEN Authorization API 1.0 information
+ * model (`SPEC_PINS.authzen`): subject, action, resource and context.
+ * `action` is the permission reference the authorizer understands.
+ */
+interface AuthorizationRequest<Ref = string> {
+  readonly subject: AuthorizationSubject;
+  readonly action: Ref;
+  readonly resource: AuthorizationResource;
+  /** The tenant, assurance level and scopes of the request. */
+  readonly context: JsonObject;
+}
+type AuthorizationOutcome = {
+  readonly outcome: "granted";
+  readonly context?: JsonObject;
+} | {
+  readonly outcome: "denied";
+  readonly reason?: string;
+  readonly context?: JsonObject;
+} | {
+  readonly outcome: "approval-required";
+  readonly approval?: {
+    readonly id: string;
+  };
+  readonly context?: JsonObject;
+};
+/**
+ * A runtime authorization decision point (API v1). Authorization libraries
+ * ship an adapter that implements it; better-supabase builds every request
+ * and fails closed on anything but `granted`.
+ */
+interface Authorizer<Ref = string> {
+  readonly apiVersion: 1;
+  readonly name: string;
+  /** The stable key of a permission reference, for specs, SQL and messages. */
+  key(ref: Ref): string;
+  /** The default permission for a table operation; lets `permissions: true` work. */
+  forOperation?(table: string, operation: string): Ref | undefined;
+  evaluate(request: AuthorizationRequest<Ref>): AuthorizationOutcome | Promise<AuthorizationOutcome>;
+  /** The batch form (AuthZEN Access Evaluations); results keep the request order. */
+  evaluations?(requests: readonly AuthorizationRequest<Ref>[]): Promise<readonly AuthorizationOutcome[]>;
+}
+type AnyAuthorizer = Authorizer<any>;
+/** The permission reference type of an authorizer, `string` without one. */
+type PermissionRef<A> = A extends Authorizer<infer R> ? R : string;
+/** Identity helper that fixes `apiVersion` and infers `Ref`. */
+declare function defineAuthorizer<Ref = string>(authorizer: Omit<Authorizer<Ref>, "apiVersion"> & {
+  readonly apiVersion?: 1;
+}): Authorizer<Ref>;
+//#endregion
+export { AuthorizationSubject as a, defineAuthorizer as c, AuthorizationResource as i, AuthorizationOutcome as n, Authorizer as o, AuthorizationRequest as r, PermissionRef as s, AnyAuthorizer as t };

package/dist/better-result/index.d.ts

@@ -0,0 +1,118 @@
+import { b as DbError, n as BetterResultApi, t as AsyncResult } from "../result-BchM1XZn.js";
+import { E as PrimaryKeyValue, H as Update, L as TableKey, R as TableMeta, V as UniqueWhere, a as AnyModels, i as AnyFunctions, x as Insert } from "../types-CoE5Zwy4.js";
+import { r as ApplyExtension } from "../plugin-CPK2HsbY.js";
+import { A as OverloadedName, B as UpsertArgs, Bt as WhereInput, C as ManyReturningArgs, Ct as FindOnlyArgs, D as OffsetRangeArgs, E as OffsetPageArgs, G as SearchScore, H as WriteArgs, I as Returned, It as RequestArgs, K as InferReadSetParams, L as RpcArgs, M as PlainName, N as RawRpcOptions, Nt as Payload, O as OverloadArgs, Pt as ReadArgs, R as RpcOptions, S as ManyResult, St as FindManyArgs, U as WriteManyArgs, V as UpsertManyArgs, W as SearchArgs, _ as Db, at as QuerySpec, b as DeleteExt, dt as AggregateArgs, et as ReadSetResult, g as CursorPageArgs, it as InferResult, j as PageOf, k as OverloadReturns, mt as AggregateResult, q as ReadSet, w as NoArgName, x as FindExt, xt as FindFirstArgs, y as DeleteArgs, yt as CountArgs, z as UpdateArgs } from "../define-DmcfoNXB.js";
+import { a as ListExtra, i as ListDefinition, o as ListPage, s as ListPagination, u as ListQuery } from "../list-query-D3JQeEL7.js";
+import { Result } from "better-result";
+//#region src/better-result/better-result.d.ts
+/** better-result's `Result` namespace with the function each `DbError` goes through. */
+interface BetterResultMapping<E> {
+  readonly Result: BetterResultApi<unknown, unknown>;
+  readonly mapError: (error: DbError) => E;
+}
+/** What `withBetterResult` calls on a `defineBetterResultErrors` converter. */
+interface BetterResultErrorsLike {
+  (result: AsyncResult<unknown>): unknown;
+  map(error: DbError): unknown;
+}
+/** A `defineBetterResultErrors` converter or a `{ Result, mapError }` mapping. */
+type BetterResultConverter = BetterResultErrorsLike | BetterResultMapping<unknown>;
+/** The error type a converter produces. */
+type ConvertedError<X> = X extends BetterResultMapping<infer E> ? E : X extends {
+  map(error: DbError): infer E;
+} ? E : never;
+type Out<T, Err> = Promise<Result<T, Err>>;
+/**
+ * A repository whose reads and writes return better-result values. Its
+ * signatures mirror `Repository`, so `select` and `include` still type the rows.
+ */
+interface BetterResultRepository<M extends AnyModels, T extends TableKey<M>, E, Err> {
+  readonly $tableName: T;
+  readonly $meta: TableMeta;
+  findMany<const A extends FindManyArgs<M, T> & FindExt<E, M, T>>(args?: A): Out<Payload<M, T, A>[], Err>;
+  findFirst<const A extends FindFirstArgs<M, T> & FindExt<E, M, T>>(args?: A): Out<Payload<M, T, A> | null, Err>;
+  findOnly<const A extends FindOnlyArgs<M, T> & FindExt<E, M, T>>(args: A): Out<Payload<M, T, A> | null, Err>;
+  findUnique<const A extends ReadArgs<M, T> & {
+    readonly where: UniqueWhere<M, T>;
+  } & FindExt<E, M, T>>(args: A): Out<Payload<M, T, A> | null, Err>;
+  findById<const A extends ReadArgs<M, T> & FindExt<E, M, T>>(id: PrimaryKeyValue<M, T>, args?: A): Out<Payload<M, T, A>, Err>;
+  count(args?: CountArgs<M, T> & FindExt<E, M, T>): Out<number, Err>;
+  aggregate<const A extends AggregateArgs<M, T> & FindExt<E, M, T>>(args: A): Out<AggregateResult<M, T, A>, Err>;
+  exists(args?: RequestArgs & {
+    readonly where?: WhereInput<M, T>;
+  } & FindExt<E, M, T>): Out<boolean, Err>;
+  paginate<const A extends (OffsetPageArgs<M, T> | OffsetRangeArgs<M, T> | CursorPageArgs<M, T>) & FindExt<E, M, T>>(args: A): Out<PageOf<M, T, A>, Err>;
+  create<const A extends WriteArgs<M, T> = {}>(data: Insert<M, T>, args?: A): Out<Returned<M, T, A>, Err>;
+  createMany<const A extends WriteManyArgs<M, T> = {}>(rows: readonly Insert<M, T>[], args?: A): Out<A extends {
+    readonly returning: false;
+  } ? {
+    count: number;
+  } : Payload<M, T, A>[], Err>;
+  update<const A extends UpdateArgs<M, T> = {}>(id: PrimaryKeyValue<M, T>, patch: Update<M, T>, args?: A): Out<Returned<M, T, A>, Err>;
+  updateMany<const A extends ManyReturningArgs<M, T> & {
+    readonly data: Update<M, T>;
+    readonly allowAll?: boolean;
+  } & FindExt<E, M, T>>(args: A): Out<ManyResult<M, T, A>, Err>;
+  upsert<const A extends UpsertArgs<M, T> = {}>(data: Insert<M, T>, args?: A): Out<A extends {
+    readonly ignoreDuplicates: true;
+  } ? Returned<M, T, A> | null : Returned<M, T, A>, Err>;
+  upsertMany<const A extends UpsertManyArgs<M, T> = {}>(rows: readonly Insert<M, T>[], args?: A): Out<A extends {
+    readonly returning: false;
+  } ? {
+    count: number;
+  } : Payload<M, T, A>[], Err>;
+  delete(id: PrimaryKeyValue<M, T>, args?: DeleteArgs & DeleteExt<E, M, T>): Out<void, Err>;
+  deleteMany<const A extends ManyReturningArgs<M, T> & DeleteExt<E, M, T> & FindExt<E, M, T>>(args: A): Out<ManyResult<M, T, A>, Err>;
+}
+/**
+ * Plugin methods that return an `AsyncResult` return a better-result value.
+ * A generic plugin method keeps its parameters but loses its type
+ * parameters; call it on `$db` and pass the result to `$from` instead.
+ */
+type BetterResultMethods<X, Err> = { readonly [K in keyof X]: X[K] extends ((...args: infer P) => AsyncResult<infer R>) ? (...args: P) => Out<R, Err> : X[K]; };
+type BetterResultRepositoryOf<M extends AnyModels, T extends TableKey<M>, E, Err> = BetterResultRepository<M, T, E, Err> & BetterResultMethods<ApplyExtension<E, M, T, "methods">, Err>;
+interface BetterResultHelpers<M extends AnyModels, F extends AnyFunctions, E, C, Err> {
+  /** The `db` this view wraps, for everything that returns plain results. */
+  readonly $db: Db<M, F, E, C>;
+  /** Converts any `AsyncResult`, such as one from a plugin method or `$with`. */
+  $from<T>(result: AsyncResult<T>): Out<T, Err>;
+  $rpc<N extends PlainName<F>>(name: N, ...rest: [...RpcArgs<F, N>, options: RawRpcOptions]): Out<unknown, Err>;
+  $rpc<N extends PlainName<F>, R = F[N]["Returns"]>(name: N, ...rest: [...RpcArgs<F, N>, options?: RpcOptions<R>]): Out<R, Err>;
+  $rpc<N extends OverloadedName<F>, const A extends F[N]["Args"]>(name: N, args: OverloadArgs<F[N], A>, options: RawRpcOptions): Out<unknown, Err>;
+  $rpc<N extends OverloadedName<F>, const A extends F[N]["Args"], R = OverloadReturns<F[N], A>>(name: N, args: OverloadArgs<F[N], A>, options?: RpcOptions<R>): Out<R, Err>;
+  $rpc<N extends NoArgName<F>>(name: N): Out<OverloadReturns<F[N], Record<never, never>>, Err>;
+  $table<T extends TableKey<M>>(name: T): BetterResultRepositoryOf<M, T, E, Err>;
+  $run<S extends QuerySpec<TableKey<M>>>(spec: S, options?: {
+    readonly signal?: AbortSignal;
+  }): Out<InferResult<S>, Err>;
+  $many<S extends ReadSet>(readSet: S, params: InferReadSetParams<S>, options?: {
+    readonly signal?: AbortSignal;
+  }): Out<ReadSetResult<S>, Err>;
+  $many<const S extends readonly QuerySpec<TableKey<M>>[]>(specs: S, options?: {
+    readonly signal?: AbortSignal;
+  }): Out<{ -readonly [K in keyof S]: InferResult<S[K]>; }, Err>;
+  $search<T extends TableKey<M>, const A extends SearchArgs<M, T>>(table: T, args: A): Out<(Payload<M, T, A> & SearchScore<A>)[], Err>;
+  /** Runs a list query (`defineListQuery`) like `list.run(db, query, extra)`. */
+  $list<T extends TableKey<M>, S extends string, LF extends string, LC extends boolean, P extends ListPagination, const A extends ListExtra<M, T> & FindExt<E, M, T>>(list: ListDefinition<M, T, E, S, LF, LC, P>, query: ListQuery<S, LF>, extra?: A): Out<ListPage<Payload<M, T, A>, LF, LC, P>, Err>;
+}
+/** A `db` whose repositories and helpers return better-result values. */
+type BetterResultDb<M extends AnyModels, F extends AnyFunctions, E, C, Err> = { readonly [T in TableKey<M>]: BetterResultRepositoryOf<M, T, E, Err>; } & BetterResultHelpers<M, F, E, C, Err>;
+/**
+ * A view of `db` whose repository methods, `$rpc`, `$run`, `$many`,
+ * `$search` and list queries (`$list`) return better-result `Result`
+ * values. `toResult` is a `defineBetterResultErrors` converter or
+ * `{ Result, mapError }`. `db` itself is unchanged, and `$db` returns it.
+ *
+ * ```ts
+ * import { Result, TaggedError } from 'better-result';
+ * import { defineBetterResultErrors } from 'better-supabase';
+ * import { withBetterResult } from 'better-supabase/better-result';
+ *
+ * const toResult = defineBetterResultErrors(Result, { not_found: NotFound }, DbFailure);
+ * const rdb = withBetterResult(db, toResult);
+ * const customer = await rdb.customers.findById(id); // Result<Customer, NotFound | DbFailure>
+ * ```
+ */
+export declare function withBetterResult<M extends AnyModels, F extends AnyFunctions, E, C, const X extends BetterResultConverter>(db: Db<M, F, E, C>, toResult: X): BetterResultDb<M, F, E, C, ConvertedError<X>>;
+//#endregion
+export type { BetterResultConverter, BetterResultDb, BetterResultErrorsLike, BetterResultHelpers, BetterResultMapping, BetterResultMethods, BetterResultRepository, BetterResultRepositoryOf, ConvertedError };

package/dist/better-result/index.js

@@ -0,0 +1,64 @@
+import { o as toBetterResult, t as AsyncResult } from "../result-DEqHCMKP.js";
+//#region src/better-result/better-result.ts
+const HELPERS = [
+	"$rpc",
+	"$run",
+	"$many",
+	"$search"
+];
+function converterOf(toResult) {
+	if (typeof toResult === "function") return (result) => toResult(result);
+	return (result) => toBetterResult(result, toResult.Result, toResult.mapError);
+}
+function view(db, convert) {
+	const wrap = (value) => value instanceof AsyncResult ? convert(value) : value;
+	const call = (target, method, name) => {
+		if (typeof method !== "function") throw new TypeError(`better-supabase: ${name} is not a function`);
+		return (...args) => wrap(method.apply(target, args));
+	};
+	const repositories = /* @__PURE__ */ new WeakMap();
+	const repository = (target, name) => {
+		if (typeof target !== "object" || target === null) throw new TypeError(`better-supabase: unknown table ${name}`);
+		const cached = repositories.get(target);
+		if (cached) return cached;
+		const wrapped = Object.fromEntries(Object.entries(target).map(([key, value]) => [key, typeof value === "function" ? call(target, value, key) : value]));
+		repositories.set(target, wrapped);
+		return wrapped;
+	};
+	const result = {
+		$db: db,
+		$from: convert,
+		$table: (name) => repository(db.$table(name), name),
+		$list: (list, query, extra) => wrap(list.run(db, query, extra))
+	};
+	for (const key of HELPERS) result[key] = call(db, db[key], `db.${key}`);
+	for (const key in db) {
+		if (key.startsWith("$")) continue;
+		Object.defineProperty(result, key, {
+			enumerable: true,
+			get: () => repository(db.$table(key), key)
+		});
+	}
+	return result;
+}
+/**
+* A view of `db` whose repository methods, `$rpc`, `$run`, `$many`,
+* `$search` and list queries (`$list`) return better-result `Result`
+* values. `toResult` is a `defineBetterResultErrors` converter or
+* `{ Result, mapError }`. `db` itself is unchanged, and `$db` returns it.
+*
+* ```ts
+* import { Result, TaggedError } from 'better-result';
+* import { defineBetterResultErrors } from 'better-supabase';
+* import { withBetterResult } from 'better-supabase/better-result';
+*
+* const toResult = defineBetterResultErrors(Result, { not_found: NotFound }, DbFailure);
+* const rdb = withBetterResult(db, toResult);
+* const customer = await rdb.customers.findById(id); // Result<Customer, NotFound | DbFailure>
+* ```
+*/
+function withBetterResult(db, toResult) {
+	return view(db, converterOf(toResult));
+}
+//#endregion
+export { withBetterResult };

package/dist/{bind-l4kAvYSv.js → bind-ButSzrHe.js}

@@ -1,7 +1,7 @@
 import { n as decodeJwtPayload } from "./base64-D2gsioCY.js";
 import { i as userContext } from "./impersonation-DcqaTBHx.js";
 import { n as identityKey } from "./user-change-XzvgafU4.js";
-import { n as createQueries } from "./query-BQ-NaZon.js";
+import { n as createQueries } from "./query-Ctz-qKRx.js";
 //#region src/client/bind.ts
 const LOADING = {
 	status: "loading",

package/dist/{bind-Bu_ZNa3W.d.ts → bind-CQ5mPyX1.d.ts}

@@ -1,6 +1,6 @@
-import { a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
-import { b as Db, t as BetterSupabase } from "./define-CJJkkr1-.js";
-import { s as BetterQueries } from "./index-Bepi-Hgg.js";
+import { a as AnyModels, i as AnyFunctions } from "./types-CoE5Zwy4.js";
+import { _ as Db, t as BetterSupabase } from "./define-DmcfoNXB.js";
+import { s as BetterQueries } from "./index-DoNVLHOU.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 //#region src/client/bind.d.ts
 interface AuthUser {

package/dist/{block-events-CrT8r7Fe.js → block-events-DTxU5tfr.js}

@@ -1,4 +1,4 @@
-import { t as cloneValue } from "./clone-BfgmLU90.js";
+import { t as cloneValue } from "./clone-dN9XOL1K.js";
 import { s as nowInstant } from "./temporal-BJGitm-h.js";
 //#region src/core/block-events.ts
 /**
@@ -57,10 +57,25 @@ function emitBlockEvent(events, type, data, meta = {}) {
 		...meta,
 		type,
 		data: cloneValue(data),
-		time: nowInstant()
+		time: (events.now ?? nowInstant)()
 	};
 	events.emit("block", event);
 }
+/**
+* The `emit` a block creator calls: skips the work without an event hub and
+* adds the actor and request context from the block's options.
+*/
+function blockEmitter(options) {
+	return (type, data, subject, tenant) => {
+		if (!options.events) return;
+		emitBlockEvent(options.events, type, data, {
+			subject,
+			...tenant ? { tenant } : {},
+			...options.actorId ? { actorId: options.actorId } : {},
+			...options.context ? { context: options.context } : {}
+		});
+	};
+}
 const matches = (pattern, type) => pattern.endsWith(".*") ? type.startsWith(pattern.slice(0, -1)) : pattern === type;
 /**
 * Listens to the block events that match `pattern` (`'support.started'` or
@@ -73,4 +88,4 @@ function onBlockEvent(betterSupabase, pattern, handler) {
 	});
 }
 //#endregion
-export { onBlockEvent as a, emitBlockEvent as i, BLOCK_EVENT_RENAMES as n, blockEventAttributes as r, BLOCK_ATTRIBUTES as t };
+export { emitBlockEvent as a, blockEventAttributes as i, BLOCK_EVENT_RENAMES as n, onBlockEvent as o, blockEmitter as r, BLOCK_ATTRIBUTES as t };

package/dist/{block-fields-GFkxl4dP.js → block-fields-CroxUuF2.js}

@@ -1,6 +1,6 @@
-import { n as dbError } from "./errors-B11Duf73.js";
-import { a as ok, r as err } from "./result-DzUbqgdW.js";
-import { t as toIssues } from "./standard-BK0cqJ7y.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
+import { a as ok, r as err } from "./result-DEqHCMKP.js";
+import { t as toIssues } from "./standard-DkzZUneg.js";
 //#region src/core/block-fields.ts
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 async function run(schema, value) {

package/dist/{block-fields-SJ6fEf3o.d.ts → block-fields-D1pfrcIY.d.ts}

@@ -1,5 +1,5 @@
-import { f as Result } from "./result-D7y2fT87.js";
-import { t as StandardSchemaV1 } from "./standard-CYsm7xpT.js";
+import { f as Result } from "./result-BchM1XZn.js";
+import { t as StandardSchemaV1 } from "./standard-lmkbOtPB.js";
 //#region src/core/block-fields.d.ts
 /** The fields a `fields` schema adds, or none when the block has no schema. */
 type FieldsOf<S> = S extends StandardSchemaV1<unknown, infer O> ? O extends object ? O : never : Record<never, never>;

package/dist/{block-helpers-CKtbFcRv.d.ts → block-helpers-C0Xj8War.d.ts}

@@ -1,5 +1,5 @@
-import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
-import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
+import { t as AsyncResult, w as ErrorMapper } from "./result-BchM1XZn.js";
+import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
 //#region src/core/block-helpers.d.ts
 /** The `temporal` option every block creator takes. */
 interface BlockTemporalOptions {

package/dist/{block-helpers-DWHxHsEQ.js → block-helpers-Cy3pB96I.js}

@@ -1,9 +1,10 @@
-import { c as mapDbError, n as dbError } from "./errors-B11Duf73.js";
+import { c as mapDbError, n as dbError, r as dbErrorOf } from "./errors-2M6CKMP4.js";
 import { l as provideTemporal } from "./temporal-BJGitm-h.js";
-import { t as temporal } from "./temporal-required-BVvW7SYJ.js";
-import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-DzUbqgdW.js";
-import { t as fromPgError } from "./executor-De1Of3m3.js";
-import { t as rawError } from "./block-transport-BLr-ZgLc.js";
+import { t as temporal } from "./temporal-required-BtynQtM-.js";
+import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-DEqHCMKP.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { t as fromPgError } from "./executor-B_Hfobee.js";
+import { n as rawError } from "./block-transport-bAKh-dGc.js";
 //#region src/core/block-helpers.ts
 /** Provides `options.temporal`, when set, for the block's time values. */
 function applyTemporal(options) {
@@ -11,6 +12,16 @@ function applyTemporal(options) {
 }
 /** The block schema when the options name none. */
 const DEFAULT_BLOCK_SCHEMA = "better_supabase";
+/**
+* A thrown error as a `DbError`: a database error goes through the app's
+* mappers first, and a `DbError` a transport already built stays as it is.
+*/
+function toBlockError(cause, mappers = []) {
+	const known = dbErrorOf(cause);
+	if (known) return known;
+	const raw = rawError(cause);
+	return raw ? mapDbError(raw, mappers) : toDbError(cause);
+}
 /** A `BlockCall` over `transport`, in `schema`, with the app's error mappers first. */
 function blockCall(transport, schema = DEFAULT_BLOCK_SCHEMA, mappers = []) {
 	return (fn, args, then) => AsyncResult.from(async () => {
@@ -18,13 +29,30 @@ function blockCall(transport, schema = DEFAULT_BLOCK_SCHEMA, mappers = []) {
 		try {
 			value = await transport.call(schema, fn, args);
 		} catch (cause) {
-			const raw = rawError(cause);
-			return err(raw ? mapDbError(raw, mappers) : toDbError(cause));
+			return err(toBlockError(cause, mappers));
 		}
 		return ok(await then(value));
 	});
 }
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** A budget of `ms` milliseconds from now, or none for `undefined`. `now` is injectable for tests. */
+function budget(ms, now = Date.now) {
+	const deadline = ms === void 0 ? Number.POSITIVE_INFINITY : now() + ms;
+	return {
+		deadline,
+		expired: () => now() >= deadline,
+		remaining: () => deadline - now()
+	};
+}
+/**
+* Calls `extend` at half the lease (at least every second) until the returned
+* function is called, so work that outlasts its lease keeps it.
+*/
+function leaseHeartbeat(leaseSeconds, extend) {
+	const timer = setInterval(extend, Math.max(1e3, leaseSeconds * 1e3 / 2));
+	return () => {
+		clearInterval(timer);
+	};
+}
 const textOf = (value) => typeof value === "string" ? value : String(value);
 const optionalText = (value) => value === null || value === void 0 ? void 0 : textOf(value);
 /** A function result that must be an object. */
@@ -63,6 +91,10 @@ function credentialRefOf(value) {
 const notFoundError = (message, hint) => dbError("not_found", message, hint === void 0 ? {} : { hint });
 /** A `timestamptz` from jsonb or `pg`, or `undefined` for null. */
 const optionalInstant = (value) => value === null || value === void 0 ? void 0 : value instanceof Date || typeof value === "string" ? toInstant(value) : void 0;
+/** Text from jsonb, or `null` when it is missing or not text. */
+const nullableText = (value) => optionalText(value) ?? null;
+/** A `timestamptz` from jsonb or `pg`, or `null` when it is missing. */
+const nullableInstant = (value) => optionalInstant(value) ?? null;
 /** A `timestamptz` that must be there; throws when it is null or missing. */
 function requiredInstant(value, field) {
 	const instant = optionalInstant(value);
@@ -187,4 +219,4 @@ function pageOf(options = {}) {
 	};
 }
 //#endregion
-export { workerId as A, run as C, stringsOf as D, sleep as E, textOf as O, requiredInstant as S, sha256Hex as T, randomToken as _, credentialRefOf as a, recordOrEmpty as b, errorText as c, isRecord as d, notFoundError as f, pageOf as g, optionalText as h, blockCall as i, toInstant as k, injectableOf as l, optionalInstant as m, applyTemporal as n, eachLimit as o, oneOf as p, asDbError as r, enumOrThrow as s, DEFAULT_BLOCK_SCHEMA as t, instantArg as u, readBodyCapped as v, seconds as w, recordsOf as x, recordOf as y };
+export { stringsOf as A, recordOrEmpty as C, seconds as D, run as E, toBlockError as M, toInstant as N, sha256Hex as O, workerId as P, recordOf as S, requiredInstant as T, optionalInstant as _, budget as a, randomToken as b, enumOrThrow as c, instantArg as d, leaseHeartbeat as f, oneOf as g, nullableText as h, blockCall as i, textOf as j, sleep as k, errorText as l, nullableInstant as m, applyTemporal as n, credentialRefOf as o, notFoundError as p, asDbError as r, eachLimit as s, DEFAULT_BLOCK_SCHEMA as t, injectableOf as u, optionalText as v, recordsOf as w, readBodyCapped as x, pageOf as y };

package/dist/{block-hooks-BmjMyXTa.js → block-hooks-BPNMIlLl.js}

@@ -1,7 +1,7 @@
-import { n as dbError, o as isDbError } from "./errors-B11Duf73.js";
-import { r as err, t as AsyncResult } from "./result-DzUbqgdW.js";
+import { n as dbError, o as isDbError } from "./errors-2M6CKMP4.js";
+import { r as err, t as AsyncResult } from "./result-DEqHCMKP.js";
 import { t as consoleLogger } from "./logger-glM28NVN.js";
-import { i as blockCall } from "./block-helpers-DWHxHsEQ.js";
+import { i as blockCall } from "./block-helpers-Cy3pB96I.js";
 //#region src/core/block-hooks.ts
 const isPlainObject = (value) => {
 	const proto = Object.getPrototypeOf(value);

package/dist/{block-hooks-plbZ0AbJ.d.ts → block-hooks-DaOVC7SC.d.ts}

@@ -1,7 +1,7 @@
-import { b as DbError, f as Result, t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
-import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
+import { b as DbError, f as Result, t as AsyncResult, w as ErrorMapper } from "./result-BchM1XZn.js";
+import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as BlockCall } from "./block-helpers-CKtbFcRv.js";
+import { t as BlockCall } from "./block-helpers-C0Xj8War.js";
 //#region src/core/block-hooks.d.ts
 /** A block method: anything that returns an `AsyncResult`. */
 type BlockMethod = (...args: never[]) => AsyncResult<unknown>;

package/dist/{block-transport-BLr-ZgLc.js → block-transport-bAKh-dGc.js}

@@ -1,4 +1,5 @@
-import { r as sqlIdent } from "./template--jDkl3UP.js";
+import { t as DbException } from "./db-exception-CnWcYPxL.js";
+import { i as sqlIdent } from "./template-lPVh-EwW.js";
 //#region src/core/block-transport.ts
 /**
 * Calls the functions over Postgres, as the user `client` runs as:
@@ -31,6 +32,31 @@ function rpcTransport(client, options = {}) {
 		return data;
 	} };
 }
+/**
+* Calls the functions through a `Db`'s executor, so a block runs wherever
+* the `Db` does: over PostgREST for `ctx.db` in a normal request, and over
+* direct Postgres as the target in a support session or for an API key.
+* Rejects with the raw database error, like the other transports, so the
+* block's error mappers see the same codes and hints.
+*/
+function dbTransport(db, options = {}) {
+	return { async call(schema, fn, args) {
+		const executor = db.$executor;
+		if (!executor.rpc) throw new TypeError(`dbTransport needs an executor with rpc(); the ${executor.name} executor has none`);
+		let raw;
+		const capture = (error) => {
+			raw = error;
+		};
+		const defined = Object.fromEntries(Object.entries(args).filter(([, value]) => value !== void 0));
+		const result = await executor.rpc(fn, defined, {
+			schema: options.schema ?? schema,
+			errorMappers: [capture]
+		});
+		if (result.ok) return result.data;
+		if (raw === void 0) throw new DbException(result.error);
+		throw Object.assign(new Error(raw.message ?? result.error.message), raw);
+	} };
+}
 const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /** The Postgres or PostgREST error a transport rejected with, if it is one. */
 function rawError(cause) {
@@ -56,4 +82,4 @@ function rawError(cause) {
 	return raw;
 }
 //#endregion
-export { rpcTransport as n, sqlTransport as r, rawError as t };
+export { sqlTransport as i, rawError as n, rpcTransport as r, dbTransport as t };