better-supabase 0.7.1 → 0.8.0

package/dist/{json-schema-CvER4kgT.js → json-schema-CT4tvrkA.js}

@@ -1,4 +1,76 @@
-import { t as isList } from "./guards-BnzDvFrz.js";
+import { t as isList } from "./guards-6F2bCtQR.js";
+import { r as tableJsonSchema, t as forTarget } from "./table-schema-htM_SbCW.js";
+//#region src/generators/json-schema-target.ts
+function isObject(value) {
+	return typeof value === "object" && value !== null && !isList(value);
+}
+/** Keywords whose value is one subschema. */
+const SINGLE = /* @__PURE__ */ new Set([
+	"additionalProperties",
+	"additionalItems",
+	"contains",
+	"propertyNames",
+	"not",
+	"if",
+	"then",
+	"else"
+]);
+/** Keywords whose value is a list of subschemas. */
+const LISTS = /* @__PURE__ */ new Set([
+	"allOf",
+	"anyOf",
+	"oneOf"
+]);
+/** Keywords whose value maps names to subschemas. */
+const MAPS = /* @__PURE__ */ new Set([
+	"properties",
+	"patternProperties",
+	"definitions"
+]);
+/** 2020-12 keywords draft-07 has no equivalent for; draft-07 would ignore them. */
+const DROPPED = /* @__PURE__ */ new Set([
+	"$dynamicAnchor",
+	"$anchor",
+	"unevaluatedProperties",
+	"unevaluatedItems"
+]);
+function mapValues(value, convert) {
+	if (!isObject(value)) return value;
+	return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, isObject(child) ? convert(child) : child]));
+}
+/**
+* Rewrites a 2020-12 schema into draft-07: `$defs` becomes `definitions`
+* (and `$ref`s into it follow), `prefixItems` becomes the array form of
+* `items`, `dependentRequired` and `dependentSchemas` become
+* `dependencies`, and keywords without a draft-07 form are left out. A
+* draft-07 schema passes through unchanged.
+*/
+function toDraft07(schema) {
+	const out = {};
+	const dependencies = {};
+	for (const [key, value] of Object.entries(schema)) {
+		if (DROPPED.has(key)) continue;
+		if (key === "$schema") continue;
+		if (key === "$defs") out["definitions"] = mapValues(value, toDraft07);
+		else if (key === "$ref" || key === "$dynamicRef") out["$ref"] = typeof value === "string" ? value.replace(/^#\/\$defs\//, "#/definitions/") : value;
+		else if (key === "prefixItems" && isList(value)) out["items"] = value.map((item) => isObject(item) ? toDraft07(item) : item);
+		else if (key === "items") {
+			const converted = isObject(value) ? toDraft07(value) : value;
+			if (schema["prefixItems"] === void 0) out["items"] = converted;
+			else out["additionalItems"] = converted;
+		} else if (key === "dependentRequired" || key === "dependentSchemas") Object.assign(dependencies, mapValues(value, toDraft07));
+		else if (SINGLE.has(key) && isObject(value)) out[key] = toDraft07(value);
+		else if (LISTS.has(key) && isList(value)) out[key] = value.map((item) => isObject(item) ? toDraft07(item) : item);
+		else if (MAPS.has(key)) out[key] = mapValues(value, toDraft07);
+		else out[key] = value;
+	}
+	if (Object.keys(dependencies).length > 0) out["dependencies"] = {
+		...isObject(out["dependencies"]) ? out["dependencies"] : {},
+		...dependencies
+	};
+	return out;
+}
+//#endregion
 //#region src/generators/shared.ts
 const INTEGER = /* @__PURE__ */ new Set([
 	"int2",
@@ -86,15 +158,20 @@ function temporalGuardImport(input) {
 		const guard = TEMPORAL_GUARDS[plan.scalar.kind];
 		if (guard) names.add(guard);
 	}
-	return names.size === 0 ? void 0 : `import { ${[...names].sort().join(", ")} } from "better-supabase";`;
+	return names.size === 0 ? void 0 : `import { ${[...names].sort().join(", ")} } from ${JSON.stringify(input.runtimeImport ?? "better-supabase")};`;
 }
 const EXAMPLE = /^\s*@example\s+(.+?)\s*$/gm;
+const DEPRECATED = /^\s*@deprecated\b.*$/gm;
+const IS_DEPRECATED = /^\s*@deprecated\b/m;
 /**
 * Splits a comment into its description and `@example` lines. An example is
 * JSON (`@example 42`, `@example "KVK-1"`) or, when it doesn't parse, text.
+* A `@deprecated` line (with or without text) sets `deprecated` and is left
+* out of the description.
 */
 function parseComment(comment) {
 	if (!comment) return { examples: [] };
+	const deprecated = IS_DEPRECATED.test(comment);
 	const examples = [...comment.matchAll(EXAMPLE)].map((match) => {
 		const raw = match[1] ?? "";
 		try {
@@ -103,11 +180,12 @@ function parseComment(comment) {
 			return raw;
 		}
 	});
-	const description = comment.replace(EXAMPLE, "").trim();
-	return description ? {
-		description,
-		examples
-	} : { examples };
+	const description = comment.replace(EXAMPLE, "").replace(DEPRECATED, "").trim();
+	return {
+		...description ? { description } : {},
+		examples,
+		...deprecated ? { deprecated: true } : {}
+	};
 }
 const COMPARISON = /^(?:(char_length|length)\(\(?"?(\w+)"?\)?(?:::[\w ]+)?\)|\(?"?(\w+)"?\)?(?:::[\w ]+)?)\s*(>=|>|<=|<)\s*\(?'?(-?\d+(?:\.\d+)?)'?\)?(?:::[\w ]+)?$/;
 const REVERSED = /^\(?'?(-?\d+(?:\.\d+)?)'?\)?(?:::[\w ]+)?\s*(>=|>|<=|<)\s*(?:(char_length|length)\(\(?"?(\w+)"?\)?(?:::[\w ]+)?\)|\(?"?(\w+)"?\)?(?:::[\w ]+)?)$/;
@@ -332,6 +410,21 @@ function fieldDocs(docs, plan) {
 		...text ? pick(found, ["minLength", "maxLength"]) : {}
 	};
 }
+/**
+* A field as `tableSchema()` and `tableJsonSchema()` read it. A jsonb column
+* with a configured TypeScript type becomes `custom`; set `schema` on the
+* result for one with a validator.
+*/
+function fieldSpec(plan, docs) {
+	return {
+		...plan.customJson ? { kind: "custom" } : plan.scalar,
+		...plan.nullable ? { nullable: true } : {},
+		...plan.optional ? { optional: true } : {},
+		...plan.column.array ? { array: true } : {},
+		...plan.managed ? { readOnly: true } : {},
+		...docs
+	};
+}
 function pick(bounds, keys) {
 	const out = {};
 	for (const key of keys) {
@@ -382,108 +475,61 @@ function parseImport(spec) {
 }
 //#endregion
 //#region src/generators/json-schema.ts
-function scalar(kind) {
-	switch (kind.kind) {
-		case "uuid": return {
-			type: "string",
-			format: "uuid"
-		};
-		case "string": return { type: "string" };
-		case "integer": return { type: "integer" };
-		case "number": return { type: "number" };
-		case "boolean": return { type: "boolean" };
-		case "datetime": return {
-			type: "string",
-			format: "date-time"
-		};
-		case "date": return {
-			type: "string",
-			format: "date"
-		};
-		case "instant": return {
-			type: "string",
-			format: "date-time"
-		};
-		case "plainDateTime": return {
-			type: "string",
-			pattern: "^\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}:\\d{2}(\\.\\d+)?$"
-		};
-		case "bigint": return {
-			type: "string",
-			pattern: "^-?\\d+$"
-		};
-		case "json":
-		case "unknown": return {};
-		case "enum": return {
-			type: "string",
-			enum: [...kind.values]
-		};
-		default: return kind;
-	}
-}
-function property(plan, docs) {
-	const { description, examples, ...bounds } = docs;
-	const schema = {
-		...nullable(plan, bounds),
-		...description === void 0 ? {} : { description },
-		...examples === void 0 ? {} : { examples: [...examples] }
-	};
-	return plan.managed ? {
+/** Marks the deprecated table and columns, which only `meta` knows about. */
+function withDeprecated(schema, deprecated, columns) {
+	if (!deprecated && columns.length === 0) return schema;
+	const properties = schema["properties"];
+	return {
 		...schema,
-		readOnly: true
-	} : schema;
-}
-function nullable(plan, bounds) {
-	let schema = {
-		...scalar(plan.scalar),
-		...bounds
+		...deprecated ? { deprecated: true } : {},
+		...columns.length > 0 && typeof properties === "object" && properties ? { properties: Object.fromEntries(Object.entries(properties).map(([name, value]) => [name, columns.includes(name) && typeof value === "object" && value ? {
+			...value,
+			deprecated: true
+		} : value])) } : {}
 	};
-	if (plan.column.array) schema = {
-		type: "array",
-		items: schema
-	};
-	if (!plan.nullable) return schema;
-	if (Object.keys(schema).length === 0) return schema;
-	const { enum: values, ...rest } = schema;
-	if (isList(values)) return {
-		...rest,
-		type: ["string", "null"],
-		enum: [...values, null]
-	};
-	return typeof schema["type"] === "string" ? {
-		...schema,
-		type: [schema["type"], "null"]
-	} : { anyOf: [schema, { type: "null" }] };
 }
-/** JSON Schema (2020-12) `$defs` for every table: `customersRow`, `customersInsert`, ... */
-function buildJsonSchema(input, id) {
+/**
+* JSON Schema `$defs` for every table: `customersRow`, `customersInsert`,
+* ... `target` lowers the document to draft-07 or the OpenAPI 3.0 dialect,
+* which keep the schemas under `definitions`.
+*/
+function buildJsonSchema(input, id, target = "draft-2020-12") {
 	const defs = {};
 	for (const [key, table] of tableEntries(input)) {
 		const docs = tableDocs(input, table);
+		const description = docs ? docs.description : table.description;
 		for (const variant of variantsFor(table)) {
-			const properties = {};
-			const required = [];
-			for (const plan of fieldsFor(table, variant, input)) {
-				properties[plan.name] = property(plan, fieldDocs(docs, plan));
-				if (!plan.optional) required.push(plan.name);
-			}
-			defs[`${key}${variant}`] = {
-				...docs ? {
-					title: variantTitle(docs, variant),
-					...docs.description === void 0 ? {} : { description: docs.description }
-				} : {},
-				type: "object",
-				properties,
-				...required.length > 0 ? { required } : {},
-				additionalProperties: false
-			};
+			const plans = fieldsFor(table, variant, input);
+			const schema = tableJsonSchema({
+				...docs ? { title: variantTitle(docs, variant) } : {},
+				...description === void 0 ? {} : { description },
+				fields: Object.fromEntries(plans.map((plan) => {
+					const spec = fieldSpec(plan, fieldDocs(docs, plan));
+					return [plan.name, docs || plan.column.description === void 0 ? spec : {
+						description: plan.column.description,
+						...spec
+					}];
+				}))
+			});
+			defs[`${key}${variant}`] = withDeprecated(schema, table.deprecated === true, plans.filter((plan) => plan.column.deprecated).map((plan) => plan.name));
 		}
 	}
-	return {
-		$schema: "https://json-schema.org/draft/2020-12/schema",
-		...id ? { $id: id } : {},
-		$defs: defs
-	};
+	switch (target) {
+		case "draft-2020-12": return {
+			$schema: "https://json-schema.org/draft/2020-12/schema",
+			...id ? { $id: id } : {},
+			$defs: defs
+		};
+		case "draft-07": return forTarget({
+			...id ? { $id: id } : {},
+			definitions: Object.fromEntries(Object.entries(defs).map(([name, def]) => [name, toDraft07(def)]))
+		}, "draft-07");
+		case "openapi-3.0": return {
+			...id ? { $id: id } : {},
+			definitions: Object.fromEntries(Object.entries(defs).map(([name, def]) => [name, forTarget(def, "openapi-3.0")]))
+		};
+		default: return target;
+	}
 }
 /** Writes the JSON Schema document; `createOpenApi` reuses the same `$defs`. */
 function jsonSchema(options = {}) {
@@ -493,10 +539,10 @@ function jsonSchema(options = {}) {
 		generate(input) {
 			return [{
 				path: options.output ?? siblingPath(input.config.output, "schema.json"),
-				contents: `${JSON.stringify(buildJsonSchema(input, options.id), null, 2)}\n`
+				contents: `${JSON.stringify(buildJsonSchema(input, options.id, options.target), null, 2)}\n`
 			}];
 		}
 	};
 }
 //#endregion
-export { fieldsFor as a, propertyKey as c, siblingPath as d, tableDocs as f, variantsFor as g, variantTitle as h, fieldDocs as i, rowType as l, temporalGuardImport as m, jsonSchema as n, optionalLine as o, tableEntries as p, HEADER as r, parseImport as s, buildJsonSchema as t, schemaName as u };
+export { variantsFor as _, fieldSpec as a, parseImport as c, schemaName as d, siblingPath as f, variantTitle as g, temporalGuardImport as h, fieldDocs as i, propertyKey as l, tableEntries as m, jsonSchema as n, fieldsFor as o, tableDocs as p, HEADER as r, optionalLine as s, buildJsonSchema as t, rowType as u, toDraft07 as v };

package/dist/{kit-Fm-Fv7q5.js → kit-BhHr9T9v.js}

@@ -1,8 +1,10 @@
-import { n as dbError } from "./errors-B11Duf73.js";
-import { n as validate } from "./standard-BK0cqJ7y.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
+import { n as validate } from "./standard-DkzZUneg.js";
 import { n as claimAt } from "./claims-PqzCxaTD.js";
-import { n as toSession } from "./view-BeFcRV6G.js";
-import { o as settle, r as guard } from "./respond-BUgsXNgk.js";
+import { t as authContext } from "./context-nPDvQ-Zl.js";
+import { n as toSession } from "./view-D5ryq3gz.js";
+import { o as settle, r as guard } from "./respond-volM3ByS.js";
+import { n as checkPermission } from "./authorizer-ayxUDXXP.js";
 //#region src/server/kit.ts
 /** `FormData` as a plain object; repeated keys become arrays. */
 function formDataObject(form) {
@@ -21,11 +23,35 @@ function actionError(error) {
 		error
 	};
 }
-/** `requireTenant` and `authorize`: the session and tenant, or why the caller is refused. */
-async function authorizeCaller(auth, checks, input, tenant) {
+/** What a `permission` on an action or route is checked against. */
+function callerResource(input) {
+	if (input === void 0 || input instanceof Request) return { type: "route" };
+	if (typeof input !== "object" || input === null || Array.isArray(input) || input instanceof FormData) return { type: "action" };
+	return {
+		type: "action",
+		properties: input
+	};
+}
+/**
+* `requireTenant`, `roles`, `permission` and `authorize`, in that order: the
+* session and tenant, or why the caller is refused.
+*/
+async function authorizeCaller(auth, checks, input, tenant, authorizer) {
 	const session = toSession(auth);
 	if (checks.requireTenant && tenant === void 0) return dbError("forbidden", "Choose an organization first", { code: "NO_TENANT" });
 	if (checks.roles && !hasRole(auth, checks.roles, checks.roleClaim)) return dbError("forbidden", "You do not have the role this needs", { code: "MISSING_ROLE" });
+	if (checks.permission !== void 0) {
+		const permitted = await checkPermission({
+			authorizer,
+			permission: checks.permission,
+			resource: callerResource(input),
+			context: {
+				...authContext(auth),
+				...tenant === void 0 ? {} : { tenant }
+			}
+		});
+		if (!permitted.ok) return permitted.error;
+	}
 	if (checks.authorize && !await checks.authorize(session, input)) return dbError("forbidden", "You are not allowed to do this", { code: "NOT_AUTHORIZED" });
 	return {
 		session,
@@ -33,8 +59,8 @@ async function authorizeCaller(auth, checks, input, tenant) {
 	};
 }
 /** `guard`, then `authorizeCaller`: the caller, or the refusal. */
-async function requireCaller(auth, options, tenant) {
-	return guard(auth, options.allow, options.aal, options.scopes) ?? authorizeCaller(auth, options, void 0, tenant);
+async function requireCaller(auth, options, tenant, authorizer) {
+	return guard(auth, options.allow, options.aal, options.scopes) ?? authorizeCaller(auth, options, void 0, tenant, authorizer);
 }
 /**
 * Runs an action body with the guard, input validation and authorize checks
@@ -42,7 +68,7 @@ async function requireCaller(auth, options, tenant) {
 * unwrap, thrown `DbException`s become errors, other throws propagate (so
 * framework redirects keep working).
 */
-async function runAction(auth, options, input, tenant, body) {
+async function runAction(auth, options, input, tenant, body, authorizer) {
 	const denied = guard(auth, options.allow, options.aal, options.scopes);
 	if (denied) return actionError(denied);
 	let parsed = input instanceof FormData ? formDataObject(input) : input;
@@ -51,7 +77,7 @@ async function runAction(auth, options, input, tenant, body) {
 		if (!checked.ok) return actionError(checked.error);
 		parsed = checked.data;
 	}
-	const caller = await authorizeCaller(auth, options, parsed, tenant);
+	const caller = await authorizeCaller(auth, options, parsed, tenant, authorizer);
 	if ("kind" in caller) return actionError(caller);
 	const settled = await settle(() => body(parsed, caller));
 	return settled.ok ? {

package/dist/{kit-CkNzZUqv.d.ts → kit-W99LCPBS.d.ts}

@@ -1,7 +1,7 @@
-import { b as DbError } from "./result-D7y2fT87.js";
-import { r as AuthState } from "./resolve-ChTYeTEl.js";
-import { t as AuthSession } from "./view-CF7ihnkg.js";
-import { r as GuardOptions } from "./respond-DprrgyXX.js";
+import { b as DbError } from "./result-BchM1XZn.js";
+import { r as AuthState } from "./resolve-MxXVWyhd.js";
+import { t as AuthSession } from "./view-TpXEUcVN.js";
+import { r as GuardOptions } from "./respond-Cw-zanCm.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/server/kit.d.ts
 /** What a server action returns: plain data, safe across any serialization boundary. */
@@ -18,13 +18,19 @@ type ActionResult<T> = {
  * Checks after `allow`, `aal` and `scopes`. A caller who fails one gets
  * `forbidden`: an `ActionResult` error, a 403, or the framework's refusal.
  */
-interface AuthorizeOptions<I, C, P, R extends boolean> {
+interface AuthorizeOptions<I, C, P, R extends boolean, Ref = unknown> {
   /** Refuse callers without an active tenant, so `ctx.tenant` is a string. */
   readonly requireTenant?: R;
   /** Admit only users holding one of these roles at `roleClaim`. */
   readonly roles?: readonly string[];
   /** The dotted claim path `roles` reads: one string or an array. Defaults to `app_metadata.role`. */
   readonly roleClaim?: string;
+  /**
+   * The permission the server's `authorizer` must grant. Without an
+   * authorizer, or on any outcome but `granted`, the caller is refused;
+   * `approval-required` refuses with `code: "APPROVAL_REQUIRED"`.
+   */
+  readonly permission?: Ref;
   /** Return `false` to refuse the caller, e.g. `(session, input) => input.ownerId === session.user.id`. */
   readonly authorize?: (session: AuthSession<C, P>, input: I) => boolean | Promise<boolean>;
 }
@@ -46,12 +52,12 @@ type Unwrapped<T> = T extends {
   readonly ok: false;
 } ? never : T;
 /** Guard, authorize and validate options of a framework-neutral action. */
-interface BlockActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R> {
+interface BlockActionOptions<S extends StandardSchemaV1 | undefined, C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<ActionParsed<S>, C, P, R, Ref> {
   /** Validates the input (plain object or `FormData`) with any Standard Schema. */
   readonly input?: S;
 }
 /** The guard and authorize checks of a loader, page or route. */
-interface BlockRequireOptions<C = unknown, P = unknown, R extends boolean = boolean> extends GuardOptions, AuthorizeOptions<undefined, C, P, R> {}
+interface BlockRequireOptions<C = unknown, P = unknown, R extends boolean = boolean, Ref = unknown> extends GuardOptions, AuthorizeOptions<undefined, C, P, R, Ref> {}
 /** The strings at a dotted claim path: one string, or every string in an array. */
 declare function rolesAt(claims: Readonly<Record<string, unknown>> | undefined, path: string): readonly string[];
 /** Whether a signed-in caller holds one of `roles` at the claim `path`. */

package/dist/{knowledge-BXBbT0Tr.d.ts → knowledge-CAReFpRA.d.ts}

@@ -1,9 +1,9 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
-import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
-import { f as AiFiles, o as AiFile } from "./types-C05bxW-W.js";
-import { m as JobHandler } from "./queue-CLJurhdy.js";
+import { t as AsyncResult, w as ErrorMapper } from "./result-BchM1XZn.js";
+import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
+import { r as BlockTemporalOptions } from "./block-helpers-C0Xj8War.js";
+import { f as AiFiles, o as AiFile } from "./types-Bb_4-vdW.js";
+import { m as JobHandler } from "./types-D__3EN0q.js";
 //#region src/blocks/knowledge/knowledge.d.ts
 /**
  * Turns texts into vectors. `model` is stored with each document, so a

package/dist/{knowledge-CDmiMLew.js → knowledge-DnHtb64A.js}

@@ -1,8 +1,9 @@
 import { t as DbException } from "./db-exception-CnWcYPxL.js";
-import { n as dbError } from "./errors-B11Duf73.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-DzUbqgdW.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-DEqHCMKP.js";
 import { t as vectorLiteral } from "./search-CUWCRYKL.js";
-import { C as run, O as textOf, b as recordOrEmpty, c as errorText, d as isRecord, h as optionalText, i as blockCall, k as toInstant, l as injectableOf, n as applyTemporal, x as recordsOf, y as recordOf } from "./block-helpers-DWHxHsEQ.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { C as recordOrEmpty, E as run, N as toInstant, S as recordOf, i as blockCall, j as textOf, l as errorText, n as applyTemporal, u as injectableOf, v as optionalText, w as recordsOf } from "./block-helpers-Cy3pB96I.js";
 //#region src/blocks/knowledge/knowledge.ts
 const SCOPES = /* @__PURE__ */ new Set([
 	"organization",

package/dist/list/index.d.ts

@@ -1,3 +1,2 @@
-import { _ as defineListQuery, a as ListExtra, c as ListParseResult, d as ListQueryConfig, f as ListQueryInput, g as UNSET, h as ParserSpec, i as ListDefinition, l as ListParsers, m as OpenApiParameter, n as FacetCounts, o as ListPage, p as ListSearchParams, r as FacetInfo, s as ListPagination, t as FacetCountFields, u as ListQuery } from "../list-query-BRt-zDF7.js";
-import "../index-CaxrMD1A.js";
+import { _ as defineListQuery, a as ListExtra, c as ListParseResult, d as ListQueryConfig, f as ListQueryInput, g as UNSET, h as ParserSpec, i as ListDefinition, l as ListParsers, m as OpenApiParameter, n as FacetCounts, o as ListPage, p as ListSearchParams, r as FacetInfo, s as ListPagination, t as FacetCountFields, u as ListQuery } from "../list-query-D3JQeEL7.js";
 export { type FacetCountFields, type FacetCounts, type FacetInfo, type ListDefinition, type ListExtra, type ListPage, type ListPagination, type ListParseResult, type ListParsers, type ListQuery, type ListQueryConfig, type ListQueryInput, type ListSearchParams, type OpenApiParameter, type ParserSpec, UNSET, defineListQuery };

package/dist/{list-query-BRt-zDF7.d.ts → list-query-D3JQeEL7.d.ts}

@@ -1,7 +1,7 @@
-import { E as ValidationIssue, t as AsyncResult } from "./result-D7y2fT87.js";
-import { L as TableKey, M as Row, a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
-import { l as CountMode } from "./executor-DvsBbNBS.js";
-import { At as OrderByArg, Ct as IncludeArg, D as OffsetPage, It as SelectArg, M as RepositoryOf, Mt as Payload, O as OffsetPageArgs, t as BetterSupabase, v as CursorPage, w as FindExt, y as CursorPageArgs, zt as WhereInput } from "./define-CJJkkr1-.js";
+import { E as ValidationIssue, t as AsyncResult } from "./result-BchM1XZn.js";
+import { L as TableKey, M as Row, a as AnyModels, i as AnyFunctions } from "./types-CoE5Zwy4.js";
+import { l as CountMode } from "./executor-Drzu3dBK.js";
+import { Bt as WhereInput, E as OffsetPageArgs, F as RepositoryOf, Lt as SelectArg, Nt as Payload, T as OffsetPage, g as CursorPageArgs, h as CursorPage, jt as OrderByArg, t as BetterSupabase, wt as IncludeArg, x as FindExt } from "./define-DmcfoNXB.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/list/list-query.d.ts
 /** Facet value meaning "not set": filters with `is null`. */

package/dist/mcp/index.d.ts

@@ -1,10 +1,22 @@
-import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
-import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-Bh0EVSwU.js";
-import { r as GuardOptions } from "../respond-DprrgyXX.js";
-import { i as ResourceOperation } from "../index-Bxih3l0u.js";
-import { a as ResourceRouteOptions } from "../resource-IPS5xi9q.js";
+import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-CoE5Zwy4.js";
+import { E as ResourceOperation } from "../model-OgBxvk3N.js";
+import { s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
+import { t as BetterSupabase } from "../define-DmcfoNXB.js";
+import { i as ServerContext, s as ServerOptions, t as BetterServer } from "../server-types-CrAmZ8jv.js";
+import { r as GuardOptions } from "../respond-Cw-zanCm.js";
+import { l as ResourceRouteOptions } from "../resource-types-CqB6GWGT.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/mcp/dialect.d.ts
+/** The JSON Schema dialect of tool schemas, which depends on the protocol revision. */
+type ToolSchemaTarget = "draft-2020-12" | "draft-07";
+//#endregion
+//#region src/mcp/permissions.d.ts
+/** `McpOptions.requiredRoles`: the roles, or the roles and the claim to read. */
+type RequiredRoles = readonly string[] | {
+  readonly roles: readonly string[];
+  readonly claim?: string;
+};
+//#endregion
 //#region src/mcp/mcp.d.ts
 export declare const MCP_PROTOCOL_VERSION: string;
 type Json = Readonly<Record<string, unknown>>;
@@ -31,10 +43,17 @@ interface ToolContext<M extends AnyModels, F extends AnyFunctions, E, C = unknow
 }
 interface McpTool<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
   readonly info: ToolInfo;
+  /**
+   * The input schema in another dialect, for clients on an older protocol
+   * revision. Without it, `info.inputSchema` is rewritten.
+   */
+  readonly inputSchemaFor?: (target: ToolSchemaTarget) => Json | undefined;
   /** Validates arguments; its output is what `run` receives. */
   readonly input?: StandardSchemaV1;
   /** Opaque data for the `authorize` and `visible` hooks. Never sent to clients. */
   readonly meta?: unknown;
+  /** Checked by the authorizer on every call; callers it denies don't see the tool. */
+  readonly permission?: unknown;
   run(args: never, ctx: ToolContext<M, F, E, C, P>): unknown;
 }
 /** What the `authorize` and `visible` hooks see of a tool. */
@@ -52,7 +71,7 @@ type ToolDecision = {
   /** OAuth scopes the call needs, sent in an `insufficient_scope` challenge. */
   readonly scopes?: readonly string[];
 };
-interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E, I, C = unknown, P = unknown> {
+interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E, I, C = unknown, P = unknown, Ref = unknown> {
   readonly name: string;
   readonly title?: string;
   readonly description: string;
@@ -63,13 +82,25 @@ interface ToolDefinition<M extends AnyModels, F extends AnyFunctions, E, I, C =
   readonly input?: StandardSchemaV1<unknown, I>;
   readonly inputSchema?: Json;
   readonly outputSchema?: Json;
+  /**
+   * The dialect `input` converts to for `ToolInfo` and the `tools` list.
+   * Defaults to `draft-2020-12`. `tools/list` converts again for clients on
+   * 2025-06-18 and earlier, which get draft-07.
+   */
+  readonly jsonSchemaTarget?: ToolSchemaTarget;
   readonly annotations?: ToolAnnotations;
   /** Opaque data for the `authorize` and `visible` hooks. Never sent to clients. */
   readonly meta?: unknown;
+  /**
+   * Checked by the authorizer after the arguments are validated, with the
+   * tool as the resource (`mcp_tool`). `tools/list` hides the tool from
+   * callers it denies.
+   */
+  readonly permission?: Ref;
   run(args: I, ctx: ToolContext<M, F, E, C, P>): unknown;
 }
 /** A table's tools: the REST resource options, plus `meta` per operation for `authorize` and `visible`. */
-type ToolResourceOptions<M extends AnyModels, T extends TableKey<M>> = ResourceRouteOptions<M, T> & {
+type ToolResourceOptions<M extends AnyModels, T extends TableKey<M>, Ref = string> = ResourceRouteOptions<M, T, Ref> & {
   /**
    * Opaque data per operation, e.g. a permission, passed to
    * `authorize` and `visible` as the table tool's `meta`. Never sent to
@@ -77,15 +108,15 @@ type ToolResourceOptions<M extends AnyModels, T extends TableKey<M>> = ResourceR
    */
   readonly meta?: { readonly [K in ResourceOperation]?: unknown; };
 };
-type ToolResources<M extends AnyModels> = { readonly [T in TableKey<M>]?: ToolResourceOptions<M, T> | true; };
-interface McpOptions<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends ServerOptions, Omit<GuardOptions, "scopes"> {
+type ToolResources<M extends AnyModels, Ref = string> = { readonly [T in TableKey<M>]?: ToolResourceOptions<M, T, Ref> | true; };
+interface McpOptions<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Ref = string> extends ServerOptions, Omit<GuardOptions, "scopes"> {
   readonly name: string;
   readonly version: string;
   readonly title?: string;
   /** Sent to clients on `initialize`, e.g. how the tools fit together. */
   readonly instructions?: string;
   /** Tables exposed as tools: `<table>_list`, `_get`, `_create`, `_update`, `_delete`. */
-  readonly resources?: ToolResources<M>;
+  readonly resources?: ToolResources<M, Ref>;
   readonly tools?: readonly McpTool<M, F, E, C, P>[];
   /**
    * Canonical URL of this MCP server (RFC 9728 `resource`). Defaults to the
@@ -118,10 +149,7 @@ interface McpOptions<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    * requiredRoles: { roles: ['admin', 'support'], claim: 'app_metadata.roles' }
    * ```
    */
-  readonly requiredRoles?: readonly string[] | {
-    readonly roles: readonly string[];
-    readonly claim?: string;
-  };
+  readonly requiredRoles?: RequiredRoles;
   /** Origins allowed to call the server (DNS rebinding protection). Defaults to any. */
   readonly allowedOrigins?: readonly string[];
   /**
@@ -159,7 +187,7 @@ interface McpOptions<M extends AnyModels, F extends AnyFunctions, E, C = unknown
    */
   readonly visible?: (ctx: ToolContext<M, F, E, C, P>, tool: ToolRef) => boolean | Promise<boolean>;
 }
-interface BetterMcp<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
+interface BetterMcp<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, Ref = string> extends BetterServer<M, F, E, C, P> {
   /** Everything in one handler: the MCP endpoint and `/.well-known/oauth-protected-resource`. */
   readonly fetch: (request: Request) => Promise<Response>;
   /** The Streamable HTTP endpoint (POST JSON-RPC). */
@@ -168,7 +196,7 @@ interface BetterMcp<M extends AnyModels, F extends AnyFunctions, E, C = unknown,
   metadata(request: Request): Response;
   readonly tools: readonly ToolInfo[];
   /** Adds a tool typed against this app's repositories. */
-  tool<I = Record<string, unknown>>(definition: ToolDefinition<M, F, E, I, C, P>): this;
+  tool<I = Record<string, unknown>>(definition: ToolDefinition<M, F, E, I, C, P, Ref>): this;
   /** Calls a tool directly, e.g. from tests or another transport. */
   call(name: string, args: unknown, ctx: ToolContext<M, F, E, C, P>): Promise<ToolResult>;
 }
@@ -181,13 +209,15 @@ interface ToolResult {
   readonly isError?: boolean;
 }
 /** A custom tool. Pass it in `createMcp({ tools: [...] })`. */
-export declare function defineTool<M extends AnyModels, F extends AnyFunctions, E, I = Record<string, unknown>, C = unknown, P = unknown>(definition: ToolDefinition<M, F, E, I, C, P>): McpTool<M, F, E, C, P>;
+export declare function defineTool<M extends AnyModels, F extends AnyFunctions, E, I = Record<string, unknown>, C = unknown, P = unknown, Ref = unknown>(definition: ToolDefinition<M, F, E, I, C, P, Ref>): McpTool<M, F, E, C, P>;
 /**
  * An MCP server (Streamable HTTP, stateless) whose tools run as the caller:
  * the Bearer token from the MCP client is verified and every query goes
  * through RLS. Answers 401 with RFC 9728 metadata so clients can sign in with
  * Supabase Auth's OAuth server.
  */
-export declare function createMcp<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options: McpOptions<M, F, E, C, P>): BetterMcp<M, F, E, C, P>;
+export declare function createMcp<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, A extends AnyAuthorizer | undefined = undefined>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options: McpOptions<M, F, E, C, P, PermissionRef<A>> & {
+  readonly authorizer?: A;
+}): BetterMcp<M, F, E, C, P, PermissionRef<A>>;
 //#endregion
 export type { BetterMcp, GuardOptions, McpOptions, McpTool, ResourceRouteOptions, ToolAnnotations, ToolContext, ToolDecision, ToolDefinition, ToolInfo, ToolRef, ToolResourceOptions, ToolResources, ToolResult };