better-supabase 0.7.1 → 0.8.0

package/dist/plugins/soft-delete/index.js

@@ -1,8 +1,8 @@
 import { t as and } from "../../types-6cYK9pbJ.js";
-import { a as ok, t as AsyncResult } from "../../result-DzUbqgdW.js";
+import { a as ok, t as AsyncResult } from "../../result-DEqHCMKP.js";
 import { r as definePlugin } from "../../plugin-tfXW1-qO.js";
 import { n as scopeOperation } from "../../scope-CDHcS7dE.js";
-import { a as insertsOnly, i as guardManaged, o as isNotNull, s as isNull, t as dbName, u as withDefault } from "../../shared-CxWmcyqB.js";
+import { a as insertsOnly, c as withDefault, i as guardManaged, o as isNotNull, s as isNull, t as dbName } from "../../shared-DHjhfRdV.js";
 //#region src/plugins/soft-delete/index.ts
 function deletedColumn(table) {
 	return dbName(table, table.flags.softDelete);
@@ -28,6 +28,13 @@ function softDelete() {
 		name: "softDelete",
 		enforce: "pre",
 		scopes: ["softDelete"],
+		describe(api) {
+			for (const { table } of api.resources) {
+				const flag = table.flags.softDelete;
+				if (!flag) continue;
+				api.markReadOnly(table.key, flag, "Set when the row is deleted. Deleted rows are not returned, and delete sets this column instead of removing the row.");
+			}
+		},
 		transformQuery(op, { options }) {
 			const hardDelete = op.kind === "delete" && options["hard"] === true;
 			const withDeleted = options["withDeleted"] === true || hardDelete;

package/dist/plugins/tenant/index.d.ts

@@ -1,5 +1,5 @@
-import { P as SchemaMeta } from "../../types-6BdhkmZe.js";
-import { d as Plugin, m as RequestContext, o as HasFlag, p as RepositoryExtension } from "../../plugin-FGY8UhYm.js";
+import { P as SchemaMeta } from "../../types-CoE5Zwy4.js";
+import { d as Plugin, m as RequestContext, o as HasFlag, p as RepositoryExtension } from "../../plugin-CPK2HsbY.js";
 //#region src/plugins/tenant/index.d.ts
 /**
  * Dotted paths to the string claims of `C` (up to three levels), e.g.
@@ -23,6 +23,11 @@ export interface TenantOptions<C = unknown> {
    * `error` (default) fails with `forbidden`; `skip` leaves it to RLS.
    */
   readonly onMissing?: "error" | "skip";
+  /**
+   * The request header `resolve` reads the tenant from. The plugin does not
+   * read it; `defineApi` documents it as a parameter of tenant tables.
+   */
+  readonly header?: string;
 }
 export interface TenantFindArgs {
   /** Skip the tenant filter for this call (admin tooling, jobs). RLS still applies. */

package/dist/plugins/tenant/index.js

@@ -1,9 +1,9 @@
 import { t as DbException } from "../../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../../errors-B11Duf73.js";
+import { n as dbError } from "../../errors-2M6CKMP4.js";
 import { a as spansAllTenants, r as definePlugin } from "../../plugin-tfXW1-qO.js";
 import { n as scopeOperation } from "../../scope-CDHcS7dE.js";
 import { o as tenantFrom, s as tenantPathsFor } from "../../claims-PqzCxaTD.js";
-import { a as insertsOnly, n as equals, r as forbidden, t as dbName } from "../../shared-CxWmcyqB.js";
+import { a as insertsOnly, n as equals, r as forbidden, t as dbName } from "../../shared-DHjhfRdV.js";
 //#region src/plugins/tenant/index.ts
 /**
 * The tenant for a request: `context.tenant`, then the configured claim.
@@ -52,6 +52,20 @@ function tenant(options = {}) {
 	return definePlugin({
 		name: "tenant",
 		scopes: ["tenant"],
+		describe(api) {
+			for (const { table } of api.resources) {
+				const flag = table.flags.tenant;
+				if (!flag) continue;
+				api.markReadOnly(table.key, flag, "Set from the request's tenant.");
+				if (options.header) api.addParameter(table.key, {
+					name: options.header,
+					in: "header",
+					required: onMissing === "error",
+					description: "The tenant the request acts for.",
+					schema: { type: "string" }
+				});
+			}
+		},
 		context(context, { schema }) {
 			if (spansAllTenants(context)) return context;
 			const id = resolvedFor(context, schema);

package/dist/plugins/timestamps/index.d.ts

@@ -1,4 +1,4 @@
-import { d as Plugin } from "../../plugin-FGY8UhYm.js";
+import { d as Plugin } from "../../plugin-CPK2HsbY.js";
 //#region src/plugins/timestamps/index.d.ts
 /**
  * Stamps the columns generated as `Flags.timestamps`: `createdAt` on insert,

package/dist/plugins/timestamps/index.js

@@ -1,5 +1,5 @@
 import { r as definePlugin } from "../../plugin-tfXW1-qO.js";
-import { a as insertsOnly, i as guardManaged, t as dbName, u as withDefault } from "../../shared-CxWmcyqB.js";
+import { a as insertsOnly, c as withDefault, i as guardManaged, t as dbName } from "../../shared-DHjhfRdV.js";
 //#region src/plugins/timestamps/index.ts
 /**
 * Stamps the columns generated as `Flags.timestamps`: `createdAt` on insert,
@@ -11,6 +11,13 @@ import { a as insertsOnly, i as guardManaged, t as dbName, u as withDefault } fr
 function timestamps() {
 	return definePlugin({
 		name: "timestamps",
+		describe(api) {
+			for (const { table } of api.resources) {
+				const flags = table.flags.timestamps;
+				if (flags?.createdAt) api.markReadOnly(table.key, flags.createdAt, "Set by the server when the row is created.");
+				if (flags?.updatedAt) api.markReadOnly(table.key, flags.updatedAt, "Set by the server on every write.");
+			}
+		},
 		beforeMutation(op, { table, now, options }) {
 			const flags = table.flags.timestamps;
 			if (!flags) return op;

package/dist/plugins/validation/index.d.ts

@@ -1,5 +1,5 @@
-import { d as Plugin } from "../../plugin-FGY8UhYm.js";
-import { t as StandardSchemaV1 } from "../../standard-CYsm7xpT.js";
+import { d as Plugin } from "../../plugin-CPK2HsbY.js";
+import { t as StandardSchemaV1 } from "../../standard-lmkbOtPB.js";
 //#region src/plugins/validation/index.d.ts
 export interface TableValidators {
   /** Validates inserts and upserts, with app-cased keys. */

package/dist/plugins/validation/index.js

@@ -1,9 +1,9 @@
 import { t as DbException } from "../../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../../errors-B11Duf73.js";
-import { i as encodeValue, r as decodeValue } from "../../wire-DtZQ4sdE.js";
+import { n as dbError } from "../../errors-2M6CKMP4.js";
+import { i as encodeValue, r as decodeValue } from "../../wire-Df3EWkG8.js";
 import { r as definePlugin } from "../../plugin-tfXW1-qO.js";
-import { n as validate } from "../../standard-BK0cqJ7y.js";
-import { c as toApp, l as toDb } from "../../shared-CxWmcyqB.js";
+import { n as validate } from "../../standard-DkzZUneg.js";
+import { n as toDb, t as toApp } from "../../casing-DdFWEtqr.js";
 //#region src/plugins/validation/index.ts
 /**
 * Rows reach plugins in wire form (ISO text, decimal text), while generated

package/dist/{pool-CAu2nLrL.d.ts → pool-gkhbGp2E.d.ts}

@@ -1,5 +1,5 @@
-import { r as Executor } from "./executor-DvsBbNBS.js";
-import { t as SqlClient } from "./executor-DbvExCFC.js";
+import { r as Executor } from "./executor-Drzu3dBK.js";
+import { t as SqlClient } from "./executor-ngjKL_Pe.js";
 //#region src/postgres/pool.d.ts
 /** The part of a `pg` pool client `createPostgres` uses. */
 interface PgPoolClient {

package/dist/postgres/index.d.ts

@@ -1,7 +1,7 @@
-import { v as Operation } from "../executor-DvsBbNBS.js";
-import { n as fromPgError, r as postgresExecutor, t as SqlClient } from "../executor-DbvExCFC.js";
-import { a as PostgresTimeouts, c as createPostgres, i as PostgresOptions, n as PgPool, o as SessionOptions, r as PgPoolClient, s as SqlClaims, t as BetterPostgres } from "../pool-CAu2nLrL.js";
-import { t as Compiler } from "../compiler-DY_wkj4R.js";
+import { v as Operation } from "../executor-Drzu3dBK.js";
+import { n as fromPgError, r as postgresExecutor, t as SqlClient } from "../executor-ngjKL_Pe.js";
+import { a as PostgresTimeouts, c as createPostgres, i as PostgresOptions, n as PgPool, o as SessionOptions, r as PgPoolClient, s as SqlClaims, t as BetterPostgres } from "../pool-gkhbGp2E.js";
+import { t as Compiler } from "../compiler-V1qvcST1.js";
 //#region src/compile/sql.d.ts
 interface SqlQuery {
   readonly text: string;

package/dist/postgres/index.js

@@ -1,4 +1,5 @@
-import { i as quoteIdent, n as postgresExecutor, r as compileSql, t as fromPgError } from "../executor-De1Of3m3.js";
+import { n as quoteIdent, t as compileSql } from "../sql-CwuqaQ4Y.js";
+import { n as postgresExecutor, t as fromPgError } from "../executor-B_Hfobee.js";
 import { Pool } from "pg";
 //#region src/postgres/pool.ts
 const DEFAULT_TIMEOUTS = {

package/dist/{postgrest-BLVdEnfe.d.ts → postgrest-BUqLag2Q.d.ts}

@@ -1,4 +1,4 @@
-import { v as Operation } from "./executor-DvsBbNBS.js";
+import { v as Operation } from "./executor-Drzu3dBK.js";
 //#region src/compile/postgrest.d.ts
 /**
  * A compiled PostgREST request, expressed as calls on the public

package/dist/powersync/index.d.ts

@@ -1,7 +1,7 @@
-import { t as AuthSnapshot } from "../bind-Bu_ZNa3W.js";
-import { _ as SqliteValue, a as postgrestTimestamp, b as quoteSqliteIdent, c as SqliteCompilerOptions, d as SqliteKeyedPlan, f as SqliteKeys, g as SqliteSelectPlan, h as SqliteReturning, i as fromSqliteError, l as SqliteDecode, m as SqliteQuery, n as PowerSyncExecutorOptions, o as powersyncExecutor, p as SqlitePlan, r as SqliteContextLike, s as SqliteColumn, t as PowerSyncDatabaseLike, u as SqliteInsertPlan, v as compileSqlite, x as sqliteValue, y as likeToGlob } from "../executor-CaWigTyR.js";
-import { a as sqliteCompiler, i as checkSqlite, n as sqliteTables, r as watch, t as WatchOptions } from "../watch-DI34G86j.js";
-import { a as UploadConnector, c as UploadRepository, d as uploadOutcome, i as RejectedStore, l as UploadRoute, n as CrudQueueLike, o as UploadConnectorOptions, r as RejectedChange, s as UploadOutcome, t as CrudEntryLike, u as createUploadConnector } from "../connector-Dv8kK0MO.js";
+import { t as AuthSnapshot } from "../bind-CQ5mPyX1.js";
+import { _ as SqliteValue, a as fromSqliteError, b as quoteSqliteIdent, c as SqliteCompilerOptions, d as SqliteKeyedPlan, f as SqliteKeys, g as SqliteSelectPlan, h as SqliteReturning, i as SqliteContextLike, l as SqliteDecode, m as SqliteQuery, n as PowerSyncExecutorOptions, o as postgrestTimestamp, p as SqlitePlan, r as powersyncExecutor, s as SqliteColumn, t as PowerSyncDatabaseLike, u as SqliteInsertPlan, v as compileSqlite, x as sqliteValue, y as likeToGlob } from "../executor-DfEtf0cq.js";
+import { a as checkSqlite, i as CheckSqliteOptions, n as sqliteTables, o as sqliteCompiler, r as watch, t as WatchOptions } from "../watch-COzRWvVN.js";
+import { a as UploadConnector, c as UploadRepository, d as uploadOutcome, i as RejectedStore, l as UploadRoute, n as CrudQueueLike, o as UploadConnectorOptions, r as RejectedChange, s as UploadOutcome, t as CrudEntryLike, u as createUploadConnector } from "../connector-CySQEFcW.js";
 //#region src/powersync/auth.d.ts
 /** The part of a PowerSync database `syncWithAuth` drives. */
 interface SyncedDatabaseLike<C> {
@@ -40,4 +40,4 @@ interface SyncWithAuthOptions<C> {
  */
 export declare function syncWithAuth<C>(db: SyncedDatabaseLike<C>, auth: AuthSourceLike, options: SyncWithAuthOptions<C>): () => void;
 //#endregion
-export { type AuthSourceLike, type CrudEntryLike, type CrudQueueLike, type PowerSyncDatabaseLike, type PowerSyncExecutorOptions, type RejectedChange, type RejectedStore, type SqliteColumn, type SqliteCompilerOptions, type SqliteContextLike, type SqliteDecode, type SqliteInsertPlan, type SqliteKeyedPlan, type SqliteKeys, type SqlitePlan, type SqliteQuery, type SqliteReturning, type SqliteSelectPlan, type SqliteValue, type SyncWithAuthOptions, type SyncedDatabaseLike, type UploadConnector, type UploadConnectorOptions, type UploadOutcome, type UploadRepository, type UploadRoute, type WatchOptions, checkSqlite, compileSqlite, createUploadConnector, fromSqliteError, likeToGlob, postgrestTimestamp, powersyncExecutor, quoteSqliteIdent, sqliteCompiler, sqliteTables, sqliteValue, uploadOutcome, watch };
+export { type AuthSourceLike, type CheckSqliteOptions, type CrudEntryLike, type CrudQueueLike, type PowerSyncDatabaseLike, type PowerSyncExecutorOptions, type RejectedChange, type RejectedStore, type SqliteColumn, type SqliteCompilerOptions, type SqliteContextLike, type SqliteDecode, type SqliteInsertPlan, type SqliteKeyedPlan, type SqliteKeys, type SqlitePlan, type SqliteQuery, type SqliteReturning, type SqliteSelectPlan, type SqliteValue, type SyncWithAuthOptions, type SyncedDatabaseLike, type UploadConnector, type UploadConnectorOptions, type UploadOutcome, type UploadRepository, type UploadRoute, type WatchOptions, checkSqlite, compileSqlite, createUploadConnector, fromSqliteError, likeToGlob, postgrestTimestamp, powersyncExecutor, quoteSqliteIdent, sqliteCompiler, sqliteTables, sqliteValue, uploadOutcome, watch };

package/dist/powersync/index.js

@@ -1,7 +1,7 @@
-import { n as dbError } from "../errors-B11Duf73.js";
-import { r as err } from "../result-DzUbqgdW.js";
-import { n as watch, t as sqliteTables } from "../watch-Xuxrvxq-.js";
-import { a as sqliteCompiler, c as quoteSqliteIdent, i as checkSqlite, l as sqliteValue, n as postgrestTimestamp, o as compileSqlite, r as powersyncExecutor, s as likeToGlob, t as fromSqliteError } from "../executor-Bq28caBo.js";
+import { n as dbError } from "../errors-2M6CKMP4.js";
+import { r as err } from "../result-DEqHCMKP.js";
+import { n as watch, t as sqliteTables } from "../watch-BcvtAHOd.js";
+import { a as sqliteCompiler, c as quoteSqliteIdent, i as checkSqlite, l as sqliteValue, n as fromSqliteError, o as compileSqlite, r as postgrestTimestamp, s as likeToGlob, t as powersyncExecutor } from "../executor-B-fD7DLt.js";
 //#region src/powersync/auth.ts
 /**
 * Syncs while a user is signed in: connects on sign-in, and on sign-out

package/dist/powersync/react/index.d.ts

@@ -1,6 +1,6 @@
-import { b as DbError, f as Result } from "../../result-D7y2fT87.js";
-import { t as PowerSyncDatabaseLike } from "../../executor-CaWigTyR.js";
-import { i as RejectedStore, r as RejectedChange } from "../../connector-Dv8kK0MO.js";
+import { b as DbError, f as Result } from "../../result-BchM1XZn.js";
+import { t as PowerSyncDatabaseLike } from "../../executor-DfEtf0cq.js";
+import { i as RejectedStore, r as RejectedChange } from "../../connector-CySQEFcW.js";
 //#region src/powersync/react/index.d.ts
 export interface UseWatchOptions<T> {
   readonly db: PowerSyncDatabaseLike;

package/dist/powersync/react/index.js

@@ -1,5 +1,5 @@
 "use client";
-import { n as watch } from "../../watch-Xuxrvxq-.js";
+import { n as watch } from "../../watch-BcvtAHOd.js";
 import { useEffect, useMemo, useRef, useState, useSyncExternalStore } from "react";
 //#region src/powersync/react/index.ts
 /**

package/dist/{problem-BreOl8b8.js → problem-CJvFeGu7.js}

@@ -1,4 +1,4 @@
-import { n as dbError } from "./errors-B11Duf73.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
 //#region src/core/problem.ts
 const PROBLEM_TYPE_BASE = "https://bettersupabase.com/problems/";
 const PROBLEM_CONTENT_TYPE = "application/problem+json";
@@ -52,6 +52,8 @@ function toProblem(error, options = {}) {
 	if ("issues" in error) problem["issues"] = error.issues;
 	if ("required" in error) problem["required"] = error.required;
 	if ("scopes" in error) problem["scopes"] = error.scopes;
+	if ("permission" in error) problem["permission"] = error.permission;
+	if ("approval" in error) problem["approval"] = error.approval;
 	if ("retryAfter" in error) problem["retryAfter"] = error.retryAfter;
 	if ("meter" in error) problem["meter"] = error.meter;
 	if ("limit" in error) problem["limit"] = error.limit;
@@ -102,6 +104,8 @@ function fromProblem(problem) {
 		"column",
 		"required",
 		"scopes",
+		"permission",
+		"approval",
 		"retryAfter",
 		"meter",
 		"limit",
@@ -111,5 +115,12 @@ function fromProblem(problem) {
 	if (kind !== "validation") delete extra["issues"];
 	return dbError(kind, problem.detail ?? problem.title, extra);
 }
+/** An empty `405` that lists the methods a route does accept. */
+function methodNotAllowed(allowed) {
+	return new Response(null, {
+		status: 405,
+		headers: { allow: allowed.join(", ") }
+	});
+}
 //#endregion
-export { problemResponse as a, isProblem as i, PROBLEM_TYPE_BASE as n, toProblem as o, fromProblem as r, PROBLEM_CONTENT_TYPE as t };
+export { methodNotAllowed as a, isProblem as i, PROBLEM_TYPE_BASE as n, problemResponse as o, fromProblem as r, toProblem as s, PROBLEM_CONTENT_TYPE as t };

package/dist/{problem-DD8LZFjc.d.ts → problem-TvGdxO1t.d.ts}

@@ -1,4 +1,4 @@
-import { E as ValidationIssue, b as DbError, x as DbErrorKind } from "./result-D7y2fT87.js";
+import { E as ValidationIssue, b as DbError, x as DbErrorKind } from "./result-BchM1XZn.js";
 //#region src/core/problem.d.ts
 /** RFC 9457 Problem Details, with the `DbError` fields as extension members. */
 interface ProblemDetails {
@@ -19,6 +19,12 @@ interface ProblemDetails {
   readonly required?: "aal1" | "aal2";
   /** The OAuth scopes a `forbidden` answer needs. */
   readonly scopes?: readonly string[];
+  /** The permission key an authorizer denied. */
+  readonly permission?: string;
+  /** The pending approval of an `APPROVAL_REQUIRED` answer. */
+  readonly approval?: {
+    readonly id: string;
+  };
   /** Seconds until a `rate_limited` or `quota_exceeded` caller may retry. */
   readonly retryAfter?: number;
   /** The meter a `quota_exceeded` answer ran out of, and its limit. */

package/dist/{provider-Di3sRutW.js → provider-DxRTex4x.js}

@@ -1,4 +1,4 @@
-import { n as dbError } from "./errors-B11Duf73.js";
+import { n as dbError } from "./errors-2M6CKMP4.js";
 //#region src/credentials/provider.ts
 /** `ref` bound to `tenant`'s namespace. */
 function tenantCredentialRef(tenant, ref) {

package/dist/{provider-D-UEMvSD.d.ts → provider-ib9wzUDz.d.ts}

@@ -1,6 +1,6 @@
 /// <reference lib="esnext.temporal" />
-import { b as DbError, t as AsyncResult } from "./result-D7y2fT87.js";
-import { r as AuthState } from "./resolve-ChTYeTEl.js";
+import { b as DbError, t as AsyncResult } from "./result-BchM1XZn.js";
+import { r as AuthState } from "./resolve-MxXVWyhd.js";
 //#region src/credentials/provider.d.ts
 /**
  * Names a credential without holding it. Tables store this as a

package/dist/query/index.d.ts

@@ -1,4 +1,4 @@
-import { t as escapeLike } from "../escape-like-ImTK0ps_.js";
+import { t as escapeLike } from "../escape-like-DDWoHzh_.js";
 import { n as invalidateTables, t as BetterQueryMeta } from "../invalidate-BBqhpxyB.js";
-import { _ as invalidateOnMutation, a as UserChangeSource, c as InfiniteExtras, d as QueriesOptions, f as QueryHelpers, g as createQueries, h as TableQueries, i as optimistic, l as InfiniteOptionsOf, m as QueryOptionsOf, n as OptimisticSnapshot, o as clearOnUserChange, p as QueryKeyOf, r as OptimisticTarget, s as BetterQueries, t as OptimisticHandlers, u as MutationOptionsOf, v as queryCache } from "../index-Bepi-Hgg.js";
+import { _ as invalidateOnMutation, a as UserChangeSource, c as InfiniteExtras, d as QueriesOptions, f as QueryHelpers, g as createQueries, h as TableQueries, i as optimistic, l as InfiniteOptionsOf, m as QueryOptionsOf, n as OptimisticSnapshot, o as clearOnUserChange, p as QueryKeyOf, r as OptimisticTarget, s as BetterQueries, t as OptimisticHandlers, u as MutationOptionsOf, v as queryCache } from "../index-DoNVLHOU.js";
 export { type BetterQueries, type BetterQueryMeta, type InfiniteExtras, type InfiniteOptionsOf, type MutationOptionsOf, type OptimisticHandlers, type OptimisticSnapshot, type OptimisticTarget, type QueriesOptions, type QueryHelpers, type QueryKeyOf, type QueryOptionsOf, type TableQueries, type UserChangeSource, clearOnUserChange, createQueries, escapeLike, invalidateOnMutation, invalidateTables, optimistic, queryCache };

package/dist/query/index.js

@@ -1,4 +1,4 @@
 import { t as escapeLike } from "../escape-like-DHfx6jRr.js";
 import { r as invalidateTables, t as clearOnUserChange } from "../user-change-XzvgafU4.js";
-import { i as queryCache, n as createQueries, r as invalidateOnMutation, t as optimistic } from "../query-BQ-NaZon.js";
+import { i as queryCache, n as createQueries, r as invalidateOnMutation, t as optimistic } from "../query-Ctz-qKRx.js";
 export { clearOnUserChange, createQueries, escapeLike, invalidateOnMutation, invalidateTables, optimistic, queryCache };

package/dist/{query-BQ-NaZon.js → query-Ctz-qKRx.js}

@@ -1,4 +1,4 @@
-import { n as isPlainObject } from "./clone-BfgmLU90.js";
+import { r as isPlainObject } from "./clone-dN9XOL1K.js";
 import { t as DbException } from "./db-exception-CnWcYPxL.js";
 import { t as invalidationTargets } from "./tables-Cb-3_VWc.js";
 import { r as invalidateTables } from "./user-change-XzvgafU4.js";

package/dist/rate-limit-Bw7HgmFj.js

@@ -0,0 +1,260 @@
+import { n as dbError } from "./errors-2M6CKMP4.js";
+import { a as ok, t as AsyncResult } from "./result-DEqHCMKP.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { o as problemResponse } from "./problem-CJvFeGu7.js";
+import { a as verifyWebhook } from "./signatures-DsWv_bYR.js";
+import { D as seconds, E as run, N as toInstant, P as workerId, a as budget, f as leaseHeartbeat, i as blockCall, l as errorText, n as applyTemporal, x as readBodyCapped } from "./block-helpers-Cy3pB96I.js";
+//#region src/blocks/jobs/webhook-inbox.ts
+function defaultType(payload) {
+	if (typeof payload !== "object" || payload === null) return null;
+	const type = payload.type;
+	return typeof type === "string" ? type : null;
+}
+/** Stores one webhook through `receive_webhook`; `duplicate` when the id was stored before. */
+async function receiveWebhook(sql, input) {
+	const [row] = await sql.queryRaw("select * from better_supabase.receive_webhook($1, $2, $3, $4, $5, $6, $7)", [
+		input.source,
+		input.id,
+		input.type ?? null,
+		JSON.stringify(input.payload),
+		JSON.stringify(input.headers),
+		input.tenant,
+		input.maxAttempts ?? null
+	]);
+	return {
+		id: Number(row.id),
+		duplicate: row.duplicate
+	};
+}
+/** Store-then-process webhooks: acknowledge fast, process with retries, never twice. */
+function createWebhookInbox(sql, options) {
+	applyTemporal(options);
+	const worker = options.worker ?? workerId();
+	const format = options.problem;
+	const maxAttempts = options.maxAttempts ?? 8;
+	if (!Number.isInteger(maxAttempts) || maxAttempts < 1) throw new TypeError(`createWebhookInbox maxAttempts must be a positive integer, not ${String(maxAttempts)}`);
+	const maxBodyBytes = options.maxBodyBytes ?? 1048576;
+	if (!Number.isInteger(maxBodyBytes) || maxBodyBytes < 1) throw new TypeError(`createWebhookInbox maxBodyBytes must be a positive integer, not ${String(maxBodyBytes)}`);
+	const verified = async (request, body) => {
+		if (options.verify) return options.verify(request, body);
+		const result = await verifyWebhook({
+			headers: request.headers,
+			body
+		}, options.secrets ?? []);
+		return result.ok ? ok({
+			id: result.data.id,
+			payload: result.data.payload
+		}) : result;
+	};
+	const save = (event) => run(() => receiveWebhook(sql, {
+		source: options.source,
+		id: event.id,
+		type: event.type === void 0 ? (options.typeOf ?? defaultType)(event.payload) : event.type,
+		payload: event.payload,
+		headers: event.headers ?? {},
+		tenant: (event.tenant === void 0 ? options.tenantOf?.(event.payload) : event.tenant) ?? null,
+		maxAttempts
+	}));
+	return {
+		store: save,
+		list: (listOptions) => run(async () => {
+			return (await sql.queryRaw("select * from better_supabase.list_webhooks($1, $2, $3, $4)", [
+				listOptions.tenant,
+				options.source,
+				listOptions.status ?? null,
+				listOptions.limit ?? 100
+			])).map((row) => ({
+				id: Number(row.id),
+				messageId: row.message_id,
+				type: row.event_type,
+				status: row.status ?? "pending",
+				attempts: row.attempts,
+				maxAttempts: row.max_attempts ?? maxAttempts,
+				lastError: row.last_error ?? null,
+				tenant: row.tenant ?? null,
+				receivedAt: toInstant(row.received_at),
+				processedAt: row.processed_at === null || row.processed_at === void 0 ? null : toInstant(row.processed_at)
+			}));
+		}),
+		purge: (purgeOptions = {}) => run(async () => {
+			const [row] = await sql.queryRaw("select better_supabase.purge_webhooks($1::interval, $2, $3, $4) as purged", [
+				seconds(purgeOptions.olderThan ?? "30 days"),
+				purgeOptions.includeDead ?? false,
+				purgeOptions.batch ?? 1e4,
+				purgeOptions.tenant ?? null
+			]);
+			return row?.purged ?? 0;
+		}),
+		async receive(request) {
+			const instance = new URL(request.url).pathname;
+			if (request.method !== "POST") return new Response(null, {
+				status: 405,
+				headers: { allow: "POST" }
+			});
+			if (!options.verify && !options.secrets) throw new TypeError(`The inbox for "${options.source}" has no \`secrets\` or \`verify\`, so it only stores events through \`store\``);
+			const body = await readBodyCapped(request.clone(), maxBodyBytes);
+			if (body === void 0) return problemResponse({
+				...dbError("invalid_input", "The body is too large", { code: "WEBHOOK_TOO_LARGE" }),
+				status: 413
+			}, {
+				instance,
+				format
+			});
+			const message = await verified(request, body);
+			if (!message.ok) return problemResponse(message.error, {
+				instance,
+				format
+			});
+			const headers = Object.fromEntries((options.keepHeaders ?? []).flatMap((name) => {
+				const value = request.headers.get(name);
+				return value === null ? [] : [[name.toLowerCase(), value]];
+			}));
+			const stored = await save({
+				id: message.data.id,
+				payload: message.data.payload,
+				headers,
+				...message.data.tenant === void 0 ? {} : { tenant: message.data.tenant }
+			});
+			if (!stored.ok) return problemResponse(stored.error, {
+				instance,
+				format
+			});
+			return Response.json(stored.data, { status: stored.data.duplicate ? 200 : 202 });
+		},
+		async process(handler, processOptions = {}) {
+			let succeeded = 0;
+			let failed = 0;
+			const lease = seconds(processOptions.lease ?? 300);
+			const spent = budget(processOptions.budgetMs);
+			for (;;) {
+				if (spent.expired()) return {
+					succeeded,
+					failed
+				};
+				const rows = await sql.queryRaw("select * from better_supabase.claim_webhooks($1, $2, $3, $4::interval)", [
+					options.source,
+					worker,
+					processOptions.batch ?? 10,
+					lease
+				]);
+				if (rows.length === 0) return {
+					succeeded,
+					failed
+				};
+				for (const row of rows) {
+					const id = Number(row.id);
+					const attempt = row.attempts;
+					const extend = async () => {
+						const [held] = await sql.queryRaw("select better_supabase.extend_webhook($1, $2, $3, $4::interval) as lease", [
+							id,
+							worker,
+							attempt,
+							lease
+						]);
+						return held?.lease ?? void 0;
+					};
+					const leaseSeconds = await extend();
+					if (leaseSeconds === void 0) continue;
+					const message = {
+						id,
+						source: row.source,
+						messageId: row.message_id,
+						type: row.event_type,
+						payload: row.payload,
+						headers: row.headers,
+						attempts: row.attempts,
+						maxAttempts: row.max_attempts ?? maxAttempts,
+						receivedAt: toInstant(row.received_at),
+						tenant: row.tenant ?? null,
+						progress: row.checkpoint ?? {},
+						async checkpoint(fields) {
+							const [saved] = await sql.queryRaw("select better_supabase.checkpoint_webhook($1, $2, $3, $4) as saved", [
+								id,
+								worker,
+								JSON.stringify(fields),
+								attempt
+							]);
+							return saved?.saved ?? false;
+						}
+					};
+					const stopHeartbeat = leaseHeartbeat(leaseSeconds, () => void extend().catch(() => void 0));
+					try {
+						const outcome = await handler(message);
+						if (typeof outcome === "object" && outcome !== null && "ok" in outcome && outcome.ok === false) throw new Error(errorText(outcome.error ?? "The handler failed"));
+						const [done] = await sql.queryRaw("select better_supabase.complete_webhook($1, $2, $3) as done", [
+							message.id,
+							worker,
+							attempt
+						]);
+						if (done?.done !== false) succeeded += 1;
+					} catch (cause) {
+						await sql.queryRaw("select better_supabase.fail_webhook($1, $2, $3, null, $4)", [
+							message.id,
+							worker,
+							errorText(cause),
+							attempt
+						]);
+						failed += 1;
+					} finally {
+						stopHeartbeat();
+					}
+				}
+			}
+		}
+	};
+}
+//#endregion
+//#region src/blocks/jobs/rate-limit.ts
+const isTransport = (source) => "call" in source;
+/**
+* Fixed-window limits for keys that aren't claims, over the `rate-limit`
+* module's counters. Pass a service SQL connection (`ctx.postgresAdmin`,
+* `postgres.admin`), or a service-role `BlockTransport` such as
+* `rpcTransport(adminClient)`.
+*/
+function createRateLimit(source, options = {}) {
+	applyTemporal(options);
+	const hit = isTransport(source) ? overTransport(blockCall(source, void 0, options.mappers)) : overSql(source);
+	return { check: (scope, key, rule) => {
+		if (rule !== void 0 && (!Number.isInteger(rule.max) || rule.max < 1)) return AsyncResult.err(dbError("invalid_input", "A rate limit's max must be a positive integer"));
+		return hit(scope, key, rule?.max ?? null, rule === void 0 ? null : seconds(rule.period));
+	} };
+}
+const overTransport = (call) => (scope, key, max, period) => call("check_rate_limit", {
+	scope,
+	key,
+	max_requests: max ?? void 0,
+	period: period ?? void 0
+}, (value) => {
+	const row = isRecord(value) ? value : {};
+	return {
+		allowed: row["allowed"] === true,
+		remaining: Number(row["remaining"] ?? 0),
+		retryAfter: Number(row["retry_after"] ?? 0)
+	};
+});
+/** One `hit_rate_limit` call: whether the hit is allowed, what is left and when to retry. */
+async function hitRateLimit(sql, scope, key, max, period) {
+	const [row] = await sql.queryRaw("select * from better_supabase.hit_rate_limit($1, $2, $3, $4::interval)", [
+		scope,
+		key,
+		max,
+		period
+	]);
+	return {
+		allowed: row?.allowed ?? false,
+		remaining: row?.remaining ?? 0,
+		retryAfter: row?.retry_after ?? 0
+	};
+}
+const overSql = (sql) => (scope, key, max, period) => run(() => hitRateLimit(sql, scope, key, max, period));
+/** A `problem+json` 429 with `Retry-After`, for a refused `check`. */
+function rateLimited(decision, options = {}) {
+	const retryAfter = Math.max(1, Math.ceil(decision.retryAfter));
+	return problemResponse(dbError("rate_limited", options.detail ?? `Too many requests. Retry after ${retryAfter} seconds.`, { retryAfter }), {
+		...options.instance === void 0 ? {} : { instance: options.instance },
+		format: options.problem
+	});
+}
+//#endregion
+export { receiveWebhook as a, createWebhookInbox as i, hitRateLimit as n, rateLimited as r, createRateLimit as t };

package/dist/react/index.d.ts

@@ -1,12 +1,12 @@
-import { t as escapeLike } from "../escape-like-ImTK0ps_.js";
-import { s as Impersonator } from "../mfa-Daak8ukG.js";
-import { t as tenantOf } from "../tenant-BxNFk9bx.js";
-import { t as AuthSession } from "../view-CF7ihnkg.js";
-import { r as LiveCountSeed } from "../index-DunNRdnT.js";
-import { r as MembershipClaim } from "../entitlements-BKSVGtrG.js";
-import { n as supportOf, t as SupportView } from "../support-view-CVOJJLpc.js";
-import { a as BroadcastOptions, f as UseActionOptions, l as LiveQueryHookOptions, n as ActionInputOf, o as ClientLike, r as ActionResultOf, s as LiveCountHookOptions, t as fieldErrorsOf } from "../field-errors-BFOa7WhB.js";
-import { A as useLiveCount, C as BetterSupabaseProviderProps, D as createHooks, E as ProfileOf, M as useSupabase, O as useAuth, S as BetterSupabaseProvider, T as LiveCount, _ as ActionHandle, a as UploadTarget, b as useActionForm, c as useUpload, d as useDebouncedSearch, f as Presence, g as ActionForm, h as usePresence, i as UploadStatus, j as useLiveQuery, k as useBroadcast, l as DebouncedSearch, m as PresenceTopic, n as SignedUrlSource, o as UseUploadOptions, p as PresenceHookOptions, r as Upload, s as useSignedUrl, t as SignedUrl, u as DebouncedSearchOptions, v as UseActionFormOptions, w as ClaimsOf, x as BetterHooks, y as useAction } from "../index-CewnYSpv.js";
+import { t as escapeLike } from "../escape-like-DDWoHzh_.js";
+import { s as Impersonator } from "../mfa-SZc9YYyb.js";
+import { t as tenantOf } from "../tenant-CM368LXb.js";
+import { t as AuthSession } from "../view-TpXEUcVN.js";
+import { r as LiveCountSeed } from "../index-BCHR4Ucl.js";
+import { r as MembershipClaim } from "../entitlements-Ds8qoYZ-.js";
+import { n as supportOf, t as SupportView } from "../support-view-scqMgtOo.js";
+import { a as BroadcastOptions, c as LiveCountHookOptions, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-DIe9XYWL.js";
+import { A as useSupabase, C as BetterSupabaseProviderProps, D as useBroadcast, E as useAuth, O as useLiveCount, S as BetterSupabaseProvider, T as createHooks, _ as ActionHandle, a as UploadTarget, b as useActionForm, c as useUpload, d as useDebouncedSearch, f as Presence, g as ActionForm, h as usePresence, i as UploadStatus, k as useLiveQuery, l as DebouncedSearch, m as PresenceTopic, n as SignedUrlSource, o as UseUploadOptions, p as PresenceHookOptions, r as Upload, s as useSignedUrl, t as SignedUrl, u as DebouncedSearchOptions, v as UseActionFormOptions, w as LiveCount, x as BetterHooks, y as useAction } from "../index-_4R4b01v.js";
 import { SessionProvider, SessionProviderProps, useSession, useSupportSession } from "./session.js";
 import { a as useSignIn, i as SignOut, n as PendingState, o as useSignOut, r as SignIn, t as AuthHookOptions } from "../sign-in-BCV5S2WZ.js";
 export { type ActionForm, type ActionHandle, type ActionInputOf, type ActionResultOf, type AuthHookOptions, type AuthSession, type BetterHooks, BetterSupabaseProvider, type BetterSupabaseProviderProps, type BroadcastOptions, type ClaimsOf, type ClientLike, type DebouncedSearch, type DebouncedSearchOptions, type Impersonator, type LiveCount, type LiveCountHookOptions, type LiveCountSeed, type LiveQueryHookOptions, type MembershipClaim, type PendingState, type Presence, type PresenceHookOptions, type PresenceTopic, type ProfileOf, SessionProvider, type SessionProviderProps, type SignIn, type SignOut, type SignedUrl, type SignedUrlSource, type SupportView, type Upload, type UploadStatus, type UploadTarget, type UseActionFormOptions, type UseActionOptions, type UseUploadOptions, createHooks, escapeLike, fieldErrorsOf, supportOf, tenantOf, useAction, useActionForm, useAuth, useBroadcast, useDebouncedSearch, useLiveCount, useLiveQuery, usePresence, useSession, useSignIn, useSignOut, useSignedUrl, useSupabase, useSupportSession, useUpload };

package/dist/react/index.js

@@ -2,9 +2,9 @@
 import { t as escapeLike } from "../escape-like-DHfx6jRr.js";
 import { t as supportOf } from "../support-view-g4YLBeqX.js";
 import { SessionProvider, useSession, useSupportSession } from "./session.js";
-import { a as useBroadcast, c as useLiveQuery, i as useAuth, l as useSupabase, r as createHooks, s as useLiveCount, t as BetterSupabaseProvider } from "../hooks-1BTCJsiw.js";
-import { t as fieldErrorsOf } from "../field-errors-VF1yb8yI.js";
-import { a as useAction, i as usePresence, n as useUpload, o as useActionForm, r as useDebouncedSearch, t as useSignedUrl } from "../react-F80mF4-t.js";
+import { a as useBroadcast, c as useLiveQuery, i as useAuth, l as useSupabase, r as createHooks, s as useLiveCount, t as BetterSupabaseProvider } from "../hooks-Bhza9Hnr.js";
+import { t as fieldErrorsOf } from "../field-errors-DZVRWRkf.js";
+import { a as useAction, i as usePresence, n as useUpload, o as useActionForm, r as useDebouncedSearch, t as useSignedUrl } from "../react-Bmpo59D7.js";
 import { t as tenantOf } from "../tenant-I1TEZ_BX.js";
-import { n as useSignIn, r as useSignOut } from "../sign-in-Cb1mwv6X.js";
+import { n as useSignIn, r as useSignOut } from "../sign-in-D_yoP0PF.js";
 export { BetterSupabaseProvider, SessionProvider, createHooks, escapeLike, fieldErrorsOf, supportOf, tenantOf, useAction, useActionForm, useAuth, useBroadcast, useDebouncedSearch, useLiveCount, useLiveQuery, usePresence, useSession, useSignIn, useSignOut, useSignedUrl, useSupabase, useSupportSession, useUpload };

package/dist/react/native/index.d.ts

@@ -1,4 +1,4 @@
-import { t as AuthSnapshot } from "../../bind-Bu_ZNa3W.js";
+import { t as AuthSnapshot } from "../../bind-CQ5mPyX1.js";
 import { a as OAuthSignInOptions, i as OAuthClient, n as AuthLinkClient, o as WebBrowserLike, r as AuthLinkResult, t as AuthFailure } from "../../auth-link-BjFPqwLz.js";
 import { n as PendingState } from "../../sign-in-BCV5S2WZ.js";
 import { Provider } from "@supabase/supabase-js";