better-supabase 0.7.1 → 0.9.0

package/dist/store-CGjgWu5n.d.ts

@@ -1,68 +0,0 @@
-import { t as AsyncResult } from "./result-D7y2fT87.js";
-//#region src/streams/store.d.ts
-/** How a stream is opened. */
-interface StreamOpenOptions {
-  /** The user who may read the stream and cancel it. */
-  readonly owner?: string;
-  readonly tenant?: string;
-  /** What the stream carries, such as `chat` or `workflow`. Defaults to `default`. */
-  readonly kind?: string;
-  /** Seconds the stream lives, or a Postgres interval such as `"2 hours"`. Defaults to one day. */
-  readonly ttl?: number | string;
-}
-interface StreamAppendResult {
-  /** The index the next chunk gets. */
-  readonly next: number;
-  /** Someone asked the writer to stop. */
-  readonly cancelled: boolean;
-}
-interface StreamStatus {
-  /** The number of chunks stored. */
-  readonly next: number;
-  readonly closed: boolean;
-  readonly cancelled: boolean;
-}
-interface StreamReadOptions {
-  /** Ends the stream early. */
-  readonly signal?: AbortSignal;
-}
-interface StreamPurgeOptions {
-  /** How long a closed stream is kept: seconds or an interval. Defaults to one day. */
-  readonly olderThan?: number | string;
-}
-/**
- * Durable, resumable output: one writer appends ordered text chunks and any
- * number of readers read from a chunk index, live or after a reconnect.
- * Chunks keep the index they were appended at, so a reader that counted `n`
- * chunks resumes with `read(id, n)`.
- */
-interface StreamStore {
-  readonly apiVersion: 1;
-  readonly name: string;
-  /** Creates the stream; `true` when it was new, `false` when it existed. */
-  open(id: string, options?: StreamOpenOptions): AsyncResult<boolean>;
-  /**
-   * Stores `chunks` at `fromIdx`, `fromIdx + 1`, ... Indexes already stored
-   * are skipped, so a retried batch is harmless. Fails with the hint
-   * `STREAM_NOT_FOUND`, `STREAM_CLOSED` or `STREAM_GAP` (`fromIdx` past the
-   * end).
-   */
-  append(id: string, fromIdx: number, chunks: readonly string[]): AsyncResult<StreamAppendResult>;
-  /**
-   * The chunks from `fromIdx` on, waiting for new ones until the stream is
-   * closed. A stream that doesn't exist (or that the caller can't read) ends
-   * at once. A read error errors the stream with the `DbError`.
-   */
-  read(id: string, fromIdx?: number, options?: StreamReadOptions): ReadableStream<string>;
-  /** The stream's state, or `undefined` when it doesn't exist. */
-  status(id: string): AsyncResult<StreamStatus | undefined>;
-  isCancelled(id: string): AsyncResult<boolean>;
-  /** Marks the stream finished; `false` when it was closed already or doesn't exist. */
-  close(id: string): AsyncResult<boolean>;
-  /** Asks the writer to stop; it learns on its next append. */
-  cancel(id: string): AsyncResult<boolean>;
-  /** Deletes expired streams and closed ones past `olderThan`; resolves with the count. */
-  purge(options?: StreamPurgeOptions): AsyncResult<number>;
-}
-//#endregion
-export { StreamStatus as a, StreamReadOptions as i, StreamOpenOptions as n, StreamStore as o, StreamPurgeOptions as r, StreamAppendResult as t };

package/dist/stripe-BMj5LtsT.js

@@ -1,38 +0,0 @@
-//#region src/blocks/stripe.ts
-const isModule = (value) => typeof value === "object" && value !== null && "default" in value && typeof value.default === "function" && "createFetchHttpClient" in value.default;
-/**
-* Loads `stripe` on first use. The specifier is a variable so bundlers leave
-* the optional peer out of apps that pass their own client; a missing
-* install returns `undefined` and the caller explains how to add it.
-*/
-async function loadStripeModule() {
-	const specifier = "stripe";
-	try {
-		return await import(specifier);
-	} catch {
-		return;
-	}
-}
-/**
-* The client `source` names: itself, or one created with Stripe's fetch HTTP
-* client so it runs on every WinterTC runtime.
-*/
-async function stripeClient(source, load = loadStripeModule) {
-	if (typeof source === "function") return source();
-	if (!("secretKey" in source)) return source;
-	const loaded = await load();
-	if (!isModule(loaded)) throw new TypeError("The billing and usage blocks need the stripe package: pnpm add stripe, or pass a Stripe client as `stripe`");
-	const Stripe = loaded.default;
-	return new Stripe(source.secretKey, {
-		httpClient: Stripe.createFetchHttpClient(),
-		...source.apiVersion === void 0 ? {} : { apiVersion: source.apiVersion }
-	});
-}
-/** Resolves the client once, on first use; a function source runs on every use. */
-function lazyStripe(source) {
-	if (typeof source === "function") return async () => source();
-	let client;
-	return () => client ??= stripeClient(source);
-}
-//#endregion
-export { lazyStripe as t };

package/dist/stripe-D04h-QBT.d.ts

@@ -1,136 +0,0 @@
-//#region src/blocks/stripe.d.ts
-/**
- * The part of the Stripe SDK (`stripe`, an optional peer) the billing and
- * usage blocks call, typed structurally so the blocks never import it.
- */
-interface StripeClient {
-  readonly customers: {
-    create(params: {
-      readonly email?: string;
-      readonly name?: string;
-      readonly metadata?: Readonly<Record<string, string>>;
-    }, options?: {
-      readonly idempotencyKey?: string;
-    }): Promise<{
-      readonly id: string;
-    }>;
-    /** Used by `billing.updateCustomer`. */
-    update?(id: string, params: Readonly<Record<string, unknown>>): Promise<{
-      readonly id: string;
-    }>;
-    /** Used by `billing.taxIds`. */
-    listTaxIds?(id: string, params?: {
-      readonly limit?: number;
-    }): Promise<{
-      readonly data: readonly StripeTaxId[];
-    }>;
-    /** Used by `billing.addTaxId`. */
-    createTaxId?(id: string, params: {
-      readonly type: string;
-      readonly value: string;
-    }): Promise<StripeTaxId>;
-    /** Used by `billing.removeTaxId`. */
-    deleteTaxId?(id: string, taxId: string): Promise<{
-      readonly id: string;
-      readonly deleted?: boolean;
-    }>;
-  };
-  readonly checkout: {
-    readonly sessions: {
-      create(params: Readonly<Record<string, unknown>>, options?: {
-        readonly idempotencyKey?: string;
-      }): Promise<{
-        readonly id: string;
-        readonly url: string | null;
-      }>;
-    };
-  };
-  readonly billingPortal: {
-    readonly sessions: {
-      create(params: {
-        readonly customer: string;
-        readonly return_url?: string;
-      }): Promise<{
-        readonly id: string;
-        readonly url: string;
-      }>;
-    };
-  };
-  readonly subscriptionItems: {
-    update(id: string, params: {
-      readonly quantity: number;
-      readonly proration_behavior?: string;
-    }, options?: {
-      readonly idempotencyKey?: string;
-    }): Promise<{
-      readonly id: string;
-      readonly quantity?: number | null;
-    }>;
-  };
-  readonly subscriptions: {
-    cancel(id: string): Promise<{
-      readonly id: string;
-    }>;
-    /** Used by `billing.changePlan` and `billing.cancelAtPeriodEnd`. */
-    update?(id: string, params: Readonly<Record<string, unknown>>, options?: {
-      readonly idempotencyKey?: string;
-    }): Promise<{
-      readonly id: string;
-    }>;
-  };
-  /** Used by `billing.voidInvoice` and `billing.markInvoiceUncollectible`. */
-  readonly invoices?: {
-    voidInvoice(id: string): Promise<{
-      readonly id: string;
-      readonly status?: string | null;
-    }>;
-    markUncollectible(id: string): Promise<{
-      readonly id: string;
-      readonly status?: string | null;
-    }>;
-  };
-  readonly billing: {
-    readonly meterEvents: {
-      create(params: {
-        readonly event_name: string;
-        readonly payload: Readonly<Record<string, string>>;
-        readonly identifier?: string;
-        readonly timestamp?: number;
-      }, options?: {
-        readonly idempotencyKey?: string;
-      }): Promise<unknown>;
-    };
-  };
-  readonly webhooks: {
-    constructEventAsync(payload: string, header: string, secret: string): Promise<{
-      readonly id: string;
-      readonly type: string;
-      readonly data: {
-        readonly object: unknown;
-      };
-    }>;
-  };
-}
-/** A customer tax id as Stripe returns it (`eu_vat`, `DE123456789`). */
-interface StripeTaxId {
-  readonly id: string;
-  readonly type: string;
-  readonly value: string;
-  readonly country?: string | null;
-  readonly verification?: {
-    readonly status?: string | null;
-  } | null;
-  readonly created?: number | null;
-}
-/**
- * A Stripe client, the secret key to create one from the `stripe` package,
- * or a function that returns a client. The function runs on every Stripe
- * call, so it can create the client lazily, pick a per-request or per-tenant
- * client (Stripe Connect), or read a rotated key; cache inside it when needed.
- */
-type StripeSource = StripeClient | {
-  readonly secretKey: string;
-  readonly apiVersion?: string;
-} | (() => StripeClient | Promise<StripeClient>);
-//#endregion
-export { StripeSource as n, StripeTaxId as r, StripeClient as t };

package/dist/support-ig_K4PvS.js

@@ -1,314 +0,0 @@
-import { c as mapDbError, n as dbError } from "./errors-B11Duf73.js";
-import { t as temporal } from "./temporal-required-BVvW7SYJ.js";
-import { a as ok, r as err, s as toDbError, t as AsyncResult } from "./result-DzUbqgdW.js";
-import { n as validate } from "./standard-BK0cqJ7y.js";
-import { t as fromPgError } from "./executor-De1Of3m3.js";
-import { d as clearSupportCookie, f as supportCookie, m as supportCookieValue } from "./adapter-iKgjHVPx.js";
-import { r as sqlIdent } from "./template--jDkl3UP.js";
-import { i as emitBlockEvent } from "./block-events-CrT8r7Fe.js";
-//#region src/auth/support.ts
-/** A session from the jsonb the `support-sessions` functions return. */
-function supportSessionFromRow(row) {
-	const instant = (value) => temporal().Instant.from(value);
-	return {
-		id: row.id,
-		adminId: row.admin_id,
-		targetUserId: row.target_user_id,
-		reason: row.reason,
-		readOnly: row.read_only ?? true,
-		...row.tenant === null ? {} : { tenant: String(row.tenant) },
-		startedAt: instant(row.started_at),
-		expiresAt: instant(row.expires_at),
-		...row.ended_at === null ? {} : { endedAt: instant(row.ended_at) },
-		...row.ended_by === null ? {} : { endedBy: row.ended_by },
-		metadata: row.metadata ?? {}
-	};
-}
-/**
-* Support sessions in the `support-sessions` SQL module. `start` runs
-* as the admin, so the module's `is_platform()` gate applies; the reads run
-* on the admin connection.
-*/
-function sqlSupportStore(postgres, options = {}) {
-	const fn = (name) => `${sqlIdent(options.schema ?? "better_supabase")}.${sqlIdent(name)}`;
-	const as = (claims) => claims ? postgres.asUser(claims) : postgres.admin;
-	const one = async (client, text, params) => {
-		const [row] = await client.queryRaw(text, params);
-		return row?.session ?? null;
-	};
-	return {
-		apiVersion: 1,
-		name: "sql",
-		async start(input) {
-			const row = await one(postgres.asUser(input.adminClaims), `select ${fn("start_support_session")}($1, $2, $3::interval, $4, $5, $6, $7) as session`, [
-				input.targetUserId,
-				input.reason,
-				`${String(input.ttlSeconds)} seconds`,
-				input.readOnly,
-				JSON.stringify(input.metadata),
-				input.tenant ?? null,
-				input.adminId
-			]);
-			if (!row) throw new Error("start_support_session returned no session");
-			return supportSessionFromRow(row);
-		},
-		async get(sessionId, adminId, claims) {
-			const row = await one(as(claims), `select ${fn("active_support_session")}($1, $2) as session`, [sessionId, adminId]);
-			return row ? supportSessionFromRow(row) : void 0;
-		},
-		async end(sessionId, endedBy, claims) {
-			const [row] = await as(claims).queryRaw(`select ${fn("end_support_session")}($1, $2) as ended`, [sessionId, endedBy]);
-			return row?.ended === true;
-		},
-		async list(filter = {}, claims) {
-			return (await as(claims).queryRaw(`select session from ${fn("list_support_sessions")}($1, $2, $3, $4) as session`, [
-				filter.adminId ?? null,
-				filter.targetUserId ?? null,
-				filter.active ?? null,
-				filter.limit ?? 50
-			])).map((row) => supportSessionFromRow(row.session));
-		},
-		async claims(targetUserId) {
-			const [row] = await postgres.admin.queryRaw(`select ${fn("support_target_claims")}($1) as claims`, [targetUserId]);
-			return row?.claims ?? {};
-		}
-	};
-}
-/**
-* The claims a support session runs with: the target's, plus `act` naming
-* the admin, the reason and the session (the audit module records all three),
-* marked `kind: "support"` so `actorOf` never reads it as an OAuth client.
-* `role` falls back to `authenticated`; the admin's claims never leak in.
-*/
-function supportClaims(session, target) {
-	const role = target["role"];
-	return {
-		...target,
-		sub: session.targetUserId,
-		role: typeof role === "string" && role !== "" ? role : "authenticated",
-		act: {
-			kind: "support",
-			sub: session.adminId,
-			reason: session.reason,
-			session_id: session.id,
-			read_only: session.readOnly
-		}
-	};
-}
-//#endregion
-//#region src/server/support.ts
-/** How long a support target's claims are reused; a role change applies within it. */
-const CLAIMS_TTL_MS = 6e4;
-const CLAIMS_CACHE_SIZE = 1e3;
-const denied = (message, code) => dbError("forbidden", message, { code });
-const invalid = (message, code) => dbError("invalid_request", message, { code });
-function storeError(cause) {
-	const raw = fromPgError(cause);
-	return raw ? mapDbError(raw) : toDbError(cause);
-}
-/**
-* Support sessions for `createServer(betterSupabase, { support })`. Apps that
-* never import it don't bundle the support code.
-*/
-function supportSessions(options) {
-	return {
-		options,
-		create: (events, claimsSchema) => createSupport(options, events, claimsSchema)
-	};
-}
-function createSupport(options, events, claimsSchema) {
-	const policy = options.policy ?? {};
-	const ttl = policy.ttl ?? 1800;
-	const maxTtl = policy.maxTtl ?? 14400;
-	const cookieName = options.cookie?.name;
-	const emit = (type, data) => {
-		emitBlockEvent(events, type, data, {
-			actorId: data.adminId,
-			...data.sessionId ? { subject: `support_sessions/${data.sessionId}` } : {}
-		});
-	};
-	const targetClaims = async (store, targetUserId) => {
-		if (options.claims) return options.claims(targetUserId);
-		if (store.claims) return store.claims(targetUserId);
-		return { role: "authenticated" };
-	};
-	/** Target claims per support session; the session itself is loaded every time, so revoking stays immediate. */
-	const claimsCache = /* @__PURE__ */ new Map();
-	const cachedTargetClaims = async (session) => {
-		const now = Date.now();
-		const cached = claimsCache.get(session.id);
-		if (cached && cached.until > now) return cached.claims;
-		const claims = await targetClaims(options.store, session.targetUserId);
-		claimsCache.delete(session.id);
-		if (claimsCache.size >= CLAIMS_CACHE_SIZE) {
-			const oldest = claimsCache.keys().next();
-			if (!oldest.done) claimsCache.delete(oldest.value);
-		}
-		claimsCache.set(session.id, {
-			claims,
-			until: Math.min(session.expiresAt.epochMilliseconds, now + CLAIMS_TTL_MS)
-		});
-		return claims;
-	};
-	const checkPolicy = (admin, request, reason, seconds) => {
-		if (admin.claims["act"] !== void 0) return denied("An impersonated session cannot start a support session", "SUPPORT_NESTED");
-		if (request.targetUserId === admin.user.id) return invalid("An admin cannot start a support session as themselves", "SUPPORT_SELF");
-		if ((policy.requireReason ?? true) && reason === "") return invalid("A reason is required", "SUPPORT_REASON_REQUIRED");
-		if (!Number.isFinite(seconds) || seconds <= 0 || seconds > maxTtl) return invalid(`ttl must be between 1 and ${String(maxTtl)} seconds`, "SUPPORT_TTL");
-	};
-	const authorized = async (input) => {
-		if (!options.authorize) return true;
-		try {
-			return await options.authorize(input);
-		} catch {
-			return false;
-		}
-	};
-	return {
-		start(admin, request) {
-			return AsyncResult.from(async () => {
-				if (admin.kind !== "user") return err(dbError("unauthorized", "Sign in to start a support session"));
-				const reason = request.reason?.trim() ?? "";
-				const seconds = request.ttl ?? ttl;
-				const readOnly = policy.readOnly === "default" ? request.readOnly ?? true : true;
-				const deny = (error, denial) => {
-					emit("support.denied", {
-						adminId: admin.user.id,
-						targetUserId: request.targetUserId,
-						...reason ? { reason } : {},
-						denial
-					});
-					return err(error);
-				};
-				const violation = checkPolicy(admin, request, reason, seconds);
-				if (violation) return deny(violation, "policy");
-				const input = {
-					admin,
-					targetUserId: request.targetUserId,
-					reason,
-					readOnly,
-					...request.tenant === void 0 ? {} : { tenant: request.tenant },
-					metadata: request.metadata ?? {}
-				};
-				if (!await authorized(input)) return deny(denied("Not allowed to start a support session", "SUPPORT_FORBIDDEN"), "authorize");
-				let session;
-				try {
-					session = await options.store.start({
-						adminId: admin.user.id,
-						adminClaims: admin.claims,
-						targetUserId: request.targetUserId,
-						reason,
-						ttlSeconds: seconds,
-						readOnly,
-						...request.tenant === void 0 ? {} : { tenant: request.tenant },
-						metadata: request.metadata ?? {}
-					});
-				} catch (cause) {
-					const error = storeError(cause);
-					return deny(error, error.code === "42501" ? "permission" : "store");
-				}
-				emit("support.started", {
-					sessionId: session.id,
-					adminId: session.adminId,
-					targetUserId: session.targetUserId,
-					reason: session.reason,
-					readOnly: session.readOnly,
-					expiresAt: session.expiresAt
-				});
-				return ok({
-					session,
-					cookie: supportCookie(session, options.cookie)
-				});
-			});
-		},
-		stop(admin, sessionId) {
-			return AsyncResult.from(async () => {
-				const cookie = clearSupportCookie(options.cookie);
-				if (admin.kind !== "user") return err(dbError("unauthorized", "Sign in to stop a support session"));
-				try {
-					const session = await options.store.get(sessionId, admin.user.id, admin.claims);
-					if (!session) return ok({
-						ended: false,
-						cookie
-					});
-					const ended = await options.store.end(sessionId, "admin", admin.claims);
-					if (ended) emit("support.ended", {
-						sessionId,
-						adminId: session.adminId,
-						targetUserId: session.targetUserId,
-						endedBy: "admin"
-					});
-					return ok({
-						ended,
-						cookie
-					});
-				} catch (cause) {
-					return err(storeError(cause));
-				}
-			});
-		},
-		revoke(caller, sessionId) {
-			return AsyncResult.from(async () => {
-				if (caller.kind !== "user") return err(dbError("unauthorized", "Sign in to revoke a support session"));
-				try {
-					return ok(await options.store.end(sessionId, "revoked", caller.claims));
-				} catch (cause) {
-					return err(storeError(cause));
-				}
-			});
-		},
-		async current(request, auth) {
-			if (auth.kind !== "user") return;
-			if (auth.claims["act"] !== void 0) return;
-			const id = supportCookieValue(request.headers.get("cookie"), cookieName);
-			if (!id) return;
-			let session;
-			let claims;
-			try {
-				session = await options.store.get(id, auth.user.id, auth.claims);
-				if (!session || session.expiresAt.epochMilliseconds <= Date.now()) return;
-				if (policy.readOnly !== "default" && !session.readOnly) session = {
-					...session,
-					readOnly: true
-				};
-				claims = supportClaims(session, await cachedTargetClaims(session));
-			} catch (cause) {
-				events.logger.warn("Could not load the support session", { cause });
-				return;
-			}
-			if (claimsSchema) {
-				const checked = await validate(claimsSchema, claims, "claims");
-				if (!checked.ok) {
-					events.logger.warn("The support target's claims fail the claims schema", { sessionId: session.id });
-					return;
-				}
-				if (typeof checked.data === "object" && checked.data !== null) claims = {
-					...claims,
-					...checked.data
-				};
-			}
-			return {
-				session,
-				admin: {
-					id: auth.user.id,
-					...auth.user.email ? { email: auth.user.email } : {}
-				},
-				claims
-			};
-		},
-		list(caller, filter) {
-			return AsyncResult.from(async () => {
-				if (caller.kind !== "user") return err(dbError("unauthorized", "Sign in to list support sessions"));
-				try {
-					return ok(await options.store.list(filter, caller.claims));
-				} catch (cause) {
-					return err(storeError(cause));
-				}
-			});
-		},
-		sessionIdOf: (request) => supportCookieValue(request.headers.get("cookie"), cookieName),
-		clearCookie: () => clearSupportCookie(options.cookie)
-	};
-}
-//#endregion
-export { sqlSupportStore as n, supportClaims as r, supportSessions as t };

package/dist/support-view-CVOJJLpc.d.ts

@@ -1,17 +0,0 @@
-import { t as AuthSession } from "./view-CF7ihnkg.js";
-//#region src/auth/support-view.d.ts
-/** A running support session as the target's view shows it, for a banner. */
-interface SupportView {
-  readonly sessionId: string;
-  /** The admin viewing the app. */
-  readonly adminId: string;
-  readonly targetUserId: string;
-  readonly reason?: string;
-  readonly readOnly: boolean;
-  /** Seconds since epoch. */
-  readonly expiresAt: number | null;
-}
-/** The support session behind `session`, or `undefined` outside one. */
-declare function supportOf(session: AuthSession): SupportView | undefined;
-//#endregion
-export { supportOf as n, SupportView as t };

package/dist/tags-Cx-LnIQP.d.ts

@@ -1,30 +0,0 @@
-import { d as CacheTarget, u as CacheAdapter } from "./define-CJJkkr1-.js";
-//#region src/core/tags.d.ts
-interface TagOptions {
-  /** The tenant the read is scoped to; `"*"` is every tenant's reads. */
-  readonly tenant?: string;
-}
-/**
- * `bs:<table>`, `bs:<table>:<id>`, or `bs:<table>@<tenant>` for a read
- * scoped to one tenant. Mutations invalidate the table tag, the tag of their
- * tenant (`bs:<table>@*` without one) and the tags of the changed rows.
- */
-declare function tagFor(table: string, id?: string | number, options?: TagOptions): string;
-/**
- * The tags a mutation invalidates: `bs:<table>` for every table in the
- * target, the tenant's `bs:<table>@<tenant>` (every tenant's `bs:<table>@*`
- * when the mutation has no tenant) and `bs:<table>:<id>` per changed row.
- */
-declare function cacheTagsOf(target: CacheTarget): string[];
-/**
- * A `CacheAdapter` for any tag-based cache: it hands `invalidate` the tags
- * from `cacheTagsOf`, e.g. a CDN purge by tag, SvelteKit's `invalidate`, or
- * a Redis set of keys per tag. Tag your reads with `tagFor`.
- *
- * ```ts
- * betterSupabase.cache(tagCache((tags) => purgeCdn(tags), 'cdn'))
- * ```
- */
-declare function tagCache(invalidate: (tags: readonly string[]) => void | Promise<void>, name?: string): CacheAdapter;
-//#endregion
-export { tagFor as i, cacheTagsOf as n, tagCache as r, TagOptions as t };