better-supabase 0.7.1 → 0.9.0

package/dist/casing-DdFWEtqr.js

@@ -0,0 +1,16 @@
+import { t as lookupOf } from "./lookup-BaP5bI27.js";
+//#region src/schema/casing.ts
+/** Database-keyed row to app-keyed row. */
+function toApp(table, row) {
+	const out = {};
+	for (const [app, meta] of lookupOf(table).entries) if (meta.db in row) out[app] = row[meta.db];
+	return out;
+}
+/** App-keyed row to database-keyed row. Unknown keys are dropped. */
+function toDb(table, row) {
+	const out = {};
+	for (const [app, meta] of lookupOf(table).entries) if (app in row) out[meta.db] = row[app];
+	return out;
+}
+//#endregion
+export { toDb as n, toApp as t };

package/dist/channel-D-LHCY11.d.ts

@@ -0,0 +1,78 @@
+/// <reference lib="esnext.temporal" />
+//#region src/blocks/notifications/types.d.ts
+/** A subject a notification is about, e.g. `{ type: 'task', id: '42' }`. */
+interface NotificationSubject {
+  readonly type: string;
+  readonly id: string;
+  /** Shown in the list, e.g. the task title, kept as it was at send time. */
+  readonly label?: string;
+}
+/** One notification as its recipient sees it. */
+interface NotificationItem<K extends string = string, D = unknown> {
+  /** The recipient row id: pass it to `markRead` and `dismiss`. */
+  readonly id: string;
+  /** The shared event id, the same for every recipient. */
+  readonly eventId: string;
+  readonly type: K;
+  readonly data: D;
+  readonly tenant: string | null;
+  readonly actorId: string | null;
+  readonly subject: NotificationSubject | null;
+  readonly summary: string | null;
+  readonly actionPath: string | null;
+  readonly priority: string | null;
+  readonly createdAt: Temporal.Instant;
+  readonly readAt: Temporal.Instant | null;
+  readonly resolvedAt: Temporal.Instant | null;
+  /** The events table's extra columns (`options.extraColumns`), by column name. */
+  readonly fields: Readonly<Record<string, unknown>>;
+}
+/** What `render` returns: the text for one notification, in one locale. */
+interface RenderedText {
+  readonly title: string;
+  readonly body?: string;
+}
+//#endregion
+//#region src/blocks/notifications/channel.d.ts
+/** One pending delivery a channel sends: the notification and who gets it. */
+interface NotificationMessage {
+  readonly deliveryId: string;
+  /** The channel name, e.g. `email`. */
+  readonly channel: string;
+  /** 1 on the first try. */
+  readonly attempts: number;
+  readonly userId: string;
+  /** The recipient's `auth.users` email, for email channels. */
+  readonly email: string | null;
+  readonly notification: NotificationItem;
+  /** What `render` returned for it, when `createNotifications` has one. */
+  readonly text?: RenderedText;
+}
+interface NotificationSendResult {
+  /** `skipped` when the channel decided not to send. Defaults to `sent`. */
+  readonly status?: "sent" | "skipped";
+  /** The provider's name, e.g. `resend` or `fcm`. */
+  readonly provider?: string;
+  /** The provider's id for the message, kept for support and webhooks. */
+  readonly providerMessageId?: string;
+  /**
+   * The template the message was built from, e.g. `task-assigned-v2`,
+   * stored on the delivery for `subjectDeliveries`. Needs notifications
+   * module version 6.
+   */
+  readonly templateKey?: string;
+}
+/**
+ * Sends notifications on one channel (email, push, Slack). The delivery
+ * worker (`notifications.deliver()`) claims pending deliveries for the
+ * channel's `name` and calls `send` for each. Throwing retries the delivery
+ * after its lease, up to `maxAttempts`, then marks it `failed`.
+ */
+interface NotificationChannel {
+  readonly apiVersion: 1;
+  /** Matches the `channel` the deliveries were created for. */
+  readonly name: string;
+  send(message: NotificationMessage): NotificationSendResult | void | Promise<NotificationSendResult | void>;
+}
+//#endregion
+export { NotificationSubject as a, NotificationItem as i, NotificationMessage as n, RenderedText as o, NotificationSendResult as r, NotificationChannel as t };

package/dist/channels-C-GCoNLd.js

@@ -0,0 +1,114 @@
+import { t as refreshRealtimeAuth } from "./auth-CdBKt0CS.js";
+import { REALTIME_SUBSCRIBE_STATES } from "@supabase/supabase-js";
+//#region src/realtime/channels.ts
+const topicChannels = /* @__PURE__ */ new WeakMap();
+/**
+* One channel per topic and client, shared by every `subscribe()` on it:
+* supabase-js hands back the open channel for a topic, so a second join or
+* an early `removeChannel` would break the first subscription.
+*/
+function joinTopic(client, topic, isPrivate, self, presence, subscriber) {
+	let byTopic = topicChannels.get(client);
+	if (!byTopic) {
+		byTopic = /* @__PURE__ */ new Map();
+		topicChannels.set(client, byTopic);
+	}
+	const topics = byTopic;
+	let shared = topics.get(topic);
+	if (shared && shared.self !== self) throw new TypeError(`better-supabase: "${topic}" is already subscribed with self: ${String(shared.self)}; every subscription on a topic needs the same \`self\``);
+	if (shared && shared.presence !== presence) throw new TypeError(`better-supabase: "${topic}" is already subscribed ${shared.presence ? "with" : "without"} presence; every topic definition for it needs the same \`presence\``);
+	if (!shared) {
+		const channel = client.channel(topic, { config: {
+			private: isPrivate,
+			broadcast: { self }
+		} });
+		const subscribers = /* @__PURE__ */ new Set();
+		const status = (next, error) => {
+			for (const each of subscribers) each.onStatus?.(next, error);
+		};
+		channel.on("broadcast", { event: "*" }, (raw) => {
+			const message = {
+				event: raw.event,
+				payload: raw["payload"],
+				topic
+			};
+			for (const each of subscribers) each.receive(message);
+		});
+		if (presence) channel.on("presence", { event: "sync" }, () => {
+			entry.synced = true;
+			const state = channel.presenceState();
+			for (const each of subscribers) each.sync?.(state);
+		});
+		const evict = () => {
+			if (topics.get(topic) !== entry) return;
+			topics.delete(topic);
+			client.removeChannel(channel);
+		};
+		const ready = (async () => {
+			await (isPrivate ? refreshRealtimeAuth(client) : void 0);
+			if (subscribers.size === 0) return;
+			await new Promise((resolve, reject) => {
+				channel.subscribe((state, error) => {
+					if (topics.get(topic) !== entry) return;
+					switch (state) {
+						case REALTIME_SUBSCRIBE_STATES.SUBSCRIBED:
+							entry.subscribed = true;
+							status("subscribed");
+							resolve();
+							return;
+						case REALTIME_SUBSCRIBE_STATES.CLOSED:
+							entry.subscribed = false;
+							status("closed");
+							resolve();
+							return;
+						case REALTIME_SUBSCRIBE_STATES.CHANNEL_ERROR:
+						case REALTIME_SUBSCRIBE_STATES.TIMED_OUT: {
+							const failure = error ?? /* @__PURE__ */ new Error(`Realtime ${state.toLowerCase()} on ${topic}`);
+							status("error", failure);
+							reject(failure);
+							if (!entry.subscribed) evict();
+							return;
+						}
+						default: reject(/* @__PURE__ */ new Error(`Unknown realtime status ${String(state)}`));
+					}
+				});
+			});
+		})();
+		ready.catch(() => void 0);
+		const entry = {
+			channel,
+			self,
+			presence,
+			subscribers,
+			ready,
+			subscribed: false,
+			synced: false,
+			tracker: void 0
+		};
+		shared = entry;
+		topics.set(topic, entry);
+	}
+	const current = shared;
+	current.subscribers.add(subscriber);
+	subscriber.onStatus?.("joining");
+	if (current.subscribed) subscriber.onStatus?.("subscribed");
+	if (current.synced) subscriber.sync?.(current.channel.presenceState());
+	return {
+		shared: current,
+		leave: async () => {
+			current.subscribers.delete(subscriber);
+			if (current.subscribers.size > 0) {
+				if (current.tracker === subscriber) {
+					current.tracker = void 0;
+					await current.channel.untrack();
+				}
+				return;
+			}
+			if (topics.get(topic) !== current) return;
+			topics.delete(topic);
+			await client.removeChannel(current.channel);
+		}
+	};
+}
+//#endregion
+export { joinTopic as t };

package/dist/chat-sdk/index.d.ts

@@ -1,10 +1,11 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "../result-D7y2fT87.js";
-import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../block-transport-DvaoPuZ9.js";
-import { a as CredentialSubject, i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "../provider-D-UEMvSD.js";
-import { o as StreamStore } from "../store-CGjgWu5n.js";
-import { C as InboxMessage, T as MessageAttachment, a as Inbox, b as InboundResult, h as Conversation, j as StoredInboundEvent, y as DeliveryStatus } from "../inbox-i7E1ppo6.js";
-import { Adapter, AdapterPostableMessage, Attachment, Message, RawMessage, StateAdapter, WebhookOptions } from "chat";
+import { t as AsyncResult, w as ErrorMapper } from "../result-Cj3yWhjH.js";
+import { a as CredentialSubject, i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "../provider-9gBq9W6k.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-DaGGXjIw.js";
+import { o as StreamStore } from "../store-B5qYKsTh.js";
+import { c as ChatActionHook, d as IdentityRef, f as IdentityTarget, i as AuthorizationHooks, p as PrincipalByIdentity, s as ChatAction, t as ApprovalRequestRef } from "../authorization-hooks-DkmrnDX7.js";
+import { E as MessageAttachment, M as StoredInboundEvent, a as Inbox, b as DeliveryStatus, g as Conversation, w as InboxMessage, x as InboundResult } from "../inbox-3ql4phyr.js";
+import { Adapter, AdapterPostableMessage, Attachment, Author, Message, RawMessage, StateAdapter, WebhookOptions } from "chat";
 //#region src/chat-sdk/delivery.d.ts
 /** One status callback for a message the bot sent on a channel. */
 interface DeliveryUpdate {
@@ -189,6 +190,112 @@ interface MaintainResult {
 /** The inbox's periodic work: wake snoozed conversations, replay and purge webhook events, sweep state. Run it from a cron job. */
 export declare function maintain(options: MaintainOptions): Promise<MaintainResult>;
 //#endregion
+//#region src/chat-sdk/identity.d.ts
+/** Where the chat helpers find `principalByIdentity` and `onAction`. */
+interface ChatIdentityOptions {
+  /** Wins over `server.authorization.identities.principalByIdentity`. */
+  readonly principalByIdentity?: PrincipalByIdentity;
+  /** `createServer(...)`: its `authorization` hooks fill the slots this call leaves out. */
+  readonly server?: {
+    readonly authorization: AuthorizationHooks | undefined;
+  };
+}
+/**
+ * The `IdentityRef` of a Chat SDK author: `kind: "chat"`, the adapter name
+ * as the provider and the platform's user id. Pass `workspace` (a Slack
+ * team id) when one app serves several workspaces.
+ */
+export declare function chatIdentityOf(author: Pick<Author, "userId">, adapter: {
+  readonly name: string;
+}, workspace?: string): IdentityRef;
+/** The user or contact `identity` is linked to; `null` without a resolver or a link. */
+export declare function resolveChatAuthor(identity: IdentityRef, options: ChatIdentityOptions): Promise<IdentityTarget | null>;
+/** What a bot job is enqueued with: a ticket for a linked user, nothing otherwise. */
+interface BotJobEnqueueOptions {
+  readonly ticket?: string;
+}
+interface BotJobsOptions<P, R> extends ChatIdentityOptions {
+  /**
+   * Enqueues the job, such as `(payload, options) => jobs.enqueue("bot",
+   * payload, options)`. Pass `options` through as is: it never carries a
+   * context, so an unlinked author's job runs without a user.
+   */
+  readonly enqueue: (payload: P, options: BotJobEnqueueOptions) => R;
+  /**
+   * Issues the opaque ticket the job runs as for a linked user. The
+   * provider's `tickets.subject` turns it back into that user's context
+   * in `forContext`.
+   */
+  readonly ticketFor: (userId: string) => string | Promise<string>;
+}
+interface EnqueuedBotJob<R> {
+  /** What `enqueue` returned. */
+  readonly result: Awaited<R>;
+  /** The author's link: a ticket was issued only for `kind: "user"`. */
+  readonly author: IdentityTarget | null;
+}
+interface BotJobs<P, R> {
+  /**
+   * Resolves the author, then enqueues `payload` with a ticket for a linked
+   * user. An unlinked author, or one linked to a contact, gets no ticket
+   * and no user context; the job never falls back to the bot's service
+   * role. A resolver or ticket error rejects without enqueuing.
+   */
+  enqueue(author: IdentityRef, payload: P): Promise<EnqueuedBotJob<R>>;
+}
+/** Enqueues bot jobs that run as the chat author's linked user. */
+export declare function botJobs<P, R>(options: BotJobsOptions<P, R>): BotJobs<P, R>;
+/** A Chat SDK `ActionEvent` as the `ChatAction` the provider decides. */
+export declare function chatActionOf(event: {
+  readonly actionId: string;
+  readonly value?: string;
+  readonly user: Pick<Author, "userId">;
+  readonly adapter: {
+    readonly name: string;
+  };
+}, workspace?: string): ChatAction;
+/** Why a chat action was refused. */
+type ChatActionRefusal = "unlinked" | "unhandled" | "refused" | "error";
+type ChatActionDecision = {
+  readonly allowed: true;
+  readonly author: IdentityTarget;
+  /** The user who acts: the linked author, or the user the hook named for a contact. */
+  readonly userId?: string;
+} | {
+  readonly allowed: false;
+  readonly reason: ChatActionRefusal;
+};
+interface ChatActionsOptions extends ChatIdentityOptions {
+  /** Wins over `server.authorization.chat.onAction`. */
+  readonly onAction?: ChatActionHook;
+}
+/**
+ * Decides a chat button press through the provider: the author is
+ * resolved, then `onAction(action, author)` runs. Everything but
+ * `allowed: true` refuses, and an unlinked author is refused before the
+ * hook runs. Act on the decision, never on the button alone.
+ */
+export declare function chatActions(options: ChatActionsOptions): (action: ChatAction) => Promise<ChatActionDecision>;
+interface ApprovalPromptOptions {
+  /** The app's approval page, such as `https://app.example.com/approvals`. */
+  readonly page: string | URL;
+  readonly request: ApprovalRequestRef;
+  /** The message above the link. */
+  readonly text?: string;
+  /** The link text. Defaults to `Review the request`. */
+  readonly label?: string;
+}
+/**
+ * The approval page URL for `request`, with `kind` and `subject` as query
+ * parameters. Opening it approves nothing: the signed-in approver decides
+ * on the page, and the page's server action or POST route checks them.
+ */
+export declare function approvalLink(page: string | URL, request: ApprovalRequestRef): string;
+/** A chat message that links to the approval page, for `thread.post`. */
+export declare function approvalPrompt(options: ApprovalPromptOptions): {
+  readonly markdown: string;
+};
+//#endregion
 //#region src/chat-sdk/inbox-adapter.d.ts
 /** The job the `inbox` module queues for a contact message while `bot_mode = 'bot'`. */
 interface InboxBotJob {
@@ -210,12 +317,29 @@ interface InboxAdapterOptions {
   readonly verify?: (request: Request) => boolean | Promise<boolean>;
   /** Stores streamed replies so a reader can resume them; the stream id lands in the message's `metadata.stream_id`. */
   readonly streams?: StreamStore;
+  /**
+   * Issues a ticket for the contact's linked user before the bot's
+   * handlers run, so they read and write as that user: `dispatch` resolves
+   * `inboxIdentityOf(contactId)` through `principalByIdentity` (or the
+   * server's `identities` hook) and calls `ticketFor` for a `kind: "user"`
+   * link, as `botJobs` does. Read it with `ticketOf(message)`. A contact
+   * with no link stays a visitor and gets no ticket.
+   */
+  readonly identities?: Omit<BotJobsOptions<unknown, unknown>, "enqueue">;
 }
 interface InboxAdapter extends Adapter<string, InboxMessage> {
   readonly name: "inbox";
   /** Hands a queued bot job to Chat SDK: loads the contact's message and runs the bot's handlers. Other authors are skipped. */
   dispatch(job: InboxBotJob): Promise<void>;
+  /**
+   * The ticket `dispatch` issued for the message's linked user, for
+   * `forContext({ ticket })`, while its handlers run; `undefined` for a
+   * visitor, after `dispatch` returns, or without the `identities` option.
+   */
+  ticketOf(message: Message<InboxMessage>): string | undefined;
 }
+/** The `IdentityRef` of an inbox contact: `kind: "chat"`, `provider: "inbox"` and the contact id. */
+export declare function inboxIdentityOf(contactId: string): IdentityRef;
 /** `inbox:<conversation id>` to the conversation id. */
 export declare function conversationIdOf(threadId: string): string;
 /**
@@ -300,4 +424,4 @@ interface SupabaseState extends StateAdapter {
  */
 export declare function createSupabaseState(options: SupabaseStateOptions): SupabaseState;
 //#endregion
-export { type BlockTransport, type ChannelAdapterOptions, type ChatInstallation, type ChatInstallations, type ChatInstallationsOptions, type ChatLike, type DeliverOptions, type DeliveryParser, type DeliveryUpdate, type DrainResult, type InboundHandler, type InboundHandlerOptions, type InboxAdapter, type InboxAdapterOptions, type InboxBotJob, type InboxOutboundJob, type InboxWebhookOptions, type InstallInput, type MaintainOptions, type MaintainResult, type MirrorThread, type ParsedDeliveries, type SupabaseState, type SupabaseStateOptions, rpcTransport, sqlTransport };
+export { type ApprovalPromptOptions, type BlockTransport, type BotJobEnqueueOptions, type BotJobs, type BotJobsOptions, type ChannelAdapterOptions, type ChatActionDecision, type ChatActionRefusal, type ChatActionsOptions, type ChatIdentityOptions, type ChatInstallation, type ChatInstallations, type ChatInstallationsOptions, type ChatLike, type DeliverOptions, type DeliveryParser, type DeliveryUpdate, type DrainResult, type EnqueuedBotJob, type InboundHandler, type InboundHandlerOptions, type InboxAdapter, type InboxAdapterOptions, type InboxBotJob, type InboxOutboundJob, type InboxWebhookOptions, type InstallInput, type MaintainOptions, type MaintainResult, type MirrorThread, type ParsedDeliveries, type SupabaseState, type SupabaseStateOptions, dbTransport, rpcTransport, sqlTransport };

package/dist/chat-sdk/index.js

@@ -1,7 +1,8 @@
-import { s as nowInstant } from "../temporal-BJGitm-h.js";
-import { n as rpcTransport, r as sqlTransport } from "../block-transport-BLr-ZgLc.js";
-import { C as run, O as textOf, _ as randomToken, c as errorText, d as isRecord, h as optionalText, i as blockCall, k as toInstant } from "../block-helpers-DWHxHsEQ.js";
-import { r as writeToStore } from "../tee-CoEppCER.js";
+import { s as nowInstant } from "../temporal-CB5Fpo5d.js";
+import { n as isRecord } from "../guards-6F2bCtQR.js";
+import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-G4t1umrR.js";
+import { C as optionalText, I as textOf, R as toInstant, T as randomToken, f as errorText, j as run, o as blockCall } from "../block-helpers-CfG_MvDR.js";
+import { r as writeToStore } from "../tee-Bsisfd7t.js";
 import { BaseFormatConverter, Message, defaultEmojiResolver, parseMarkdown, stringifyMarkdown } from "chat";
 //#region src/chat-sdk/delivery.ts
 const STATUSES = {
@@ -313,6 +314,131 @@ async function maintain(options) {
 	};
 }
 //#endregion
+//#region src/chat-sdk/identity.ts
+/**
+* The `IdentityRef` of a Chat SDK author: `kind: "chat"`, the adapter name
+* as the provider and the platform's user id. Pass `workspace` (a Slack
+* team id) when one app serves several workspaces.
+*/
+function chatIdentityOf(author, adapter, workspace) {
+	return {
+		kind: "chat",
+		provider: adapter.name,
+		value: author.userId,
+		...workspace === void 0 ? {} : { workspace }
+	};
+}
+/** The user or contact `identity` is linked to; `null` without a resolver or a link. */
+async function resolveChatAuthor(identity, options) {
+	const resolve = options.principalByIdentity ?? options.server?.authorization?.identities?.principalByIdentity;
+	return resolve ? await resolve(identity) ?? null : null;
+}
+/** Enqueues bot jobs that run as the chat author's linked user. */
+function botJobs(options) {
+	return { async enqueue(identity, payload) {
+		const author = await resolveChatAuthor(identity, options);
+		if (author?.kind !== "user") return {
+			result: await options.enqueue(payload, {}),
+			author
+		};
+		const ticket = await options.ticketFor(author.userId);
+		if (typeof ticket !== "string" || ticket === "") throw new TypeError("botJobs: ticketFor returned an empty ticket");
+		return {
+			result: await options.enqueue(payload, { ticket }),
+			author
+		};
+	} };
+}
+/** A Chat SDK `ActionEvent` as the `ChatAction` the provider decides. */
+function chatActionOf(event, workspace) {
+	return {
+		id: event.actionId,
+		...event.value === void 0 ? {} : { value: event.value },
+		author: chatIdentityOf(event.user, event.adapter, workspace)
+	};
+}
+/**
+* Decides a chat button press through the provider: the author is
+* resolved, then `onAction(action, author)` runs. Everything but
+* `allowed: true` refuses, and an unlinked author is refused before the
+* hook runs. Act on the decision, never on the button alone.
+*/
+function chatActions(options) {
+	return async (action) => {
+		const hook = options.onAction ?? options.server?.authorization?.chat?.onAction;
+		let author;
+		try {
+			author = await resolveChatAuthor(action.author, options);
+		} catch {
+			return {
+				allowed: false,
+				reason: "error"
+			};
+		}
+		if (author === null) return {
+			allowed: false,
+			reason: "unlinked"
+		};
+		if (!hook) return {
+			allowed: false,
+			reason: "unhandled"
+		};
+		let decision;
+		try {
+			decision = await hook(action, author);
+		} catch {
+			return {
+				allowed: false,
+				reason: "error"
+			};
+		}
+		if (decision === void 0) return {
+			allowed: false,
+			reason: "unhandled"
+		};
+		if (!decision.allowed) return {
+			allowed: false,
+			reason: "refused"
+		};
+		switch (author.kind) {
+			case "user": return decision.userId === void 0 || decision.userId === author.userId ? {
+				allowed: true,
+				author,
+				userId: author.userId
+			} : {
+				allowed: false,
+				reason: "refused"
+			};
+			case "contact": return decision.userId === void 0 ? {
+				allowed: true,
+				author
+			} : {
+				allowed: true,
+				author,
+				userId: decision.userId
+			};
+			default: throw new TypeError(`unknown identity target ${String(author)}`);
+		}
+	};
+}
+/**
+* The approval page URL for `request`, with `kind` and `subject` as query
+* parameters. Opening it approves nothing: the signed-in approver decides
+* on the page, and the page's server action or POST route checks them.
+*/
+function approvalLink(page, request) {
+	const url = new URL(page);
+	url.searchParams.set("kind", request.kind);
+	url.searchParams.set("subject", request.subject);
+	return url.toString();
+}
+const escapeLabel = (label) => label.replaceAll(/[[\]\\]/g, (char) => `\\${char}`);
+/** A chat message that links to the approval page, for `thread.post`. */
+function approvalPrompt(options) {
+	const link = `[${escapeLabel(options.label ?? "Review the request")}](${approvalLink(options.page, options.request).replaceAll(")", "%29")})`;
+	return { markdown: options.text === void 0 ? link : `${options.text}\n\n${link}` };
+}
+//#endregion
 //#region src/chat-sdk/inbox-adapter.ts
 const PREFIX = "inbox:";
 var MarkdownConverter = class extends BaseFormatConverter {
@@ -324,6 +450,14 @@ var MarkdownConverter = class extends BaseFormatConverter {
 	}
 };
 const converter = new MarkdownConverter();
+/** The `IdentityRef` of an inbox contact: `kind: "chat"`, `provider: "inbox"` and the contact id. */
+function inboxIdentityOf(contactId) {
+	return {
+		kind: "chat",
+		provider: "inbox",
+		value: contactId
+	};
+}
 /** `inbox:<conversation id>` to the conversation id. */
 function conversationIdOf(threadId) {
 	if (!threadId.startsWith(PREFIX) || threadId.length === 6) throw new Error(`"${threadId}" is not an inbox thread id`);
@@ -375,6 +509,11 @@ function inboxAdapter(options) {
 	const { inbox } = options;
 	const userName = options.userName ?? "bot";
 	let chat;
+	const tickets = /* @__PURE__ */ new Map();
+	const ticketJobs = options.identities === void 0 ? void 0 : botJobs({
+		...options.identities,
+		enqueue: (_message, { ticket }) => ticket
+	});
 	const parseMessage = (raw) => {
 		const isBot = raw.authorType === "bot" || raw.authorType === "system";
 		const userId = raw.authorType === "bot" ? userName : raw.authorId ?? raw.authorType;
@@ -428,7 +567,16 @@ function inboxAdapter(options) {
 		if (!chat) throw new Error("inboxAdapter: initialize() has not run");
 		const message = await inbox.messages.get(job.message_id).orThrow();
 		if (message?.conversationId !== job.conversation_id || message.authorType !== "contact" || message.kind !== "message") return;
-		await chat.processMessage(adapter, `${PREFIX}${message.conversationId}`, parseMessage(message));
+		const parsed = parseMessage(message);
+		if (ticketJobs !== void 0 && message.authorId !== null) {
+			const { result } = await ticketJobs.enqueue(inboxIdentityOf(message.authorId), parsed);
+			if (result !== void 0) tickets.set(message.id, result);
+		}
+		try {
+			await chat.processMessage(adapter, `${PREFIX}${message.conversationId}`, parsed);
+		} finally {
+			tickets.delete(message.id);
+		}
 	};
 	const adapter = {
 		name: "inbox",
@@ -446,6 +594,7 @@ function inboxAdapter(options) {
 		parseMessage,
 		renderFormatted: (content) => converter.fromAst(content),
 		dispatch,
+		ticketOf: (message) => tickets.get(message.id),
 		handleWebhook: async (request) => {
 			if (!options.verify || !await options.verify(request)) return new Response("unauthorized", { status: 401 });
 			let job;
@@ -730,4 +879,4 @@ function createSupabaseState(options) {
 	};
 }
 //#endregion
-export { DELIVERY_PARSERS, channelAdapter, conversationIdOf, createChatInstallations, createSupabaseState, deliver, inboundHandler, inboxAdapter, maintain, messengerDeliveries, rpcTransport, sqlTransport, twilioDeliveries, webhook, whatsappDeliveries, whatsappWindowOpen };
+export { DELIVERY_PARSERS, approvalLink, approvalPrompt, botJobs, channelAdapter, chatActionOf, chatActions, chatIdentityOf, conversationIdOf, createChatInstallations, createSupabaseState, dbTransport, deliver, inboundHandler, inboxAdapter, inboxIdentityOf, maintain, messengerDeliveries, resolveChatAuthor, rpcTransport, sqlTransport, twilioDeliveries, webhook, whatsappDeliveries, whatsappWindowOpen };

package/dist/chat-sdk/react/index.d.ts

@@ -1,2 +1,3 @@
-import { a as UseConversationOptions, c as useConversation, i as InboxWidgetState, l as useInbox, n as InboxListState, o as UseInboxOptions, r as InboxSource, s as UseInboxWidgetOptions, t as ConversationState, u as useInboxWidget } from "../../index-ACiNPN4Z.js";
+import { l as InboxSource } from "../../client-Lx3mlvKO.js";
+import { a as UseInboxOptions, c as useInbox, i as UseConversationOptions, l as useInboxWidget, n as InboxListState, o as UseInboxWidgetOptions, r as InboxWidgetState, s as useConversation, t as ConversationState } from "../../index-jhqhynmh.js";
 export { type ConversationState, type InboxListState, type InboxSource, type InboxWidgetState, type UseConversationOptions, type UseInboxOptions, type UseInboxWidgetOptions, useConversation, useInbox, useInboxWidget };

package/dist/chat-sdk/react/index.js

@@ -1,3 +1,2 @@
 "use client";
-import { useConversation, useInbox, useInboxWidget } from "../../blocks/inbox/react/index.js";
-export { useConversation, useInbox, useInboxWidget };
+export { useConversation, useInbox, useInboxWidget } from "../../blocks/inbox/react/index.js";

package/dist/chat-sdk/react/server.d.ts

@@ -1,3 +1,4 @@
-import { a as UseConversationOptions, i as InboxWidgetState, n as InboxListState, o as UseInboxOptions, r as InboxSource, s as UseInboxWidgetOptions, t as ConversationState } from "../../index-ACiNPN4Z.js";
+import { l as InboxSource } from "../../client-Lx3mlvKO.js";
+import { a as UseInboxOptions, i as UseConversationOptions, n as InboxListState, o as UseInboxWidgetOptions, r as InboxWidgetState, t as ConversationState } from "../../index-jhqhynmh.js";
 import { useConversation, useInbox, useInboxWidget } from "../../blocks/inbox/react/server.js";
 export { type ConversationState, type InboxListState, type InboxSource, type InboxWidgetState, type UseConversationOptions, type UseInboxOptions, type UseInboxWidgetOptions, useConversation, useInbox, useInboxWidget };

package/dist/chat-sdk/react/server.js

@@ -1,2 +1 @@
-import { useConversation, useInbox, useInboxWidget } from "../../blocks/inbox/react/server.js";
-export { useConversation, useInbox, useInboxWidget };
+export { useConversation, useInbox, useInboxWidget } from "../../blocks/inbox/react/server.js";

package/dist/claims-0KZVT804.js

@@ -0,0 +1,61 @@
+import { defineMiddleware } from "@supabase/middleware";
+//#region src/auth/claims.ts
+/** Entry contributing `ctx.auth`, the typed caller, from `ctx.bs`. */
+function withAuth() {
+	return defineMiddleware({
+		key: "auth",
+		run: () => (_request, ctx) => Promise.resolve({ auth: ctx.bs.auth })
+	})();
+}
+/** `jwtClaims` as `withSupabase` contributes it: the verified token's payload, or `null`. */
+function jwtClaimsOf(auth) {
+	if (auth.kind === "user") return auth.claims;
+	if (auth.kind === "apiKey") return auth.claims;
+	return null;
+}
+/** `userClaims` as `withSupabase` contributes it, or `null` without a user. */
+function userClaimsOf(auth) {
+	return auth.kind === "user" ? auth.user : null;
+}
+/**
+* `authMode` as `withSupabase` names it: `user` for a verified user token
+* or a user's API key, `secret` for a secret key or an organization's API
+* key, `none` otherwise (no credentials, or ones a
+* guard refuses).
+*/
+function authModeOf(auth) {
+	switch (auth.kind) {
+		case "user": return "user";
+		case "service": return "secret";
+		case "apiKey": return auth.userId ? "user" : "secret";
+		case "anon":
+		case "invalid": return "none";
+		default: return auth;
+	}
+}
+/**
+* Entry contributing `ctx.jwtClaims` under the `withSupabase` key, so
+* `withPostgresClient` and `withOpenFeature` compose downstream.
+*/
+function withJwtClaims() {
+	return defineMiddleware({
+		key: "jwtClaims",
+		run: () => (_request, ctx) => Promise.resolve({ jwtClaims: jwtClaimsOf(ctx.auth) })
+	})();
+}
+/** Entry contributing `ctx.userClaims` under the `withSupabase` key. */
+function withUserClaims() {
+	return defineMiddleware({
+		key: "userClaims",
+		run: () => (_request, ctx) => Promise.resolve({ userClaims: userClaimsOf(ctx.auth) })
+	})();
+}
+/** Entry contributing `ctx.authMode` under the `withSupabase` key. */
+function withAuthMode() {
+	return defineMiddleware({
+		key: "authMode",
+		run: () => (_request, ctx) => Promise.resolve({ authMode: authModeOf(ctx.auth) })
+	})();
+}
+//#endregion
+export { withAuthMode as a, withAuth as i, jwtClaimsOf as n, withJwtClaims as o, userClaimsOf as r, withUserClaims as s, authModeOf as t };