better-supabase 0.8.0 → 0.10.0

package/dist/create/lite/index.d.ts

@@ -0,0 +1,85 @@
+import { t as PresetMigrationFile } from "../../types-DGHfTW8_.js";
+//#region src/lite/runtime.d.ts
+/**
+ * The parts of `@supabase/lite` that `liteStack()` uses, typed
+ * structurally so the optional peer stays out of the published types.
+ */
+interface LiteConnection {
+  createMigrator(sql: string): {
+    migrate(): Promise<unknown>;
+  };
+  translateDdl(sql: string): Promise<unknown>;
+  transaction(statements: string[]): Promise<void>;
+  close(): Promise<void>;
+}
+interface PgliteConnection extends LiteConnection {
+  /** The PGlite instance: `exec` runs several statements, `query` returns `{ rows }`. */
+  readonly driver: {
+    exec(sql: string): Promise<unknown>;
+    query(sql: string): Promise<{
+      rows: unknown[];
+    }>;
+  };
+}
+interface LiteAppConfig {
+  readonly connection: LiteConnection;
+  readonly auth: {
+    readonly enabled: boolean;
+    readonly jwt_secret: string;
+    readonly publishable_key?: string;
+    readonly secret_key?: string;
+  };
+}
+interface LiteApp {
+  init(): Promise<unknown>;
+  fetch(request: Request): Promise<Response>;
+}
+interface LiteRuntime {
+  readonly App: new (config: LiteAppConfig) => LiteApp;
+  createPgliteConnection(): Promise<PgliteConnection>;
+  createSqliteConnection(url: string): Promise<LiteConnection>;
+}
+//#endregion
+//#region src/create/lite/prelude.d.ts
+/**
+ * What a Supabase project already has before the first migration runs: the
+ * API roles, the `auth` schema with `auth.users` and the JWT helpers, and a
+ * `storage.buckets` table. PGlite starts without them, so validation creates
+ * a minimal copy. It covers the columns the block SQL reads, not the full
+ * GoTrue or Storage schemas.
+ */
+export declare const SUPABASE_PRELUDE: string;
+//#endregion
+//#region src/create/lite/index.d.ts
+/** One file that failed to apply in Postgres. */
+export interface DesignIssue {
+  readonly module: string;
+  readonly path: string;
+  readonly message: string;
+}
+/** A module PGlite can't run, such as one that needs an extension it doesn't ship. */
+export interface SkippedModule {
+  readonly module: string;
+  readonly reason: string;
+}
+export interface DesignValidation {
+  /** `true` when every file that could run applied cleanly. */
+  readonly ok: boolean;
+  readonly issues: readonly DesignIssue[];
+  readonly skipped: readonly SkippedModule[];
+  /** Tables in `public` after the files applied. */
+  readonly tables: number;
+}
+export interface ValidateDesignOptions {
+  /** A loaded `@supabase/lite`; loaded on demand when left out. */
+  readonly runtime?: LiteRuntime;
+}
+/**
+ * Applies the files `previewFiles` returns to an in-memory PGlite database
+ * and reports what Postgres rejects. A module that needs an extension PGlite
+ * doesn't ship (`pgmq`, `btree_gist`) is skipped, not failed, along with its
+ * other files. pgTAP test files are left out, as in `deployQuery`. Throws when `@supabase/lite` isn't installed.
+ */
+export declare function validateDesign(files: readonly PresetMigrationFile[], options?: ValidateDesignOptions): Promise<DesignValidation>;
+//#endregion
+export {};

package/dist/create/lite/index.js

@@ -0,0 +1,126 @@
+import { n as loadLite, t as LITE_INSTALL } from "../../runtime-BOXURhEW.js";
+//#region src/create/lite/prelude.ts
+/**
+* What a Supabase project already has before the first migration runs: the
+* API roles, the `auth` schema with `auth.users` and the JWT helpers, and a
+* `storage.buckets` table. PGlite starts without them, so validation creates
+* a minimal copy. It covers the columns the block SQL reads, not the full
+* GoTrue or Storage schemas.
+*/
+const SUPABASE_PRELUDE = `
+do $$
+declare
+  role_name text;
+begin
+  foreach role_name in array array['anon', 'authenticated', 'supabase_auth_admin'] loop
+    if not exists (select 1 from pg_roles where rolname = role_name) then
+      execute format('create role %I nologin', role_name);
+    end if;
+  end loop;
+
+  if not exists (select 1 from pg_roles where rolname = 'service_role') then
+    create role service_role nologin bypassrls;
+  end if;
+end $$;
+
+create schema if not exists auth;
+create schema if not exists extensions;
+create schema if not exists storage;
+
+create table if not exists auth.users (
+  id uuid primary key default gen_random_uuid(),
+  email text,
+  phone text,
+  raw_app_meta_data jsonb default '{}',
+  raw_user_meta_data jsonb default '{}',
+  created_at timestamptz default now(),
+  updated_at timestamptz default now(),
+  last_sign_in_at timestamptz,
+  confirmed_at timestamptz,
+  email_confirmed_at timestamptz,
+  banned_until timestamptz,
+  deleted_at timestamptz,
+  is_anonymous boolean default false,
+  role text,
+  aud text,
+  encrypted_password text
+);
+
+create or replace function auth.uid() returns uuid language sql stable as
+  $$ select nullif(current_setting('request.jwt.claim.sub', true), '')::uuid $$;
+
+create or replace function auth.jwt() returns jsonb language sql stable as
+  $$ select coalesce(nullif(current_setting('request.jwt.claims', true), ''), '{}')::jsonb $$;
+
+create or replace function auth.role() returns text language sql stable as
+  $$ select nullif(current_setting('request.jwt.claim.role', true), '') $$;
+
+create table if not exists storage.buckets (
+  id text primary key,
+  name text,
+  public boolean default false,
+  file_size_limit bigint,
+  allowed_mime_types text[]
+);
+
+create table if not exists storage.objects (
+  id uuid primary key default gen_random_uuid(),
+  bucket_id text,
+  name text,
+  owner uuid
+);
+`;
+//#endregion
+//#region src/create/lite/index.ts
+const MISSING_EXTENSION = /extension "([^"]+)" is not available/u;
+function messageOf(error) {
+	return (error instanceof Error ? error.message : String(error)).replaceAll(/\s+/gu, " ").slice(0, 300);
+}
+/**
+* Applies the files `previewFiles` returns to an in-memory PGlite database
+* and reports what Postgres rejects. A module that needs an extension PGlite
+* doesn't ship (`pgmq`, `btree_gist`) is skipped, not failed, along with its
+* other files. pgTAP test files are left out, as in `deployQuery`. Throws when `@supabase/lite` isn't installed.
+*/
+async function validateDesign(files, options = {}) {
+	const runtime = options.runtime ?? await loadLite();
+	if (runtime === void 0) throw new Error(LITE_INSTALL);
+	const connection = await runtime.createPgliteConnection();
+	try {
+		const { driver } = connection;
+		await driver.exec(SUPABASE_PRELUDE);
+		const issues = [];
+		const skipped = /* @__PURE__ */ new Map();
+		for (const file of files) {
+			if (file.path.includes("/tests/") || skipped.has(file.module)) continue;
+			try {
+				await driver.exec(file.contents);
+			} catch (error) {
+				const message = messageOf(error);
+				const extension = MISSING_EXTENSION.exec(message)?.[1];
+				if (extension === void 0) issues.push({
+					module: file.module,
+					path: file.path,
+					message
+				});
+				else skipped.set(file.module, `Needs the ${extension} extension, which PGlite doesn't ship.`);
+			}
+		}
+		const { rows } = await driver.query("select count(*)::int as count from pg_tables where schemaname = 'public'");
+		const [row] = rows;
+		const tables = typeof row === "object" && row !== null && "count" in row ? Number(row.count) : 0;
+		return {
+			ok: issues.length === 0,
+			issues,
+			skipped: [...skipped].map(([module, reason]) => ({
+				module,
+				reason
+			})),
+			tables
+		};
+	} finally {
+		await connection.close();
+	}
+}
+//#endregion
+export { SUPABASE_PRELUDE, validateDesign };

package/dist/create/supabase/index.d.ts

@@ -0,0 +1,68 @@
+import { a as SupabaseLint, c as isProjectRef, i as SmartRegion, l as managementClient, n as ManagementError, o as SupabaseOrganization, r as SMART_REGIONS, s as SupabaseProject, t as ManagementClient } from "../../management-D1gG89z2.js";
+//#region src/create/supabase/oauth.d.ts
+export declare const SUPABASE_API: string;
+/** Where the session and the in-flight authorization live. */
+export declare const COOKIE_PATH: string;
+export declare const SESSION_COOKIE = "bs_supabase";
+export declare const FLOW_COOKIE = "bs_supabase_flow";
+/** A flow cookie older than this is ignored, so a stale tab can't finish one. */
+export declare const FLOW_MAX_AGE = 600;
+/** The session cookie outlives the access token; the refresh token renews it. */
+export declare const SESSION_MAX_AGE: number;
+export interface OAuthConfig {
+  readonly clientId: string;
+  readonly clientSecret: string;
+  readonly cookieSecret: string;
+}
+export interface SupabaseSession {
+  readonly accessToken: string;
+  readonly refreshToken?: string | undefined;
+  /** Epoch milliseconds. */
+  readonly expiresAt: number;
+}
+export declare function isSession(value: unknown): value is SupabaseSession;
+export interface OAuthFlow {
+  readonly state: string;
+  readonly verifier: string;
+  readonly returnTo: string;
+}
+export declare function isFlow(value: unknown): value is OAuthFlow;
+/** `length` random bytes as base64url. */
+export declare function randomToken(length?: number): string;
+/** A PKCE verifier and its S256 challenge (RFC 7636). */
+export declare function pkcePair(): Promise<{
+  verifier: string;
+  challenge: string;
+}>;
+/** Encrypts `value` as JSON with AES-GCM: base64url of the IV, then the ciphertext. */
+export declare function seal(value: SupabaseSession | OAuthFlow, secret: string): Promise<string>;
+/** The value `seal` wrote, or `undefined` when it is missing, tampered with or another shape. */
+export declare function unseal<TValue>(sealed: string | undefined, secret: string, guard: (value: unknown) => value is TValue): Promise<TValue | undefined>;
+/**
+ * A same-site path under `/create` to return to after the consent screen,
+ * or `/create` for anything else, so the callback never redirects off site.
+ */
+export declare function returnPath(value: string | null): string;
+/** Adds `deploy=1`, which opens the deploy dialog again after the redirect. */
+export declare function withDeployFlag(path: string): string;
+export declare function authorizeUrl({ clientId, redirectUri, state, challenge }: {
+  clientId: string;
+  redirectUri: string;
+  state: string;
+  challenge: string;
+}): string;
+export declare class OAuthError extends Error {
+  override readonly name = "OAuthError";
+}
+/** Exchanges the authorization code from the callback for a session. */
+export declare function exchangeCode(config: OAuthConfig, { code, verifier, redirectUri }: {
+  code: string;
+  verifier: string;
+  redirectUri: string;
+}, fetchImpl?: typeof fetch, now?: number): Promise<SupabaseSession>;
+/** Whether the access token expires within a minute. */
+export declare function needsRefresh(session: SupabaseSession, now: number): boolean;
+/** A new session from the refresh token; it keeps the old refresh token when Supabase sends none. */
+export declare function refreshSession(config: OAuthConfig, session: SupabaseSession, fetchImpl?: typeof fetch, now?: number): Promise<SupabaseSession>;
+//#endregion
+export { ManagementClient, ManagementError, SMART_REGIONS, SmartRegion, SupabaseLint, SupabaseOrganization, SupabaseProject, isProjectRef, managementClient };

package/dist/create/supabase/index.js

@@ -0,0 +1,312 @@
+//#region src/create/supabase/guards.ts
+/** A plain JSON object. */
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function arrayOf(read) {
+	return (value) => {
+		if (!Array.isArray(value)) return;
+		const items = [];
+		for (const item of value) {
+			const parsed = read(item);
+			if (parsed === void 0) return;
+			items.push(parsed);
+		}
+		return items;
+	};
+}
+//#endregion
+//#region src/create/supabase/oauth.ts
+const SUPABASE_API = "https://api.supabase.com";
+/** Where the session and the in-flight authorization live. */
+const COOKIE_PATH = "/create/supabase";
+const SESSION_COOKIE = "bs_supabase";
+const FLOW_COOKIE = "bs_supabase_flow";
+/** A flow cookie older than this is ignored, so a stale tab can't finish one. */
+const FLOW_MAX_AGE = 600;
+/** The session cookie outlives the access token; the refresh token renews it. */
+const SESSION_MAX_AGE = 604800;
+function isSession(value) {
+	return isRecord(value) && typeof value["accessToken"] === "string" && (value["refreshToken"] === void 0 || typeof value["refreshToken"] === "string") && typeof value["expiresAt"] === "number";
+}
+function isFlow(value) {
+	return isRecord(value) && typeof value["state"] === "string" && typeof value["verifier"] === "string" && typeof value["returnTo"] === "string";
+}
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+function fromBase64url(value) {
+	const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/"));
+	const bytes = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
+	return bytes;
+}
+/** `length` random bytes as base64url. */
+function randomToken(length = 32) {
+	return base64url(crypto.getRandomValues(new Uint8Array(length)));
+}
+/** A PKCE verifier and its S256 challenge (RFC 7636). */
+async function pkcePair() {
+	const verifier = randomToken(32);
+	const digest = await crypto.subtle.digest("SHA-256", encoder.encode(verifier));
+	return {
+		verifier,
+		challenge: base64url(new Uint8Array(digest))
+	};
+}
+async function cookieKey(secret) {
+	const material = await crypto.subtle.importKey("raw", encoder.encode(secret), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: /* @__PURE__ */ new Uint8Array(0),
+		info: encoder.encode("better-supabase create session")
+	}, material, {
+		name: "AES-GCM",
+		length: 256
+	}, false, ["encrypt", "decrypt"]);
+}
+/** Encrypts `value` as JSON with AES-GCM: base64url of the IV, then the ciphertext. */
+async function seal(value, secret) {
+	const iv = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(12));
+	const cipher = await crypto.subtle.encrypt({
+		name: "AES-GCM",
+		iv
+	}, await cookieKey(secret), encoder.encode(JSON.stringify(value)));
+	const sealed = new Uint8Array(iv.length + cipher.byteLength);
+	sealed.set(iv);
+	sealed.set(new Uint8Array(cipher), iv.length);
+	return base64url(sealed);
+}
+/** The value `seal` wrote, or `undefined` when it is missing, tampered with or another shape. */
+async function unseal(sealed, secret, guard) {
+	if (sealed === void 0 || sealed === "") return;
+	try {
+		const bytes = fromBase64url(sealed);
+		const plain = await crypto.subtle.decrypt({
+			name: "AES-GCM",
+			iv: bytes.slice(0, 12)
+		}, await cookieKey(secret), bytes.slice(12));
+		const parsed = JSON.parse(decoder.decode(plain));
+		return guard(parsed) ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* A same-site path under `/create` to return to after the consent screen,
+* or `/create` for anything else, so the callback never redirects off site.
+*/
+function returnPath(value) {
+	if (value === null) return "/create";
+	try {
+		const url = new URL(value, "https://create.invalid");
+		if (url.origin !== "https://create.invalid" || url.pathname !== "/create" && !url.pathname.startsWith("/create/")) return "/create";
+		return `${url.pathname}${url.search}`;
+	} catch {
+		return "/create";
+	}
+}
+/** Adds `deploy=1`, which opens the deploy dialog again after the redirect. */
+function withDeployFlag(path) {
+	const url = new URL(path, "https://create.invalid");
+	url.searchParams.set("deploy", "1");
+	return `${url.pathname}${url.search}`;
+}
+function authorizeUrl({ clientId, redirectUri, state, challenge }) {
+	const url = new URL("/v1/oauth/authorize", SUPABASE_API);
+	url.search = new URLSearchParams({
+		client_id: clientId,
+		redirect_uri: redirectUri,
+		response_type: "code",
+		state,
+		code_challenge: challenge,
+		code_challenge_method: "S256"
+	}).toString();
+	return url.toString();
+}
+var OAuthError = class extends Error {
+	name = "OAuthError";
+};
+async function tokenRequest(config, body, fetchImpl, now) {
+	const response = await fetchImpl(new URL("/v1/oauth/token", SUPABASE_API), {
+		method: "POST",
+		headers: {
+			"Content-Type": "application/x-www-form-urlencoded",
+			Accept: "application/json",
+			Authorization: `Basic ${btoa(`${config.clientId}:${config.clientSecret}`)}`
+		},
+		body: new URLSearchParams(body)
+	});
+	if (!response.ok) throw new OAuthError(`Supabase refused the token request (${String(response.status)}).`);
+	const payload = await response.json();
+	if (!isRecord(payload) || typeof payload["access_token"] !== "string" || typeof payload["expires_in"] !== "number" || payload["refresh_token"] !== void 0 && typeof payload["refresh_token"] !== "string") throw new OAuthError("Supabase sent a token response without a token.");
+	return {
+		accessToken: payload["access_token"],
+		refreshToken: payload["refresh_token"],
+		expiresAt: now + payload["expires_in"] * 1e3
+	};
+}
+/** Exchanges the authorization code from the callback for a session. */
+function exchangeCode(config, { code, verifier, redirectUri }, fetchImpl = fetch, now = Date.now()) {
+	return tokenRequest(config, {
+		grant_type: "authorization_code",
+		code,
+		code_verifier: verifier,
+		redirect_uri: redirectUri
+	}, fetchImpl, now);
+}
+/** Whether the access token expires within a minute. */
+function needsRefresh(session, now) {
+	return session.expiresAt - 6e4 <= now;
+}
+/** A new session from the refresh token; it keeps the old refresh token when Supabase sends none. */
+async function refreshSession(config, session, fetchImpl = fetch, now = Date.now()) {
+	if (session.refreshToken === void 0) throw new OAuthError("The Supabase session expired. Connect again.");
+	const next = await tokenRequest(config, {
+		grant_type: "refresh_token",
+		refresh_token: session.refreshToken
+	}, fetchImpl, now);
+	return {
+		...next,
+		refreshToken: next.refreshToken ?? session.refreshToken
+	};
+}
+//#endregion
+//#region src/create/supabase/management.ts
+const SMART_REGIONS = [
+	"americas",
+	"emea",
+	"apac"
+];
+/** A Supabase project ref: lowercase letters and digits, never a path. */
+function isProjectRef(value) {
+	return /^[a-z0-9]{1,64}$/u.test(value);
+}
+function text(record, key) {
+	const value = record[key];
+	return typeof value === "string" ? value : void 0;
+}
+const readOrganization = (value) => {
+	if (!isRecord(value)) return;
+	const id = text(value, "id");
+	const slug = text(value, "slug");
+	const name = text(value, "name");
+	return id === void 0 || slug === void 0 || name === void 0 ? void 0 : {
+		id,
+		slug,
+		name
+	};
+};
+const readProject = (value) => {
+	if (!isRecord(value)) return;
+	const ref = text(value, "ref");
+	const name = text(value, "name");
+	const organization_slug = text(value, "organization_slug");
+	const region = text(value, "region");
+	const status = text(value, "status");
+	return ref === void 0 || name === void 0 || organization_slug === void 0 || region === void 0 || status === void 0 ? void 0 : {
+		ref,
+		name,
+		organization_slug,
+		region,
+		status
+	};
+};
+const readHealthy = (value) => Array.isArray(value) ? value.some((service) => isRecord(service) && service["name"] === "db" && service["healthy"] === true) : void 0;
+const readLint = (value) => {
+	if (!isRecord(value)) return;
+	const name = text(value, "name");
+	const title = text(value, "title");
+	const level = value["level"];
+	if (name === void 0 || title === void 0 || level !== "ERROR" && level !== "WARN" && level !== "INFO") return;
+	return {
+		name,
+		title,
+		level,
+		detail: text(value, "detail"),
+		remediation: text(value, "remediation")
+	};
+};
+const readLints = (value) => isRecord(value) ? arrayOf(readLint)(value["lints"]) : void 0;
+const readTableCount = (value) => {
+	if (!Array.isArray(value)) return;
+	const first = value[0];
+	if (first === void 0) return 0;
+	if (!isRecord(first)) return;
+	const count = Number(first["count"]);
+	return Number.isNaN(count) ? void 0 : count;
+};
+const readAny = () => true;
+/** A Management API call that failed; `status` is the HTTP status, 0 for a bad response. */
+var ManagementError = class extends Error {
+	name = "ManagementError";
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+	}
+};
+const PUBLIC_TABLES = `select count(*) as count
+from pg_catalog.pg_tables
+where schemaname = 'public'`;
+/**
+* The Management API calls the deploy dialog makes, with the user's OAuth
+* access token. Responses are parsed, and every failure is a `ManagementError`.
+*/
+function managementClient(accessToken, fetchImpl = fetch) {
+	async function call(path, read, init = {}) {
+		const response = await fetchImpl(new URL(path, SUPABASE_API), {
+			method: init.method ?? "GET",
+			headers: {
+				Authorization: `Bearer ${accessToken}`,
+				Accept: "application/json",
+				"Content-Type": "application/json"
+			},
+			body: init.body === void 0 ? null : JSON.stringify(init.body)
+		});
+		const json = await response.json().catch(() => null);
+		if (!response.ok) throw new ManagementError((isRecord(json) ? text(json, "message") : void 0) ?? `Supabase answered ${String(response.status)}.`, response.status);
+		const parsed = read(json);
+		if (parsed === void 0) throw new ManagementError(`Supabase sent an unexpected response for ${path}.`, 0);
+		return parsed;
+	}
+	return {
+		organizations: () => call("/v1/organizations", arrayOf(readOrganization)),
+		projects: () => call("/v1/projects", arrayOf(readProject)),
+		createProject: (input) => call("/v1/projects", readProject, {
+			method: "POST",
+			body: {
+				name: input.name,
+				organization_slug: input.organizationSlug,
+				db_pass: input.dbPass,
+				region_selection: {
+					type: "smartGroup",
+					code: input.region
+				}
+			}
+		}),
+		project: (ref) => call(`/v1/projects/${encodeURIComponent(ref)}`, readProject),
+		databaseHealthy: async (ref) => call(`/v1/projects/${encodeURIComponent(ref)}/health?services=db`, readHealthy),
+		publicTableCount: async (ref) => call(`/v1/projects/${encodeURIComponent(ref)}/database/query/read-only`, readTableCount, {
+			method: "POST",
+			body: { query: PUBLIC_TABLES }
+		}),
+		applyMigration: async (ref, name, query) => {
+			await call(`/v1/projects/${encodeURIComponent(ref)}/database/migrations`, readAny, {
+				method: "POST",
+				body: {
+					name,
+					query
+				}
+			});
+		},
+		securityLints: async (ref) => call(`/v1/projects/${encodeURIComponent(ref)}/advisors/security`, readLints)
+	};
+}
+//#endregion
+export { COOKIE_PATH, FLOW_COOKIE, FLOW_MAX_AGE, ManagementError, OAuthError, SESSION_COOKIE, SESSION_MAX_AGE, SMART_REGIONS, SUPABASE_API, authorizeUrl, exchangeCode, isFlow, isProjectRef, isSession, managementClient, needsRefresh, pkcePair, randomToken, refreshSession, returnPath, seal, unseal, withDeployFlag };

package/dist/credentials/index.d.ts

@@ -1,7 +1,8 @@
-import { t as AsyncResult } from "../result-BchM1XZn.js";
-import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-inD4fFq-.js";
-import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-ib9wzUDz.js";
-import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-BpmApxxW.js";
+import { t as AsyncResult } from "../result-Cj3yWhjH.js";
+import { F as CredentialEventData, wt as Events } from "../events-CtAHxPal.js";
+import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-CQ1SrhLa.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../block-transport-NbUJygA7.js";
+import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-EnOQJWjn.js";
 //#region src/credentials/compose.d.ts
 /**
  * One provider over several: each call goes to the provider whose `name`
@@ -28,4 +29,13 @@ interface RevokeIfConfiguredOptions {
  */
 export declare function revokeIfConfigured(provider: CredentialProvider | undefined, ref: CredentialRef, options: RevokeIfConfiguredOptions): AsyncResult<boolean>;
 //#endregion
-export { type BlockTransport, type CompleteAuthorizationOptions, type CredentialCapabilities, type CredentialProvider, type CredentialRef, type CredentialSubject, type CredentialToken, type GetTokenOptions, type RevokeIfConfiguredOptions, type SetCredentialOptions, type StartAuthorizationOptions, type VaultCredentialRef, type VaultCredentials, type VaultCredentialsOptions, type VaultInboundScheme, credentialRefInTenant, dbTransport, foreignCredentialRef, rpcTransport, sqlTransport, subjectFor, tenantCredentialRef, vaultCredentials };
+//#region src/blocks/credentials/events.d.ts
+/** The events of the `credentials` block: type to data. */
+type CredentialsEvents = {
+  readonly "credential.set": CredentialEventData;
+  readonly "credential.deleted": CredentialEventData;
+};
+/** The `credentials` block's event types, for its manifest and `onBlockEvent`. */
+export declare const credentialsEvents: Events<CredentialsEvents>;
+//#endregion
+export { type BlockTransport, type CompleteAuthorizationOptions, type CredentialCapabilities, type CredentialProvider, type CredentialRef, type CredentialSubject, type CredentialToken, type CredentialsEvents, type GetTokenOptions, type RevokeIfConfiguredOptions, type SetCredentialOptions, type StartAuthorizationOptions, type VaultCredentialRef, type VaultCredentials, type VaultCredentialsOptions, type VaultInboundScheme, credentialRefInTenant, dbTransport, foreignCredentialRef, rpcTransport, sqlTransport, subjectFor, tenantCredentialRef, vaultCredentials };

package/dist/credentials/index.js

@@ -1,11 +1,12 @@
-import { n as dbError } from "../errors-2M6CKMP4.js";
-import { a as ok, r as err, t as AsyncResult } from "../result-DEqHCMKP.js";
-import { a as tenantCredentialRef, i as subjectFor, n as credentialRefInTenant, r as foreignCredentialRef } from "../provider-DxRTex4x.js";
+import { n as dbError } from "../errors-8i6tSICm.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-COkvI9t5.js";
+import { a as tenantCredentialRef, i as subjectFor, n as credentialRefInTenant, r as foreignCredentialRef } from "../provider-DKh2xFZb.js";
+import { n as event, t as defineEvents } from "../event-map-Dy2vKHai.js";
 import { n as hmacHex, r as timingSafeEqual } from "../hmac-DCud0myt.js";
-import { a as verifyWebhook, i as verifySharedSecret } from "../signatures-DsWv_bYR.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-bAKh-dGc.js";
-import { i as blockCall } from "../block-helpers-Cy3pB96I.js";
-import { n as revokeIfConfigured, t as credentialRouter } from "../compose-BHej1acw.js";
+import { o as verifySharedSecret, s as verifyWebhook } from "../signatures-C9CGYZS1.js";
+import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../block-transport-G4t1umrR.js";
+import { o as blockCall } from "../block-helpers-BfVCR5Fc.js";
+import { n as revokeIfConfigured, t as credentialRouter } from "../compose-CO_cljl3.js";
 //#region src/credentials/vault.ts
 const MAX_CACHED = 256;
 const invalidRef = (message) => err(dbError("invalid_input", message, { hint: "CREDENTIAL_REF_INVALID" }));
@@ -157,4 +158,11 @@ function vaultCredentials(options) {
 	};
 }
 //#endregion
-export { credentialRefInTenant, credentialRouter, dbTransport, foreignCredentialRef, revokeIfConfigured, rpcTransport, sqlTransport, subjectFor, tenantCredentialRef, vaultCredentials };
+//#region src/blocks/credentials/events.ts
+/** The `credentials` block's event types, for its manifest and `onBlockEvent`. */
+const credentialsEvents = defineEvents({
+	"credential.set": event(),
+	"credential.deleted": event()
+});
+//#endregion
+export { credentialRefInTenant, credentialRouter, credentialsEvents, dbTransport, foreignCredentialRef, revokeIfConfigured, rpcTransport, sqlTransport, subjectFor, tenantCredentialRef, vaultCredentials };