better-supabase 0.8.0 → 0.10.0

package/dist/envelope--7d0Q3Se.js

@@ -0,0 +1,90 @@
+import { n as dbError } from "./errors-8i6tSICm.js";
+import { a as ok, r as err } from "./result-COkvI9t5.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { o as tenantFrom, s as tenantPathsFor } from "./claims-PqzCxaTD.js";
+import { n as impersonatorClaim, r as impersonatorOf } from "./impersonation-CDeCzZP6.js";
+import { i as delegatedClaims, n as PERMISSION_CAP_CLAIM, o as permissionCapOf, t as DELEGATION_CLAIMS } from "./delegation-Dt8hMJWu.js";
+//#region src/blocks/jobs/envelope.ts
+/** Marks a payload that carries a job context; pgmq stores it as the payload. */
+const ENVELOPE = "$bs";
+function ticketOf(context, options) {
+	const ticket = options.ticket ?? context?.["ticket"];
+	if (ticket === void 0) return ok(void 0);
+	if (typeof ticket === "string" && ticket !== "") return ok(ticket);
+	return err(dbError("validation", "A job ticket is a non-empty string", { issues: [{
+		message: "Expected a non-empty string",
+		path: ["ticket"]
+	}] }));
+}
+/**
+* The context a job records: the actor, the tenant, the ticket, and the
+* `act` chain and delegation of the token, so a job an OAuth or MCP client
+* queued runs with that client's scopes, never the user's full rights.
+* An invalid `act` chain or malformed delegation is `forbidden`.
+*/
+function recordContext(context, options = {}) {
+	const ticket = ticketOf(context, options);
+	if (!ticket.ok) return ticket;
+	if (!context) return ok(ticket.data === void 0 ? void 0 : { ticket: ticket.data });
+	const claims = context.claims ?? {};
+	const delegated = delegatedClaims(claims);
+	if (!delegated.ok) return err(dbError("forbidden", delegated.reason === "invalid-chain" ? "The job context has an invalid act claim" : "The job context has invalid delegation claims"));
+	const cap = permissionCapOf(claims);
+	if (cap === false) return err(dbError("forbidden", "The job context has an invalid permission cap"));
+	const tenant = tenantFrom(context, tenantPathsFor(void 0));
+	const impersonator = impersonatorOf(claims);
+	const recorded = {
+		...context.actor ? { actor: context.actor } : {},
+		...tenant === void 0 ? {} : { tenant },
+		...ticket.data === void 0 ? {} : { ticket: ticket.data },
+		...delegated.delegation,
+		...cap === void 0 ? {} : { [PERMISSION_CAP_CLAIM]: cap },
+		...impersonator ? { act: impersonatorClaim(impersonator) } : {}
+	};
+	if (!recorded.actor && recorded.tenant === void 0 && recorded.ticket === void 0) return ok(void 0);
+	return ok(recorded);
+}
+/** Wraps a payload with the recorded context of `context`, when there is one. */
+function wrapPayload(payload, context, options = {}) {
+	const recorded = recordContext(context, options);
+	if (!recorded.ok) return recorded;
+	return ok(recorded.data === void 0 ? payload : {
+		[ENVELOPE]: 1,
+		context: recorded.data,
+		payload
+	});
+}
+/** `wrapPayload` that throws a `TypeError` for a context it refuses. */
+function withContext(payload, context, options = {}) {
+	const wrapped = wrapPayload(payload, context, options);
+	if (!wrapped.ok) throw new TypeError(wrapped.error.message);
+	return wrapped.data;
+}
+function isActor(value) {
+	return isRecord(value) && typeof value["id"] === "string" && (value["kind"] === "user" || value["kind"] === "service" || value["kind"] === "anon");
+}
+/**
+* Splits a stored payload into the payload and its recorded context. The
+* recorded `act` and delegation claims come back as they were stored, so
+* `forContext` checks them again and refuses a malformed one.
+*/
+function unwrap(stored) {
+	if (!isRecord(stored) || stored[ENVELOPE] !== 1 || !Object.hasOwn(stored, "payload")) return {
+		payload: stored,
+		context: {}
+	};
+	const recorded = isRecord(stored["context"]) ? stored["context"] : {};
+	const { actor, tenant, ticket } = recorded;
+	const claims = Object.fromEntries(DELEGATION_CLAIMS.filter((key) => Object.hasOwn(recorded, key) && recorded[key] !== void 0).map((key) => [key, recorded[key]]));
+	return {
+		payload: stored["payload"],
+		context: {
+			...isActor(actor) ? { actor } : {},
+			...typeof tenant === "string" && tenant.length > 0 ? { tenant } : {},
+			...ticket === void 0 ? {} : { ticket },
+			...Object.keys(claims).length > 0 ? { claims } : {}
+		}
+	};
+}
+//#endregion
+export { withContext as n, wrapPayload as r, unwrap as t };

package/dist/errors-7MqM7bbV.js

@@ -0,0 +1,44 @@
+import { t as DbException } from "./db-exception-CnWcYPxL.js";
+import { n as dbError, o as isDbError } from "./errors-8i6tSICm.js";
+import { s as toDbError } from "./result-COkvI9t5.js";
+//#region src/storage/errors.ts
+/** Maps a Storage error (`StorageApiError`, fetch failures) to a `DbError`. */
+function fromStorageError(raw, table) {
+	if (isDbError(raw)) return raw;
+	if (raw instanceof DbException) return raw.error;
+	if (typeof raw !== "object" || raw === null) return toDbError(raw);
+	const failure = raw;
+	if (failure.name === "AbortError") return toDbError(raw);
+	const message = failure.message ?? "Storage request failed";
+	const code = failure.code ?? failure.statusCode;
+	const base = {
+		...code ? { code } : {},
+		...table ? { table } : {}
+	};
+	const statusCode = Number(failure.statusCode);
+	const status = Number.isFinite(statusCode) && statusCode >= 400 ? statusCode : failure.status ?? 0;
+	if (code === "FeatureNotEnabled" || /^Route \S+ not found$/.test(message)) return dbError("unsupported", message, base);
+	if (/row-level security|unauthorized to|AccessDenied/i.test(`${message} ${code ?? ""}`)) return dbError("forbidden", message, base);
+	if (/already exists|duplicate/i.test(`${message} ${code ?? ""}`)) return dbError("conflict", message, base);
+	if (failure.name === "StorageUnknownError" && status === 0) return dbError("network", message, base);
+	switch (status) {
+		case 400: return dbError("invalid_request", message, base);
+		case 401: return dbError("unauthorized", message, base);
+		case 403: return dbError("forbidden", message, base);
+		case 404: return dbError("not_found", message, base);
+		case 409: return dbError("conflict", message, base);
+		case 413:
+		case 415: return dbError("invalid_input", message, {
+			...base,
+			status
+		});
+		case 408:
+		case 429: return dbError("network", message, {
+			...base,
+			status
+		});
+		default: return status >= 500 ? dbError("network", message, base) : dbError("unexpected", message, base);
+	}
+}
+//#endregion
+export { fromStorageError as t };

package/dist/errors-8i6tSICm.js

@@ -0,0 +1,301 @@
+import { t as DbException } from "./db-exception-CnWcYPxL.js";
+//#region src/core/errors.ts
+const STATUS = {
+	not_found: 404,
+	unauthorized: 401,
+	forbidden: 403,
+	conflict: 409,
+	foreign_key: 409,
+	check: 422,
+	not_null: 422,
+	exclusion: 409,
+	invalid_input: 400,
+	invalid_value: 500,
+	raised: 400,
+	timeout: 504,
+	serialization: 409,
+	network: 503,
+	aborted: 499,
+	invalid_request: 400,
+	validation: 422,
+	multiple_rows: 409,
+	stale: 412,
+	max_affected: 400,
+	rate_limited: 429,
+	quota_exceeded: 429,
+	unsupported: 501,
+	unexpected: 500
+};
+function statusOf(kind) {
+	return STATUS[kind];
+}
+/** Creates a `DbError` with the default status for its kind. */
+function dbError(kind, message, ...[extra]) {
+	const error = {
+		kind,
+		message,
+		status: STATUS[kind]
+	};
+	if (extra) {
+		for (const [key, value] of Object.entries(extra)) if (value !== void 0) error[key] = value;
+	}
+	return error;
+}
+function isDbError(value) {
+	return typeof value === "object" && value !== null && typeof value.kind === "string" && typeof value.message === "string" && typeof value.status === "number";
+}
+/**
+* The `DbError` in a `DbError`, a `DbException`, or an error whose `cause`
+* is a `DbError` (what `betterSupabase.mapError()` mappers should set).
+*/
+function dbErrorOf(value) {
+	if (value instanceof DbException) return value.error;
+	if (value instanceof Error && isDbError(value.cause)) return value.cause;
+	return isDbError(value) ? value : void 0;
+}
+function constraintGuard(kind) {
+	return (error, constraint) => {
+		const found = dbErrorOf(error);
+		if (found?.kind !== kind) return false;
+		return constraint === void 0 || found.constraint === constraint;
+	};
+}
+/**
+* A unique violation, optionally for one constraint. Accepts a `DbError` or a
+* `DbException`. Pass the generated `UniqueConstraint` type to check names:
+* `isConflict<UniqueConstraint>(error, 'customers_organization_id_kvk_key')`.
+*/
+const isConflict = constraintGuard("conflict");
+/** A CHECK violation, optionally for one constraint (`CheckConstraint`). */
+const isCheck = constraintGuard("check");
+/** A foreign key violation, optionally for one constraint (`ForeignKeyConstraint`). */
+const isForeignKey = constraintGuard("foreign_key");
+const CONSTRAINT_IN_MESSAGE = /constraint "([^"]+)"/;
+const KEY_COLUMNS_IN_DETAILS = /^Key \(([^)]+)\)=/;
+const COLUMN_IN_MESSAGE = /column "([^"]+)"/;
+const RETRY_AFTER = /retry after (\d+)/i;
+const PERMISSION_DENIED = /^permission denied for (table|view|sequence|function|schema) (\S+)/;
+/**
+* The SQL compiler fails a write past `maxAffected` by casting this text,
+* followed by `:<rows>`, to an integer: plain SQL has no `raise`.
+*/
+const MAX_AFFECTED_MARKER = "better_supabase:max_affected";
+const MAX_AFFECTED_COUNT = /better_supabase:max_affected:(\d+)/;
+function constraintOf(raw) {
+	return raw.constraint ?? CONSTRAINT_IN_MESSAGE.exec(raw.message ?? "")?.[1];
+}
+/** The hint `better_supabase.check_json_schema()` raises with (the `jsonb-schemas` module). */
+const JSON_SCHEMA_HINT = "JSON_SCHEMA_INVALID";
+/** The prefix of the `jsonb-schemas` check constraints and triggers. */
+const JSON_SCHEMA_CONSTRAINT = "bs_json_";
+const JSON_SCHEMA_COLUMN = /^[\w$]+\.([\w$]+) does not match its JSON Schema/;
+/**
+* One issue per pg_jsonschema error in DETAIL (a JSON array of strings), at
+* the column's database name. Without the list (the check constraint itself
+* failed), one issue for the whole value.
+*/
+function jsonSchemaIssues(raw) {
+	const column = raw.column ?? JSON_SCHEMA_COLUMN.exec(raw.message ?? "")?.[1];
+	const path = column === void 0 ? {} : { path: [column] };
+	let errors;
+	try {
+		errors = JSON.parse(raw.details ?? "");
+	} catch {
+		errors = void 0;
+	}
+	const messages = Array.isArray(errors) ? errors.filter((entry) => typeof entry === "string") : [];
+	return messages.length > 0 ? messages.map((message) => ({
+		message,
+		...path
+	})) : [{
+		message: "The value does not match its JSON Schema",
+		...path
+	}];
+}
+function columnsOf(raw) {
+	return KEY_COLUMNS_IN_DETAILS.exec(raw.details ?? "")?.[1]?.split(",").map((column) => column.trim());
+}
+function optional(raw) {
+	const out = {};
+	if (raw.code) out.code = raw.code;
+	if (raw.details) out.details = raw.details;
+	if (raw.hint) out.hint = raw.hint;
+	return out;
+}
+/**
+* The `permissions` a `42501` raised with `detail = '{"permissions": [...]}'`
+* names, so a refusal from SQL carries the keys the caller lacks.
+*/
+function permissionsOf(details) {
+	if (details === void 0 || !details.startsWith("{")) return {};
+	let parsed;
+	try {
+		parsed = JSON.parse(details);
+	} catch {
+		return {};
+	}
+	if (typeof parsed !== "object" || parsed === null) return {};
+	const permissions = "permissions" in parsed ? parsed.permissions : void 0;
+	return Array.isArray(permissions) && permissions.every((key) => typeof key === "string") ? { permissions } : {};
+}
+/** Adds the operation's limit to a `max_affected` error that doesn't name it. */
+function withMaxAffected(error, maxAffected) {
+	return error.kind === "max_affected" && maxAffected !== void 0 && error.maxAffected === void 0 ? {
+		...error,
+		maxAffected
+	} : error;
+}
+/**
+* Maps a PostgREST or Postgres error to a `DbError`. Custom mappers run
+* first; the first one that returns an error wins.
+*/
+function mapDbError(raw, mappers = []) {
+	const fallback = mapBuiltin(raw);
+	for (const mapper of mappers) {
+		const mapped = mapper(raw, fallback);
+		if (mapped) return mapped;
+	}
+	return fallback;
+}
+function mapBuiltin(raw) {
+	const message = raw.message ?? "Unknown database error";
+	const base = optional(raw);
+	const code = raw.code ?? "";
+	if (raw.name === "AbortError" || code === "20" || message.startsWith("AbortError:")) return dbError("aborted", message, base);
+	switch (code) {
+		case "23505": {
+			const extra = {};
+			const constraint = constraintOf(raw);
+			const columns = columnsOf(raw);
+			if (constraint) extra.constraint = constraint;
+			if (columns) extra.columns = columns;
+			return dbError("conflict", message, {
+				...base,
+				...extra
+			});
+		}
+		case "23503": {
+			const extra = {};
+			const constraint = constraintOf(raw);
+			const columns = columnsOf(raw);
+			if (constraint) extra.constraint = constraint;
+			if (columns) extra.columns = columns;
+			return dbError("foreign_key", message, {
+				...base,
+				...extra
+			});
+		}
+		case "23514": {
+			const constraint = constraintOf(raw);
+			if (base.hint === JSON_SCHEMA_HINT || constraint?.startsWith(JSON_SCHEMA_CONSTRAINT)) return dbError("validation", message, {
+				...base,
+				issues: jsonSchemaIssues(raw)
+			});
+			return dbError("check", message, {
+				...base,
+				...constraint ? { constraint } : {}
+			});
+		}
+		case "23502": {
+			const column = raw.column ?? COLUMN_IN_MESSAGE.exec(message)?.[1];
+			return dbError("not_null", message, {
+				...base,
+				...column ? { column } : {}
+			});
+		}
+		case "23P01": {
+			const constraint = constraintOf(raw);
+			return dbError("exclusion", message, {
+				...base,
+				...constraint ? { constraint } : {}
+			});
+		}
+		case "42501": {
+			const object = PERMISSION_DENIED.exec(message);
+			const postgrestHint = base.hint?.startsWith("Grant the required");
+			if (!object || base.hint && !postgrestHint) return dbError("forbidden", message, {
+				...base,
+				...permissionsOf(base.details)
+			});
+			const advice = object[1] === "table" || object[1] === "view" ? `The Data API role has no grant on this ${object[1]}, as on a project with default privileges turned off: add it to \`expose\` and run \`better-supabase add grants\`. \`better-supabase doctor\` (BS106) lists every missing grant.` : `The Data API role has no ${object[1] === "function" ? "execute" : "usage"} grant on this ${object[1]}; grant it to the role that needs it.`;
+			const details = [
+				message,
+				base.details,
+				postgrestHint ? base.hint : ""
+			].filter(Boolean).join("\n");
+			return dbError("forbidden", "permission denied", {
+				...base,
+				details,
+				hint: advice
+			});
+		}
+		case "25006": return dbError("forbidden", "This connection is read-only, so the write was refused", {
+			...base,
+			details: base.details ?? message,
+			hint: base.hint ?? "The transaction is read-only, such as in a read-only support session; writes need a writable connection."
+		});
+		case "P0001": return dbError("raised", message, base);
+		case "P0002": return dbError("not_found", message, base);
+		case "57014": return dbError("timeout", message, base);
+		case "40001":
+		case "40P01": return dbError("serialization", message, base);
+		case "PGRST116": return /multiple|more than one/i.test(raw.details ?? message) ? dbError("multiple_rows", message, base) : dbError("not_found", message, base);
+		case "PGRST301":
+		case "PGRST302":
+		case "PGRST303": return dbError("unauthorized", message, base);
+		case "PGRST124": return dbError("max_affected", message, base);
+		case "22P02":
+			if (message.includes("better_supabase:max_affected")) {
+				const affected = MAX_AFFECTED_COUNT.exec(message)?.[1];
+				return dbError("max_affected", `The write affects ${affected ?? "more"} rows, more than maxAffected allows`, { code: "22P02" });
+			}
+			break;
+		case "PGRST123": return dbError("invalid_request", message, {
+			...base,
+			hint: base.hint ?? "PostgREST aggregates are off. Run `alter role authenticator set pgrst.db_aggregates_enabled = 'true'; notify pgrst, 'reload config';` (see BS210), or use better-supabase/postgres."
+		});
+		case "BS429":
+		case "PT429": {
+			const seconds = RETRY_AFTER.exec(raw.details ?? "")?.[1];
+			return dbError("rate_limited", message, {
+				...base,
+				...seconds ? { retryAfter: Number(seconds) } : {}
+			});
+		}
+		case "POSTGRES_POOL_BUSY":
+		case "POSTGRES_CONNECT_PAUSED": return dbError("network", message, {
+			...base,
+			...raw.retryAfterMs === void 0 ? {} : { retryAfter: Math.max(1, Math.ceil(raw.retryAfterMs / 1e3)) }
+		});
+		case "BSQ29": return dbError("quota_exceeded", message, {
+			...base,
+			...quotaDetails(raw.details)
+		});
+	}
+	if (code.startsWith("22")) return dbError("invalid_input", message, base);
+	if (code.startsWith("PGRST1") || code.startsWith("PGRST2")) return dbError("invalid_request", message, base);
+	if (code.startsWith("08") || /fetch failed|network/i.test(message)) return dbError("network", message, base);
+	return dbError("unexpected", message, base);
+}
+/** `consume_quota` puts `{ meter, limit, retry_after }` in the error's DETAIL. */
+function quotaDetails(details) {
+	let parsed;
+	try {
+		parsed = JSON.parse(details ?? "");
+	} catch {
+		return {};
+	}
+	if (typeof parsed !== "object" || parsed === null) return {};
+	const record = parsed;
+	const field = (key) => record[key];
+	const meter = field("meter");
+	const limit = field("limit");
+	const retryAfter = field("retry_after");
+	return {
+		...typeof meter === "string" ? { meter } : {},
+		...typeof limit === "number" ? { limit } : {},
+		...typeof retryAfter === "number" ? { retryAfter } : {}
+	};
+}
+//#endregion
+export { isConflict as a, mapDbError as c, isCheck as i, statusOf as l, dbError as n, isDbError as o, dbErrorOf as r, isForeignKey as s, MAX_AFFECTED_MARKER as t, withMaxAffected as u };

package/dist/escape-like-AUEPn-C5.d.ts

@@ -0,0 +1,15 @@
+import { b as DbError, x as DbErrorKind } from "./result-Cj3yWhjH.js";
+//#region src/core/db-exception.d.ts
+/** Thrown by `.orThrow()`. Carries the plain `DbError` as `error`. */
+declare class DbException extends Error {
+  override readonly name = "DbException";
+  readonly error: DbError;
+  constructor(error: DbError);
+  get kind(): DbErrorKind;
+}
+//#endregion
+//#region src/ir/escape-like.d.ts
+/** Escapes LIKE wildcards so user input matches literally. */
+declare function escapeLike(value: string): string;
+//#endregion
+export { DbException as n, escapeLike as t };

package/dist/eve/index.d.ts

@@ -1,8 +1,8 @@
-import { a as ResolveAuthOptions, r as AuthState } from "../resolve-MxXVWyhd.js";
-import { i as CredentialRef, r as CredentialProvider } from "../provider-ib9wzUDz.js";
-import { i as AiChat } from "../ai-chat-DXkMy74O.js";
-import { a as Inbox } from "../inbox-Cd1KCEBL.js";
-import { a as EveMemoryToolsContext, c as MemoryDocumentConflictError, d as supabaseDocumentBackend, f as supabaseMemory, i as EveMemoryTool, l as SupabaseDocumentBackendOptions, m as EveSessionContext, n as EveMemoryContext, o as EveRecallMessage, p as EveSessionAuth, r as EveMemoryProvider, s as EveRecallResult, t as EveDocumentBackend, u as SupabaseMemoryOptions } from "../eve-CoAIcCkq.js";
+import { a as ResolveAuthOptions, r as AuthState } from "../resolve-7atr-wWr.js";
+import { i as CredentialRef, r as CredentialProvider } from "../provider-CQ1SrhLa.js";
+import { i as AiChat } from "../ai-chat-al8b3spK.js";
+import { a as Inbox } from "../inbox-BaUJgHOF.js";
+import { a as EveMemoryToolsContext, c as MemoryDocumentConflictError, d as supabaseDocumentBackend, f as supabaseMemory, i as EveMemoryTool, l as SupabaseDocumentBackendOptions, m as EveSessionContext, n as EveMemoryContext, o as EveRecallMessage, p as EveSessionAuth, r as EveMemoryProvider, s as EveRecallResult, t as EveDocumentBackend, u as SupabaseMemoryOptions } from "../eve-BcEr_hPo.js";
 //#region src/eve/auth.d.ts
 /** Thrown by `supabaseAuth` so eve answers with `response` instead of downgrading to anonymous. */
 export declare class EveAuthRejection extends Error {

package/dist/eve/index.js

@@ -1,9 +1,9 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
 import { n as isRecord } from "../guards-6F2bCtQR.js";
 import { a as tenantClaimPaths, n as claimAt, t as DEFAULT_CLAIMS } from "../claims-PqzCxaTD.js";
-import { r as resolveAuth } from "../resolve-Bvgf3ut_.js";
-import { t as isAnonymousUser } from "../view-D5ryq3gz.js";
-import { t as importOptionalPeer } from "../optional-peer-D1pi-skw.js";
+import { r as resolveAuth } from "../resolve-CAR9oaKW.js";
+import { t as isAnonymousUser } from "../view-DZ63nqwt.js";
+import { t as importOptionalPeer } from "../optional-peer-Dx8TaYXw.js";
 //#region src/eve/ids.ts
 /** A UUID (version 8) from the SHA-256 of `input`, so the same input always gets the same id. */
 async function stableUuid(input) {
@@ -21,7 +21,7 @@ var EveAuthRejection = class extends Error {
 	response;
 	constructor(message, status = 401) {
 		super(message);
-		this.response = new Response(JSON.stringify({ error: message }), {
+		this.response = Response.json({ error: message }, {
 			status,
 			headers: { "content-type": "application/json" }
 		});
@@ -230,9 +230,9 @@ function persistSessions(options) {
 	});
 	const chatFor = async (ctx) => {
 		const auth = ctx.session.auth.initiator ?? ctx.session.auth.current;
-		if (auth?.principalType !== "user") return void 0;
+		if (auth?.principalType !== "user") return;
 		const organizationId = organizationOf(auth);
-		if (organizationId === void 0) return void 0;
+		if (organizationId === void 0) return;
 		const id = await chatIdOf(ctx.session.id);
 		await chats.chats.create(organizationId, {
 			id,
@@ -244,7 +244,7 @@ function persistSessions(options) {
 	};
 	const knownChat = async (ctx) => {
 		const auth = ctx.session.auth.initiator ?? ctx.session.auth.current;
-		if (auth?.principalType !== "user" || organizationOf(auth) === void 0) return void 0;
+		if (auth?.principalType !== "user" || organizationOf(auth) === void 0) return;
 		return chatIdOf(ctx.session.id);
 	};
 	const release = async (ctx, turnId, status, error) => {
@@ -366,9 +366,9 @@ function supabaseMemory(options) {
 	});
 	const target = async (ctx) => {
 		const auth = ctx.session.auth.current;
-		if (auth?.principalType !== "user") return void 0;
+		if (auth?.principalType !== "user") return;
 		const organizationId = organizationOf(auth);
-		if (organizationId === void 0) return void 0;
+		if (organizationId === void 0) return;
 		return {
 			organizationId,
 			namespace: {

package/dist/eve-BcEr_hPo.d.ts

@@ -0,0 +1,151 @@
+import { d as KnowledgeSearchOptions, r as Knowledge } from "./knowledge-BYtgA52P.js";
+import { t as Memory } from "./types-DOaUIJxW.js";
+//#region src/eve/types.d.ts
+/**
+ * eve's `SessionAuthContext`, typed structurally so this entry never imports
+ * eve. `attributes` carries `tenantId`, `roles` and `isAnonymous`.
+ */
+interface EveSessionAuth {
+  readonly authenticator: string;
+  readonly principalType: string;
+  readonly principalId: string;
+  readonly issuer?: string;
+  readonly subject?: string;
+  readonly attributes: Readonly<Record<string, string | readonly string[]>>;
+}
+/** The session part of the context eve passes to hooks, memory and connections. */
+interface EveSessionContext {
+  readonly session: {
+    readonly id: string;
+    readonly auth: {
+      readonly current: EveSessionAuth | null;
+      readonly initiator?: EveSessionAuth | null;
+    };
+  };
+}
+//#endregion
+//#region src/eve/eve.d.ts
+/** eve's `MemoryDocumentConflictError`, matched by name. */
+declare class MemoryDocumentConflictError extends Error {
+  override readonly name = "MemoryDocumentConflictError";
+  readonly key: string;
+  constructor(key: string);
+}
+/** The backend eve's `fileMemory({ backend })` reads and writes. */
+interface EveDocumentBackend {
+  /** The document backend contract version. Omitted means 1. */
+  readonly apiVersion?: 1;
+  read(input: {
+    readonly key: string;
+    readonly signal?: AbortSignal;
+  }): Promise<{
+    readonly content: string;
+    readonly version: string;
+  } | null>;
+  write(input: {
+    readonly key: string;
+    readonly content: string;
+    readonly expectedVersion: string | null;
+    readonly signal?: AbortSignal;
+  }): Promise<{
+    readonly content: string;
+    readonly version: string;
+  }>;
+}
+interface SupabaseDocumentBackendOptions {
+  /** `createMemory` on a service transport. */
+  readonly memory: Memory;
+  /** Prefixes every key, so apps can share the table. Defaults to `eve`. */
+  readonly scope?: string;
+}
+/**
+ * A document backend for eve's `fileMemory()` over the memory module's
+ * `memory_documents` table. A write with a stale version throws
+ * `MemoryDocumentConflictError`, so eve retries with the current document.
+ */
+declare function supabaseDocumentBackend(options: SupabaseDocumentBackendOptions): EveDocumentBackend;
+interface EveMessagePart {
+  readonly type: string;
+  readonly text?: unknown;
+}
+interface EveModelMessage {
+  readonly role: string;
+  readonly content: string | readonly EveMessagePart[];
+}
+/** The context eve passes to a memory provider's `tools`. */
+interface EveMemoryToolsContext extends EveSessionContext {
+  readonly memory: {
+    readonly scope: {
+      readonly key: string;
+    };
+    readonly slot?: string;
+  };
+}
+/** The context eve passes to a memory provider's recall and capture handlers. */
+interface EveMemoryContext extends EveMemoryToolsContext {
+  readonly operationId: string;
+  readonly messages?: readonly EveModelMessage[];
+  readonly turn?: {
+    readonly id: string;
+    readonly input: readonly EveModelMessage[];
+    readonly sequence?: number;
+  } | null;
+  readonly abortSignal?: AbortSignal;
+}
+interface EveRecallMessage {
+  readonly id?: string;
+  readonly content: string;
+}
+interface EveRecallResult {
+  readonly messages: readonly EveRecallMessage[];
+}
+/** A provider for eve's `defineMemory({ provider })`; pass it through `defineMemoryProvider`. */
+interface EveMemoryProvider {
+  readonly recall: {
+    "turn.started"(ctx: EveMemoryContext): Promise<EveRecallResult | null>;
+  };
+  readonly capture?: {
+    "turn.completed"?(ctx: EveMemoryContext): Promise<void>;
+  };
+  tools?(ctx: EveMemoryToolsContext): Promise<Readonly<Record<string, EveMemoryTool>> | null>;
+}
+/** A tool from eve's `defineTool`, as a memory provider returns it. */
+interface EveMemoryTool {
+  readonly description: string;
+  readonly inputSchema: unknown;
+  execute(input: never, context: never): unknown;
+}
+interface SupabaseMemoryOptions {
+  /** `createMemory` on a service transport: eve calls the provider outside a user request. */
+  readonly memory: Memory;
+  /** Tenant documents to search alongside the memories. */
+  readonly knowledge?: Knowledge;
+  /**
+   * The knowledge scopes to search. Defaults to the tenant's shared
+   * documents: the provider searches as the service role, so a wider scope
+   * can show one user's documents to another.
+   */
+  readonly knowledgeScopes?: KnowledgeSearchOptions["scopes"];
+  /** Archival memories and knowledge chunks to recall per turn. Defaults to 5. */
+  readonly k?: number;
+  /** The tenant of a principal. Defaults to `attributes.tenantId`. */
+  readonly organizationOf?: (auth: EveSessionAuth) => string | undefined;
+  /**
+   * Facts to keep from a finished turn (an LLM call of yours). Without it
+   * the provider stores only what the model saves with its `remember` tool.
+   */
+  readonly extract?: (messages: readonly EveModelMessage[], ctx: EveMemoryContext) => Promise<readonly string[]>;
+  /** Adds the `remember` and `forget` tools. Defaults to true. */
+  readonly tools?: boolean;
+  /** Returns `eve/tools`; defaults to importing it on first use. */
+  readonly load?: () => Promise<unknown>;
+}
+/**
+ * An eve memory provider over the memory and knowledge blocks. Every read
+ * and write is partitioned by the scope key and the signed-in user; recall
+ * stores its answer under the operation id, so a replayed recall returns the
+ * same messages.
+ */
+declare function supabaseMemory(options: SupabaseMemoryOptions): EveMemoryProvider;
+//#endregion
+export { EveMemoryToolsContext as a, MemoryDocumentConflictError as c, supabaseDocumentBackend as d, supabaseMemory as f, EveMemoryTool as i, SupabaseDocumentBackendOptions as l, EveSessionContext as m, EveMemoryContext as n, EveRecallMessage as o, EveSessionAuth as p, EveMemoryProvider as r, EveRecallResult as s, EveDocumentBackend as t, SupabaseMemoryOptions as u };