better-supabase 0.8.0 → 0.10.0

package/dist/search-LbjCylX5.js

@@ -0,0 +1,106 @@
+import { t as AsyncResult } from "./result-COkvI9t5.js";
+import { I as textOf, S as optionalInstant, j as run, k as recordsOf, o as blockCall, y as nullableText } from "./block-helpers-BfVCR5Fc.js";
+import { r as withBlockHooks } from "./block-hooks-ByKlh8Qy.js";
+//#region src/blocks/search/search.ts
+const vectorArg = (values) => run(() => Promise.resolve().then(() => vectorText(values)));
+const vectorText = (values) => {
+	if (!values.every(Number.isFinite)) throw new TypeError("an embedding holds finite numbers only");
+	return `[${values.join(",")}]`;
+};
+function hitOf(row) {
+	return {
+		organizationId: textOf(row["organizationId"]),
+		subjectType: textOf(row["subjectType"]),
+		subjectId: textOf(row["subjectId"]),
+		title: nullableText(row["title"]),
+		url: nullableText(row["url"]),
+		snippet: nullableText(row["snippet"]),
+		score: Number(row["score"] ?? 0)
+	};
+}
+function userItemOf(row) {
+	return {
+		subjectType: textOf(row["subjectType"]),
+		subjectId: textOf(row["subjectId"]),
+		title: nullableText(row["title"]),
+		url: nullableText(row["url"]),
+		openedAt: optionalInstant(row["openedAt"]),
+		starredAt: optionalInstant(row["starredAt"])
+	};
+}
+function pendingOf(row) {
+	return {
+		subjectType: textOf(row["subjectType"]),
+		subjectId: textOf(row["subjectId"]),
+		contentHash: textOf(row["contentHash"]),
+		text: textOf(row["text"])
+	};
+}
+/**
+* The `search` SQL module as typed calls. Build it with the caller's
+* transport for `search`, `recents` and `favorites`, and pass `service` for
+* the index maintenance methods.
+*/
+function createSearch(options) {
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const service = blockCall(options.service ?? options.transport, options.schema, options.mappers);
+	const list = (fn) => (list = {}) => call(fn, {
+		max_results: list.limit ?? 10,
+		types: list.types ?? null
+	}, (value) => recordsOf(value, fn).map(userItemOf));
+	const pendingEmbeddings = (limit = 100) => service("search_pending_embeddings", { max_results: limit }, (value) => recordsOf(value, "search_pending_embeddings").map(pendingOf));
+	const setEmbedding = (entry, embedding) => vectorArg(embedding).andThen((vector) => service("search_set_embedding", {
+		subject_type: entry.subjectType,
+		subject_id: entry.subjectId,
+		content_hash: entry.contentHash,
+		embedding: vector
+	}, (value) => value === true));
+	const client = {
+		search: (q, query = {}) => (query.embedding === void 0 || query.embedding === null ? AsyncResult.ok({}) : vectorArg(query.embedding).map((vector) => ({ query_embedding: vector }))).andThen((embedding) => call("search", {
+			q,
+			types: query.types ?? null,
+			tenant: query.organizationId ?? null,
+			max_results: query.limit ?? 20,
+			...embedding
+		}, (value) => recordsOf(value, "search").map(hitOf))),
+		recents: list("search_recents"),
+		favorites: list("search_favorites"),
+		touch: (subjectType, subjectId) => call("search_touch", {
+			subject_type: subjectType,
+			subject_id: subjectId
+		}, (value) => value === true),
+		star: (subjectType, subjectId, starred = true) => call("search_star", {
+			subject_type: subjectType,
+			subject_id: subjectId,
+			starred
+		}, (value) => value === true),
+		refresh: (subjectType, subjectId) => service("search_refresh", {
+			subject_type: subjectType,
+			subject_id: subjectId
+		}, (value) => value === true),
+		remove: (subjectType, subjectId) => service("search_remove", {
+			subject_type: subjectType,
+			subject_id: subjectId
+		}, (value) => value === true),
+		reindex: (subjectType) => service("search_reindex", { subject_type: subjectType ?? null }, Number),
+		pendingEmbeddings,
+		setEmbedding,
+		embedPending: (embed, limit = 100) => pendingEmbeddings(limit).andThen((pending) => run(async () => {
+			if (pending.length === 0) return 0;
+			const vectors = await embed(pending.map((item) => item.text));
+			if (vectors.length !== pending.length) throw new TypeError(`embed returned ${String(vectors.length)} vectors for ${String(pending.length)} texts`);
+			return service("search_set_embeddings", {
+				subject_types: pending.map((item) => item.subjectType),
+				subject_ids: pending.map((item) => item.subjectId),
+				content_hashes: pending.map((item) => item.contentHash),
+				embeddings: vectors.map(vectorText)
+			}, Number).orThrow();
+		}))
+	};
+	return withBlockHooks(client, options.hooks, {
+		block: "search",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+//#endregion
+export { createSearch as t };

package/dist/server/index.d.ts

@@ -1,51 +1,35 @@
-import { b as DbError } from "../result-BchM1XZn.js";
-import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-CoE5Zwy4.js";
-import { t as SqlClient } from "../executor-ngjKL_Pe.js";
-import { m as RequestContext } from "../plugin-CPK2HsbY.js";
-import { _ as writeSession, a as CookieWrite, c as StoredSession, h as sessionCookieName, n as CookieOptions, p as readSession, r as CookieRecord, t as AUTH_CACHE_HEADERS } from "../session-ChiXDZdZ.js";
-import { a as ResolveAuthOptions, c as resolveAuth, i as InvalidReason, n as AuthResolver, o as ResolvedState, r as AuthState, s as clientIp, t as AuthResolution } from "../resolve-MxXVWyhd.js";
-import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-TvGdxO1t.js";
+import { b as DbError, f as Result } from "../result-Cj3yWhjH.js";
+import { a as AnyModels, i as AnyFunctions, z as TableKey } from "../types-BO8lVTun.js";
+import { lt as SupportEventData, wt as Events } from "../events-CtAHxPal.js";
+import { m as RequestContext } from "../plugin-D5OIaP93.js";
+import { E as writeSession, S as readSession, a as ResolveAuthOptions, c as resolveAuth, d as CookieRecord, g as StoredSession, i as InvalidReason, l as AUTH_CACHE_HEADERS, n as AuthResolver, o as ResolvedState, p as CookieWrite, r as AuthState, s as clientIp, t as AuthResolution, u as CookieOptions, w as sessionCookieName } from "../resolve-7atr-wWr.js";
+import { n as SqlClient } from "../executor-DzJQVTE2.js";
+import { a as SessionActor, c as agentClaims, i as IDENTITY_SCOPES, l as delegationOf, n as ActorOutcome, o as SessionDelegation, r as AgentActOptions, s as actorOf, t as ActClaim } from "../actor-BAhb-d1S.js";
+import { c as fromProblem, d as toProblem, i as ProblemDetails, l as isProblem, n as PROBLEM_CONTENT_TYPE, o as ProblemOptions, r as PROBLEM_TYPE_BASE, s as ProblemResponseOptions, u as problemResponse } from "../problem-CEjyhV5T.js";
 import { a as AuthorizationSubject, c as defineAuthorizer, i as AuthorizationResource, n as AuthorizationOutcome, o as Authorizer, r as AuthorizationRequest, s as PermissionRef, t as AnyAuthorizer } from "../authorizer-eiOjo-3l.js";
-import { i as ResourcePagination } from "../resource--vTrBe6I.js";
-import { t as StorageApi } from "../storage-api-CB7Zl1Ci.js";
-import { Wt as DbStats, _ as Db, t as BetterSupabase } from "../define-DmcfoNXB.js";
-import { a as checkAal, c as impersonatorOf, i as amrOf, n as AmrEntry, o as ImpersonationOptions, r as aalOf, s as Impersonator, t as Aal } from "../mfa-SZc9YYyb.js";
-import { A as SUPPORT_COOKIE, B as SupportSessionStore, C as SupportAuthorizeInput, D as SupportSessions, E as SupportPolicy, F as SqlSupportStoreOptions, G as LiteDriver, H as sqlSupportStore, I as SupportCallerClaims, L as SupportEndedBy, M as clearSupportCookie, N as supportCookie, O as SupportStartRequest, P as supportCookieValue, R as SupportListFilter, S as SupportApi, T as SupportOptions, U as supportClaims, V as SupportStartInput, W as RequestIdOptions, _ as ReplicaState, a as ServerDbOptions, b as deleteAccount, c as TENANT_HEADER, d as SuspendAccountOptions, f as SuspendAccountResult, g as PRIMARY_COOKIE, h as suspendAccount, i as ServerContext, j as SupportCookieOptions, k as supportSessions, l as EndSessionsResult, m as lastSignIns, n as ContextOptions, o as ServerKeys, p as endSessions, r as ForContextOptions, s as ServerOptions, t as BetterServer, u as LastSignIn, v as DeleteAccountOptions, w as SupportExpireRouteOptions, x as ActiveSupport, y as DeleteAccountResult, z as SupportSession } from "../server-types-CrAmZ8jv.js";
-import { n as SessionActor, r as SessionDelegation, t as ActClaim } from "../actor-CQTlc1Hh.js";
-import { n as toSession, t as AuthSession } from "../view-TpXEUcVN.js";
-import { a as SessionEntryConfig, c as withGuard, i as withBetterSupabase, l as ServerCore, n as BetterSupabaseContributions, o as withSession, r as BetterSupabaseEntry, s as GuardEntryConfig, t as BetterSupabaseConfig, u as serverCore } from "../composite-CWAJTRBF.js";
-import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-Cw-zanCm.js";
-import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-W99LCPBS.js";
-import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-CqB6GWGT.js";
-import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-BO9LjtWG.js";
-import { n as supportOf, t as SupportView } from "../support-view-scqMgtOo.js";
-import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-CcvcRqEd.js";
+import { i as ResourcePagination } from "../resource-DxcgtHq6.js";
+import { t as StorageApi } from "../storage-api-B4Ib2Zpo.js";
+import { Wt as DbStats, _ as Db, t as BetterSupabase } from "../define-DXTC706J.js";
+import { n as Impersonator, r as impersonatorOf, t as ImpersonationOptions } from "../impersonation-D5chOkrO.js";
+import { _ as SupportAuthorize, a as AutomationHooks, b as TicketSubject, c as ChatActionHook, d as IdentityRef, f as IdentityTarget, g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, l as DelegationPermissions, m as Subscriber, n as Approver, o as AutomationRef, p as PrincipalByIdentity, r as ApproverOf, s as ChatAction, t as ApprovalRequestRef, u as DelegationRef, v as SupportAuthorizeInput, x as defineAuthorizationHooks, y as SupportDecision } from "../authorization-hooks-Do5djkpz.js";
+import { A as SupportApprovalQuery, B as sqlSupportStore, C as supportSessions, D as supportCookie, E as clearSupportCookie, F as SupportRequest, G as LiteDriver, H as RequestIdOptions, I as SupportRequestInput, J as deleteAccount, K as DeleteAccountOptions, L as SupportSession, M as SupportCallerClaims, N as SupportEndedBy, O as supportCookieValue, P as SupportListFilter, R as SupportSessionStore, S as SupportStartRequest, T as SupportCookieOptions, U as PRIMARY_COOKIE, V as supportClaims, W as ReplicaState, _ as SupportApi, a as ServerDbOptions, b as SupportPolicy, c as TENANT_HEADER, d as SuspendAccountOptions, f as SuspendAccountResult, g as ActiveSupport, h as suspendAccount, i as ServerContext, j as SupportApprover, k as SqlSupportStoreOptions, l as EndSessionsResult, m as lastSignIns, n as ContextOptions, o as ServerKeys, p as endSessions, q as DeleteAccountResult, r as ForContextOptions, s as ServerOptions, t as BetterServer, u as LastSignIn, v as SupportExpireRouteOptions, w as SUPPORT_COOKIE, x as SupportSessions, y as SupportOptions, z as SupportStartInput } from "../server-types-fXwJoFjt.js";
+import { a as checkAal, i as amrOf, n as AmrEntry, r as aalOf, t as Aal } from "../mfa-DtflCXEt.js";
+import { n as toSession, t as AuthSession } from "../view-SuASaomx.js";
+import { a as serverCore, i as ServerCore, n as SessionEntryConfig, r as withSession, t as AuthOutageHook } from "../session-Djo5t4KQ.js";
+import { a as RespondOptions, c as isResult, d as RefreshPolicy, f as isPrefetch, h as shouldRefresh, i as MiddlewareOptions, l as respond, m as shouldCheckSession, n as AuthKind, o as Settled, p as refreshFor, r as GuardOptions, s as guard, u as settle } from "../respond-Cdg5ibH5.js";
+import { a as GuardEntryConfig, i as withBetterSupabase, n as BetterSupabaseContributions, o as withGuard, r as BetterSupabaseEntry, t as BetterSupabaseConfig } from "../composite-DMMA_Whg.js";
+import { a as AuthorizedContext, i as AuthorizeOptions, l as hasRole, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions, u as rolesAt } from "../kit-BlcEFQql.js";
+import { n as subjectReaders, t as SubjectReadersOptions } from "../subject-readers-81xiWh4M.js";
+import { i as toCsv, n as csvColumns, t as CsvOptions } from "../csv-D3eKxV1T.js";
+import { i as JwsAlgorithm, n as Jwks, r as JwksOfOptions } from "../jws-35a8VhFV.js";
+import { a as ResourceHandler, c as ResourceList, l as ResourceRouteOptions, s as ResourceInput } from "../resource-types-CC59gMHE.js";
+import { i as tagFor, n as cacheTagsOf, r as tagCache, t as TagOptions } from "../tags-7NHyD1P8.js";
+import { n as supportOf, t as SupportView } from "../support-view-CznLe4jq.js";
+import { a as sessionStatus, c as RefreshOutcome, i as clearSessionCookies, l as refreshSession, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-EcTtzzQJ.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Middleware, SingleKeyEntry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
 import { PostgresApi } from "@supabase/server/middleware/postgres";
-//#region src/core/csv.d.ts
-interface CsvOptions {
-  /**
-   * The columns in order. Defaults to every key of the rows, in the order
-   * they first appear.
-   */
-  readonly columns?: readonly string[];
-  /**
-   * Prefixes a text cell that starts with `=`, `+`, `-`, `@`, a tab or a
-   * carriage return with `'`, so a spreadsheet shows it instead of running
-   * it as a formula (CSV injection). Default true.
-   */
-  readonly escapeFormulas?: boolean;
-}
-/** The columns of `rows`: every key, in the order it first appears. */
-export declare function csvColumns(rows: readonly Readonly<Record<string, unknown>>[]): string[];
-/**
- * RFC 4180 CSV with a header row and CRLF line ends. Objects and arrays are
- * written as JSON, null and undefined as empty cells.
- */
-export declare function toCsv(rows: readonly Readonly<Record<string, unknown>>[], options?: CsvOptions): string;
-//#endregion
 //#region src/server/csv.d.ts
 interface CsvResponseOptions extends CsvOptions {
   /** The download name, such as `invoices.csv`. */
@@ -128,12 +112,26 @@ export declare function handle<M extends AnyModels, F extends AnyFunctions, E, C
  */
 export declare function resolveToken<C, P>(server: Pick<BetterServer<AnyModels, AnyFunctions, unknown, C, P>, "resolve">, token: string | null | undefined): Promise<AuthState<C, P>>;
 //#endregion
+//#region src/blocks/support-sessions/events.d.ts
+/** The events of the `support-sessions` block: type to data. */
+type SupportSessionsEvents = {
+  readonly "support.started": SupportEventData;
+  readonly "support.ended": SupportEventData;
+  readonly "support.denied": SupportEventData;
+};
+/** The `support-sessions` block's event types, for its manifest and `onBlockEvent`. */
+export declare const supportSessionsEvents: Events<SupportSessionsEvents>;
+//#endregion
 //#region src/server/support-storage.d.ts
 interface SupportStorageOptions {
   /** The service-role `supabase.storage` that serves what the target may read. */
   readonly admin: StorageApi;
-  /** Runs as the target, such as `postgres.asUser(support.claims)`, so RLS on `storage.objects` decides. */
+  /** Runs as the target, such as `postgres.asUser(support.claims)`, so RLS on `storage.objects` decides. Writes need its `transaction`. */
   readonly sql: SqlClient;
+  /** Runs as the connection-string role, such as `postgres.admin`. Writes need it to make the target the owner of what they store. */
+  readonly adminSql?: SqlClient;
+  /** The session the writes are recorded under. Writes need it. */
+  readonly session?: Pick<SupportSession, "id" | "adminId" | "targetUserId">;
   /** Whether the session is read-only. Defaults to true. */
   readonly readOnly?: boolean;
 }
@@ -151,11 +149,15 @@ interface SupportStorageOptions {
  * like a missing one. `getPublicUrl` is built without a check, as it is
  * built without a request.
  *
- * Writes resolve to a `403` error: `SUPPORT_READ_ONLY` in a read-only
- * session and `SUPPORT_STORAGE_WRITES` in a writable one. The service client
- * would store the object with no owner, and Storage never sees the session's
- * `act` claim, so the write could be neither attributed to the target nor
- * audited as the admin's.
+ * In a writable session, `upload`, `update`, `remove`, `copy` and `move`
+ * first run the row change Storage would make as the target, inside a
+ * savepoint that is rolled back, so the policies on `storage.objects`
+ * decide as for the target's own request. Then the service client writes,
+ * the admin connection makes the target the owner of the stored object,
+ * and its `user_metadata` records the session id and the admin's id. A
+ * refused dry run resolves to Storage's `403`. Signed uploads resolve to a
+ * `403` `SUPPORT_STORAGE_WRITES` error, and every write in a read-only
+ * session to a `403` `SUPPORT_READ_ONLY` error.
  */
 export declare function supportStorage(options: SupportStorageOptions): StorageApi;
 //#endregion
@@ -199,7 +201,7 @@ export declare function withBetterPostgres<M extends AnyModels, D, F extends Any
  *
  * ```ts
  * pipeline(
- *   [withBetterSupabase(bs), withPostgresAdminClient(), withBlock('jobs', (ctx) => createJobs(ctx.postgresAdmin, queues))],
+ *   [withBetterSupabase(bs), withPostgresAdminClient(), withBlock('jobs', (ctx) => createJobs({ sql: ctx.postgresAdmin, queues }))],
  *   (req, ctx) => ctx.jobs.drainRoute({ secret, handlers })(req),
  * )
  * ```
@@ -219,6 +221,75 @@ export declare function userClaimsOf(auth: AuthState): UserClaims | null;
  */
 export declare function authModeOf(auth: AuthState): AuthMode;
 //#endregion
+//#region src/core/jwks-cache.d.ts
+/** Where a key set comes from: inline, a URL fetched and cached, or a loader. */
+type JwksInput = Jwks | URL | (() => Promise<Jwks>);
+interface JwksSourceOptions extends JwksOfOptions {
+  /** How long a fetched key set is used before it is fetched again. Default: 300. */
+  readonly cacheSeconds?: number;
+  /** The least time between two fetches for an unknown `kid`. Default: 30. */
+  readonly refetchSeconds?: number;
+  readonly fetch?: typeof fetch;
+  /** Epoch milliseconds. */
+  readonly now?: () => number;
+}
+//#endregion
+//#region src/auth/access-token.d.ts
+/**
+ * Checks whether an access token was revoked, by its `jti` or by the grant it
+ * was issued under. `createOAuthServer` from `better-supabase/blocks/oauth-server`
+ * has this shape.
+ */
+interface AccessTokenRevocation {
+  isRevoked(jti: string, grantId: string | undefined): PromiseLike<Result<boolean>>;
+}
+interface AccessTokenResolverOptions {
+  /** The authorization server's keys: inline, a JWKS URL (cached), or a loader. */
+  readonly jwks: JwksInput;
+  /** The `iss` the tokens must carry, compared exactly. */
+  readonly issuer: string | readonly string[];
+  /** This resource server's identifier; the token's `aud` must contain it. */
+  readonly audience: string | readonly string[];
+  /** The `alg` values accepted. Default: `RS256`, `PS256`, `ES256` and `EdDSA`. */
+  readonly algorithms?: readonly JwsAlgorithm[];
+  /** Seconds of clock skew allowed on `exp`, `nbf` and `iat`. Default: 30. */
+  readonly clockSkew?: number;
+  /**
+   * The Postgres role queries run as, which the token's `role` must match
+   * when it has one. Default: `authenticated`.
+   */
+  readonly role?: string;
+  /** Checked on every request after the signature; a failure answers 401. */
+  readonly revocation?: AccessTokenRevocation;
+  /** The claim with the grant id `revocation` receives. Default: `grant_id`. */
+  readonly grantClaim?: string;
+  /**
+   * Extra claims for a verified token, such as a tenant read from a custom
+   * claim. Claims the token carries keep their values.
+   */
+  readonly claims?: (payload: Readonly<Record<string, unknown>>) => Readonly<Record<string, unknown>>;
+  /** How the JWKS is cached when `jwks` is a URL or a loader. */
+  readonly cache?: Pick<JwksSourceOptions, "cacheSeconds" | "refetchSeconds">;
+  readonly fetch?: typeof fetch;
+  /** Epoch milliseconds. */
+  readonly now?: () => number;
+}
+/**
+ * Resolves an OAuth 2.0 access token in the JWT format of RFC 9068, issued
+ * by an authorization server the app trusts, to a `user` auth state with
+ * `source: "oauth"`. Its claims keep `sub`, `client_id` and `scope`, so
+ * queries run as the user under RLS and the access functions narrow the
+ * token to the permissions its scopes map to.
+ *
+ * Only `Authorization: Bearer` tokens with the `typ` header `at+jwt` are
+ * claimed; others fall through to the next resolver and the Supabase token
+ * check. A claimed token that fails a check answers 401, never anon.
+ *
+ * `ctx.supabase` forwards the token to PostgREST, which accepts it only
+ * when the issuer is registered as Supabase third-party auth.
+ */
+export declare function accessTokenResolver(options: AccessTokenResolverOptions): AuthResolver;
+//#endregion
 //#region src/auth/revocation.d.ts
 /** A client that can read `auth.sessions`, such as `createPostgres().admin`. */
 interface SessionLookup {
@@ -242,6 +313,41 @@ export declare function checkSession(sql: SessionLookup, auth: {
   readonly kind: string;
 }): Promise<DbError | undefined>;
 //#endregion
+//#region src/core/ratelimit-headers.d.ts
+/**
+ * The `RateLimit` and `RateLimit-Policy` response fields of
+ * draft-ietf-httpapi-ratelimit-headers (`SPEC_PINS.ratelimitHeaders`), as
+ * RFC 9651 Structured Fields Lists.
+ */
+/** One quota policy in `RateLimit-Policy`. */
+interface RateLimitPolicy {
+  /** Printable ASCII; the `RateLimit` item names the policy with it. */
+  readonly name: string;
+  /** The quota: requests (or `unit`) allowed per window. */
+  readonly quota: number;
+  /** The window in whole seconds, greater than zero. */
+  readonly window?: number;
+  readonly unit?: "requests" | "content-bytes" | "concurrent-requests";
+}
+/** The quota left under one policy, for `RateLimit`. */
+interface RateLimitState {
+  readonly policy: string;
+  readonly remaining: number;
+  /** Seconds until the quota is restored. */
+  readonly reset?: number;
+}
+/** Whether `name` can be a policy name: printable ASCII only (RFC 9651 § 3.3.3). */
+export declare function isRateLimitPolicyName(name: string): boolean;
+/** The `RateLimit-Policy` value for `policies`. */
+export declare function rateLimitPolicyHeader(policies: readonly RateLimitPolicy[]): string;
+/** The `RateLimit` value for `states`. */
+export declare function rateLimitHeader(states: readonly RateLimitState[]): string;
+/**
+ * Whole seconds in a period of `count unit` (`1 minute`, `30 seconds`,
+ * `2 hours`) or a number of seconds; `undefined` for any other interval.
+ */
+export declare function periodSeconds(period: number | string): number | undefined;
+//#endregion
 //#region src/server/resource.d.ts
 /**
  * Operations over one table, matching the paths and responses of the API
@@ -287,4 +393,4 @@ export declare function withDbStats(options?: {
   };
 }, () => DbStats>;
 //#endregion
-export { AUTH_CACHE_HEADERS, type Aal, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type AmrEntry, type AnyAuthorizer, type AuthKind, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PermissionRef, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SupabaseAuthContext, type SupportApi, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, aalOf, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, defineAuthorizer, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };
+export { AUTH_CACHE_HEADERS, type Aal, type AccessTokenResolverOptions, type AccessTokenRevocation, type AccountEventType, type ActClaim, type ActionResult, type ActiveSupport, type ActorOutcome, type AgentActOptions, type AmrEntry, type AnyAuthorizer, type ApprovalRequestRef, type Approver, type ApproverOf, type AuthKind, type AuthOutageHook, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type AuthorizationHooks, type AuthorizationOutcome, type AuthorizationRequest, type AuthorizationResource, type AuthorizationSubject, type AuthorizeOptions, type AuthorizedContext, type Authorizer, type AutomationHooks, type AutomationRef, type BetterServer, type BetterSupabaseConfig, type BetterSupabaseContributions, type BetterSupabaseEntry, type BlockActionOptions, type BlockRequireOptions, type ChatAction, type ChatActionHook, type ClearSessionCookiesOptions, type ContextOptions, type CookieOptions, type CookieRecord, type CookieWrite, type CsvOptions, type CsvResponseOptions, type DelegationPermissions, type DelegationRef, type DeleteAccountOptions, type DeleteAccountResult, type EndSessionsResult, type ForContextOptions, type GuardEntryConfig, type GuardOptions, type HandleOptions, IDENTITY_SCOPES, type IdentityRef, type IdentityTarget, type ImpersonationOptions, type Impersonator, type InvalidReason, type LastSignIn, type LiteDriver, type MiddlewareOptions, PRIMARY_COOKIE, PROBLEM_CONTENT_TYPE, PROBLEM_TYPE_BASE, type PermissionRef, type PrincipalByIdentity, type ProblemDetails, type ProblemOptions, type ProblemResponseOptions, type RateLimitPolicy, type RateLimitState, type RefreshOutcome, type RefreshPolicy, type ReplicaState, type RequestIdOptions, type ResolveAuthOptions, type ResolvedState, type ResourceHandler, type ResourceInput, type ResourceList, type ResourcePagination, type ResourceRouteOptions, type RespondOptions, SUPPORT_COOKIE, type ServerContext, type ServerCore, type ServerDbOptions, type ServerOptions, type ServerTiming, type SessionActor, type SessionDelegation, type SessionEntryConfig, type SessionLookup, type SessionStatus, type SessionStatusOptions, type Settled, type SqlSupportStoreOptions, type StoredSession, type SubjectReadersOptions, type Subscriber, type SubscriberEvent, type SubscriberPolicy, type SupabaseAuthContext, type SupportApi, type SupportApprovalQuery, type SupportApprover, type SupportAuthorize, type SupportAuthorizeInput, type SupportCallerClaims, type SupportCookieOptions, type SupportDecision, type SupportEndedBy, type SupportExpireRouteOptions, type SupportListFilter, type SupportOptions, type SupportPolicy, type SupportRequest, type SupportRequestInput, type SupportSession, type SupportSessionStore, type SupportSessions, type SupportSessionsEvents, type SupportStartInput, type SupportStartRequest, type SupportStorageOptions, type SupportView, type SuspendAccountOptions, type SuspendAccountResult, TENANT_HEADER, type TagOptions, type TicketSubject, aalOf, actorOf, agentClaims, amrOf, authContext, cacheTagsOf, checkAal, clearSessionCookies, clearSupportCookie, clientIp, csvColumns, defineAuthorizationHooks, defineAuthorizer, delegationOf, deleteAccount, endSessions, fromProblem, guard, hasRole, impersonatorOf, isPrefetch, isProblem, isResult, lastSignIns, problemResponse, readSession, refreshFor, refreshSession, resolveAuth, respond, rolesAt, serverCore, sessionCookieName, sessionStatus, settle, shouldCheckSession, shouldRefresh, sqlSupportStore, subjectReaders, supportClaims, supportCookie, supportCookieValue, supportOf, supportSessions, suspendAccount, tagCache, tagFor, toCsv, toProblem, toSession, withBetterSupabase, withGuard, withSession, writeSession };