better-supabase 0.8.0 → 0.10.0

package/dist/api-keys-C8BlF3L2.d.ts

@@ -1,156 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { t as AsyncResult } from "./result-BchM1XZn.js";
-import { t as BlockTransport } from "./block-transport-inD4fFq-.js";
-import { n as AuthResolver } from "./resolve-MxXVWyhd.js";
-import { r as BlockTemporalOptions } from "./block-helpers-C0Xj8War.js";
-import { JWTClaims } from "@supabase/server";
-//#region src/blocks/api-keys/api-keys.d.ts
-type ApiKeyState = "active" | "grace" | "revoked" | "expired";
-interface ApiKey {
-  readonly id: string;
-  /** Set for a tenant key, and for a personal key limited to one tenant. */
-  readonly organizationId?: string;
-  /** Set for a personal key: it acts as this user. */
-  readonly userId?: string;
-  readonly name: string;
-  readonly prefix: string;
-  readonly publicId: string;
-  readonly scopes: readonly string[];
-  /** Requests per minute, when the key has a limit. */
-  readonly rateLimit?: number;
-  readonly expiresAt?: Temporal.Instant;
-  readonly lastUsedAt?: Temporal.Instant;
-  /** In the future while a rotated key's grace period runs. */
-  readonly revokedAt?: Temporal.Instant;
-  readonly rotatedFrom?: string;
-  readonly createdBy?: string;
-  readonly createdAt: Temporal.Instant;
-  readonly state: ApiKeyState;
-  readonly successorId?: string;
-}
-/** A new key. `token` is shown once: only its hash is stored. */
-interface CreatedApiKey {
-  readonly key: ApiKey;
-  readonly token: string;
-}
-interface CreateApiKeyInput {
-  readonly name: string;
-  /** The tenant the key acts in. Required unless `personal`. */
-  readonly organizationId?: string;
-  /** Acts as the signed-in user (in `organizationId` only, when set). */
-  readonly personal?: boolean;
-  /** `*` grants every scope. */
-  readonly scopes?: readonly string[];
-  readonly expiresAt?: Temporal.Instant;
-  /** Requests per minute. */
-  readonly rateLimit?: number;
-}
-type ApiKeyCheck = {
-  readonly status: "ok";
-  readonly key: ApiKey;
-} | {
-  readonly status: "invalid";
-} | {
-  readonly status: "rate_limited";
-  readonly retryAfter: number;
-};
-interface ApiKeys {
-  create(input: CreateApiKeyInput): AsyncResult<CreatedApiKey>;
-  /** A tenant's keys for its managers (the caller's own otherwise), or the caller's personal keys. */
-  list(organizationId?: string): AsyncResult<readonly ApiKey[]>;
-  revoke(id: string): AsyncResult<boolean>;
-  /** A new token for the key; the old one keeps working for `grace` (one day by default). */
-  rotate(id: string, options?: {
-    readonly grace?: Temporal.Duration;
-  }): AsyncResult<CreatedApiKey>;
-  /** Checks a presented token and counts the request. Needs a service transport. */
-  verify(token: string): AsyncResult<ApiKeyCheck>;
-}
-interface ApiKeysOptions extends BlockTemporalOptions {
-  readonly transport: BlockTransport;
-  readonly schema?: string;
-  /** The token's first segment, lowercase letters and digits. Defaults to `bs`. */
-  readonly prefix?: string;
-}
-interface ParsedApiKey {
-  readonly prefix: string;
-  readonly publicId: string;
-  readonly secret: string;
-  /** Whether the token ends in a checksum; keys created before it have none. */
-  readonly checksum: boolean;
-}
-/**
- * The CRC-32 (IEEE 802.3) of `text` as 6 base62 characters: the checksum
- * GitHub-style tokens end in, so a secret
- * scanner or the server rejects a mistyped key without a lookup.
- */
-declare function apiKeyChecksum(text: string): string;
-/**
- * Splits `<prefix>_<public id>_<secret><checksum>`: a 43-character base62
- * secret and the 6-character checksum of everything before it. A key from
- * before the checksum (`<prefix>_<public id>_<secret>`) still parses. A
- * checksum that doesn't match, or anything else (a JWT, say), is
- * `undefined`.
- */
-declare function parseApiKey(token: string): ParsedApiKey | undefined;
-/**
- * API keys over the `api-keys` SQL module. Members create and rotate keys
- * with their own transport; `verify` (and `apiKeyResolver`) need one that
- * runs as the service role.
- */
-declare function createApiKeys(options: ApiKeysOptions): ApiKeys;
-/**
- * A second claim for an authorization provider's SQL functions, with the
- * field names they read. Every field but `name` is optional.
- */
-interface ApiKeyExtraClaim {
-  /** The claim. `api_key` adds the fields to the module's own claim. */
-  readonly name: string;
-  /** The field with the permission keys, default `scopes`. */
-  readonly scopes?: string;
-  /** The field with a tenant key's tenant, default `tenant`. */
-  readonly tenant?: string;
-  /** The field with a tenant key's roles, default `roles`. */
-  readonly roles?: string;
-  /** The roles a tenant key holds in its tenant, unless `serviceRoles` in the options answers. */
-  readonly serviceRoles?: readonly string[];
-}
-interface ApiKeyClaimsOptions {
-  /**
-   * Also write the claim an authorization provider's SQL functions read:
-   * the scopes as a ceiling, and a tenant key's tenant and roles.
-   */
-  readonly claim?: ApiKeyExtraClaim;
-  /** The roles a tenant key holds in its tenant; default `claim.serviceRoles`. */
-  readonly serviceRoles?: (key: ApiKey) => readonly string[];
-  /**
-   * The permission keys `*` stands for in `claim`, which has no wildcard,
-   * so without this a key with `*` allows nothing there.
-   */
-  readonly allPermissions?: readonly string[];
-  /**
-   * The claim that narrows a provider's functions to one tenant (such as
-   * `tenant_id`), set for a personal key limited to a tenant.
-   */
-  readonly tenantClaim?: string;
-}
-interface ApiKeyResolverOptions extends ApiKeyClaimsOptions {
-  /** `createApiKeys` over a service transport. */
-  readonly keys: Pick<ApiKeys, "verify">;
-  /** The header that carries the key besides `Authorization: Bearer`. Defaults to `x-api-key`. */
-  readonly header?: string;
-}
-/**
- * The claims queries run with for a key: `api_key` with `id`, `name`,
- * `scopes` and `organization_id` for the module's `has_scope()` and
- * `api_key_tenant()`, plus `options.claim`.
- */
-declare function apiKeyClaims(key: ApiKey, options?: ApiKeyClaimsOptions): JWTClaims;
-/**
- * Resolves `x-api-key` (or a Bearer token shaped like a key) to an `apiKey`
- * auth state. Requests without one fall through to the JWT and cookie
- * resolution. Pass it to `createServer({ auth: { resolvers: [...] } })`.
- */
-declare function apiKeyResolver(options: ApiKeyResolverOptions): AuthResolver;
-//#endregion
-export { ApiKeyResolverOptions as a, ApiKeysOptions as c, ParsedApiKey as d, apiKeyChecksum as f, parseApiKey as g, createApiKeys as h, ApiKeyExtraClaim as i, CreateApiKeyInput as l, apiKeyResolver as m, ApiKeyCheck as n, ApiKeyState as o, apiKeyClaims as p, ApiKeyClaimsOptions as r, ApiKeys as s, ApiKey as t, CreatedApiKey as u };

package/dist/assistant-DBlFDZsi.d.ts

@@ -1,147 +0,0 @@
-import { b as DbError } from "./result-BchM1XZn.js";
-import { i as AiMessage } from "./message-B0fNJgq8.js";
-import { E as AiRunStatus, F as AiUserMessageTrigger, _ as AiModerationAction, i as AiChat, u as AiChatRecord } from "./ai-chat-DXkMy74O.js";
-import { o as StreamStore } from "./store-DsIYEBnv.js";
-import { c as GatewayOptions, i as CostBackfillPayload, t as AiUsage } from "./gateway-S9vicgeo.js";
-import { LanguageModelUsage, ModelMessage, UIMessage, UIMessageChunk, UIMessageStreamOnEndCallback } from "ai";
-//#region src/ai-sdk/chat/assistant.d.ts
-/** Who asks, for one request. */
-interface AssistantContext {
-  /**
-   * The chat block for this request: the user's transport, and a service
-   * transport (`service`) for the writes only the server makes.
-   */
-  readonly chats: AiChat;
-  readonly userId: string;
-  readonly organizationId: string;
-  /**
-   * Keeps the function alive until the answer is stored, after the response
-   * is sent: `after` in Next.js, `ctx.waitUntil` on Workers and Vercel.
-   */
-  readonly waitUntil?: (promise: Promise<unknown>) => void;
-}
-/** What `run` gets to generate one answer. */
-interface AssistantRunArgs {
-  readonly chat: AiChatRecord;
-  /** The model the request may use, after the catalog check. */
-  readonly model: string;
-  readonly messages: ModelMessage[];
-  /** The history the model sees, as UI messages. */
-  readonly uiMessages: UIMessage[];
-  /** Aborted by `stop()`; pass it to `streamText` or `agent.stream`. */
-  readonly abortSignal: AbortSignal;
-  /** Spend attribution for the AI Gateway (`gatewayOptions`). */
-  readonly providerOptions: {
-    readonly gateway: GatewayOptions;
-  };
-  readonly context: AssistantContext;
-}
-/** The part of a `streamText` or `agent.stream` result the assistant reads. */
-interface AssistantRunResult {
-  toUIMessageStream(options: {
-    originalMessages: UIMessage[];
-    generateMessageId: () => string;
-    onEnd: UIMessageStreamOnEndCallback<UIMessage>;
-    onError?: (error: unknown) => string;
-  }): ReadableStream<UIMessageChunk>;
-  readonly totalUsage?: PromiseLike<LanguageModelUsage>;
-  readonly providerMetadata?: PromiseLike<unknown>;
-}
-/** The verdict of a moderation hook. */
-interface AssistantModeration {
-  readonly action: AiModerationAction;
-  readonly category: string;
-  readonly score?: number;
-}
-/** What `onFinish` gets once the answer is stored. */
-interface AssistantFinish {
-  readonly chat: AiChatRecord;
-  readonly message: UIMessage;
-  readonly status: AiRunStatus;
-  readonly model: string;
-  readonly usage: AiUsage | undefined;
-  readonly context: AssistantContext;
-}
-interface AssistantOptions {
-  /** Where the answer's stream is kept, so a reload resumes it. */
-  readonly streams: StreamStore;
-  /** Starts the generation: `agent.stream(...)` or `streamText(...)`. */
-  readonly run: (args: AssistantRunArgs) => AssistantRunResult | PromiseLike<AssistantRunResult>;
-  /** The model when neither the request nor the chat names an allowed one. */
-  readonly defaultModel: string;
-  /**
-   * The quota check before a generation (`usageQuota(usage, meter)`); an
-   * error answers 429.
-   */
-  readonly quota?: (organizationId: string) => Promise<DbError | undefined>;
-  /** Checks the user's message; `block` answers 403, others are recorded. */
-  readonly moderate?: (input: {
-    readonly message: AiMessage;
-    readonly chat: AiChatRecord;
-  }) => Promise<AssistantModeration | undefined>;
-  /** Called with the cost backfill payload when the gateway hasn't reported a cost yet. */
-  readonly enqueueCostBackfill?: (payload: CostBackfillPayload) => Promise<unknown>;
-  /** Called after the answer is stored, such as to record usage. */
-  readonly onFinish?: (finish: AssistantFinish) => void | Promise<void>;
-  /** What the stream is kept for: seconds or a Postgres interval. Defaults to one day. */
-  readonly streamTtl?: number | string;
-  /** The `feature` tag of the gateway options. Defaults to `chat`. */
-  readonly feature?: string;
-  /** Turns a stream error into the message the client sees. */
-  readonly onError?: (error: unknown) => string;
-  /** Makes message and stream ids. Defaults to `crypto.randomUUID()`. */
-  readonly generateId?: () => string;
-}
-/** The body `useAssistant` sends. */
-interface AssistantRequestBody {
-  /** The chat id; the client may make it, and the chat is created on first use. */
-  readonly id: string;
-  readonly message: UIMessage;
-  readonly trigger?: AiUserMessageTrigger;
-  /** For `regenerate-message`, the answer to write again. */
-  readonly messageId?: string;
-  readonly model?: string;
-}
-/** A checked and stored user turn, ready for a model: what `prepare` returns. */
-interface AssistantTurn {
-  readonly chat: AiChatRecord;
-  /** The model the request may use, after the catalog check. */
-  readonly model: string;
-  /** The stored user message, which the answer is saved under. */
-  readonly parentId: string;
-  /** The history the model sees, as UI messages. */
-  readonly uiMessages: UIMessage[];
-  readonly messages: ModelMessage[];
-  /** Spend attribution for the AI Gateway (`gatewayOptions`). */
-  readonly providerOptions: {
-    readonly gateway: GatewayOptions;
-  };
-}
-interface Assistant {
-  /** Stores the user's message, starts the answer and streams it (SSE). */
-  respond(request: Request, context: AssistantContext): Promise<Response>;
-  /**
-   * The checks and writes before a generation, without one: parses the
-   * body `useAssistant` sends, creates the chat on first use, picks the
-   * model, moderates, checks the quota, stores the user's message and loads
-   * the history. Returns a problem response when one of them fails.
-   */
-  prepare(body: unknown, context: AssistantContext): Promise<AssistantTurn | Response>;
-  /** The running answer of `chatId` from the start, or 204 when none runs. */
-  resume(chatId: string, context: AssistantContext, options?: {
-    readonly fromIdx?: number;
-    readonly signal?: AbortSignal;
-  }): Promise<Response>;
-  /** Asks the running answer to stop: 204 whether or not one runs, a problem when the user may not. */
-  stop(chatId: string, context: AssistantContext): Promise<Response>;
-}
-/**
- * A chat route for the AI SDK on the `ai-chat` block: `respond` stores the
- * user's message, picks an allowed model, checks the quota, claims the
- * chat's answer, runs the model and streams it while keeping a copy in the
- * stream store; the answer and its usage are stored when it ends, even
- * after the client left. `resume` replays it after a reload, `stop` ends it.
- */
-declare function createAssistant(options: AssistantOptions): Assistant;
-//#endregion
-export { AssistantOptions as a, AssistantRunResult as c, AssistantModeration as i, AssistantTurn as l, AssistantContext as n, AssistantRequestBody as o, AssistantFinish as r, AssistantRunArgs as s, Assistant as t, createAssistant as u };

package/dist/attributes-5dYul0u0.js

@@ -1,13 +0,0 @@
-//#region src/workflow-sdk/attributes.ts
-/** The attributes the Supabase World's status trigger copies into `workflow_runs`. */
-const WORKFLOW_ATTRIBUTES = {
-	tenant: "bs.tenant",
-	actor: "bs.actor",
-	key: "bs.key",
-	/** The builder definition a run started from; its alerts match on it. */
-	definition: "bs.definition",
-	/** The builder version number a run started from. */
-	version: "bs.version"
-};
-//#endregion
-export { WORKFLOW_ATTRIBUTES as t };

package/dist/authorization-BFCqamMs.d.ts

@@ -1,172 +0,0 @@
-import { i as DisabledRow } from "./modules-DpPwzC7E.js";
-//#region src/config/authorization.d.ts
-/**
- * SQL expression templates the SQL modules and the access policies call.
- * `{permission}` is a text expression (a literal or a parameter), `{user}` a
- * uuid expression, `{tenant}` an expression of the tenant id type and
- * `{role}` a text expression. `{scope}` is the scope's name unquoted, so it
- * can be part of a function name (`app.ids_{scope}({permission})`); write
- * `'{scope}'` to pass it as text.
- */
-interface AuthorizationFunctions {
-  /**
-   * The ids of the `{scope}` instances where the caller holds
-   * `{permission}`, as a set: it is used as
-   * `select t.id::text from <template> as t(id)`.
-   */
-  readonly idsWith: string;
-  /** Whether the caller holds `{permission}` platform-wide. */
-  readonly isPlatform: string;
-  /** `idsWith` for `{user}`, so `can_user` answers for another user. */
-  readonly idsWithFor?: string;
-  /** `isPlatform` for `{user}`. */
-  readonly isPlatformFor?: string;
-  /** The ids of the `{scope}` instances the caller is a member of, as a set. */
-  readonly memberIds?: string;
-  /** `memberIds` for `{user}`, which the access token hook calls as `supabase_auth_admin`. */
-  readonly memberIdsFor?: string;
-  /** Whether the caller may assign `{role}` in `{tenant}`. */
-  readonly canAssign?: string;
-  /** Whether `{user}` may assign `{role}` in `{tenant}`. */
-  readonly canAssignFor?: string;
-  /**
-   * The permission keys `{user}` holds in `{tenant}`, as a `text[]`. It
-   * fills `member_permissions` and the `permissions` claim; without it
-   * both are empty.
-   */
-  readonly permissionsFor?: string;
-  /**
-   * Whether the caller may decide the tool call `{tool}` (text) waits on in
-   * `{tenant}`. Without it only the chat's owner and the service role decide.
-   */
-  readonly canApprove?: string;
-}
-/** One scope the provider decides permissions in, such as `organization`. */
-interface AuthorizationScope {
-  /** Lower case letters, digits and `_`, starting with a letter. */
-  readonly name: string;
-  /** The Postgres type of the scope's ids: `uuid`, `text`, `bigint` or `integer`. */
-  readonly idType?: string;
-  /** The scope this one sits in; the root scope has none. */
-  readonly parent?: string;
-}
-/** A function the templates call, which must exist and be executable by `role`. */
-interface AuthorizationRequirement {
-  /** `schema.name`. */
-  readonly function: string;
-  /** The argument types, such as `text` or `uuid, text`. */
-  readonly args?: string;
-  readonly role: string;
-}
-/** A permission key the provider defines. */
-interface AuthorizationPermission {
-  readonly key: string;
-  /**
-   * `true` when the SQL functions answer for the key completely. A key with
-   * row conditions they don't check is `false`, and policies refuse it.
-   * Unset means unknown, which counts as `false`.
-   */
-  readonly sqlComplete?: boolean;
-  /** The scopes it can be granted at. */
-  readonly scopes?: readonly string[];
-}
-/** A table of memberships the provider reads. */
-interface AuthorizationMembership {
-  /** `schema.table`. */
-  readonly table: string;
-  readonly userColumn: string;
-  /** The scope column, or the scope every row is in. */
-  readonly scope: {
-    readonly column: string;
-  } | {
-    readonly value: string;
-  };
-  readonly idColumn: string;
-}
-/** A membership table whose role column points into a roles table. */
-interface AuthorizationRoleSource {
-  /** `schema.table` of the memberships. */
-  readonly table: string;
-  readonly role: {
-    readonly column: string;
-    readonly through: {
-      /** `schema.table` of the roles. */
-      readonly table: string;
-      readonly id: string;
-      readonly column: string;
-    };
-  };
-}
-/** The access token hook the provider generates. */
-interface AuthorizationTokenHook {
-  /** `schema.name`. */
-  readonly function: string;
-  /** The claim it writes the active tenant id to. */
-  readonly tenantClaim?: string;
-  /** Claims it writes itself, which a second writer would contradict. */
-  readonly ownedClaims: readonly string[];
-  /** Claims it fills from other functions, such as `features` from `better_supabase.feature_claims`. */
-  readonly registeredClaims?: readonly {
-    readonly name: string;
-    /** `schema.name`. */
-    readonly function: string;
-  }[];
-  /** A byte budget over some claims, which doctor `--as` measures (BS405). */
-  readonly budget?: {
-    readonly claims: readonly string[];
-    readonly bytes: number;
-    /** A claim the hook sets to `true` when it dropped entries to stay within the budget. */
-    readonly truncatedClaim?: string;
-  };
-  /** Comment lines the provider's generated files contain, so doctor recognises them. */
-  readonly markers?: {
-    /** In the file that defines the hook. */
-    readonly hook?: string;
-    /** In the migration that grants the hook's functions. */
-    readonly grants?: string;
-  };
-  /** The command that writes the hook's grants, for BS404. */
-  readonly grantsCommand?: string;
-}
-/**
- * An authorization system the SQL modules, the policies and doctor delegate
- * to. It is plain data, usually built from the provider's own output files.
- */
-interface AuthorizationProvider {
-  readonly apiVersion: 1;
-  /** The provider's name, for messages. */
-  readonly name: string;
-  readonly scopes: readonly AuthorizationScope[];
-  /** The scope tenants are. */
-  readonly tenantScope: string;
-  readonly functions: AuthorizationFunctions;
-  readonly requires?: readonly AuthorizationRequirement[];
-  readonly permissions?: readonly AuthorizationPermission[];
-  readonly memberships?: readonly AuthorizationMembership[];
-  /** Rows that say whether a user or a tenant is active. */
-  readonly suspension?: {
-    readonly user?: DisabledRow;
-    readonly tenant?: DisabledRow;
-  };
-  readonly roleSources?: readonly AuthorizationRoleSource[];
-  /** `schema.table.column` of every column that decides access (BS213). */
-  readonly decidingColumns?: readonly string[];
-  readonly tokenHook?: AuthorizationTokenHook;
-  /** How `canApprove` decisions are made. */
-  readonly approvals?: {
-    /** The user who asked for the tool call can't approve it. Default `false`. */
-    readonly distinctApprover?: boolean;
-  };
-  /** What the provider found wrong while building this, for doctor. */
-  readonly problems?: readonly string[];
-}
-/**
- * The error for a provider built for another API version, or `undefined`
- * for version 1.
- */
-declare function providerApiProblem(provider: {
-  readonly name?: unknown;
-  readonly apiVersion?: unknown;
-}): string | undefined;
-//#endregion
-export { AuthorizationRequirement as a, AuthorizationTokenHook as c, AuthorizationProvider as i, providerApiProblem as l, AuthorizationMembership as n, AuthorizationRoleSource as o, AuthorizationPermission as r, AuthorizationScope as s, AuthorizationFunctions as t };

package/dist/authorizer-ayxUDXXP.js

@@ -1,126 +0,0 @@
-import { n as deepFreeze, r as isPlainObject, t as cloneValue } from "./clone-dN9XOL1K.js";
-import { n as dbError } from "./errors-2M6CKMP4.js";
-import { a as ok, r as err } from "./result-DEqHCMKP.js";
-//#region src/core/authorizer.ts
-/** Identity helper that fixes `apiVersion` and infers `Ref`. */
-function defineAuthorizer(authorizer) {
-	return {
-		...authorizer,
-		apiVersion: 1
-	};
-}
-const ANONYMOUS = {
-	type: "anon",
-	id: "anonymous"
-};
-function scopesOf(claims) {
-	const scope = claims?.["scope"];
-	return typeof scope === "string" ? scope.split(" ").filter(Boolean) : [];
-}
-/** A frozen copy of the verified claims, so an authorizer cannot change them. */
-function claimsProperty(claims) {
-	if (!isPlainObject(claims)) return {};
-	return { claims: deepFreeze(cloneValue(claims)) };
-}
-/** The subject and context of a request, from the verified context only. */
-function requestOf(context) {
-	const actor = context?.actor;
-	const claims = context?.claims;
-	const act = claims?.["act"];
-	const subject = actor ? {
-		type: typeof act === "object" && act !== null && actor.kind === "user" ? "agent" : actor.kind,
-		id: actor.id,
-		properties: {
-			...actor.role === void 0 ? {} : { role: actor.role },
-			...actor.email === void 0 ? {} : { email: actor.email },
-			...actor.impersonator === void 0 ? {} : { impersonator: actor.impersonator },
-			...claimsProperty(claims)
-		}
-	} : ANONYMOUS;
-	const aal = claims?.["aal"];
-	return {
-		subject,
-		context: {
-			...context?.tenant === void 0 ? {} : { tenant: context.tenant },
-			...typeof aal === "string" ? { aal } : {},
-			scopes: scopesOf(claims)
-		}
-	};
-}
-function isOutcome(value) {
-	if (typeof value !== "object" || value === null || !("outcome" in value)) return false;
-	const { outcome } = value;
-	return outcome === "granted" || outcome === "denied" || outcome === "approval-required";
-}
-/** The `forbidden` error for an outcome other than `granted`, or `undefined`. */
-function outcomeError(outcome, permission) {
-	if (!isOutcome(outcome)) return dbError("forbidden", `The authorizer gave no decision for ${permission}`, {
-		code: "PERMISSION_DENIED",
-		permission
-	});
-	switch (outcome.outcome) {
-		case "granted": return;
-		case "denied": return dbError("forbidden", outcome.reason ?? `Permission ${permission} is required`, {
-			code: "PERMISSION_DENIED",
-			permission
-		});
-		case "approval-required": return dbError("forbidden", `${permission} needs an approval`, {
-			code: "APPROVAL_REQUIRED",
-			permission,
-			...outcome.approval ? { approval: { id: outcome.approval.id } } : {}
-		});
-		default: return outcome;
-	}
-}
-/**
-* Checks one permission and fails closed: a missing authorizer, a throw or
-* an unknown outcome all deny. Never throws (invariant 4).
-*/
-async function checkPermission(options) {
-	const { authorizer, permission } = options;
-	if (!authorizer) return err(dbError("forbidden", "A permission is declared, but no authorizer is set", { code: "PERMISSION_DENIED" }));
-	let key;
-	try {
-		key = authorizer.key(permission);
-	} catch {
-		return err(dbError("forbidden", "Unknown permission", { code: "PERMISSION_DENIED" }));
-	}
-	const { subject, context } = requestOf(options.context);
-	try {
-		const error = outcomeError(await authorizer.evaluate({
-			subject,
-			action: permission,
-			resource: options.resource,
-			context
-		}), key);
-		return error ? err(error) : ok(void 0);
-	} catch {
-		return err(dbError("forbidden", `The authorizer failed for ${key}`, {
-			code: "PERMISSION_DENIED",
-			permission: key
-		}));
-	}
-}
-/**
-* Checks one permission per resource, with `evaluations` when the
-* authorizer has it. Returns whether each one is granted, in order; any
-* failure denies.
-*/
-async function checkEach(authorizer, permission, resources, context) {
-	if (!authorizer || resources.length === 0) return resources.map(() => false);
-	const { subject, context: requestContext } = requestOf(context);
-	const requests = resources.map((resource) => ({
-		subject,
-		action: permission,
-		resource,
-		context: requestContext
-	}));
-	try {
-		const outcomes = authorizer.evaluations ? await authorizer.evaluations(requests) : await Promise.all(requests.map((request) => Promise.resolve(authorizer.evaluate(request))));
-		return requests.map((_, index) => isOutcome(outcomes[index]) && outcomes[index].outcome === "granted");
-	} catch {
-		return resources.map(() => false);
-	}
-}
-//#endregion
-export { requestOf as i, checkPermission as n, defineAuthorizer as r, checkEach as t };

package/dist/base64-D2gsioCY.js

@@ -1,42 +0,0 @@
-//#region src/core/base64.ts
-const encoder = /* @__PURE__ */ new TextEncoder();
-const decoder = /* @__PURE__ */ new TextDecoder();
-/** Standard base64 (RFC 4648 section 4) of `input`, with padding. */
-function toBase64(input) {
-	const bytes = typeof input === "string" ? encoder.encode(input) : input;
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCodePoint(byte);
-	return btoa(binary);
-}
-/** Bytes of standard or URL-safe base64, padded or not. Throws on invalid input. */
-function fromBase64(text) {
-	const base64 = text.replaceAll("-", "+").replaceAll("_", "/");
-	const binary = atob(base64 + "=".repeat((4 - base64.length % 4) % 4));
-	const bytes = new Uint8Array(binary.length);
-	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
-	return bytes;
-}
-/** URL-safe base64 (RFC 4648 section 5) of `input`, without padding. */
-function toBase64Url(input) {
-	return toBase64(input).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}
-/** UTF-8 text of base64 or base64url. Throws on invalid input. */
-function base64ToText(text) {
-	return decoder.decode(fromBase64(text));
-}
-/**
-* The payload of a JWT, decoded without verifying the signature. Only for
-* reading claims such as `exp` from a token that is verified elsewhere.
-*/
-function decodeJwtPayload(token) {
-	const part = token.split(".")[1];
-	if (!part) return void 0;
-	try {
-		const parsed = JSON.parse(base64ToText(part));
-		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
-	} catch {
-		return;
-	}
-}
-//#endregion
-export { toBase64Url as a, toBase64 as i, decodeJwtPayload as n, fromBase64 as r, base64ToText as t };