better-supabase 0.8.0 → 0.10.0

package/dist/blocks/notifications/react/index.d.ts

@@ -1,37 +1,11 @@
-import { x as SubscriptionStatus } from "../../../index-BCHR4Ucl.js";
+import { n as NotificationSource, o as NotificationsSnapshot, r as NotificationsActions, t as NotificationFeedOptions } from "../../../client-B0rvMvA8.js";
 //#region src/blocks/notifications/react/index.d.ts
-/** Loads one list of items, e.g. a server action that calls `notifications.list()`. */
-export type NotificationSource<T> = () => Promise<readonly T[]>;
-export interface UseNotificationsOptions<T> {
-  /**
-   * The private topic the `notifications` module broadcasts to, e.g.
-   * `notifications:${userId}` (`sql.modules.notifications.options.topic`). `null`
-   * loads once without realtime.
-   */
-  readonly topic: string | null;
-  /** The notifications, newest first. */
-  readonly load: NotificationSource<T>;
-  /** More items merged in, such as running jobs or pending approvals. */
-  readonly sources?: readonly NotificationSource<T>[];
-  /** Orders the merged list. Defaults to the order the sources return. */
-  readonly sort?: (a: T, b: T) => number;
-  /** The badge number. Defaults to the items without a `readAt`. */
-  readonly count?: (items: readonly T[]) => number;
-  /** Runs for each broadcast, e.g. to show a toast for `notification_created`. */
-  readonly onMessage?: (event: string, payload: unknown) => void;
-}
-export interface NotificationsState<T> {
-  /** `undefined` until the first load. */
-  readonly items: readonly T[] | undefined;
-  readonly count: number;
-  readonly status: SubscriptionStatus;
-  readonly error: unknown;
-  /** Loads again, e.g. after marking items read. */
-  readonly refresh: () => Promise<void>;
-}
+export type UseNotificationsOptions<T> = NotificationFeedOptions<T>;
+export interface NotificationsState<T> extends NotificationsSnapshot<T>, NotificationsActions {}
 /**
  * The signed-in user's notifications, kept current: loads them, then loads
- * again after each broadcast on `topic` and after the channel rejoins.
+ * again after each broadcast on `topic` and after the channel rejoins. The
+ * same hook runs in React DOM and React Native.
  *
  * ```tsx
  * const { items, count } = useNotifications({
@@ -41,4 +15,5 @@ export interface NotificationsState<T> {
  * ```
  */
 export declare function useNotifications<T>(options: UseNotificationsOptions<T>): NotificationsState<T>;
-//#endregion
+//#endregion
+export type { NotificationSource };

package/dist/blocks/notifications/react/index.js

@@ -1,12 +1,12 @@
 "use client";
-import { i as useAuth, l as useSupabase } from "../../../hooks-Bhza9Hnr.js";
-import { t as watchTopic } from "../../../react-topic-seAWjL3_.js";
-import { useCallback, useEffect, useRef, useState } from "react";
+import { n as unreadCount, t as createNotificationsController } from "../../../client-BpS8a6Fm.js";
+import { n as useLatest, t as useController } from "../../../react-controller-Xn-IU44p.js";
+import { t as useBlockEnv } from "../../../react-env-Cc7Vf6eb.js";
 //#region src/blocks/notifications/react/index.ts
-const unread = (items) => items.filter((item) => typeof item === "object" && item !== null && "readAt" in item && item.readAt === null).length;
 /**
 * The signed-in user's notifications, kept current: loads them, then loads
-* again after each broadcast on `topic` and after the channel rejoins.
+* again after each broadcast on `topic` and after the channel rejoins. The
+* same hook runs in React DOM and React Native.
 *
 * ```tsx
 * const { items, count } = useNotifications({
@@ -16,52 +16,26 @@ const unread = (items) => items.filter((item) => typeof item === "object" && ite
 * ```
 */
 function useNotifications(options) {
-	const supabase = useSupabase();
-	const auth = useAuth();
-	const [items, setItems] = useState(void 0);
-	const [error, setError] = useState(void 0);
-	const [status, setStatus] = useState("closed");
-	const latest = useRef(options);
-	latest.current = options;
-	const userId = auth.user?.id ?? null;
-	const refresh = useCallback(async () => {
-		const current = latest.current;
-		try {
-			const merged = (await Promise.all([current.load, ...current.sources ?? []].map((source) => source()))).flat();
-			setItems(current.sort ? [...merged].sort(current.sort) : merged);
-			setError(void 0);
-		} catch (cause) {
-			setError(cause);
+	const { auth, ports } = useBlockEnv();
+	const latest = useLatest(options);
+	const { topic } = options;
+	return useController(() => createNotificationsController({
+		auth,
+		ports,
+		topic,
+		load: () => latest.current.load(),
+		sources: [async () => (await Promise.all((latest.current.sources ?? []).map((source) => source()))).flat()],
+		sort: (a, b) => latest.current.sort?.(a, b) ?? 0,
+		count: (items) => (latest.current.count ?? unreadCount)(items),
+		onMessage: (event, payload) => {
+			latest.current.onMessage?.(event, payload);
 		}
-	}, []);
-	const topic = options.topic;
-	useEffect(() => {
-		if (auth.status !== "signed-in") return;
-		refresh();
-		if (!topic) return;
-		return watchTopic(supabase, topic, {
-			onMessage: (event, payload) => {
-				latest.current.onMessage?.(event, payload);
-				refresh();
-			},
-			onRejoin: () => void refresh(),
-			onStatus: setStatus
-		});
-	}, [
-		supabase,
+	}), [
+		auth,
+		ports,
 		topic,
-		userId,
-		auth.status,
-		refresh
-	]);
-	const list = items ?? [];
-	return {
-		items,
-		count: (options.count ?? unread)(list),
-		status,
-		error,
-		refresh
-	};
+		latest
+	]).view;
 }
 //#endregion
 export { useNotifications };

package/dist/blocks/notifications/react/server.d.ts

@@ -1,4 +1,5 @@
-import { NotificationSource, NotificationsState, UseNotificationsOptions } from "./index.js";
+import { n as NotificationSource } from "../../../client-B0rvMvA8.js";
+import { NotificationsState, UseNotificationsOptions } from "./index.js";
 //#region src/blocks/notifications/react/server.d.ts
 /** The `react-server` build of `useNotifications`: call `notifications.list()` instead. */
 export declare const useNotifications: <T>(options: UseNotificationsOptions<T>) => NotificationsState<T>;

package/dist/blocks/notifications/solid/index.d.ts

@@ -0,0 +1,13 @@
+import { t as BlockOptions } from "../../../block-env-Dxl7rsI0.js";
+import { t as SolidController } from "../../../solid-controller-CZrt1Tg6.js";
+import { a as NotificationsControllerOptions, o as NotificationsSnapshot, r as NotificationsActions } from "../../../client-B0rvMvA8.js";
+//#region src/blocks/notifications/solid/index.d.ts
+/**
+ * `createNotificationsController` as a Solid primitive: `state()` reads the
+ * snapshot. Call it in a component; the work starts on mount and the controller
+ * is disposed with the owner. `auth` and `ports` default to the client of
+ * `<BetterSupabaseProvider client={bs}>`.
+ */
+export declare function useNotifications<T>(options: BlockOptions<NotificationsControllerOptions<T>>): SolidController<NotificationsSnapshot<T>, NotificationsActions>;
+//#endregion
+export type { BlockOptions, NotificationsActions, NotificationsControllerOptions, NotificationsSnapshot, SolidController };

package/dist/blocks/notifications/solid/index.js

@@ -0,0 +1,14 @@
+import { t as createNotificationsController } from "../../../client-BpS8a6Fm.js";
+import { t as useBlockController } from "../../../solid-controller-DLsmrczT.js";
+//#region src/blocks/notifications/solid/index.ts
+/**
+* `createNotificationsController` as a Solid primitive: `state()` reads the
+* snapshot. Call it in a component; the work starts on mount and the controller
+* is disposed with the owner. `auth` and `ports` default to the client of
+* `<BetterSupabaseProvider client={bs}>`.
+*/
+function useNotifications(options) {
+	return useBlockController(createNotificationsController, options);
+}
+//#endregion
+export { useNotifications };

package/dist/blocks/notifications/svelte/index.d.ts

@@ -0,0 +1,13 @@
+import { t as BlockOptions } from "../../../block-env-Dxl7rsI0.js";
+import { t as SvelteController } from "../../../svelte-controller-DDbju9CW.js";
+import { a as NotificationsControllerOptions, o as NotificationsSnapshot, r as NotificationsActions } from "../../../client-B0rvMvA8.js";
+//#region src/blocks/notifications/svelte/index.d.ts
+/**
+ * `createNotificationsController` as a Svelte readable store of the snapshot,
+ * with the actions on `.actions`. Call it in a component's script; the work
+ * starts on mount and the controller is disposed with the component. `auth` and
+ * `ports` default to the client of `setBetterSupabase(bs)`.
+ */
+export declare function useNotifications<T>(options: BlockOptions<NotificationsControllerOptions<T>>): SvelteController<NotificationsSnapshot<T>, NotificationsActions>;
+//#endregion
+export type { BlockOptions, NotificationsActions, NotificationsControllerOptions, NotificationsSnapshot, SvelteController };

package/dist/blocks/notifications/svelte/index.js

@@ -0,0 +1,14 @@
+import { t as createNotificationsController } from "../../../client-BpS8a6Fm.js";
+import { t as useBlockController } from "../../../svelte-controller-CDAujo-_.js";
+//#region src/blocks/notifications/svelte/index.ts
+/**
+* `createNotificationsController` as a Svelte readable store of the snapshot,
+* with the actions on `.actions`. Call it in a component's script; the work
+* starts on mount and the controller is disposed with the component. `auth` and
+* `ports` default to the client of `setBetterSupabase(bs)`.
+*/
+function useNotifications(options) {
+	return useBlockController(createNotificationsController, options);
+}
+//#endregion
+export { useNotifications };

package/dist/blocks/notifications/vue/index.d.ts

@@ -0,0 +1,13 @@
+import { t as BlockOptions } from "../../../block-env-Dxl7rsI0.js";
+import { t as VueController } from "../../../vue-controller-D_ohttBZ.js";
+import { a as NotificationsControllerOptions, o as NotificationsSnapshot, r as NotificationsActions } from "../../../client-B0rvMvA8.js";
+//#region src/blocks/notifications/vue/index.d.ts
+/**
+ * `createNotificationsController` as a Vue composable: `state` is a shallow ref
+ * of the snapshot. Call it in `setup` or an effect scope; the work starts on
+ * mount and the controller is disposed with the scope. `auth` and `ports`
+ * default to the client of `app.use(betterSupabase(bs))`.
+ */
+export declare function useNotifications<T>(options: BlockOptions<NotificationsControllerOptions<T>>): VueController<NotificationsSnapshot<T>, NotificationsActions>;
+//#endregion
+export type { BlockOptions, NotificationsActions, NotificationsControllerOptions, NotificationsSnapshot, VueController };

package/dist/blocks/notifications/vue/index.js

@@ -0,0 +1,14 @@
+import { t as createNotificationsController } from "../../../client-BpS8a6Fm.js";
+import { t as useBlockController } from "../../../vue-controller-C9tFzqAc.js";
+//#region src/blocks/notifications/vue/index.ts
+/**
+* `createNotificationsController` as a Vue composable: `state` is a shallow ref
+* of the snapshot. Call it in `setup` or an effect scope; the work starts on
+* mount and the controller is disposed with the scope. `auth` and `ports`
+* default to the client of `app.use(betterSupabase(bs))`.
+*/
+function useNotifications(options) {
+	return useBlockController(createNotificationsController, options);
+}
+//#endregion
+export { useNotifications };

package/dist/blocks/number-sequences/index.d.ts

@@ -0,0 +1,45 @@
+import { t as AsyncResult, w as ErrorMapper } from "../../result-Cj3yWhjH.js";
+import { $ as SaasEventData, wt as Events } from "../../events-CtAHxPal.js";
+import { n as Logger } from "../../logger-DWVYUmwi.js";
+import { t as BlockTransport } from "../../block-transport-NbUJygA7.js";
+import { n as BlockHooks } from "../../block-hooks-C_WaodoA.js";
+import { s as BlockOf } from "../../define-block-BlHQxDIQ.js";
+//#region src/blocks/number-sequences/number-sequences.d.ts
+interface NumberSequencesOptions {
+  readonly transport: BlockTransport;
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+  /** `withBlockHooks` hooks around the client's methods. */
+  readonly hooks?: BlockHooks<NumberSequences>;
+  /** Receives the errors `after` hooks throw. Default: `console`. */
+  readonly logger?: Logger;
+}
+interface NumberSequences {
+  /**
+   * Allocates the next gapless number. Service role only: a client round
+   * trip would commit the number before the document does. Documents take
+   * their number from the column trigger instead.
+   */
+  next(organizationId: string, entity: string, at?: string): AsyncResult<string>;
+  /**
+   * The number the next document would get, formatted, without assigning
+   * it. Needs the `assign` permission in the organization; a concurrent
+   * document can still take it first.
+   */
+  preview(organizationId: string, entity: string, at?: string): AsyncResult<string>;
+}
+export declare function createNumberSequences(options: NumberSequencesOptions): NumberSequences;
+//#endregion
+//#region src/blocks/number-sequences/events.d.ts
+/** The events of the `number-sequences` block: type to data. */
+type NumberSequencesEvents = {
+  readonly "number.assigned": SaasEventData;
+};
+/** The `number-sequences` block's event types, for its manifest and `onBlockEvent`. */
+export declare const numberSequencesEvents: Events<NumberSequencesEvents>;
+//#endregion
+//#region src/blocks/number-sequences/manifest.d.ts
+/** The `number-sequences` block's manifest (ADR 0029). */
+export declare const numberSequencesBlock: BlockOf<"number-sequences", typeof createNumberSequences, NumberSequencesEvents>;
+//#endregion
+export type { NumberSequences, NumberSequencesEvents, NumberSequencesOptions };

package/dist/blocks/number-sequences/index.js

@@ -0,0 +1,49 @@
+import { t as numberSequencesSqlOptions } from "../../options-Bn4cu0gt.js";
+import { n as event, t as defineEvents } from "../../event-map-Dy2vKHai.js";
+import { o as blockCall } from "../../block-helpers-BfVCR5Fc.js";
+import { r as withBlockHooks } from "../../block-hooks-ByKlh8Qy.js";
+import { n as defineBlock } from "../../define-block-B6Gjs57G.js";
+//#region src/blocks/number-sequences/number-sequences.ts
+function createNumberSequences(options) {
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const text = (value) => {
+		if (typeof value === "string") return value;
+		throw new TypeError("preview_number did not return a number");
+	};
+	return withBlockHooks({
+		next: (organizationId, entity, at) => call("next_number", {
+			tenant: organizationId,
+			p_entity: entity,
+			at: at ?? null
+		}, (value) => {
+			if (typeof value === "number" || typeof value === "bigint") return String(value);
+			if (typeof value === "string") return value;
+			throw new TypeError("next_number did not return a number");
+		}),
+		preview: (organizationId, entity, at) => call("preview_number", {
+			p_tenant: organizationId,
+			p_entity: entity,
+			...at === void 0 ? {} : { p_at: at }
+		}, text)
+	}, options.hooks, {
+		block: "number-sequences",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+//#endregion
+//#region src/blocks/number-sequences/events.ts
+/** The `number-sequences` block's event types, for its manifest and `onBlockEvent`. */
+const numberSequencesEvents = defineEvents({ "number.assigned": event() });
+//#endregion
+//#region src/blocks/number-sequences/manifest.ts
+/** The `number-sequences` block's manifest (ADR 0029). */
+const numberSequencesBlock = defineBlock({
+	name: "number-sequences",
+	sql: ["number-sequences"],
+	options: { "number-sequences": numberSequencesSqlOptions },
+	events: numberSequencesEvents,
+	create: createNumberSequences,
+	category: "database"
+});
+//#endregion
+export { createNumberSequences, numberSequencesBlock, numberSequencesEvents };

package/dist/blocks/oauth-server/index.d.ts

@@ -0,0 +1,228 @@
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult } from "../../result-Cj3yWhjH.js";
+import { wt as Events } from "../../events-CtAHxPal.js";
+import { n as Logger } from "../../logger-DWVYUmwi.js";
+import { s as sqlTransport, t as BlockTransport } from "../../block-transport-NbUJygA7.js";
+import { n as BlockOptions } from "../../block-helpers-7pMBVsE6.js";
+import { n as BlockHooks } from "../../block-hooks-C_WaodoA.js";
+import { s as BlockOf } from "../../define-block-BlHQxDIQ.js";
+//#region src/blocks/oauth-server/oauth-server.d.ts
+declare const AUTH_METHODS: readonly ["none", "client_secret_basic", "client_secret_post"];
+declare const GRANT_TYPES: readonly ["authorization_code", "refresh_token", "client_credentials", "urn:ietf:params:oauth:grant-type:device_code"];
+/** How a client authenticates at the token endpoint (RFC 7591 section 2). */
+type OAuthClientAuthMethod = (typeof AUTH_METHODS)[number];
+/** A grant type a client may use. */
+type OAuthGrantType = (typeof GRANT_TYPES)[number];
+interface OAuthServerOptions extends BlockOptions {
+  /** How long an authorization code is valid, in seconds. Default: 60. */
+  readonly codeSeconds?: number;
+  /** How long a device code is valid, in seconds. Default: 600. */
+  readonly deviceCodeSeconds?: number;
+  /** The minimum seconds between device code polls. Default: 5. */
+  readonly deviceInterval?: number;
+  /** `withBlockHooks` hooks around the client's methods. */
+  readonly hooks?: NoInfer<BlockHooks<OAuthServer>>;
+  /** Receives the errors `after` hooks throw. Default: `console`. */
+  readonly logger?: Logger;
+}
+/** The client metadata a registration sets (RFC 7591 section 2). */
+interface OAuthClientMetadata {
+  readonly name?: string;
+  /** Absolute `https` URIs, or `http` on a loopback host; no fragment. */
+  readonly redirectUris?: readonly string[];
+  /** Default: `["authorization_code"]`. */
+  readonly grantTypes?: readonly OAuthGrantType[];
+  /** `none` registers a public client without a secret. Default: `client_secret_basic`. */
+  readonly tokenEndpointAuthMethod?: OAuthClientAuthMethod;
+  /** Space-separated scopes the client may ask for. */
+  readonly scope?: string;
+  /** Other RFC 7591 metadata, such as `logo_uri` or `software_id`, stored as given. */
+  readonly metadata?: Readonly<Record<string, unknown>>;
+}
+/** A registered client, without its secret. */
+interface OAuthClient {
+  readonly clientId: string;
+  readonly name: string | null;
+  readonly redirectUris: readonly string[];
+  readonly grantTypes: readonly OAuthGrantType[];
+  readonly tokenEndpointAuthMethod: OAuthClientAuthMethod;
+  readonly scope: string | null;
+  readonly metadata: Readonly<Record<string, unknown>>;
+  readonly createdBy: string | null;
+  readonly createdAt: Temporal.Instant;
+  readonly updatedAt: Temporal.Instant;
+}
+/** What `registerClient` returns. The secret and token are shown once and stored hashed. */
+interface RegisteredOAuthClient {
+  readonly client: OAuthClient;
+  /** `null` for a public client (`tokenEndpointAuthMethod: "none"`). */
+  readonly clientSecret: string | null;
+  /** The RFC 7592 registration access token for reading and updating the client. */
+  readonly registrationAccessToken: string;
+}
+interface RegisterClientOptions {
+  /** The user who registered the client, when one did. */
+  readonly createdBy?: string;
+}
+interface AuthorizationCodeRequest {
+  readonly clientId: string;
+  /** The user who consented. */
+  readonly userId: string;
+  /** The `redirect_uri` of the request, when it named one. */
+  readonly redirectUri?: string;
+  readonly scope?: string;
+  readonly codeChallenge: string;
+  /** Must be `S256`; `plain` and any other method are refused. */
+  readonly codeChallengeMethod: string;
+  /** The OpenID Connect `nonce`, returned by `redeemAuthorizationCode`. */
+  readonly nonce?: string;
+}
+/** What `createAuthorizationCode` returns. */
+interface IssuedAuthorizationCode {
+  /** The code for the redirect; only its hash is stored. */
+  readonly code: string;
+  readonly grantId: string;
+  readonly expiresAt: Temporal.Instant;
+}
+interface AuthorizationCodeRedemption {
+  readonly code: string;
+  readonly clientId: string;
+  /** Must match the authorization request's `redirect_uri`. */
+  readonly redirectUri?: string;
+  readonly codeVerifier: string;
+}
+/** A code or device code exchanged once: who to issue tokens for. */
+interface OAuthAuthorization {
+  readonly userId: string;
+  readonly clientId: string;
+  readonly grantId: string;
+  readonly scope: string;
+  readonly nonce: string | null;
+}
+/** What `createDeviceCode` returns (RFC 8628 section 3.2). */
+interface IssuedDeviceCode {
+  readonly deviceCode: string;
+  /** Eight letters, shown as `XXXX-XXXX`. */
+  readonly userCode: string;
+  readonly expiresIn: number;
+  readonly interval: number;
+}
+/** The pending request behind a user code, for the verification page. */
+interface DeviceRequest {
+  readonly clientId: string;
+  readonly scope: string;
+  readonly expiresAt: Temporal.Instant;
+}
+/** A device code poll, mapped to the RFC 8628 section 3.5 token responses. */
+type DeviceCodePoll = {
+  readonly status: "ok";
+  readonly authorization: OAuthAuthorization;
+} | {
+  readonly status: "authorization_pending";
+  readonly interval: number;
+} | {
+  readonly status: "slow_down";
+  readonly interval: number;
+} | {
+  readonly status: "access_denied";
+} | {
+  readonly status: "expired_token";
+} | {
+  readonly status: "invalid_grant";
+};
+/** A user's consent for a client, which the tokens issued under it carry as `grant_id`. */
+interface OAuthGrant {
+  readonly id: string;
+  readonly userId: string;
+  readonly clientId: string;
+  readonly clientName: string | null;
+  readonly scopes: readonly string[];
+  readonly createdAt: Temporal.Instant;
+  readonly updatedAt: Temporal.Instant;
+  readonly revokedAt: Temporal.Instant | null;
+}
+interface ListGrantsOptions {
+  readonly includeRevoked?: boolean;
+}
+interface RevokeTokenOptions {
+  readonly grantId?: string;
+}
+/**
+ * The `oauth-server` storage as typed calls. Service role only, except the
+ * signed-in user's `my_oauth_grants` and `revoke_my_oauth_grant`.
+ */
+interface OAuthServer {
+  /** Registers a client (RFC 7591) and returns its secret and registration token once. */
+  registerClient(metadata: OAuthClientMetadata, options?: RegisterClientOptions): AsyncResult<RegisteredOAuthClient>;
+  readClient(clientId: string): AsyncResult<OAuthClient | null>;
+  /** Changes the given metadata (RFC 7592); `null` for an unknown client. */
+  updateClient(clientId: string, metadata: Omit<OAuthClientMetadata, "tokenEndpointAuthMethod">): AsyncResult<OAuthClient | null>;
+  /** A new secret for a confidential client; `null` for an unknown or public client. */
+  rotateSecret(clientId: string): AsyncResult<string | null>;
+  /** Deletes the client, its grants and its codes. */
+  deleteClient(clientId: string): AsyncResult<boolean>;
+  /** The client when the secret matches, `null` otherwise. Pass `null` for a public client. */
+  verifyClient(clientId: string, secret: string | null): AsyncResult<OAuthClient | null>;
+  /** Whether the RFC 7592 registration access token belongs to the client. */
+  verifyRegistrationToken(clientId: string, token: string): AsyncResult<boolean>;
+  /** Stores a code after the user consented, under their grant for the client. */
+  createAuthorizationCode(request: AuthorizationCodeRequest): AsyncResult<IssuedAuthorizationCode>;
+  /**
+   * Exchanges a code once, checking the client, redirect URI and PKCE
+   * verifier. `null` for any mismatch; a reused code also revokes its grant.
+   */
+  redeemAuthorizationCode(redemption: AuthorizationCodeRedemption): AsyncResult<OAuthAuthorization | null>;
+  createDeviceCode(clientId: string, scope?: string): AsyncResult<IssuedDeviceCode>;
+  /** The pending request for a user code as typed, dashes and case ignored. */
+  deviceRequest(userCode: string): AsyncResult<DeviceRequest | null>;
+  approveDeviceCode(userCode: string, userId: string): AsyncResult<boolean>;
+  denyDeviceCode(userCode: string, userId: string): AsyncResult<boolean>;
+  pollDeviceCode(deviceCode: string, clientId: string): AsyncResult<DeviceCodePoll>;
+  listGrants(userId: string, options?: ListGrantsOptions): AsyncResult<readonly OAuthGrant[]>;
+  /** Revokes a grant: every token carrying its `grant_id` fails `isRevoked`. */
+  revokeGrant(grantId: string): AsyncResult<boolean>;
+  /** Puts an access token's `jti` on the revocation list until `expiresAt`. */
+  revokeToken(jti: string, expiresAt: Temporal.Instant, options?: RevokeTokenOptions): AsyncResult<boolean>;
+  /**
+   * Whether a token is revoked by `jti` or by its grant. A grant id that is
+   * unknown counts as revoked. Fits `accessTokenResolver({ revocation })`.
+   */
+  isRevoked(jti: string, grantId: string | undefined): AsyncResult<boolean>;
+  /** Deletes expired codes, device codes and revocation entries. */
+  purge(): AsyncResult<number>;
+}
+/**
+ * The `oauth-server` SQL module as typed calls: secrets, codes and
+ * registration tokens are generated and hashed here, and only their SHA-256
+ * reaches the database. It stores what an authorization server needs and
+ * issues no tokens; sign them with `createSigningKeys` and verify them with
+ * `accessTokenResolver`.
+ */
+export declare function createOAuthServer(options: OAuthServerOptions): OAuthServer;
+//#endregion
+//#region src/blocks/oauth-server/events.d.ts
+/** `oauth_client.*`: the client id, never its secret. */
+interface OAuthClientEventData {
+  readonly clientId: string;
+}
+/** `oauth_grant.*`: who granted which client access. */
+interface OAuthGrantEventData {
+  readonly grantId: string;
+  readonly userId: string;
+  readonly clientId: string;
+}
+/** The events of the `oauth-server` block: type to data. */
+type OAuthServerEvents = {
+  readonly "oauth_client.registered": OAuthClientEventData;
+  readonly "oauth_client.deleted": OAuthClientEventData;
+  readonly "oauth_grant.created": OAuthGrantEventData;
+  readonly "oauth_grant.revoked": OAuthGrantEventData;
+};
+/** The `oauth-server` block's event types, for its manifest and `onBlockEvent`. */
+export declare const oauthServerEvents: Events<OAuthServerEvents>;
+//#endregion
+//#region src/blocks/oauth-server/manifest.d.ts
+/** The `oauth-server` block's manifest (ADR 0029). */
+export declare const oauthServerBlock: BlockOf<"oauth-server", typeof createOAuthServer, OAuthServerEvents>;
+//#endregion
+export { type AuthorizationCodeRedemption, type AuthorizationCodeRequest, type BlockTransport, type DeviceCodePoll, type DeviceRequest, type IssuedAuthorizationCode, type IssuedDeviceCode, type ListGrantsOptions, type OAuthAuthorization, type OAuthClient, type OAuthClientAuthMethod, type OAuthClientEventData, type OAuthClientMetadata, type OAuthGrant, type OAuthGrantEventData, type OAuthGrantType, type OAuthServer, type OAuthServerEvents, type OAuthServerOptions, type RegisterClientOptions, type RegisteredOAuthClient, type RevokeTokenOptions, sqlTransport };