better-supabase 0.8.0 → 0.9.0

package/dist/mfa-DtflCXEt.d.ts

@@ -0,0 +1,30 @@
+import { b as DbError } from "./result-Cj3yWhjH.js";
+//#region src/auth/mfa.d.ts
+/** Authenticator assurance level: `aal2` once a second factor is verified in this session. */
+type Aal = "aal1" | "aal2";
+/** One way the user proved who they are in this session (the JWT `amr` claim). */
+interface AmrEntry {
+  /** `password`, `otp`, `oauth`, `totp`, `sso/saml`, `anonymous`, ... */
+  readonly method: string;
+  /** Seconds since epoch. */
+  readonly timestamp: number;
+  /** SSO provider id, for `sso/saml`. */
+  readonly provider?: string;
+}
+/** The session's assurance level from its claims; anything but `aal2` reads as `aal1`. */
+declare function aalOf(claims: Readonly<Record<string, unknown>>): Aal;
+/** The `amr` claim as typed entries, skipping malformed ones. */
+declare function amrOf(claims: Readonly<Record<string, unknown>>): readonly AmrEntry[];
+/**
+ * `undefined` when a user session meets `required`; otherwise a `forbidden`
+ * error with `required` and code `INSUFFICIENT_AAL`, for the client to start
+ * an MFA challenge. Non-user sessions pass: `allow` decides about them.
+ */
+declare function checkAal(auth: {
+  readonly kind: "user";
+  readonly claims: object;
+} | {
+  readonly kind: string;
+}, required: Aal): DbError | undefined;
+//#endregion
+export { checkAal as a, amrOf as i, AmrEntry as n, aalOf as r, Aal as t };

package/dist/model-lUafmeBQ.d.ts

@@ -0,0 +1,311 @@
+//#region src/spec/model.d.ts
+/** A JSON Schema (2020-12) object. Model schemas reference components as `#/components/schemas/<Name>`. */
+type JsonSchema = Readonly<Record<string, unknown>>;
+/** A JSON object, for extensions and free-form fields. */
+type JsonObject = Readonly<Record<string, unknown>>;
+type ResourceOperation = "list" | "get" | "create" | "update" | "delete";
+/** HTTP methods an operation can use; `query` is an OpenAPI 3.2 method. */
+type HttpMethod = "get" | "put" | "post" | "patch" | "delete" | "head" | "options" | "trace" | "query";
+interface ModelParameter {
+  readonly name: string;
+  readonly in: "path" | "query" | "header" | "cookie";
+  readonly required?: boolean;
+  readonly description?: string;
+  readonly deprecated?: boolean;
+  readonly schema: JsonSchema;
+  /** How an array or object query value is written (`form` for `a,b`). */
+  readonly style?: string;
+  readonly explode?: boolean;
+}
+/** A named example of a media type. */
+interface ModelExample {
+  readonly summary?: string;
+  readonly description?: string;
+  readonly value: unknown;
+}
+/** Media type to its schema. `itemSchema` describes each item of a stream (SSE, JSON Lines). */
+interface ModelContent {
+  readonly schema?: JsonSchema;
+  readonly itemSchema?: JsonSchema;
+  readonly examples?: Readonly<Record<string, ModelExample>>;
+}
+interface ModelBody {
+  readonly required: boolean;
+  readonly description?: string;
+  readonly content: Readonly<Record<string, ModelContent>>;
+}
+interface ModelResponse {
+  readonly description: string;
+  /** Short summary; native in OpenAPI 3.2. */
+  readonly summary?: string;
+  readonly content?: Readonly<Record<string, ModelContent>>;
+  readonly headers?: Readonly<Record<string, {
+    readonly description?: string;
+    readonly schema: JsonSchema;
+  }>>;
+}
+/** A response, or the name of a shared one in `ApiModel.responses`. */
+type ModelResponseOrRef = ModelResponse | {
+  readonly ref: string;
+};
+/** Scheme name to its required scopes. `[]` means no scopes. */
+type SecurityRequirement = Readonly<Record<string, readonly string[]>>;
+/** Where an operation comes from, so tools and adapters can find their own. */
+type OperationSource = {
+  readonly kind: "resource";
+  readonly table: string;
+  readonly operation: ResourceOperation;
+} | {
+  readonly kind: "action";
+  readonly table: string;
+  readonly action: string;
+} | {
+  readonly kind: "data-api";
+  /** The table's app key, for `select`, `insert`, `update` and `delete`. */
+  readonly table?: string;
+  /** The function's key, for `rpc`. */
+  readonly function?: string;
+  readonly operation: DataApiOperation | "rpc";
+} | {
+  readonly kind: "route";
+} | {
+  readonly kind: "fragment";
+};
+/** A table operation of the Data API (PostgREST). */
+type DataApiOperation = "select" | "insert" | "update" | "delete";
+interface ModelOperation {
+  /** The operationId: unique across the model. */
+  readonly id: string;
+  readonly method: HttpMethod;
+  /** The OpenAPI path template, e.g. `/api/customers/{id}`. */
+  readonly path: string;
+  readonly summary?: string;
+  readonly description?: string;
+  readonly tags: readonly string[];
+  readonly deprecated?: boolean;
+  readonly parameters: readonly ModelParameter[];
+  readonly requestBody?: ModelBody;
+  readonly responses: Readonly<Record<string, ModelResponseOrRef>>;
+  /** Overrides the model's `servers`, e.g. the Supabase project for the Data API. */
+  readonly servers?: readonly ModelServer[];
+  /** Overrides the model's `security`; `[]` makes the operation public. */
+  readonly security?: readonly SecurityRequirement[];
+  /** The permission key the authorizer checks, from `Authorizer.key()`. */
+  readonly permission?: string;
+  readonly source: OperationSource;
+  /** `x-` fields, with their prefix. */
+  readonly extensions: JsonObject;
+  /**
+   * Deep-merged into the operation object a format renders (OpenAPI), after
+   * the fragments, so it wins over both the generated fields and fragments.
+   */
+  readonly extend?: JsonObject;
+}
+interface ModelTag {
+  readonly name: string;
+  readonly summary?: string;
+  readonly description?: string;
+  /** The parent tag's name (OpenAPI 3.2 nested tags). */
+  readonly parent?: string;
+  /** `nav`, `badge` or another value from the OAI Tag Kind registry. */
+  readonly kind?: string;
+}
+interface ModelServer {
+  readonly url: string;
+  /** Native in OpenAPI 3.2. */
+  readonly name?: string;
+  readonly description?: string;
+}
+interface OAuthFlow {
+  readonly authorizationUrl?: string;
+  readonly tokenUrl?: string;
+  readonly refreshUrl?: string;
+  readonly scopes: Readonly<Record<string, string>>;
+}
+type ModelSecurityScheme = {
+  readonly type: "http";
+  readonly scheme: string;
+  readonly bearerFormat?: string;
+  readonly description?: string;
+} | {
+  readonly type: "apiKey";
+  readonly name: string;
+  readonly in: "header" | "query" | "cookie";
+  readonly description?: string;
+} | {
+  readonly type: "oauth2";
+  readonly description?: string;
+  readonly flows: {
+    readonly authorizationCode?: OAuthFlow;
+    readonly clientCredentials?: OAuthFlow;
+    readonly implicit?: OAuthFlow;
+    readonly password?: OAuthFlow;
+  };
+  /** RFC 8414 metadata URL; native in OpenAPI 3.2. */
+  readonly metadataUrl?: string;
+} | {
+  readonly type: "openIdConnect";
+  readonly openIdConnectUrl: string;
+  readonly description?: string;
+} | {
+  /** The Security Profiles proposal; only `3.3-preview` emits it. */
+  readonly type: "profile";
+  readonly description?: string;
+  readonly profileMetadata: {
+    readonly profile: string;
+    readonly parametersSchema?: string;
+    readonly authorizationServer?: string;
+    readonly servers?: readonly string[];
+  };
+};
+/** A Security Profile Requirement (Security Profiles proposal, preview only). */
+interface ModelSecurityProfileRequirement {
+  readonly scheme: string;
+  readonly operation?: string;
+  readonly tokenEndpointAuthMethods?: readonly string[];
+  readonly grantTypes?: readonly string[];
+  readonly scopes?: readonly string[];
+}
+interface ModelMessage {
+  readonly id: string;
+  readonly name?: string;
+  readonly title?: string;
+  readonly summary?: string;
+  readonly description?: string;
+  readonly contentType?: string;
+  readonly payload: JsonSchema;
+  readonly headers?: JsonSchema;
+  /** A runtime expression such as `$message.payload#/id`. */
+  readonly correlationId?: string;
+  /** Names of shared traits in `ApiModel.messageTraits`, applied in order. */
+  readonly traits?: readonly string[];
+  readonly extensions?: JsonObject;
+}
+/** Fields several messages share, such as the CloudEvents headers. */
+interface ModelMessageTrait {
+  readonly summary?: string;
+  readonly description?: string;
+  readonly contentType?: string;
+  readonly headers?: JsonSchema;
+}
+interface ModelChannelOperation {
+  readonly id: string;
+  readonly action: "send" | "receive";
+  readonly summary?: string;
+  readonly description?: string;
+  /** Message ids, a subset of the channel's. */
+  readonly messages?: readonly string[];
+  readonly permission?: string;
+  readonly extensions?: JsonObject;
+}
+interface ModelChannel {
+  readonly id: string;
+  /** The address with `{param}` placeholders, e.g. `bs:t:{schema}.{table}`. */
+  readonly address: string;
+  readonly title?: string;
+  readonly summary?: string;
+  readonly description?: string;
+  readonly parameters?: Readonly<Record<string, {
+    readonly description?: string;
+  }>>;
+  /** The protocol the channel runs on: `ws` (Realtime) or `http` (webhooks). */
+  readonly protocol: "ws" | "http";
+  readonly messages: readonly string[];
+  readonly operations: readonly ModelChannelOperation[];
+  readonly extensions?: JsonObject;
+}
+interface ModelWebhook {
+  /** The event name, e.g. `invoice.paid`. */
+  readonly id: string;
+  readonly summary?: string;
+  readonly description?: string;
+  readonly payload: JsonSchema;
+  /** Standard Webhooks headers (`webhook-id`, `webhook-timestamp`, `webhook-signature`). */
+  readonly standardWebhooks: boolean;
+}
+/** A step calls an operation by id or sends or receives on a channel (Arazzo 1.1). */
+interface ModelStep {
+  readonly id: string;
+  readonly description?: string;
+  readonly operationId?: string;
+  readonly channel?: {
+    readonly id: string;
+    readonly action: "send" | "receive";
+    readonly correlationId?: string;
+  };
+  readonly workflowId?: string;
+  readonly parameters?: readonly {
+    readonly name: string;
+    readonly in?: "path" | "query" | "header" | "cookie";
+    readonly value: unknown;
+  }[];
+  readonly requestBody?: {
+    readonly payload: unknown;
+  };
+  readonly successCriteria?: readonly {
+    readonly condition: string;
+  }[];
+  readonly outputs?: Readonly<Record<string, string>>;
+  readonly onSuccess?: readonly JsonObject[];
+  readonly onFailure?: readonly JsonObject[];
+}
+interface ModelWorkflow {
+  readonly id: string;
+  readonly summary?: string;
+  readonly description?: string;
+  readonly inputs?: JsonSchema;
+  readonly steps: readonly ModelStep[];
+  readonly outputs?: Readonly<Record<string, string>>;
+}
+interface ModelInfo {
+  readonly title: string;
+  readonly version: string;
+  readonly summary?: string;
+  readonly description?: string;
+  readonly termsOfService?: string;
+  readonly contact?: {
+    readonly name?: string;
+    readonly url?: string;
+    readonly email?: string;
+  };
+  readonly license?: {
+    readonly name: string;
+    readonly identifier?: string;
+    readonly url?: string;
+  };
+}
+/**
+ * A version-neutral description of the API. `defineApi` builds it once; each
+ * `DocumentFormat` lowers it to one version of its format. Formats never
+ * mutate it.
+ */
+interface ApiModel {
+  readonly info: ModelInfo;
+  /** The document's own URL (`$self` in OpenAPI 3.2). */
+  readonly self?: string;
+  readonly servers: readonly ModelServer[];
+  readonly tags: readonly ModelTag[];
+  readonly operations: readonly ModelOperation[];
+  readonly schemas: Readonly<Record<string, JsonSchema>>;
+  /** Shared responses, referenced by name from operations. */
+  readonly responses: Readonly<Record<string, ModelResponse>>;
+  readonly securitySchemes: Readonly<Record<string, ModelSecurityScheme>>;
+  readonly security: readonly SecurityRequirement[];
+  readonly securityProfileRequirements?: Readonly<Record<string, ModelSecurityProfileRequirement>>;
+  readonly channels: readonly ModelChannel[];
+  readonly messages: Readonly<Record<string, ModelMessage>>;
+  readonly messageTraits?: Readonly<Record<string, ModelMessageTrait>>;
+  readonly webhooks: readonly ModelWebhook[];
+  readonly workflows: readonly ModelWorkflow[];
+  /**
+   * OpenAPI fragments (parsed YAML or JSON), deep-merged over the generated
+   * document in order. A field they change is reported as `fragment-conflict`.
+   */
+  readonly fragments: readonly JsonObject[];
+  /** The Realtime websocket URL, the AsyncAPI server. */
+  readonly realtimeUrl?: string;
+  /** Prefix of the generated `x-` fields. Defaults to `x-better-supabase-`. */
+  readonly extensionPrefix: string;
+}
+//#endregion
+export { ModelWebhook as C, ResourceOperation as D, OperationSource as E, SecurityRequirement as O, ModelTag as S, OAuthFlow as T, ModelResponseOrRef as _, JsonSchema as a, ModelServer as b, ModelChannelOperation as c, ModelInfo as d, ModelMessage as f, ModelResponse as g, ModelParameter as h, JsonObject as i, ModelContent as l, ModelOperation as m, DataApiOperation as n, ModelBody as o, ModelMessageTrait as p, HttpMethod as r, ModelChannel as s, ApiModel as t, ModelExample as u, ModelSecurityProfileRequirement as v, ModelWorkflow as w, ModelStep as x, ModelSecurityScheme as y };

package/dist/model-messages-CTu-6kBu.js

@@ -0,0 +1,206 @@
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { a as meta } from "./messages-Cx4ttLJJ.js";
+//#region src/ai-sdk/model-messages.ts
+const FETCHABLE_URL = /^(?:https?|data):/u;
+function fileUrl(data) {
+	if (data instanceof URL) return data.href;
+	if (typeof data === "string") return FETCHABLE_URL.test(data) ? data : void 0;
+	if (isRecord(data) && data["type"] === "url") return fileUrl(data["url"]);
+}
+function outputOf(output) {
+	switch (output.type) {
+		case "text":
+		case "json":
+		case "content": return {
+			output: output.value,
+			isError: false
+		};
+		case "error-text":
+		case "error-json": return {
+			output: output.value,
+			isError: true
+		};
+		case "execution-denied": {
+			const reason = output.reason ?? "The tool call was denied.";
+			return {
+				output: reason,
+				isError: true,
+				denied: reason
+			};
+		}
+		default: return output;
+	}
+}
+/** Collects one turn's parts, keeping one approval part per tool call. */
+var TurnParts = class {
+	parts = [];
+	#approvalAt = /* @__PURE__ */ new Map();
+	#callOf = /* @__PURE__ */ new Map();
+	constructor(approvals) {
+		for (const approval of approvals) this.#callOf.set(approval.approvalId, approval.toolCallId);
+	}
+	approval(part) {
+		this.#callOf.set(part.approvalId, part.toolCallId);
+		const at = this.#approvalAt.get(part.toolCallId);
+		if (at === void 0) {
+			this.#approvalAt.set(part.toolCallId, this.parts.length);
+			this.parts.push(part);
+		} else this.parts[at] = part;
+	}
+	callOf(approvalId) {
+		return this.#callOf.get(approvalId);
+	}
+	result(toolCallId, toolName, output) {
+		const result = outputOf(output);
+		if (result.denied !== void 0) {
+			const at = this.#approvalAt.get(toolCallId);
+			const current = at === void 0 ? void 0 : this.parts[at];
+			this.approval({
+				type: "tool-approval",
+				toolCallId,
+				approvalId: current?.type === "tool-approval" ? current.approvalId : `approval-${toolCallId}`,
+				state: "denied",
+				reason: result.denied
+			});
+		}
+		this.parts.push({
+			type: "tool-result",
+			toolCallId,
+			toolName,
+			output: result.output,
+			...result.isError ? { isError: true } : {}
+		});
+	}
+};
+function assistantParts(message, turn) {
+	if (typeof message.content === "string") {
+		if (message.content !== "") turn.parts.push({
+			type: "text",
+			text: message.content,
+			state: "done"
+		});
+		return;
+	}
+	for (const part of message.content) switch (part.type) {
+		case "text":
+		case "reasoning":
+			turn.parts.push({
+				type: part.type,
+				text: part.text,
+				state: "done"
+			});
+			break;
+		case "file": {
+			const url = fileUrl(part.data);
+			if (url !== void 0) turn.parts.push({
+				type: "file",
+				mediaType: part.mediaType,
+				url,
+				...part.filename === void 0 ? {} : { filename: part.filename }
+			});
+			break;
+		}
+		case "reasoning-file": {
+			const url = fileUrl(part.data);
+			if (url !== void 0) turn.parts.push({
+				type: "data",
+				name: "ui.reasoning-file",
+				data: {
+					mediaType: part.mediaType,
+					url
+				}
+			});
+			break;
+		}
+		case "custom":
+			turn.parts.push({
+				type: "data",
+				name: "ui.custom",
+				data: { kind: part.kind }
+			});
+			break;
+		case "tool-call":
+			turn.parts.push({
+				type: "tool-call",
+				toolCallId: part.toolCallId,
+				toolName: part.toolName,
+				input: part.input ?? {},
+				...part.providerExecuted === void 0 ? {} : { providerExecuted: part.providerExecuted }
+			});
+			break;
+		case "tool-result":
+			turn.result(part.toolCallId, part.toolName, part.output);
+			break;
+		case "tool-approval-request":
+			turn.approval({
+				type: "tool-approval",
+				toolCallId: part.toolCallId,
+				approvalId: part.approvalId,
+				state: "requested"
+			});
+			break;
+		default: return part;
+	}
+}
+function toolMessageParts(message, turn) {
+	for (const part of message.content) switch (part.type) {
+		case "tool-result":
+			turn.result(part.toolCallId, part.toolName, part.output);
+			break;
+		case "tool-approval-response": {
+			const toolCallId = turn.callOf(part.approvalId);
+			if (toolCallId !== void 0) turn.approval({
+				type: "tool-approval",
+				toolCallId,
+				approvalId: part.approvalId,
+				state: part.approved ? "approved" : "denied",
+				...part.reason === void 0 ? {} : { reason: part.reason }
+			});
+			break;
+		}
+		default: return part;
+	}
+}
+/**
+* One answer in the canonical form, from the model messages an agent added
+* in a turn (`result.messages` after the history). Each assistant message
+* starts a step whose id is `<id>:<n>`, so saving the answer again after
+* another step updates the same message.
+*/
+function fromModelMessages(id, messages, options = {}) {
+	const approvals = options.approvals ?? [];
+	const turn = new TurnParts(approvals);
+	let step = 0;
+	for (const message of messages) if (message.role === "assistant") {
+		turn.parts.push({
+			type: "step",
+			boundary: "start",
+			stepId: `${id}:${step}`
+		});
+		step += 1;
+		assistantParts(message, turn);
+	} else if (message.role === "tool") toolMessageParts(message, turn);
+	for (const approval of approvals) turn.approval({
+		type: "tool-approval",
+		toolCallId: approval.toolCallId,
+		approvalId: approval.approvalId,
+		state: approval.state,
+		...approval.reason === void 0 ? {} : { reason: approval.reason }
+	});
+	for (const source of options.sources ?? []) turn.parts.push({
+		type: "source",
+		sourceType: source.sourceType,
+		id: source.id,
+		...source.url === void 0 ? {} : { url: source.url },
+		...source.title === void 0 ? {} : { title: source.title },
+		...source.mediaType === void 0 ? {} : { mediaType: source.mediaType },
+		...meta(source.providerMetadata)
+	});
+	return {
+		id,
+		role: "assistant",
+		parts: turn.parts
+	};
+}
+//#endregion
+export { fromModelMessages as t };