better-supabase 0.8.0 → 0.9.0

package/dist/authorization-hooks-DkmrnDX7.d.ts

@@ -0,0 +1,214 @@
+import { m as RequestContext } from "./plugin-CDLJRFFg.js";
+import { r as AuthState } from "./resolve-w9EpHzuM.js";
+//#region src/core/contracts/authorization-hooks.d.ts
+/**
+ * An email address or chat user, as a bot or a mail webhook sees it. The
+ * value is what the platform reports; it names no one until an identity
+ * link maps it to a user or a contact.
+ */
+interface IdentityRef {
+  readonly kind: "email" | "chat";
+  /** `slack`, `teams`, `whatsapp`, an email provider; unset for a plain address. */
+  readonly provider?: string;
+  /** The address (lower case) or the platform's user id. */
+  readonly value: string;
+  /** The platform workspace, such as a Slack team id. */
+  readonly workspace?: string;
+}
+/** Where an identity link points: an app user or a contact the app stores. */
+type IdentityTarget = {
+  readonly kind: "user";
+  readonly userId: string;
+} | {
+  readonly kind: "contact";
+  readonly contactId: string;
+};
+/**
+ * Looks up the verified link for an identity. `null` for an identity no
+ * signed-in link flow or verified address created; the caller then treats
+ * the author as anonymous.
+ */
+type PrincipalByIdentity = (identity: IdentityRef) => IdentityTarget | null | Promise<IdentityTarget | null>;
+/** The fields of an event a subscriber check reads. */
+interface SubscriberEvent {
+  readonly type: string;
+  readonly tenant: string | null;
+  /** The user who caused the event, or `null` for service work. */
+  readonly actorId: string | null;
+  readonly payload: unknown;
+  /** The event's subject, such as `invoices/123`, when it has one. */
+  readonly subject?: string | null;
+}
+/**
+ * A subscription a fan-out may deliver to. `principal` is the user who owns
+ * it, or the id of the service principal an organization-owned subscription
+ * runs as (`kind: "service"`).
+ */
+interface Subscriber {
+  readonly principal: string;
+  readonly kind?: "user" | "service";
+}
+/**
+ * Narrows a fan-out to the subscribers that may read the event: webhook
+ * endpoints, outbox consumers, realtime members and notification
+ * recipients. It returns a subset of `subscribers`; a subscriber it leaves
+ * out gets nothing, and a throw or rejection delivers to no one.
+ */
+type SubscriberPolicy = <S extends Subscriber>(event: SubscriberEvent, subscribers: readonly S[]) => readonly S[] | Promise<readonly S[]>;
+/** A request that waits for someone other than the requester to approve it. */
+interface ApprovalRequestRef {
+  /** `ai-tool` (an AI tool call), `support-session`, or the app's own kind. */
+  readonly kind: string;
+  /** The tool name for `ai-tool`, the request id for `support-session`. */
+  readonly subject: string;
+  readonly tenant?: string;
+  /** The user who asked; never their own approver. */
+  readonly requester?: string;
+}
+/** The signed-in user who would approve, with their verified claims. */
+interface Approver {
+  readonly userId: string;
+  readonly claims: Readonly<Record<string, unknown>>;
+}
+/**
+ * Whether `approver` may decide `request`. The SQL side is the
+ * `isApprover` template of the authorization provider; this is the same
+ * decision for server code. A throw counts as `false`, and better-supabase
+ * refuses the requester before it asks.
+ */
+type ApproverOf = (approver: Approver, request: ApprovalRequestRef) => boolean | Promise<boolean>;
+/** What `mayPublish` and `runAs` get about a published automation. */
+interface AutomationRef {
+  /** The user who published it, or `null` for an organization-owned automation. */
+  readonly publisher: string | null;
+  readonly tenant: string | null;
+  /** The permissions its nodes need, as stored at publish. */
+  readonly permissions: readonly string[];
+}
+/** How a provider decides published automations (workflow builder versions). */
+interface AutomationHooks {
+  /** Whether the publisher may publish a version whose nodes need `permissions`. */
+  readonly mayPublish?: (automation: AutomationRef & {
+    readonly claims: Readonly<Record<string, unknown>>;
+  }) => boolean | Promise<boolean>;
+  /**
+   * The claims a step of a published version runs with: the publisher's
+   * current claims narrowed to `permissions`, or the service principal's
+   * for an organization-owned automation. `null` when the publisher is
+   * gone, suspended or no longer holds a stored permission; the step then
+   * fails and never falls back to the service role.
+   */
+  readonly runAs?: (automation: AutomationRef) => Readonly<Record<string, unknown>> | null | Promise<Readonly<Record<string, unknown>> | null>;
+}
+/**
+ * Turns an opaque run ticket back into the context a job or a workflow step
+ * runs as. `null` or a throw refuses the ticket (expired, revoked, or for a
+ * principal that is gone), and the run fails instead of running as anyone
+ * else. The ticket is stored in plain text as a run attribute, so it is an
+ * id the provider looks up, never a bearer secret.
+ */
+type TicketSubject = (ticket: string) => RequestContext | null | Promise<RequestContext | null>;
+/** A delegated token, as `forContext` sees it: an OAuth client or agent acting for a user. */
+interface DelegationRef {
+  readonly userId: string;
+  readonly tenant?: string;
+  /** The OAuth client, when the token has a `client_id`. */
+  readonly clientId?: string;
+  /** The scopes the user granted, split on spaces. */
+  readonly scopes: readonly string[];
+  /** RFC 9396 `authorization_details`, when the token has them. */
+  readonly authorizationDetails?: readonly {
+    readonly type: string;
+    readonly [field: string]: unknown;
+  }[];
+}
+/**
+ * The permission keys a delegated token may use, for scopes the provider
+ * maps at runtime (`authorization.delegation.scopes` is the static form in
+ * SQL). `forContext` caps the work to them, narrowed by its own
+ * `permissions`; a throw grants nothing.
+ */
+type DelegationPermissions = (delegation: DelegationRef) => readonly string[] | Promise<readonly string[]>;
+/** A button a chat user pressed on a message the app sent. */
+interface ChatAction {
+  /** The action id the card declared, such as `approve`. */
+  readonly id: string;
+  readonly value?: string;
+  /** The chat user, as the platform reports them. */
+  readonly author: IdentityRef;
+}
+/**
+ * Decides a chat action for its linked author: `undefined` when the
+ * provider does not handle the action. An approval button is decided here,
+ * through the provider; an unlinked author is refused.
+ */
+type ChatActionHook = (action: ChatAction, author: IdentityTarget | null) => {
+  readonly allowed: boolean;
+  readonly userId?: string;
+} | undefined | Promise<{
+  readonly allowed: boolean;
+  readonly userId?: string;
+} | undefined>;
+/** A support session start the `authorize` hook decides. */
+interface SupportAuthorizeInput {
+  readonly admin: Extract<AuthState, {
+    kind: "user";
+  }>;
+  readonly targetUserId: string;
+  /** Never empty: a start without a reason is refused before `authorize` runs. */
+  readonly reason: string;
+  readonly readOnly: boolean;
+  readonly tenant?: string;
+  readonly metadata: Readonly<Record<string, unknown>>;
+}
+/**
+ * `true` allows a support start that still needs a second approver unless
+ * approval is off; `{ approvedBy }` allows it and names the distinct approver
+ * the provider checked. `false`, a throw and an `approvedBy` equal to the
+ * admin refuse it.
+ */
+type SupportDecision = boolean | {
+  readonly approvedBy: string;
+};
+/** Decides a support session start. */
+type SupportAuthorize = (input: SupportAuthorizeInput) => SupportDecision | Promise<SupportDecision>;
+/**
+ * The runtime half of an authorization provider (`apiVersion: 1`). The
+ * `authorization` config key is plain data for SQL; these hooks decide the
+ * same things in server code, so one provider can own automations,
+ * support sessions, delivery, identity links, chat actions, approvals and
+ * delegated tokens end to end. Every hook is optional, and a slot passed to a block directly
+ * wins over the hook.
+ */
+interface AuthorizationHooks {
+  readonly apiVersion: 1;
+  /** The provider's name, for messages. */
+  readonly name: string;
+  readonly automation?: AutomationHooks;
+  readonly support?: {
+    readonly authorize: SupportAuthorize;
+  };
+  readonly delivery?: {
+    /** Webhook endpoints, outbox consumers and realtime members. */
+    readonly subscribers?: SubscriberPolicy;
+    /** Notification recipients. */
+    readonly audience?: SubscriberPolicy;
+  };
+  readonly identities?: {
+    readonly principalByIdentity: PrincipalByIdentity;
+  };
+  readonly chat?: {
+    readonly onAction?: ChatActionHook;
+  };
+  readonly approverOf?: ApproverOf;
+  readonly tickets?: {
+    readonly subject: TicketSubject;
+  };
+  readonly delegation?: {
+    readonly permissions: DelegationPermissions;
+  };
+}
+/** Types `hooks` and freezes it; better-supabase never mutates a provider. */
+declare function defineAuthorizationHooks<const H extends AuthorizationHooks>(hooks: H): H;
+//#endregion
+export { SupportAuthorize as _, AutomationHooks as a, TicketSubject as b, ChatActionHook as c, IdentityRef as d, IdentityTarget as f, SubscriberPolicy as g, SubscriberEvent as h, AuthorizationHooks as i, DelegationPermissions as l, Subscriber as m, Approver as n, AutomationRef as o, PrincipalByIdentity as p, ApproverOf as r, ChatAction as s, ApprovalRequestRef as t, DelegationRef as u, SupportAuthorizeInput as v, defineAuthorizationHooks as x, SupportDecision as y };

package/dist/authorizer-DH7DjkL3.js

@@ -0,0 +1,126 @@
+import { n as deepFreeze, r as isPlainObject, t as cloneValue } from "./clone-dN9XOL1K.js";
+import { n as dbError } from "./errors-8i6tSICm.js";
+import { a as ok, r as err } from "./result-BlgnMB0H.js";
+//#region src/core/authorizer.ts
+/** Identity helper that fixes `apiVersion` and infers `Ref`. */
+function defineAuthorizer(authorizer) {
+	return {
+		...authorizer,
+		apiVersion: 1
+	};
+}
+const ANONYMOUS = {
+	type: "anon",
+	id: "anonymous"
+};
+function scopesOf(claims) {
+	const scope = claims?.["scope"];
+	return typeof scope === "string" ? scope.split(" ").filter(Boolean) : [];
+}
+/** A frozen copy of the verified claims, so an authorizer cannot change them. */
+function claimsProperty(claims) {
+	if (!isPlainObject(claims)) return {};
+	return { claims: deepFreeze(cloneValue(claims)) };
+}
+/** The subject and context of a request, from the verified context only. */
+function requestOf(context) {
+	const actor = context?.actor;
+	const claims = context?.claims;
+	const act = claims?.["act"];
+	const subject = actor ? {
+		type: typeof act === "object" && act !== null && actor.kind === "user" ? "agent" : actor.kind,
+		id: actor.id,
+		properties: {
+			...actor.role === void 0 ? {} : { role: actor.role },
+			...actor.email === void 0 ? {} : { email: actor.email },
+			...actor.impersonator === void 0 ? {} : { impersonator: actor.impersonator },
+			...claimsProperty(claims)
+		}
+	} : ANONYMOUS;
+	const aal = claims?.["aal"];
+	return {
+		subject,
+		context: {
+			...context?.tenant === void 0 ? {} : { tenant: context.tenant },
+			...typeof aal === "string" ? { aal } : {},
+			scopes: scopesOf(claims)
+		}
+	};
+}
+function isOutcome(value) {
+	if (typeof value !== "object" || value === null || !("outcome" in value)) return false;
+	const { outcome } = value;
+	return outcome === "granted" || outcome === "denied" || outcome === "approval-required";
+}
+/** The `forbidden` error for an outcome other than `granted`, or `undefined`. */
+function outcomeError(outcome, permission) {
+	if (!isOutcome(outcome)) return dbError("forbidden", `The authorizer gave no decision for ${permission}`, {
+		code: "PERMISSION_DENIED",
+		permission
+	});
+	switch (outcome.outcome) {
+		case "granted": return;
+		case "denied": return dbError("forbidden", outcome.reason ?? `Permission ${permission} is required`, {
+			code: "PERMISSION_DENIED",
+			permission
+		});
+		case "approval-required": return dbError("forbidden", `${permission} needs an approval`, {
+			code: "APPROVAL_REQUIRED",
+			permission,
+			...outcome.approval ? { approval: { id: outcome.approval.id } } : {}
+		});
+		default: return outcome;
+	}
+}
+/**
+* Checks one permission and fails closed: a missing authorizer, a throw or
+* an unknown outcome all deny. Never throws (invariant 4).
+*/
+async function checkPermission(options) {
+	const { authorizer, permission } = options;
+	if (!authorizer) return err(dbError("forbidden", "A permission is declared, but no authorizer is set", { code: "PERMISSION_DENIED" }));
+	let key;
+	try {
+		key = authorizer.key(permission);
+	} catch {
+		return err(dbError("forbidden", "Unknown permission", { code: "PERMISSION_DENIED" }));
+	}
+	const { subject, context } = requestOf(options.context);
+	try {
+		const error = outcomeError(await authorizer.evaluate({
+			subject,
+			action: permission,
+			resource: options.resource,
+			context
+		}), key);
+		return error ? err(error) : ok(void 0);
+	} catch {
+		return err(dbError("forbidden", `The authorizer failed for ${key}`, {
+			code: "PERMISSION_DENIED",
+			permission: key
+		}));
+	}
+}
+/**
+* Checks one permission per resource, with `evaluations` when the
+* authorizer has it. Returns whether each one is granted, in order; any
+* failure denies.
+*/
+async function checkEach(authorizer, permission, resources, context) {
+	if (!authorizer || resources.length === 0) return resources.map(() => false);
+	const { subject, context: requestContext } = requestOf(context);
+	const requests = resources.map((resource) => ({
+		subject,
+		action: permission,
+		resource,
+		context: requestContext
+	}));
+	try {
+		const outcomes = authorizer.evaluations ? await authorizer.evaluations(requests) : await Promise.all(requests.map((request) => Promise.resolve(authorizer.evaluate(request))));
+		return requests.map((_, index) => isOutcome(outcomes[index]) && outcomes[index].outcome === "granted");
+	} catch {
+		return resources.map(() => false);
+	}
+}
+//#endregion
+export { requestOf as i, checkPermission as n, defineAuthorizer as r, checkEach as t };

package/dist/base64-BmeCBgGo.js

@@ -0,0 +1,42 @@
+//#region src/core/base64.ts
+const encoder = /* @__PURE__ */ new TextEncoder();
+const decoder = /* @__PURE__ */ new TextDecoder();
+/** Standard base64 (RFC 4648 section 4) of `input`, with padding. */
+function toBase64(input) {
+	const bytes = typeof input === "string" ? encoder.encode(input) : input;
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary);
+}
+/** Bytes of standard or URL-safe base64, padded or not. Throws on invalid input. */
+function fromBase64(text) {
+	const base64 = text.replaceAll("-", "+").replaceAll("_", "/");
+	const binary = atob(base64 + "=".repeat((4 - base64.length % 4) % 4));
+	const bytes = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
+	return bytes;
+}
+/** URL-safe base64 (RFC 4648 section 5) of `input`, without padding. */
+function toBase64Url(input) {
+	return toBase64(input).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+/** UTF-8 text of base64 or base64url. Throws on invalid input. */
+function base64ToText(text) {
+	return decoder.decode(fromBase64(text));
+}
+/**
+* The payload of a JWT, decoded without verifying the signature. Only for
+* reading claims such as `exp` from a token that is verified elsewhere.
+*/
+function decodeJwtPayload(token) {
+	const part = token.split(".")[1];
+	if (!part) return;
+	try {
+		const parsed = JSON.parse(base64ToText(part));
+		return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { toBase64Url as a, toBase64 as i, decodeJwtPayload as n, fromBase64 as r, base64ToText as t };

package/dist/batch-limit-DKVQDz4o.js

@@ -0,0 +1,5 @@
+//#region src/core/batch-limit.ts
+/** The most events one batched sink call (`audit_event_many`, ...) takes. */
+const MAX_BATCH = 1e3;
+//#endregion
+export { MAX_BATCH as t };

package/dist/before-route-B98js9m_.js

@@ -0,0 +1,30 @@
+import { t as around } from "./shared-BmMcMoW9.js";
+//#region src/bridges/before-route.ts
+/**
+* Runs the entries ahead of a framework that owns the route and the
+* response (Express, Fastify, Koa, Nitro 2, SolidStart, NestJS). A short
+* circuit is the answer; otherwise the framework copies the headers and
+* hands the contributions to the route. Response-phase entries see an
+* empty response, so `withDbStats` and `withServerTiming` report nothing here.
+*/
+function beforeRoute(entries) {
+	const run = around(entries);
+	return async (request, env) => {
+		let contributions;
+		const marker = new Response(null);
+		const response = await run(request, env, (handed) => {
+			contributions = handed;
+			return Promise.resolve(marker);
+		});
+		return contributions === void 0 ? {
+			reached: false,
+			response
+		} : {
+			reached: true,
+			contributions,
+			headers: response.headers
+		};
+	};
+}
+//#endregion
+export { beforeRoute as t };

package/dist/better-result/index.d.ts

@@ -1,8 +1,8 @@
-import { b as DbError, n as BetterResultApi, t as AsyncResult } from "../result-BchM1XZn.js";
-import { E as PrimaryKeyValue, H as Update, L as TableKey, R as TableMeta, V as UniqueWhere, a as AnyModels, i as AnyFunctions, x as Insert } from "../types-CoE5Zwy4.js";
-import { r as ApplyExtension } from "../plugin-CPK2HsbY.js";
-import { A as OverloadedName, B as UpsertArgs, Bt as WhereInput, C as ManyReturningArgs, Ct as FindOnlyArgs, D as OffsetRangeArgs, E as OffsetPageArgs, G as SearchScore, H as WriteArgs, I as Returned, It as RequestArgs, K as InferReadSetParams, L as RpcArgs, M as PlainName, N as RawRpcOptions, Nt as Payload, O as OverloadArgs, Pt as ReadArgs, R as RpcOptions, S as ManyResult, St as FindManyArgs, U as WriteManyArgs, V as UpsertManyArgs, W as SearchArgs, _ as Db, at as QuerySpec, b as DeleteExt, dt as AggregateArgs, et as ReadSetResult, g as CursorPageArgs, it as InferResult, j as PageOf, k as OverloadReturns, mt as AggregateResult, q as ReadSet, w as NoArgName, x as FindExt, xt as FindFirstArgs, y as DeleteArgs, yt as CountArgs, z as UpdateArgs } from "../define-DmcfoNXB.js";
-import { a as ListExtra, i as ListDefinition, o as ListPage, s as ListPagination, u as ListQuery } from "../list-query-D3JQeEL7.js";
+import { b as DbError, n as BetterResultApi, t as AsyncResult } from "../result-Cj3yWhjH.js";
+import { B as TableMeta, E as PrimaryKeyValue, U as UniqueWhere, W as Update, a as AnyModels, i as AnyFunctions, x as Insert, z as TableKey } from "../types-YfwpIE-d.js";
+import { r as ApplyExtension } from "../plugin-CDLJRFFg.js";
+import { A as OverloadedName, B as UpsertArgs, Bt as WhereInput, C as ManyReturningArgs, Ct as FindOnlyArgs, D as OffsetRangeArgs, E as OffsetPageArgs, G as SearchScore, H as WriteArgs, I as Returned, It as RequestArgs, K as InferReadSetParams, L as RpcArgs, M as PlainName, N as RawRpcOptions, Nt as Payload, O as OverloadArgs, Pt as ReadArgs, R as RpcOptions, S as ManyResult, St as FindManyArgs, U as WriteManyArgs, V as UpsertManyArgs, W as SearchArgs, _ as Db, at as QuerySpec, b as DeleteExt, dt as AggregateArgs, et as ReadSetResult, g as CursorPageArgs, it as InferResult, j as PageOf, k as OverloadReturns, mt as AggregateResult, q as ReadSet, w as NoArgName, x as FindExt, xt as FindFirstArgs, y as DeleteArgs, yt as CountArgs, z as UpdateArgs } from "../define-DxHHbNEb.js";
+import { a as ListExtra, d as ListQuery, i as ListDefinition, o as ListPage, s as ListPagination } from "../list-query-PvP3pPGQ.js";
 import { Result } from "better-result";
 //#region src/better-result/better-result.d.ts
 /** better-result's `Result` namespace with the function each `DbError` goes through. */

package/dist/better-result/index.js

@@ -1,4 +1,4 @@
-import { o as toBetterResult, t as AsyncResult } from "../result-DEqHCMKP.js";
+import { o as toBetterResult, t as AsyncResult } from "../result-BlgnMB0H.js";
 //#region src/better-result/better-result.ts
 const HELPERS = [
 	"$rpc",

package/dist/bind-a7sUgvf4.d.ts

@@ -0,0 +1,70 @@
+import { a as AnyModels, i as AnyFunctions } from "./types-YfwpIE-d.js";
+import { _ as Db, t as BetterSupabase } from "./define-DxHHbNEb.js";
+import { t as ClientPorts } from "./ports-DAdQyjZz.js";
+import { s as BetterQueries } from "./index-DygICr8c.js";
+import { SupabaseClient } from "@supabase/supabase-js";
+//#region src/client/bind.d.ts
+interface AuthUser {
+  readonly id: string;
+  readonly email?: string;
+  readonly role?: string;
+}
+/**
+ * What the UI needs to know. Claims are decoded, not verified: RLS enforces
+ * access. A token refresh that changes only `exp`, `iat`, `nbf` or `jti`
+ * keeps the previous snapshot, so read expiry from the session, not here.
+ */
+type AuthSnapshot = {
+  readonly status: "loading";
+  readonly user: null;
+  readonly claims: null;
+} | {
+  readonly status: "signed-out";
+  readonly user: null;
+  readonly claims: null;
+} | {
+  readonly status: "signed-in";
+  readonly user: AuthUser;
+  readonly claims: Readonly<Record<string, unknown>>;
+};
+interface ClientAuth {
+  readonly current: () => AuthSnapshot;
+  /** `useSyncExternalStore`-compatible. */
+  readonly subscribe: (listener: () => void) => () => void;
+}
+interface BetterClient<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> {
+  /** The definition the client was created from (schema metadata, specs, live queries). */
+  readonly betterSupabase: BetterSupabase<M, unknown, F, E, C, P>;
+  readonly supabase: SupabaseClient;
+  /** Repositories with the current session's actor and claims. */
+  readonly db: Db<M, F, E, SupabaseClient>;
+  /** TanStack Query option factories over `db`. */
+  readonly queries: BetterQueries<M, E, F>;
+  readonly auth: ClientAuth;
+  /** The platform services block controllers use: storage, shortcuts, files, push, links. */
+  readonly ports: ClientPorts;
+  /**
+   * Stops following `supabase`'s session. Call it when the client goes away
+   * before the app does: Fast Refresh, tests, a client per account.
+   */
+  readonly dispose: () => void;
+}
+interface BindClientOptions {
+  /**
+   * `staleTime` for every query option in `queries`. Above zero, a remount
+   * or a window focus reuses cached rows instead of refetching them.
+   */
+  readonly staleTime?: number;
+  /**
+   * Platform services for the block hooks. React Native apps pass
+   * `nativePorts()` from `better-supabase/client/native`.
+   */
+  readonly ports?: ClientPorts;
+}
+/**
+ * Repositories that follow `supabase`'s session, TanStack Query options and
+ * an auth store, for a supabase-js client you created yourself.
+ */
+declare function bindClient<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, supabase: SupabaseClient, options?: BindClientOptions): BetterClient<M, F, E, C, P>;
+//#endregion
+export { ClientAuth as a, BindClientOptions as i, AuthUser as n, bindClient as o, BetterClient as r, AuthSnapshot as t };

package/dist/block-env-CBd_SoL5.js

@@ -0,0 +1,29 @@
+import { t as topicPort } from "./watch-topic-miuymrli.js";
+//#region src/blocks/block-env.ts
+/** The client's session and ports; the topic port defaults to its supabase-js client. */
+function blockEnv(client) {
+	return {
+		supabase: client.supabase,
+		auth: client.auth,
+		ports: {
+			...client.ports,
+			topic: client.ports?.topic ?? topicPort(client.supabase)
+		}
+	};
+}
+/**
+* Fills `auth` and `ports` from `env` when `options` leaves them out; `env`
+* runs only then. Without `env` the controller takes neither key.
+*/
+function withEnv(options, env) {
+	const given = new Map(Object.entries(options));
+	if (env === void 0 || given.get("auth") !== void 0 && given.get("ports") !== void 0) return options;
+	const { auth, ports } = env();
+	return {
+		auth,
+		ports,
+		...options
+	};
+}
+//#endregion
+export { withEnv as n, blockEnv as t };

package/dist/block-env-Dxl7rsI0.d.ts

@@ -0,0 +1,10 @@
+import { SupabaseClient } from "@supabase/supabase-js";
+//#region src/blocks/block-env.d.ts
+type EnvKey = "auth" | "ports";
+/**
+ * A controller's options as a binding takes them: `auth` and `ports` come
+ * from the provider unless the caller passes its own.
+ */
+type BlockOptions<O> = Omit<O, EnvKey> & Partial<Pick<O, Extract<keyof O, EnvKey>>>;
+//#endregion
+export { BlockOptions as t };

package/dist/block-events-DD9Q_NUz.js

@@ -0,0 +1,96 @@
+import { t as cloneValue } from "./clone-dN9XOL1K.js";
+import { s as nowInstant } from "./temporal-CB5Fpo5d.js";
+//#region src/core/block-events.ts
+/**
+* Event types that changed name in 0.6, old to new, for sinks and consumers
+* that still receive the old ones (`BLOCK_EVENT_RENAMES[type] ?? type`).
+* `better-supabase codemod 0.6` rewrites the string literals.
+*/
+const BLOCK_EVENT_RENAMES = {
+	"org.created": "organization.created",
+	"org.updated": "organization.updated",
+	"org.deleted": "organization.deleted",
+	"org.member_added": "organization.member_added",
+	"org.member_removed": "organization.member_removed",
+	"org.member_left": "organization.member_left",
+	"org.role_changed": "organization.role_changed",
+	"org.ownership_transferred": "organization.ownership_transferred",
+	"org.switched": "organization.switched"
+};
+/**
+* Fixed OpenTelemetry attribute names for block work, so dashboards and
+* queries can rely on them.
+*/
+const BLOCK_ATTRIBUTES = {
+	event: "better_supabase.block.event",
+	tenant: "better_supabase.tenant",
+	actor: "better_supabase.actor.id",
+	supportSessionId: "better_supabase.support.session_id",
+	organizationId: "better_supabase.organization.id",
+	invitationId: "better_supabase.invitation.id",
+	notificationType: "better_supabase.notification.type",
+	webhookEndpointId: "better_supabase.webhook.endpoint_id"
+};
+/** The `BLOCK_ATTRIBUTES` an event carries. */
+function blockEventAttributes(event) {
+	const attributes = { [BLOCK_ATTRIBUTES.event]: event.type };
+	if (event.tenant) attributes[BLOCK_ATTRIBUTES.tenant] = event.tenant;
+	if (event.actorId) attributes[BLOCK_ATTRIBUTES.actor] = event.actorId;
+	const data = Object.fromEntries(Object.entries(event.data));
+	const add = (key, value) => {
+		if (typeof value === "string" && value.length > 0) attributes[key] = value;
+	};
+	add(BLOCK_ATTRIBUTES.supportSessionId, data["sessionId"]);
+	add(BLOCK_ATTRIBUTES.organizationId, data["organizationId"]);
+	add(BLOCK_ATTRIBUTES.invitationId, data["invitationId"]);
+	add(BLOCK_ATTRIBUTES.notificationType, data["type"]);
+	add(BLOCK_ATTRIBUTES.webhookEndpointId, data["endpointId"]);
+	return attributes;
+}
+/**
+* Emits a block event on `events` with a copy of `data`. Does nothing without
+* a `block` handler, so blocks call it unconditionally. `M` is the emitting
+* block's event map.
+*/
+function emitBlockEvent(events, type, data, meta = {}) {
+	if (!events.has("block")) return;
+	const copy = cloneValue(data);
+	const event = {
+		...meta,
+		type,
+		data: copy,
+		time: (events.now ?? nowInstant)()
+	};
+	events.emit("block", event);
+}
+/**
+* The `emit` a block creator calls with its own event map: skips the work
+* without an event hub and adds the actor and request context from the
+* block's options.
+*/
+function blockEmitter(options) {
+	return (type, data, subject, tenant) => {
+		if (!options.events) return;
+		emitBlockEvent(options.events, type, data, {
+			subject,
+			...tenant ? { tenant } : {},
+			...options.actorId ? { actorId: options.actorId } : {},
+			...options.context ? { context: options.context } : {}
+		});
+	};
+}
+const matches = (pattern, type) => pattern.endsWith(".*") ? type.startsWith(pattern.slice(0, -1)) : pattern === type;
+/**
+* Listens to the block events that match `pattern` (`'support.started'` or
+* `'support.*'`), typed by `events`: a block's events, `defineBlocks(...)`
+* or `defineEvents(...)`. Returns a function that stops listening.
+*/
+function onBlockEvent(betterSupabase, events, pattern, handler) {
+	const known = new Set(events.types);
+	return betterSupabase.events.on("block", (event) => {
+		if (!known.has(event.type) || !matches(pattern, event.type)) return;
+		handler(event);
+	});
+}
+//#endregion
+export { emitBlockEvent as a, blockEventAttributes as i, BLOCK_EVENT_RENAMES as n, onBlockEvent as o, blockEmitter as r, BLOCK_ATTRIBUTES as t };