better-supabase 0.8.0 → 0.9.0

package/dist/plugins/validation/index.js

@@ -1,8 +1,8 @@
 import { t as DbException } from "../../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../../errors-2M6CKMP4.js";
-import { i as encodeValue, r as decodeValue } from "../../wire-Df3EWkG8.js";
+import { n as dbError } from "../../errors-8i6tSICm.js";
+import { i as encodeValue, r as decodeValue } from "../../wire-DEY0ajW9.js";
 import { r as definePlugin } from "../../plugin-tfXW1-qO.js";
-import { n as validate } from "../../standard-DkzZUneg.js";
+import { n as validate } from "../../standard-B5fe2gnW.js";
 import { n as toDb, t as toApp } from "../../casing-DdFWEtqr.js";
 //#region src/plugins/validation/index.ts
 /**

package/dist/pool-CwOCsX9e.d.ts

@@ -0,0 +1,114 @@
+import { r as Executor } from "./executor-DoE-5iM8.js";
+import { o as EventHub } from "./events-CTreRrgP.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { n as SqlClient } from "./executor-BBHgjUJu.js";
+//#region src/postgres/pool.d.ts
+/** The part of a `pg` pool client `createPostgres` uses. */
+interface PgPoolClient {
+  query(text: string, values?: unknown[]): Promise<{
+    rows: unknown[];
+  }>;
+  release(): void;
+}
+/** The part of a `pg.Pool` `createPostgres` uses. */
+interface PgPool {
+  connect(): Promise<PgPoolClient>;
+  end(): Promise<void>;
+  /** `pg.Pool` reports errors of idle connections here. */
+  on?(event: "error", listener: (error: Error) => void): unknown;
+}
+/** Statement timeouts in milliseconds by the role a transaction runs as. */
+interface PostgresTimeouts {
+  /** The connection-string role (`admin` and `transaction` without claims). Unset by default. */
+  readonly admin?: number;
+  /** Defaults to 8000, Supabase's setting for the role. */
+  readonly authenticated?: number;
+  /** Defaults to 3000, Supabase's setting for the role. */
+  readonly anon?: number;
+}
+interface PostgresOptions {
+  /** Defaults to `$SUPABASE_DB_URL`, then `$DATABASE_URL`. */
+  readonly connectionString?: string;
+  /** An existing pool to run on instead of opening one. `end()` ends it. */
+  readonly pool?: PgPool;
+  readonly max?: number;
+  /**
+   * Statement timeout in milliseconds, applied per transaction: one value
+   * for every role, or one per role. `set role` doesn't apply the role's own
+   * `statement_timeout`, so `authenticated` and `anon` get Supabase's 8 s
+   * and 3 s unless you set them.
+   */
+  readonly statementTimeout?: number | PostgresTimeouts;
+  /**
+   * Ends a session that stays idle inside a transaction this long, in
+   * milliseconds, so `transaction(fn)` can't hold a connection while `fn`
+   * waits on something else. Defaults to 15000; `0` turns it off. Statements
+   * outside a transaction don't set it.
+   */
+  readonly idleInTransactionTimeout?: number;
+  /** How long `connect` waits for a connection, in milliseconds. Defaults to 10000. */
+  readonly connectionTimeout?: number;
+  /** How long an unused connection stays open, in milliseconds. Defaults to 10000. */
+  readonly idleTimeout?: number;
+  /**
+   * `betterSupabase.events`: an error on an idle pooled connection arrives as
+   * an `error` event instead of crashing the process.
+   */
+  readonly events?: EventHub;
+  /** Where idle-connection errors go without `error` handlers. Defaults to the console. */
+  readonly logger?: Logger;
+}
+/** JWT claims to run as. `role` must be `authenticated` or `anon`. */
+interface SqlClaims {
+  readonly sub?: string;
+  readonly role?: string;
+  readonly [claim: string]: unknown;
+}
+/** What every transaction of a user session sets besides the claims and role. */
+interface SessionOptions {
+  /**
+   * Transaction-local settings, e.g. `{ 'better_supabase.tenant': id }`.
+   * Names need a dot (custom settings); `role` and `request.jwt.claims` are
+   * set from the claims.
+   */
+  readonly settings?: Readonly<Record<string, string>>;
+  /** Runs every transaction with `begin read only`: writes fail with 25006. */
+  readonly readOnly?: boolean;
+  /**
+   * Statement timeout in milliseconds for this session's transactions,
+   * instead of the role's `statementTimeout` from `createPostgres`.
+   */
+  readonly statementTimeout?: number;
+}
+interface BetterPostgres {
+  /** Connects as the connection-string role. On Supabase that bypasses RLS. */
+  readonly admin: SqlClient;
+  /** Runs every query as the given user, with RLS, like PostgREST does. */
+  asUser(claims: SqlClaims, options?: SessionOptions): SqlClient;
+  /** Runs every query as `anon`. */
+  readonly anon: SqlClient;
+  /**
+   * Repositories' executor as the given user (`postgresExecutor(asUser(claims))`).
+   * `createServer` calls it for `ctx.sql`, so only apps that pass `postgres`
+   * bundle the SQL compiler.
+   */
+  executorFor(claims: SqlClaims, options?: SessionOptions): Executor;
+  /**
+   * Runs `fn` in one transaction. Pass claims to run it as a user; the
+   * session options apply with or without them.
+   */
+  transaction<T>(fn: (client: SqlClient) => Promise<T>, options?: {
+    readonly claims?: SqlClaims;
+  } & SessionOptions): Promise<T>;
+  end(): Promise<void>;
+  [Symbol.asyncDispose](): Promise<void>;
+}
+/**
+ * A pooled Postgres connection for jobs, scripts and tests. Each query (or
+ * transaction) runs in its own transaction; claims and role are
+ * transaction-local, so nothing leaks back into the pool. An `admin` query
+ * with no timeout to set runs on its own, without `begin` and `commit`.
+ */
+declare function createPostgres(options?: PostgresOptions): BetterPostgres;
+//#endregion
+export { PostgresTimeouts as a, createPostgres as c, PostgresOptions as i, PgPool as n, SessionOptions as o, PgPoolClient as r, SqlClaims as s, BetterPostgres as t };

package/dist/pool-errors-GMjlCN0d.js

@@ -0,0 +1,27 @@
+import { c as mapDbError } from "./errors-8i6tSICm.js";
+import { s as toDbError } from "./result-BlgnMB0H.js";
+import { t as consoleLogger } from "./logger-glM28NVN.js";
+import { n as errorEvent } from "./events-xbpHkcK9.js";
+import { t as fromPgError } from "./pg-error-BV_X8Isq.js";
+//#region src/postgres/pool-errors.ts
+/**
+* Listens for errors on idle pooled connections, such as a server restart or
+* an ended session. `pg.Pool` emits them as an `error` event, and Node exits
+* on an `error` event nobody listens to. The listener reports the error and
+* never throws.
+*/
+function watchPoolErrors(pool, options) {
+	pool.on?.("error", (cause) => {
+		try {
+			const raw = fromPgError(cause);
+			const error = raw ? mapDbError(raw, []) : toDbError(cause);
+			if (options.events?.has("error")) {
+				options.events.emit("error", errorEvent(error));
+				return;
+			}
+			(options.logger ?? options.events?.logger ?? consoleLogger).error("an idle Postgres connection failed", { error });
+		} catch {}
+	});
+}
+//#endregion
+export { watchPoolErrors as t };

package/dist/ports-Ca63W4cW.d.ts

@@ -0,0 +1,285 @@
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { t as StandardSchemaV1 } from "./standard-C3_AAF3g.js";
+import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
+import { r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
+import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
+import { r as FieldsOf } from "./block-fields-5UA84ZUg.js";
+import { f as AiFiles } from "./types-pNY_UpDs.js";
+import { g as JobHandler } from "./types-CdP0z5tS.js";
+import { i as EventSink } from "./cloud-event-5rCEzIgK.js";
+import { g as Workflows } from "./workflows-DFQeXDAI.js";
+//#region src/blocks/attachments/attachments.d.ts
+interface StorageReply<T> {
+  readonly data: T | null;
+  readonly error: unknown;
+}
+/** The `supabase.storage.from(bucket)` methods attachments use. */
+interface AttachmentBucket {
+  createSignedUploadUrl(path: string): PromiseLike<StorageReply<{
+    readonly signedUrl: string;
+    readonly token: string;
+  }>>;
+  createSignedUrl(path: string, expiresIn: number, options?: {
+    download?: string | boolean;
+  }): PromiseLike<StorageReply<{
+    readonly signedUrl: string;
+  }>>;
+  download(path: string): PromiseLike<StorageReply<Blob>>;
+  remove(paths: string[]): PromiseLike<StorageReply<unknown>>;
+  /** Used by `put`, which uploads from the server. */
+  upload?(path: string, body: Blob | ArrayBuffer | Uint8Array, options?: {
+    readonly contentType?: string;
+    readonly upsert?: boolean;
+  }): PromiseLike<StorageReply<unknown>>;
+}
+/** `supabase.storage`, typed structurally. */
+interface AttachmentStorage {
+  from(bucket: string): AttachmentBucket;
+}
+interface AttachmentsOptions<S extends StandardSchemaV1 | undefined = undefined> extends BlockTemporalOptions {
+  /**
+   * A Standard Schema for the attachment columns the app adds
+   * (`blocks.attachments.options.extraColumns`), keyed by column name. It
+   * types and parses them on every read, and validates them on `upload`
+   * and `put`, which return a `validation` error for a bad value.
+   */
+  readonly fields?: S;
+  /** `withBlockHooks` hooks around the client's methods. */
+  readonly hooks?: NoInfer<BlockHooks<Attachments<FieldsOf<S>>>>;
+  /** Receives the errors `after` hooks throw. Default: `console`. */
+  readonly logger?: Logger;
+  /** The caller's transport (`rpcTransport(supabase)`). */
+  readonly transport: BlockTransport;
+  /** The caller's `supabase.storage`, so the bucket policies apply. */
+  readonly storage: AttachmentStorage;
+  /** The module schema, or its API schema: `defineBlocks` passes it from `blocks.generated.ts`. Default `better_supabase`. */
+  readonly schema?: string;
+  readonly mappers?: readonly ErrorMapper[];
+  /**
+   * `blocks.attachments.options.requireScan`, which `defineBlocks` passes
+   * from `blocks.generated.ts`. Default `true`.
+   */
+  readonly requireScan?: boolean;
+  /** Lifetime of a signed download URL in seconds. Default 300. */
+  readonly downloadTtl?: number;
+}
+type AttachmentStatus = "pending" | "clean" | "infected" | "failed";
+interface Attachment {
+  readonly id: string;
+  /** `undefined` for a file of a subject without a tenant (`tenant: false`). */
+  readonly organizationId: string | undefined;
+  readonly subjectType: string | undefined;
+  readonly subjectId: string | undefined;
+  readonly bucket: string;
+  /** The object path in the bucket, `{organizationId}/attachments/{id}` unless `options.path` says otherwise. */
+  readonly path: string;
+  readonly name: string;
+  readonly mimeType: string;
+  readonly size: number;
+  readonly status: AttachmentStatus;
+  /** What the scanner reported, such as the signature it matched. */
+  readonly scanDetail: string | undefined;
+  /** What `upload` stored with the file; `{}` without any. */
+  readonly metadata: Readonly<Record<string, unknown>>;
+  readonly uploadedBy: string | undefined;
+  readonly createdAt: Temporal.Instant;
+  /** Set by `confirm()` once the object exists. */
+  readonly uploadedAt: Temporal.Instant | undefined;
+  readonly scannedAt: Temporal.Instant | undefined;
+}
+interface NewAttachment {
+  /** `null` for a subject type configured with `tenant: false`. */
+  readonly organizationId: string | null;
+  readonly name: string;
+  readonly mimeType: string;
+  /** Bytes; `confirm()` replaces it with the stored size. */
+  readonly size: number;
+  readonly subjectType?: string;
+  readonly subjectId?: string;
+  /** App data about the file, such as a caption or its source, kept with the record. */
+  readonly metadata?: Readonly<Record<string, unknown>>;
+}
+interface AttachmentUpload<F extends object = Record<never, never>> {
+  readonly attachment: Attachment & F;
+  /** PUT the file here, or pass `token` to `uploadToSignedUrl(path, token, file)`. */
+  readonly signedUrl: string;
+  readonly token: string;
+}
+interface AttachmentDownload<F extends object = Record<never, never>> {
+  readonly attachment: Attachment & F;
+  readonly signedUrl: string;
+}
+/** `F` is the extra attachment fields `options.fields` describes. */
+interface Attachments<F extends object = Record<never, never>> {
+  /**
+   * Creates the pending record and a signed upload URL for its path. When
+   * Storage refuses the URL, the record is deleted again.
+   */
+  upload(attachment: NewAttachment & Partial<F>): AsyncResult<AttachmentUpload<F>>;
+  /** Marks the upload done after the file is stored; emits `attachment.uploaded`. */
+  confirm(id: string): AsyncResult<Attachment & F>;
+  get(id: string): AsyncResult<Attachment & F>;
+  list(organizationId: string | null, subject?: {
+    readonly type: string;
+    readonly id: string;
+  }): AsyncResult<readonly (Attachment & F)[]>;
+  /**
+   * A signed URL for a file the scanner passed. `invalid_request` with hint
+   * `ATTACHMENT_NOT_SCANNED` until then, and for an infected file.
+   */
+  download(id: string, options?: {
+    readonly as?: string | boolean;
+  }): AsyncResult<AttachmentDownload<F>>;
+  /** Deletes the file, then the record (the uploader, or `attachments.manage`). */
+  remove(id: string): AsyncResult<boolean>;
+  /**
+   * Creates the record, uploads `file` from the server and confirms it, for
+   * files the server makes or fetches (an export, a generated PDF, an
+   * import). Returns the confirmed attachment, which still waits for the
+   * scan when the module requires one. When Storage refuses the upload,
+   * the record is deleted again, so no pending record is left behind.
+   */
+  put(attachment: NewAttachment & Partial<F>, file: Blob | ArrayBuffer | Uint8Array): AsyncResult<Attachment & F>;
+  /**
+   * The file's bytes, for server-side processing, behind the same scan gate
+   * as `download`: `ATTACHMENT_NOT_SCANNED` until the scan passes.
+   */
+  read(id: string): AsyncResult<{
+    readonly attachment: Attachment & F;
+    readonly file: Blob;
+  }>;
+}
+declare function createAttachments<S extends StandardSchemaV1 | undefined = undefined>(options: AttachmentsOptions<S>): Attachments<FieldsOf<S>>;
+/** A scanner's verdict on one file. */
+interface ScanVerdict {
+  readonly status: "clean" | "infected";
+  /** Stored as `scan_detail`, such as the matched signature. */
+  readonly detail?: string;
+}
+interface AttachmentScannerOptions extends BlockTemporalOptions {
+  /** A service-role transport: `set_attachment_status()` is granted to `service_role` only. */
+  readonly transport: BlockTransport;
+  /** A service-role `supabase.storage`, to read pending files. */
+  readonly storage: AttachmentStorage;
+  readonly schema?: string;
+  /** Scans the file (ClamAV, a scanning API). A throw records `failed` and rethrows. */
+  readonly scan: (file: Blob, attachment: Attachment, signal?: AbortSignal) => ScanVerdict | Promise<ScanVerdict>;
+  /** The outbox `typePrefix`. Default `dev.better-supabase`. */
+  readonly typePrefix?: string;
+}
+/** The payload `job` expects. */
+interface AttachmentScanJob {
+  readonly attachmentId: string;
+}
+interface AttachmentScanner {
+  /** Scans one uploaded file and records the verdict. */
+  scan(id: string, signal?: AbortSignal): AsyncResult<Attachment>;
+  /**
+   * A jobs handler: `queue.work('attachment-scans', scanner.job)`. A deleted
+   * attachment completes the job; other errors throw so the queue retries.
+   */
+  readonly job: JobHandler<AttachmentScanJob>;
+  /**
+   * An outbox sink that scans each `attachment.uploaded` event's file. An
+   * event for a deleted attachment is skipped, so it never holds up the
+   * events behind it; other errors throw so the relay retries the batch.
+   */
+  sink(): EventSink;
+}
+/**
+ * Scans uploaded files with the app's `scan` function and records `clean`,
+ * `infected` or `failed`. A file already clean or infected is not scanned
+ * again, so replayed events and retried jobs are safe.
+ */
+declare function createAttachmentScanner(options: AttachmentScannerOptions): AttachmentScanner;
+/** A scanned object in any bucket (`scanned_objects`). */
+interface ScannedObject {
+  readonly bucket: string;
+  readonly path: string;
+  readonly status: AttachmentStatus;
+  readonly detail: string | undefined;
+  readonly scannedAt: Temporal.Instant | undefined;
+}
+interface ObjectScannerOptions extends BlockTemporalOptions {
+  /** A service-role transport: `set_object_scan()` is granted to `service_role` only. */
+  readonly transport: BlockTransport;
+  /** A service-role `supabase.storage`, to read the objects. */
+  readonly storage: AttachmentStorage;
+  readonly schema?: string;
+  /** Scans the file. A throw records `failed` and rethrows. */
+  readonly scan: (file: Blob, object: {
+    readonly bucket: string;
+    readonly path: string;
+  }, signal?: AbortSignal) => ScanVerdict | Promise<ScanVerdict>;
+  /** The outbox `typePrefix`. Default `dev.better-supabase`. */
+  readonly typePrefix?: string;
+}
+/** The payload `ObjectScanner.job` expects. */
+interface ObjectScanJob {
+  readonly bucket: string;
+  readonly path: string;
+}
+interface ObjectScanner {
+  /** Scans one object and records the verdict; a clean or infected object is not scanned again. */
+  scan(bucket: string, path: string, signal?: AbortSignal): AsyncResult<ScannedObject>;
+  /**
+   * A jobs handler: `queue.work('object-scans', scanner.job)`. An object
+   * deleted from storage completes the job; other errors throw.
+   */
+  readonly job: JobHandler<ObjectScanJob>;
+  /**
+   * An outbox sink that scans each `object.uploaded` event's object. An
+   * event for an object deleted from storage is skipped; other errors throw
+   * so the relay retries the batch.
+   */
+  sink(): EventSink;
+}
+/**
+ * The scan gate for objects outside the attachments table, such as a file
+ * drive or avatars: scans an object with the app's `scan` function and
+ * records the verdict in `scanned_objects`, which storage policies read with
+ * `object_clean(bucket_id, name)`. With `options.scanBuckets`, new objects in
+ * those buckets get a pending row and an `object.uploaded` event.
+ */
+declare function createObjectScanner(options: ObjectScannerOptions): ObjectScanner;
+//#endregion
+//#region src/blocks/ports.d.ts
+/** What a `notifier` port sends: one notification to its recipients. */
+interface NotifierInput {
+  readonly recipients: readonly string[];
+  readonly tenant: string;
+  /** Deduplicates retries of the same send. */
+  readonly key: string;
+  readonly subject?: {
+    readonly type: string;
+    readonly id: string;
+  };
+  readonly data: Readonly<Record<string, unknown>>;
+}
+/** Sends notifications for a block that consumes `notifier`. */
+interface Notifier {
+  send(type: string, input: NotifierInput): unknown;
+}
+/**
+ * The ports blocks provide and consume, by name. A manifest's `provides`
+ * builds a port from its client, and `createBlocks` hands it to the blocks
+ * whose `consumes` name it. Every port has one provider in a set of blocks,
+ * except `sink`: each block that provides one adds an outbox sink.
+ */
+interface BlockPorts {
+  /** The `notifications` block. */
+  readonly notifier: Notifier;
+  /** The `ai-files` block, for knowledge. */
+  readonly files: AiFiles;
+  /** The `attachments` block, for the drive's files. */
+  readonly attachments: Attachments;
+  /** The `workflows` block, for the workflow builder's schedules. */
+  readonly workflows: Workflows;
+  /** An outbox sink, for `outbox.relayRoute({ consumers: blocks.sinks })`. */
+  readonly sink: EventSink;
+}
+type PortName = keyof BlockPorts;
+//#endregion
+export { createAttachments as C, createAttachmentScanner as S, ObjectScanJob as _, Attachment as a, ScanVerdict as b, AttachmentScanJob as c, AttachmentStatus as d, AttachmentStorage as f, NewAttachment as g, AttachmentsOptions as h, PortName as i, AttachmentScanner as l, Attachments as m, Notifier as n, AttachmentBucket as o, AttachmentUpload as p, NotifierInput as r, AttachmentDownload as s, BlockPorts as t, AttachmentScannerOptions as u, ObjectScanner as v, createObjectScanner as w, ScannedObject as x, ObjectScannerOptions as y };

package/dist/ports-DAdQyjZz.d.ts

@@ -0,0 +1,86 @@
+import { t as AsyncResult } from "./result-Cj3yWhjH.js";
+import { n as TopicPort } from "./watch-topic-EFpOIIDE.js";
+import { SupabaseClient } from "@supabase/supabase-js";
+//#region src/client/ports.d.ts
+/**
+ * A string store: `localStorage` on the web (`webStorage()`), AsyncStorage,
+ * MMKV or SecureStore on React Native (`nativeStorage()`).
+ */
+interface StoragePort {
+  readonly get: (key: string) => Promise<string | null>;
+  readonly set: (key: string, value: string) => Promise<void>;
+  readonly remove: (key: string) => Promise<void>;
+}
+/** A key combination. `mod` is Cmd on macOS and Ctrl elsewhere. */
+interface Shortcut {
+  readonly key: string;
+  readonly mod?: boolean;
+  readonly shift?: boolean;
+  readonly alt?: boolean;
+}
+/** Runs `run` on each press of `shortcut` until the returned function is called. */
+type KeyboardPort = (shortcut: Shortcut, run: () => void) => () => void;
+/** A file the user picked, readable on every platform. */
+interface PickedFile {
+  readonly name: string;
+  /** The MIME type, when the platform reports one. */
+  readonly type: string | undefined;
+  readonly size: number | undefined;
+  /** The local URI on React Native; `undefined` on the web. */
+  readonly uri: string | undefined;
+  /** The bytes: a `Blob` on the web, an `ArrayBuffer` on React Native. */
+  readonly read: () => Promise<Blob | ArrayBuffer>;
+}
+interface PickFilesOptions {
+  /** MIME types or extensions, such as `image/*` or `.pdf`. */
+  readonly accept?: readonly string[];
+  readonly multiple?: boolean;
+}
+/** Opens the platform's file picker; resolves with no files when the user cancels. */
+type FilePickerPort = (options?: PickFilesOptions) => Promise<readonly PickedFile[]>;
+interface UploadDestination {
+  readonly bucket: string;
+  readonly path: string;
+  readonly upsert?: boolean;
+}
+/** Uploads a picked file and resolves with its stored path. */
+type UploadPort = (file: PickedFile, to: UploadDestination) => AsyncResult<{
+  readonly path: string;
+}>;
+/** The device's push token for the platform's push service. */
+interface PushTokenPort {
+  /** The push provider the token belongs to, such as `expo` or `webpush`. */
+  readonly provider: string;
+  /**
+   * The token, asking for permission first unless `request` is false.
+   * Resolves with `null` when the user denies it or the platform has none.
+   */
+  readonly token: (options?: {
+    readonly request?: boolean;
+  }) => Promise<string | null>;
+}
+/** The URL the app opened with, and the ones it opens later. */
+interface DeepLinkPort {
+  readonly initial: () => Promise<string | null>;
+  readonly subscribe: (listener: (url: string) => void) => () => void;
+}
+/**
+ * The platform services block controllers use. `createClient` from
+ * `better-supabase/client` fills the web ports, and `nativePorts()` from
+ * `better-supabase/client/native` the React Native ones.
+ */
+interface ClientPorts {
+  readonly topic?: TopicPort;
+  readonly storage?: StoragePort;
+  readonly keyboard?: KeyboardPort;
+  readonly files?: FilePickerPort;
+  readonly upload?: UploadPort;
+  readonly push?: PushTokenPort;
+  readonly links?: DeepLinkPort;
+}
+/** A storage port that keeps values in memory, for tests and server renders. */
+declare function memoryStorage(initial?: Readonly<Record<string, string>>): StoragePort;
+/** The upload port over Supabase Storage, for web and native picked files alike. */
+declare function storageUpload(supabase: Pick<SupabaseClient, "storage">): UploadPort;
+//#endregion
+export { PickFilesOptions as a, Shortcut as c, UploadPort as d, memoryStorage as f, KeyboardPort as i, StoragePort as l, DeepLinkPort as n, PickedFile as o, storageUpload as p, FilePickerPort as r, PushTokenPort as s, ClientPorts as t, UploadDestination as u };

package/dist/ports-DGK3KTDH.js

@@ -0,0 +1,133 @@
+import { a as ok, r as err, t as AsyncResult } from "./result-BlgnMB0H.js";
+import { n as decodeJwtPayload } from "./base64-BmeCBgGo.js";
+import { i as userContext } from "./impersonation-CDeCzZP6.js";
+import { n as identityKey } from "./user-change-XzvgafU4.js";
+import { n as createQueries } from "./query-Ctz-qKRx.js";
+import { t as fromStorageError } from "./errors-PIpcoe4z.js";
+//#region src/client/bind.ts
+const LOADING = {
+	status: "loading",
+	user: null,
+	claims: null
+};
+const SIGNED_OUT = {
+	status: "signed-out",
+	user: null,
+	claims: null
+};
+/**
+* `session.user`, or `undefined` when auth-js put its placeholder there: with
+* `tokens-only` cookies and no user in `userStorage`, reading `id` throws.
+*/
+function storedUser(session) {
+	try {
+		return typeof session.user.id === "string" ? session.user : void 0;
+	} catch {
+		return;
+	}
+}
+const text = (value) => typeof value === "string" && value !== "" ? value : void 0;
+function snapshotOf(session) {
+	if (!session) return SIGNED_OUT;
+	const claims = decodeJwtPayload(session.access_token) ?? {};
+	const stored = storedUser(session);
+	const id = text(claims["sub"]) ?? stored?.id;
+	if (id === void 0) return SIGNED_OUT;
+	const email = text(claims["email"]) ?? text(stored?.email);
+	const role = text(claims["role"]) ?? text(stored?.role);
+	return {
+		status: "signed-in",
+		user: {
+			id,
+			...email ? { email } : {},
+			...role ? { role } : {}
+		},
+		claims
+	};
+}
+function contextOf(snapshot) {
+	if (snapshot.status !== "signed-in") return {
+		actor: {
+			id: "anon",
+			kind: "anon",
+			role: "anon"
+		},
+		claims: { role: "anon" }
+	};
+	return userContext(snapshot.user, snapshot.claims);
+}
+/**
+* Repositories that follow `supabase`'s session, TanStack Query options and
+* an auth store, for a supabase-js client you created yourself.
+*/
+function bindClient(betterSupabase, supabase, options = {}) {
+	let snapshot = LOADING;
+	let db;
+	const listeners = /* @__PURE__ */ new Set();
+	const { data } = supabase.auth.onAuthStateChange((_event, session) => {
+		const next = snapshotOf(session);
+		if (next.status === snapshot.status && identityKey(next) === identityKey(snapshot)) return;
+		snapshot = next;
+		db = void 0;
+		for (const listener of listeners) listener();
+	});
+	const client = {
+		betterSupabase,
+		supabase,
+		ports: options.ports ?? {},
+		get db() {
+			db ??= betterSupabase.connect(supabase, contextOf(snapshot));
+			return db;
+		},
+		queries: createQueries(betterSupabase, () => client.db, options.staleTime === void 0 ? {} : { staleTime: options.staleTime }),
+		dispose: () => {
+			data.subscription.unsubscribe();
+			listeners.clear();
+		},
+		auth: {
+			current: () => snapshot,
+			subscribe: (listener) => {
+				listeners.add(listener);
+				return () => {
+					listeners.delete(listener);
+				};
+			}
+		}
+	};
+	return client;
+}
+//#endregion
+//#region src/client/ports.ts
+/** A storage port that keeps values in memory, for tests and server renders. */
+function memoryStorage(initial = {}) {
+	const values = new Map(Object.entries(initial));
+	return {
+		get: (key) => Promise.resolve(values.get(key) ?? null),
+		set: (key, value) => {
+			values.set(key, value);
+			return Promise.resolve();
+		},
+		remove: (key) => {
+			values.delete(key);
+			return Promise.resolve();
+		}
+	};
+}
+/** The upload port over Supabase Storage, for web and native picked files alike. */
+function storageUpload(supabase) {
+	return (file, to) => AsyncResult.from(async () => {
+		try {
+			const body = await file.read();
+			const { data, error } = await supabase.storage.from(to.bucket).upload(to.path, body, {
+				...file.type === void 0 ? {} : { contentType: file.type },
+				...to.upsert === void 0 ? {} : { upsert: to.upsert }
+			});
+			if (error) return err(fromStorageError(error, to.bucket));
+			return ok({ path: data.path });
+		} catch (cause) {
+			return err(fromStorageError(cause, to.bucket));
+		}
+	});
+}
+//#endregion
+export { storageUpload as n, bindClient as r, memoryStorage as t };