better-supabase 0.8.0 → 0.9.0

package/dist/blocks/announcements/react/index.js

@@ -1,9 +1,9 @@
 "use client";
-import { i as useAuth, l as useSupabase } from "../../../hooks-Bhza9Hnr.js";
-import { r as rpcTransport } from "../../../block-transport-bAKh-dGc.js";
-import { t as watchTopic } from "../../../react-topic-seAWjL3_.js";
-import { t as createAnnouncements } from "../../../announcements-p_BFofiR.js";
-import { useCallback, useEffect, useMemo, useState } from "react";
+import { r as rpcTransport } from "../../../block-transport-G4t1umrR.js";
+import { t as useController } from "../../../react-controller-Xn-IU44p.js";
+import { t as useBlockEnv } from "../../../react-env-Cc7Vf6eb.js";
+import { t as createAnnouncements } from "../../../announcements-BHCzraR6.js";
+import { t as createAnnouncementsController } from "../../../client-DNq8xYb-.js";
 //#region src/blocks/announcements/react/index.ts
 /**
 * The signed-in user's live announcements, loaded again whenever staff
@@ -14,73 +14,25 @@ import { useCallback, useEffect, useMemo, useState } from "react";
 * ```
 */
 function useAnnouncements(options = {}) {
-	const supabase = useSupabase();
-	const auth = useAuth();
-	const [items, setItems] = useState(void 0);
-	const [error, setError] = useState(void 0);
-	const [status, setStatus] = useState("closed");
-	const organizationId = options.organizationId ?? null;
-	const topic = options.topic === void 0 ? "announcements" : options.topic;
-	const schema = options.schema;
-	const client = useMemo(() => createAnnouncements({
-		transport: rpcTransport(supabase),
-		...schema === void 0 ? {} : { schema }
-	}), [supabase, schema]);
-	const userId = auth.user?.id ?? null;
-	const signedIn = auth.status === "signed-in";
-	const apply = useCallback((result) => {
-		if (result.ok) {
-			setItems(result.data);
-			setError(void 0);
-		} else setError(result.error);
-	}, []);
-	const refresh = useCallback(async () => {
-		apply(await client.listActive(organizationId));
-	}, [
-		client,
-		organizationId,
-		apply
-	]);
-	const dismiss = useCallback(async (announcementId) => {
-		const result = await client.dismiss(announcementId);
-		if (!result.ok) {
-			setError(result.error);
-			return;
-		}
-		setItems((current) => current?.filter((item) => item.id !== announcementId));
-	}, [client]);
-	useEffect(() => {
-		if (!signedIn) return;
-		let active = true;
-		const load = () => void client.listActive(organizationId).then((result) => {
-			if (active) apply(result);
-		});
-		load();
-		const leave = topic ? watchTopic(supabase, topic, {
-			onMessage: load,
-			onRejoin: load,
-			onStatus: setStatus
-		}) : void 0;
-		return () => {
-			active = false;
-			leave?.();
-		};
-	}, [
-		client,
+	const { supabase, auth, ports } = useBlockEnv();
+	const { organizationId, topic, schema } = options;
+	return useController(() => createAnnouncementsController({
+		client: createAnnouncements({
+			transport: rpcTransport(supabase),
+			...schema === void 0 ? {} : { schema }
+		}),
+		auth,
+		ports,
+		...organizationId === void 0 ? {} : { organizationId },
+		...topic === void 0 ? {} : { topic }
+	}), [
 		supabase,
-		topic,
+		auth,
+		ports,
 		organizationId,
-		signedIn,
-		userId,
-		apply
-	]);
-	return {
-		items,
-		status,
-		error,
-		dismiss,
-		refresh
-	};
+		topic,
+		schema
+	]).view;
 }
 //#endregion
 export { useAnnouncements };

package/dist/blocks/announcements/solid/index.d.ts

@@ -0,0 +1,13 @@
+import { t as BlockOptions } from "../../../block-env-Dxl7rsI0.js";
+import { t as SolidController } from "../../../solid-controller-DqlvYFZa.js";
+import { i as AnnouncementsSnapshot, r as AnnouncementsControllerOptions, t as AnnouncementsActions } from "../../../client-BAcILZOf.js";
+//#region src/blocks/announcements/solid/index.d.ts
+/**
+ * `createAnnouncementsController` as a Solid primitive: `state()` reads the
+ * snapshot. Call it in a component; the work starts on mount and the controller
+ * is disposed with the owner. `auth` and `ports` default to the client of
+ * `<BetterSupabaseProvider client={bs}>`.
+ */
+export declare function useAnnouncements(options: BlockOptions<AnnouncementsControllerOptions>): SolidController<AnnouncementsSnapshot, AnnouncementsActions>;
+//#endregion
+export type { AnnouncementsActions, AnnouncementsControllerOptions, AnnouncementsSnapshot, BlockOptions, SolidController };

package/dist/blocks/announcements/solid/index.js

@@ -0,0 +1,14 @@
+import { t as useBlockController } from "../../../solid-controller-DLsmrczT.js";
+import { t as createAnnouncementsController } from "../../../client-DNq8xYb-.js";
+//#region src/blocks/announcements/solid/index.ts
+/**
+* `createAnnouncementsController` as a Solid primitive: `state()` reads the
+* snapshot. Call it in a component; the work starts on mount and the controller
+* is disposed with the owner. `auth` and `ports` default to the client of
+* `<BetterSupabaseProvider client={bs}>`.
+*/
+function useAnnouncements(options) {
+	return useBlockController(createAnnouncementsController, options);
+}
+//#endregion
+export { useAnnouncements };

package/dist/blocks/announcements/svelte/index.d.ts

@@ -0,0 +1,13 @@
+import { t as BlockOptions } from "../../../block-env-Dxl7rsI0.js";
+import { t as SvelteController } from "../../../svelte-controller-DxxHEHxD.js";
+import { i as AnnouncementsSnapshot, r as AnnouncementsControllerOptions, t as AnnouncementsActions } from "../../../client-BAcILZOf.js";
+//#region src/blocks/announcements/svelte/index.d.ts
+/**
+ * `createAnnouncementsController` as a Svelte readable store of the snapshot,
+ * with the actions on `.actions`. Call it in a component's script; the work
+ * starts on mount and the controller is disposed with the component. `auth` and
+ * `ports` default to the client of `setBetterSupabase(bs)`.
+ */
+export declare function useAnnouncements(options: BlockOptions<AnnouncementsControllerOptions>): SvelteController<AnnouncementsSnapshot, AnnouncementsActions>;
+//#endregion
+export type { AnnouncementsActions, AnnouncementsControllerOptions, AnnouncementsSnapshot, BlockOptions, SvelteController };

package/dist/blocks/announcements/svelte/index.js

@@ -0,0 +1,14 @@
+import { t as useBlockController } from "../../../svelte-controller-CDAujo-_.js";
+import { t as createAnnouncementsController } from "../../../client-DNq8xYb-.js";
+//#region src/blocks/announcements/svelte/index.ts
+/**
+* `createAnnouncementsController` as a Svelte readable store of the snapshot,
+* with the actions on `.actions`. Call it in a component's script; the work
+* starts on mount and the controller is disposed with the component. `auth` and
+* `ports` default to the client of `setBetterSupabase(bs)`.
+*/
+function useAnnouncements(options) {
+	return useBlockController(createAnnouncementsController, options);
+}
+//#endregion
+export { useAnnouncements };

package/dist/blocks/announcements/vue/index.d.ts

@@ -0,0 +1,13 @@
+import { t as BlockOptions } from "../../../block-env-Dxl7rsI0.js";
+import { t as VueController } from "../../../vue-controller-HPfMTDa2.js";
+import { i as AnnouncementsSnapshot, r as AnnouncementsControllerOptions, t as AnnouncementsActions } from "../../../client-BAcILZOf.js";
+//#region src/blocks/announcements/vue/index.d.ts
+/**
+ * `createAnnouncementsController` as a Vue composable: `state` is a shallow ref
+ * of the snapshot. Call it in `setup` or an effect scope; the work starts on
+ * mount and the controller is disposed with the scope. `auth` and `ports`
+ * default to the client of `app.use(betterSupabase(bs))`.
+ */
+export declare function useAnnouncements(options: BlockOptions<AnnouncementsControllerOptions>): VueController<AnnouncementsSnapshot, AnnouncementsActions>;
+//#endregion
+export type { AnnouncementsActions, AnnouncementsControllerOptions, AnnouncementsSnapshot, BlockOptions, VueController };

package/dist/blocks/announcements/vue/index.js

@@ -0,0 +1,14 @@
+import { t as useBlockController } from "../../../vue-controller-C9tFzqAc.js";
+import { t as createAnnouncementsController } from "../../../client-DNq8xYb-.js";
+//#region src/blocks/announcements/vue/index.ts
+/**
+* `createAnnouncementsController` as a Vue composable: `state` is a shallow ref
+* of the snapshot. Call it in `setup` or an effect scope; the work starts on
+* mount and the controller is disposed with the scope. `auth` and `ports`
+* default to the client of `app.use(betterSupabase(bs))`.
+*/
+function useAnnouncements(options) {
+	return useBlockController(createAnnouncementsController, options);
+}
+//#endregion
+export { useAnnouncements };

package/dist/blocks/api-keys/index.d.ts

@@ -1,11 +1,14 @@
-import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-inD4fFq-.js";
-import { r as AuthState } from "../../resolve-MxXVWyhd.js";
-import { t as BlockProblemOptions } from "../../problem-TvGdxO1t.js";
-import { a as ApiKeyResolverOptions, c as ApiKeysOptions, d as ParsedApiKey, f as apiKeyChecksum, g as parseApiKey, h as createApiKeys, i as ApiKeyExtraClaim, l as CreateApiKeyInput, m as apiKeyResolver, n as ApiKeyCheck, o as ApiKeyState, p as apiKeyClaims, r as ApiKeyClaimsOptions, s as ApiKeys, t as ApiKey, u as CreatedApiKey } from "../../api-keys-C8BlF3L2.js";
+import { v as ApiKeyEventData, wt as Events } from "../../events-CTreRrgP.js";
+import { r as AuthState } from "../../resolve-w9EpHzuM.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DaGGXjIw.js";
+import { t as BlockProblemOptions } from "../../problem-CEjyhV5T.js";
+import { s as BlockOf } from "../../define-block-CLZMEFeK.js";
+import { _ as createApiKeys, a as ApiKeyExtraClaims, c as ApiKeyState, d as CreateApiKeyInput, f as CreatedApiKey, g as apiKeyResolver, h as apiKeyClaims, i as ApiKeyExtraClaim, l as ApiKeys, m as apiKeyChecksum, n as ApiKeyCheck, o as ApiKeyReservedClaim, p as ParsedApiKey, r as ApiKeyClaimsOptions, s as ApiKeyResolverOptions, t as ApiKey, u as ApiKeysOptions, v as parseApiKey } from "../../api-keys-BYoGCM9p.js";
+import { a as ApiKeysControllerOptions, i as ApiKeysController, n as ApiKeyDraft, o as ApiKeysSnapshot, r as ApiKeysActions, s as createApiKeysController, t as ApiKeyChange } from "../../client-BxnLb9bz.js";
 import { Entry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";
 //#region src/blocks/api-keys/pipeline.d.ts
-interface WithApiKeyOptions extends ApiKeyResolverOptions, BlockProblemOptions {}
+interface WithApiKeyOptions<F extends object = Record<never, never>> extends ApiKeyResolverOptions<F>, BlockProblemOptions {}
 /** The API key a request verified with, as `withApiKey` puts it on `ctx.auth`. */
 type ApiKeyAuth = Extract<AuthState, {
   readonly kind: "apiKey";
@@ -30,6 +33,20 @@ interface ApiKeyContributions {
  * pipeline([withApiKey({ keys }), withPostgresClient(), withBetterPostgres(betterSupabase)()], (req, ctx) => ...)
  * ```
  */
-export declare function withApiKey(options: WithApiKeyOptions): Entry<ApiKeyContributions>;
+export declare function withApiKey<F extends object = Record<never, never>>(options: WithApiKeyOptions<F>): Entry<ApiKeyContributions>;
 //#endregion
-export { type ApiKey, type ApiKeyAuth, type ApiKeyCheck, type ApiKeyClaimsOptions, type ApiKeyContributions, type ApiKeyExtraClaim, type ApiKeyResolverOptions, type ApiKeyState, type ApiKeys, type ApiKeysOptions, type BlockTransport, type CreateApiKeyInput, type CreatedApiKey, type ParsedApiKey, type WithApiKeyOptions, apiKeyChecksum, apiKeyClaims, apiKeyResolver, createApiKeys, dbTransport, parseApiKey, rpcTransport, sqlTransport };
+//#region src/blocks/api-keys/events.d.ts
+/** The events of the `api-keys` block: type to data. */
+type ApiKeysEvents = {
+  readonly "api_key.created": ApiKeyEventData;
+  readonly "api_key.revoked": ApiKeyEventData;
+  readonly "api_key.rotated": ApiKeyEventData;
+};
+/** The `api-keys` block's event types, for its manifest and `onBlockEvent`. */
+export declare const apiKeysEvents: Events<ApiKeysEvents>;
+//#endregion
+//#region src/blocks/api-keys/manifest.d.ts
+/** The `api-keys` block's manifest (ADR 0029). */
+export declare const apiKeysBlock: BlockOf<"api-keys", typeof createApiKeys, ApiKeysEvents>;
+//#endregion
+export { type ApiKey, type ApiKeyAuth, type ApiKeyChange, type ApiKeyCheck, type ApiKeyClaimsOptions, type ApiKeyContributions, type ApiKeyDraft, type ApiKeyExtraClaim, type ApiKeyExtraClaims, type ApiKeyReservedClaim, type ApiKeyResolverOptions, type ApiKeyState, type ApiKeys, type ApiKeysActions, type ApiKeysController, type ApiKeysControllerOptions, type ApiKeysEvents, type ApiKeysOptions, type ApiKeysSnapshot, type BlockTransport, type CreateApiKeyInput, type CreatedApiKey, type ParsedApiKey, type WithApiKeyOptions, apiKeyChecksum, apiKeyClaims, apiKeyResolver, createApiKeys, createApiKeysController, dbTransport, parseApiKey, rpcTransport, sqlTransport };

package/dist/blocks/api-keys/index.js

@@ -1,298 +1,13 @@
-import { n as dbError } from "../../errors-2M6CKMP4.js";
-import { t as temporal } from "../../temporal-required-BtynQtM-.js";
-import { a as ok, t as AsyncResult } from "../../result-DEqHCMKP.js";
-import { o as problemResponse } from "../../problem-CJvFeGu7.js";
+import { n as dbError } from "../../errors-8i6tSICm.js";
+import { o as problemResponse } from "../../problem-pIiL3WbE.js";
+import { n as event, t as defineEvents } from "../../event-map-Dy2vKHai.js";
+import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../../block-transport-G4t1umrR.js";
 import { a as withAuthMode, o as withJwtClaims, s as withUserClaims } from "../../claims-0KZVT804.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../../block-transport-bAKh-dGc.js";
-import { A as stringsOf, O as sha256Hex, S as recordOf, _ as optionalInstant, d as instantArg, i as blockCall, j as textOf, n as applyTemporal, v as optionalText, w as recordsOf } from "../../block-helpers-Cy3pB96I.js";
+import { n as defineBlock } from "../../define-block-B6Gjs57G.js";
+import { a as parseApiKey, i as createApiKeys, n as apiKeyClaims, r as apiKeyResolver, t as apiKeyChecksum } from "../../api-keys-BEQatEUW.js";
+import { t as createApiKeysController } from "../../client-PGRk3DGz.js";
+import { t as apiKeysSqlOptions } from "../../options-eBPsk4WI.js";
 import { defineComposite, defineMiddleware } from "@supabase/middleware";
-//#region src/blocks/api-keys/api-keys.ts
-const TOKEN = /^([a-z][a-z0-9]*)_([0-9a-f]{16})_([A-Za-z0-9_-]{32,})$/;
-const PREFIX = /^[a-z][a-z0-9]*$/;
-const ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-const SECRET_LENGTH = 43;
-const CHECKSUM_LENGTH = 6;
-const CHECKED_TAIL = /^[A-Za-z0-9]{49}$/;
-const CRC_TABLE = (() => {
-	const table = /* @__PURE__ */ new Uint32Array(256);
-	for (let index = 0; index < 256; index += 1) {
-		let value = index;
-		for (let bit = 0; bit < 8; bit += 1) value = value & 1 ? 3988292384 ^ value >>> 1 : value >>> 1;
-		table[index] = value >>> 0;
-	}
-	return table;
-})();
-/**
-* The CRC-32 (IEEE 802.3) of `text` as 6 base62 characters: the checksum
-* GitHub-style tokens end in, so a secret
-* scanner or the server rejects a mistyped key without a lookup.
-*/
-function apiKeyChecksum(text) {
-	let crc = 4294967295;
-	for (let index = 0; index < text.length; index += 1) crc = (CRC_TABLE[(crc ^ (text.codePointAt(index) ?? 0)) & 255] ?? 0) ^ crc >>> 8;
-	let value = (crc ^ 4294967295) >>> 0;
-	let out = "";
-	for (let index = 0; index < CHECKSUM_LENGTH; index += 1) {
-		out = ALPHABET[value % 62] + out;
-		value = Math.floor(value / 62);
-	}
-	return out;
-}
-function base62Secret() {
-	let secret = "";
-	const bytes = /* @__PURE__ */ new Uint8Array(64);
-	while (secret.length < SECRET_LENGTH) {
-		crypto.getRandomValues(bytes);
-		for (const byte of bytes) if (byte < 248 && secret.length < SECRET_LENGTH) secret += ALPHABET[byte % 62];
-	}
-	return secret;
-}
-/**
-* Splits `<prefix>_<public id>_<secret><checksum>`: a 43-character base62
-* secret and the 6-character checksum of everything before it. A key from
-* before the checksum (`<prefix>_<public id>_<secret>`) still parses. A
-* checksum that doesn't match, or anything else (a JWT, say), is
-* `undefined`.
-*/
-function parseApiKey(token) {
-	const match = TOKEN.exec(token.trim());
-	if (!match) return void 0;
-	const prefix = match[1];
-	const publicId = match[2];
-	const tail = match[3];
-	if (CHECKED_TAIL.test(tail)) {
-		const secret = tail.slice(0, SECRET_LENGTH);
-		return tail.slice(SECRET_LENGTH) === apiKeyChecksum(`${prefix}_${publicId}_${secret}`) ? {
-			prefix,
-			publicId,
-			secret,
-			checksum: true
-		} : void 0;
-	}
-	return {
-		prefix,
-		publicId,
-		secret: tail,
-		checksum: false
-	};
-}
-function publicId() {
-	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(8));
-	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-const STATES = [
-	"active",
-	"grace",
-	"revoked",
-	"expired"
-];
-function stateOf(value, revokedAt, expiresAt) {
-	const known = STATES.find((state) => state === value);
-	if (known) return known;
-	const now = temporal().Now.instant();
-	const past = (at) => at !== void 0 && temporal().Instant.compare(at, now) <= 0;
-	if (past(revokedAt)) return "revoked";
-	if (past(expiresAt)) return "expired";
-	return revokedAt === void 0 ? "active" : "grace";
-}
-function apiKeyOf(value) {
-	const row = recordOf(value, "api key");
-	const organizationId = optionalText(row["organization_id"]);
-	const userId = optionalText(row["user_id"]);
-	const expiresAt = optionalInstant(row["expires_at"]);
-	const lastUsedAt = optionalInstant(row["last_used_at"]);
-	const revokedAt = optionalInstant(row["revoked_at"]);
-	const rotatedFrom = optionalText(row["rotated_from"]);
-	const createdBy = optionalText(row["created_by"]);
-	const successorId = optionalText(row["successor_id"]);
-	const rateLimit = row["rate_limit"];
-	return {
-		id: textOf(row["id"]),
-		...organizationId ? { organizationId } : {},
-		...userId ? { userId } : {},
-		name: textOf(row["name"]),
-		prefix: textOf(row["prefix"]),
-		publicId: textOf(row["public_id"]),
-		scopes: stringsOf(row["scopes"]),
-		...typeof rateLimit === "number" ? { rateLimit } : {},
-		...expiresAt ? { expiresAt } : {},
-		...lastUsedAt ? { lastUsedAt } : {},
-		...revokedAt ? { revokedAt } : {},
-		...rotatedFrom ? { rotatedFrom } : {},
-		...createdBy ? { createdBy } : {},
-		createdAt: optionalInstant(row["created_at"]) ?? temporal().Now.instant(),
-		state: stateOf(row["state"], revokedAt, expiresAt),
-		...successorId ? { successorId } : {}
-	};
-}
-function checkOf(value) {
-	const row = recordOf(value, "verify_api_key");
-	switch (row["status"]) {
-		case "ok": return {
-			status: "ok",
-			key: apiKeyOf(row["key"])
-		};
-		case "rate_limited": return {
-			status: "rate_limited",
-			retryAfter: Number(row["retry_after"] ?? 60)
-		};
-		default: return { status: "invalid" };
-	}
-}
-/**
-* API keys over the `api-keys` SQL module. Members create and rotate keys
-* with their own transport; `verify` (and `apiKeyResolver`) need one that
-* runs as the service role.
-*/
-function createApiKeys(options) {
-	applyTemporal(options);
-	const prefix = options.prefix ?? "bs";
-	if (!PREFIX.test(prefix)) throw new TypeError(`createApiKeys: prefix must be lowercase letters and digits, not "${prefix}"`);
-	const call = blockCall(options.transport, options.schema ?? "better_supabase");
-	const fresh = async () => {
-		const id = publicId();
-		const secret = base62Secret();
-		const key = `${prefix}_${id}_${secret}`;
-		return {
-			id,
-			token: `${key}${apiKeyChecksum(key)}`,
-			hash: await sha256Hex(secret)
-		};
-	};
-	return {
-		create: (input) => AsyncResult.from(async () => {
-			const { id, token, hash } = await fresh();
-			return call("create_api_key", {
-				name: input.name,
-				public_id: id,
-				secret_hash: hash,
-				tenant: input.organizationId ?? null,
-				personal: input.personal ?? false,
-				scopes: input.scopes ?? [],
-				expires_at: instantArg(input.expiresAt) ?? null,
-				rate_limit: input.rateLimit ?? null,
-				prefix
-			}, (value) => ({
-				key: apiKeyOf(value),
-				token
-			}));
-		}),
-		list: (organizationId) => call("list_api_keys", { tenant: organizationId ?? null }, (value) => recordsOf(value, "list_api_keys").map(apiKeyOf)),
-		revoke: (id) => call("revoke_api_key", { key: id }, (value) => value === true),
-		rotate: (id, rotateOptions = {}) => AsyncResult.from(async () => {
-			const { id: next, token, hash } = await fresh();
-			return call("rotate_api_key", {
-				key: id,
-				public_id: next,
-				secret_hash: hash,
-				grace: (rotateOptions.grace ?? temporal().Duration.from({ days: 1 })).toString()
-			}, (value) => ({
-				key: apiKeyOf(value),
-				token
-			}));
-		}),
-		verify: (token) => AsyncResult.from(async () => {
-			const parsed = parseApiKey(token);
-			if (!parsed || parsed.prefix !== prefix) return ok({ status: "invalid" });
-			return call("verify_api_key", {
-				public_id: parsed.publicId,
-				secret_hash: await sha256Hex(parsed.secret)
-			}, checkOf);
-		})
-	};
-}
-/**
-* The claims queries run with for a key: `api_key` with `id`, `name`,
-* `scopes` and `organization_id` for the module's `has_scope()` and
-* `api_key_tenant()`, plus `options.claim`.
-*/
-function apiKeyClaims(key, options = {}) {
-	const scopes = key.scopes.includes("*") && options.allPermissions ? [.../* @__PURE__ */ new Set([...key.scopes.filter((scope) => scope !== "*"), ...options.allPermissions])] : key.scopes;
-	const base = {
-		id: key.id,
-		name: key.name,
-		scopes,
-		...key.organizationId ? { organization_id: key.organizationId } : {}
-	};
-	const claims = {
-		sub: key.userId ?? "",
-		role: "authenticated",
-		aud: "authenticated",
-		api_key: base
-	};
-	if (options.claim !== void 0) {
-		const names = options.claim;
-		const claim = names.name;
-		const service = key.userId === void 0 && key.organizationId !== void 0;
-		const roles = service ? options.serviceRoles?.(key) ?? names.serviceRoles : void 0;
-		const target = claim === "api_key" ? base : {
-			id: key.id,
-			name: key.name
-		};
-		target[names.scopes ?? "scopes"] = scopes.filter((scope) => scope !== "*");
-		if (service) target[names.tenant ?? "tenant"] = key.organizationId;
-		if (roles && roles.length > 0) target[names.roles ?? "roles"] = [...roles];
-		claims[claim] = target;
-	}
-	if (options.tenantClaim !== void 0 && key.userId !== void 0 && key.organizationId !== void 0) claims[options.tenantClaim] = key.organizationId;
-	return claims;
-}
-function presented(request, header) {
-	const direct = request.headers.get(header)?.trim();
-	if (direct) return direct;
-	const bearer = request.headers.get("authorization")?.match(/^Bearer\s+(.+)$/i)?.[1]?.trim();
-	return bearer && parseApiKey(bearer) ? bearer : void 0;
-}
-/**
-* Resolves `x-api-key` (or a Bearer token shaped like a key) to an `apiKey`
-* auth state. Requests without one fall through to the JWT and cookie
-* resolution. Pass it to `createServer({ auth: { resolvers: [...] } })`.
-*/
-function apiKeyResolver(options) {
-	const header = options.header ?? "x-api-key";
-	return {
-		name: "api-keys",
-		async resolve(request) {
-			const token = presented(request, header);
-			if (token === void 0) return void 0;
-			const checked = await options.keys.verify(token);
-			if (!checked.ok) return {
-				kind: "invalid",
-				error: checked.error
-			};
-			const check = checked.data;
-			switch (check.status) {
-				case "ok": {
-					const { key } = check;
-					return {
-						kind: "apiKey",
-						keyId: key.id,
-						name: key.name,
-						...key.organizationId ? { organizationId: key.organizationId } : {},
-						...key.userId ? { userId: key.userId } : {},
-						scopes: key.scopes,
-						createdAt: key.createdAt,
-						...key.createdBy ? { createdBy: key.createdBy } : {},
-						claims: apiKeyClaims(key, options)
-					};
-				}
-				case "rate_limited": return {
-					kind: "invalid",
-					error: dbError("rate_limited", "API key rate limit exceeded", {
-						code: "API_KEY_RATE_LIMITED",
-						retryAfter: check.retryAfter
-					})
-				};
-				case "invalid": return {
-					kind: "invalid",
-					error: dbError("unauthorized", "Invalid API key", { code: "INVALID_API_KEY" })
-				};
-				default: return check;
-			}
-		}
-	};
-}
-//#endregion
 //#region src/blocks/api-keys/pipeline.ts
 function withApiKeyAuth(options) {
 	const resolver = apiKeyResolver(options);
@@ -331,4 +46,24 @@ function withApiKey(options) {
 	] })();
 }
 //#endregion
-export { apiKeyChecksum, apiKeyClaims, apiKeyResolver, createApiKeys, dbTransport, parseApiKey, rpcTransport, sqlTransport, withApiKey };
+//#region src/blocks/api-keys/events.ts
+/** The `api-keys` block's event types, for its manifest and `onBlockEvent`. */
+const apiKeysEvents = defineEvents({
+	"api_key.created": event(),
+	"api_key.revoked": event(),
+	"api_key.rotated": event()
+});
+//#endregion
+//#region src/blocks/api-keys/manifest.ts
+/** The `api-keys` block's manifest (ADR 0029). */
+const apiKeysBlock = defineBlock({
+	name: "api-keys",
+	sql: ["api-keys"],
+	options: { "api-keys": apiKeysSqlOptions },
+	events: apiKeysEvents,
+	create: createApiKeys,
+	category: "developer",
+	recipes: ["api-keys-table"]
+});
+//#endregion
+export { apiKeyChecksum, apiKeyClaims, apiKeyResolver, apiKeysBlock, apiKeysEvents, createApiKeys, createApiKeysController, dbTransport, parseApiKey, rpcTransport, sqlTransport, withApiKey };

package/dist/blocks/api-keys/react/index.d.ts

@@ -0,0 +1,29 @@
+import { n as ApiKeyDraft, o as ApiKeysSnapshot, r as ApiKeysActions, t as ApiKeyChange } from "../../../client-BxnLb9bz.js";
+//#region src/blocks/api-keys/react/index.d.ts
+export interface UseApiKeysOptions {
+  /**
+   * The organization whose keys to list and create; without one the hook
+   * lists the caller's personal keys.
+   */
+  readonly organizationId: string | null | undefined;
+  /** The schema the calls go to: the module schema (default `better_supabase`), or the API schema from `blocks.<module>.api`. */
+  readonly schema?: string;
+  /** The token's first segment, `blocks.api-keys.options.prefix` (default `bs`). */
+  readonly prefix?: string;
+  /** Runs after a key was created or revoked. */
+  readonly onChanged?: (change: ApiKeyChange) => void | Promise<void>;
+}
+export interface ApiKeysState extends ApiKeysSnapshot, ApiKeysActions {}
+/**
+ * An organization's API keys through the browser client, for an API keys
+ * table: `create` keeps the new token in `created`, which is the only time
+ * it is shown, and `revoke` revokes a key. The same hook runs in React DOM
+ * and React Native.
+ *
+ * ```tsx
+ * const { keys, created, create, revoke } = useApiKeys({ organizationId });
+ * ```
+ */
+export declare function useApiKeys(options: UseApiKeysOptions): ApiKeysState;
+//#endregion
+export type { ApiKeyChange, ApiKeyDraft };

package/dist/blocks/api-keys/react/index.js

@@ -0,0 +1,43 @@
+"use client";
+import { r as rpcTransport } from "../../../block-transport-G4t1umrR.js";
+import { n as useLatest, t as useController } from "../../../react-controller-Xn-IU44p.js";
+import { t as useBlockEnv } from "../../../react-env-Cc7Vf6eb.js";
+import { i as createApiKeys } from "../../../api-keys-BEQatEUW.js";
+import { t as createApiKeysController } from "../../../client-PGRk3DGz.js";
+//#region src/blocks/api-keys/react/index.ts
+/**
+* An organization's API keys through the browser client, for an API keys
+* table: `create` keeps the new token in `created`, which is the only time
+* it is shown, and `revoke` revokes a key. The same hook runs in React DOM
+* and React Native.
+*
+* ```tsx
+* const { keys, created, create, revoke } = useApiKeys({ organizationId });
+* ```
+*/
+function useApiKeys(options) {
+	const { supabase, auth } = useBlockEnv();
+	const latest = useLatest(options);
+	const { organizationId, schema, prefix } = options;
+	return useController(() => createApiKeysController({
+		client: createApiKeys({
+			transport: rpcTransport(supabase),
+			...schema === void 0 ? {} : { schema },
+			...prefix === void 0 ? {} : { prefix }
+		}),
+		auth,
+		organizationId: organizationId ?? null,
+		onChanged: async (change) => {
+			await latest.current.onChanged?.(change);
+		}
+	}), [
+		supabase,
+		auth,
+		organizationId,
+		schema,
+		prefix,
+		latest
+	]).view;
+}
+//#endregion
+export { useApiKeys };

package/dist/blocks/api-keys/react/server.d.ts

@@ -0,0 +1,7 @@
+import { n as ApiKeyDraft, t as ApiKeyChange } from "../../../client-BxnLb9bz.js";
+import { ApiKeysState, UseApiKeysOptions } from "./index.js";
+//#region src/blocks/api-keys/react/server.d.ts
+/** The `react-server` build of `useApiKeys`: call `apiKeys.list()` instead. */
+export declare const useApiKeys: (options: UseApiKeysOptions) => ApiKeysState;
+//#endregion
+export type { ApiKeyChange, ApiKeyDraft, ApiKeysState, UseApiKeysOptions };

package/dist/blocks/api-keys/react/server.js

@@ -0,0 +1,7 @@
+//#region src/blocks/api-keys/react/server.ts
+/** The `react-server` build of `useApiKeys`: call `apiKeys.list()` instead. */
+const useApiKeys = () => {
+	throw new Error("better-supabase: useApiKeys() runs in Client Components only. In Server Components call `apiKeys.list()` instead.");
+};
+//#endregion
+export { useApiKeys };