better-supabase 0.8.0 → 0.9.0

package/dist/blocks/api-keys/solid/index.d.ts

@@ -0,0 +1,13 @@
+import { t as BlockOptions } from "../../../block-env-Dxl7rsI0.js";
+import { t as SolidController } from "../../../solid-controller-DqlvYFZa.js";
+import { a as ApiKeysControllerOptions, o as ApiKeysSnapshot, r as ApiKeysActions } from "../../../client-BxnLb9bz.js";
+//#region src/blocks/api-keys/solid/index.d.ts
+/**
+ * `createApiKeysController` as a Solid primitive: `state()` reads the snapshot.
+ * Call it in a component; the work starts on mount and the controller is
+ * disposed with the owner. `auth` and `ports` default to the client of
+ * `<BetterSupabaseProvider client={bs}>`.
+ */
+export declare function useApiKeys(options: BlockOptions<ApiKeysControllerOptions>): SolidController<ApiKeysSnapshot, ApiKeysActions>;
+//#endregion
+export type { ApiKeysActions, ApiKeysControllerOptions, ApiKeysSnapshot, BlockOptions, SolidController };

package/dist/blocks/api-keys/solid/index.js

@@ -0,0 +1,14 @@
+import { t as useBlockController } from "../../../solid-controller-DLsmrczT.js";
+import { t as createApiKeysController } from "../../../client-PGRk3DGz.js";
+//#region src/blocks/api-keys/solid/index.ts
+/**
+* `createApiKeysController` as a Solid primitive: `state()` reads the snapshot.
+* Call it in a component; the work starts on mount and the controller is
+* disposed with the owner. `auth` and `ports` default to the client of
+* `<BetterSupabaseProvider client={bs}>`.
+*/
+function useApiKeys(options) {
+	return useBlockController(createApiKeysController, options);
+}
+//#endregion
+export { useApiKeys };

package/dist/blocks/api-keys/svelte/index.d.ts

@@ -0,0 +1,13 @@
+import { t as BlockOptions } from "../../../block-env-Dxl7rsI0.js";
+import { t as SvelteController } from "../../../svelte-controller-DxxHEHxD.js";
+import { a as ApiKeysControllerOptions, o as ApiKeysSnapshot, r as ApiKeysActions } from "../../../client-BxnLb9bz.js";
+//#region src/blocks/api-keys/svelte/index.d.ts
+/**
+ * `createApiKeysController` as a Svelte readable store of the snapshot, with
+ * the actions on `.actions`. Call it in a component's script; the work starts
+ * on mount and the controller is disposed with the component. `auth` and
+ * `ports` default to the client of `setBetterSupabase(bs)`.
+ */
+export declare function useApiKeys(options: BlockOptions<ApiKeysControllerOptions>): SvelteController<ApiKeysSnapshot, ApiKeysActions>;
+//#endregion
+export type { ApiKeysActions, ApiKeysControllerOptions, ApiKeysSnapshot, BlockOptions, SvelteController };

package/dist/blocks/api-keys/svelte/index.js

@@ -0,0 +1,14 @@
+import { t as useBlockController } from "../../../svelte-controller-CDAujo-_.js";
+import { t as createApiKeysController } from "../../../client-PGRk3DGz.js";
+//#region src/blocks/api-keys/svelte/index.ts
+/**
+* `createApiKeysController` as a Svelte readable store of the snapshot, with
+* the actions on `.actions`. Call it in a component's script; the work starts
+* on mount and the controller is disposed with the component. `auth` and
+* `ports` default to the client of `setBetterSupabase(bs)`.
+*/
+function useApiKeys(options) {
+	return useBlockController(createApiKeysController, options);
+}
+//#endregion
+export { useApiKeys };

package/dist/blocks/api-keys/vue/index.d.ts

@@ -0,0 +1,13 @@
+import { t as BlockOptions } from "../../../block-env-Dxl7rsI0.js";
+import { t as VueController } from "../../../vue-controller-HPfMTDa2.js";
+import { a as ApiKeysControllerOptions, o as ApiKeysSnapshot, r as ApiKeysActions } from "../../../client-BxnLb9bz.js";
+//#region src/blocks/api-keys/vue/index.d.ts
+/**
+ * `createApiKeysController` as a Vue composable: `state` is a shallow ref of
+ * the snapshot. Call it in `setup` or an effect scope; the work starts on mount
+ * and the controller is disposed with the scope. `auth` and `ports` default to
+ * the client of `app.use(betterSupabase(bs))`.
+ */
+export declare function useApiKeys(options: BlockOptions<ApiKeysControllerOptions>): VueController<ApiKeysSnapshot, ApiKeysActions>;
+//#endregion
+export type { ApiKeysActions, ApiKeysControllerOptions, ApiKeysSnapshot, BlockOptions, VueController };

package/dist/blocks/api-keys/vue/index.js

@@ -0,0 +1,14 @@
+import { t as useBlockController } from "../../../vue-controller-C9tFzqAc.js";
+import { t as createApiKeysController } from "../../../client-PGRk3DGz.js";
+//#region src/blocks/api-keys/vue/index.ts
+/**
+* `createApiKeysController` as a Vue composable: `state` is a shallow ref of
+* the snapshot. Call it in `setup` or an effect scope; the work starts on mount
+* and the controller is disposed with the scope. `auth` and `ports` default to
+* the client of `app.use(betterSupabase(bs))`.
+*/
+function useApiKeys(options) {
+	return useBlockController(createApiKeysController, options);
+}
+//#endregion
+export { useApiKeys };

package/dist/blocks/approvals/index.d.ts

@@ -0,0 +1,22 @@
+import { A as CollaborationEventData, wt as Events } from "../../events-CTreRrgP.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DaGGXjIw.js";
+import { s as BlockOf } from "../../define-block-CLZMEFeK.js";
+import { a as ApprovalRequestDetail, c as ApprovalStep, d as createApprovals, i as ApprovalRequest, l as Approvals, n as ApprovalDecision, o as ApprovalRequestInput, r as ApprovalListOptions, s as ApprovalStatus, t as ApprovalApprovers, u as ApprovalsOptions } from "../../approvals-a2KmioBh.js";
+//#region src/blocks/approvals/events.d.ts
+/** The events of the `approvals` block: type to data. */
+type ApprovalsEvents = {
+  readonly "approval.requested": CollaborationEventData;
+  readonly "approval.approved": CollaborationEventData;
+  readonly "approval.rejected": CollaborationEventData;
+  readonly "approval.cancelled": CollaborationEventData;
+  readonly "approval.expired": CollaborationEventData;
+  readonly "approval.delegated": CollaborationEventData;
+};
+/** The `approvals` block's event types, for its manifest and `onBlockEvent`. */
+export declare const approvalsEvents: Events<ApprovalsEvents>;
+//#endregion
+//#region src/blocks/approvals/manifest.d.ts
+/** The `approvals` block's manifest (ADR 0029). */
+export declare const approvalsBlock: BlockOf<"approvals", typeof createApprovals, ApprovalsEvents>;
+//#endregion
+export { type ApprovalApprovers, type ApprovalDecision, type ApprovalListOptions, type ApprovalRequest, type ApprovalRequestDetail, type ApprovalRequestInput, type ApprovalStatus, type ApprovalStep, type Approvals, type ApprovalsEvents, type ApprovalsOptions, type BlockTransport, createApprovals, dbTransport, rpcTransport, sqlTransport };

package/dist/blocks/approvals/index.js

@@ -0,0 +1,189 @@
+import { n as dbError } from "../../errors-8i6tSICm.js";
+import { r as err, t as AsyncResult } from "../../result-BlgnMB0H.js";
+import { n as event, t as defineEvents } from "../../event-map-Dy2vKHai.js";
+import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../../block-transport-G4t1umrR.js";
+import { A as requiredInstant, C as optionalText, D as recordOf, I as textOf, k as recordsOf, n as applyTemporal, o as blockCall } from "../../block-helpers-CfG_MvDR.js";
+import { r as withBlockHooks } from "../../block-hooks-BsXncUlZ.js";
+import { c as withFields, n as blockFields, r as extraFieldsArg, t as allWithFields } from "../../block-fields-ffD6Gxe4.js";
+import { n as defineBlock } from "../../define-block-B6Gjs57G.js";
+import { t as approvalsSqlOptions } from "../../options-C2HesT4A.js";
+//#region src/blocks/approvals/approvals.ts
+const STATUSES = [
+	"pending",
+	"approved",
+	"rejected",
+	"cancelled",
+	"expired"
+];
+const DECISIONS = [
+	"approved",
+	"rejected",
+	"delegated"
+];
+function statusOf(value) {
+	const status = STATUSES.find((item) => item === value);
+	if (status === void 0) throw new TypeError(`unknown approval status ${String(value)}`);
+	return status;
+}
+function decisionKind(value) {
+	const decision = DECISIONS.find((item) => item === value);
+	if (decision === void 0) throw new TypeError(`unknown approval decision ${String(value)}`);
+	return decision;
+}
+const instant = (value, name) => value === null || value === void 0 ? {} : { [name]: requiredInstant(value, name) };
+function approversOf(value) {
+	const row = recordOf(value, "approvers");
+	const permission = optionalText(row["permission"]);
+	const role = optionalText(row["role"]);
+	const team = optionalText(row["team"]);
+	return {
+		...permission === void 0 ? {} : { permission },
+		...role === void 0 ? {} : { role },
+		...team === void 0 ? {} : { team },
+		...Array.isArray(row["users"]) ? { users: row["users"].map((user) => textOf(user)) } : {}
+	};
+}
+function requestOf(value, fn) {
+	const row = recordOf(value, fn);
+	const requestedBy = optionalText(row["requestedBy"]);
+	const reason = optionalText(row["reason"]);
+	const payload = row["payload"];
+	return {
+		id: textOf(row["id"]),
+		organizationId: textOf(row["organizationId"]),
+		subjectType: textOf(row["subjectType"]),
+		subjectId: textOf(row["subjectId"]),
+		action: textOf(row["action"]),
+		status: statusOf(row["status"]),
+		step: Number(row["step"]),
+		steps: recordsOf(row["steps"] ?? [], fn).map((step) => ({
+			approvers: approversOf(step["approvers"]),
+			required: Number(step["required"])
+		})),
+		payload: typeof payload === "object" && payload !== null && !Array.isArray(payload) ? recordOf(payload, fn) : {},
+		createdAt: requiredInstant(row["createdAt"], "createdAt"),
+		...requestedBy === void 0 ? {} : { requestedBy },
+		...reason === void 0 ? {} : { reason },
+		...instant(row["expiresAt"], "expiresAt"),
+		...instant(row["decidedAt"], "decidedAt")
+	};
+}
+function decisionOf(value) {
+	const approver = optionalText(value["approver"]);
+	const delegateTo = optionalText(value["delegateTo"]);
+	const comment = optionalText(value["comment"]);
+	return {
+		id: textOf(value["id"]),
+		step: Number(value["step"]),
+		decision: decisionKind(value["decision"]),
+		createdAt: requiredInstant(value["createdAt"], "createdAt"),
+		...approver === void 0 ? {} : { approver },
+		...delegateTo === void 0 ? {} : { delegateTo },
+		...comment === void 0 ? {} : { comment }
+	};
+}
+/** The `approvals` SQL module as typed calls. */
+function createApprovals(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const fields = blockFields(options.fields, "approval request fields");
+	const one = (fn, args) => call(fn, args, (value) => value).andThen((value) => withFields(fields, value, requestOf(value, fn)));
+	const approverOf = options.authorization?.approverOf;
+	if (approverOf !== void 0 && options.approver === void 0) throw new TypeError("createApprovals: authorization.approverOf needs the approver the transport runs as");
+	const refused = dbError("forbidden", "not an approver for this step", { hint: "APPROVAL_FORBIDDEN" });
+	/** Runs `then` once `approverOf` allows the caller on request `id`; the SQL check runs as well. */
+	const asApprover = (id, then) => {
+		const approver = options.approver;
+		if (approverOf === void 0 || approver === void 0) return then();
+		return getRequest(id).andThen(async (request) => {
+			if (!request.canDecide) return err(refused);
+			let allowed = false;
+			try {
+				allowed = await approverOf(approver, {
+					kind: `${request.subjectType}.${request.action}`,
+					subject: request.subjectId,
+					tenant: request.organizationId,
+					...request.requestedBy === void 0 ? {} : { requester: request.requestedBy }
+				});
+			} catch {
+				allowed = false;
+			}
+			return allowed ? then() : err(refused);
+		});
+	};
+	const getRequest = (id) => call("get_approval", { request_id: id }, (value) => value).andThen((value) => {
+		const row = recordOf(value, "get_approval");
+		return withFields(fields, row, {
+			...requestOf(row, "get_approval"),
+			canDecide: row["canDecide"] === true,
+			decisions: recordsOf(row["decisions"] ?? [], "get_approval").map(decisionOf)
+		});
+	});
+	const decide = (id, decision, comment) => asApprover(id, () => one("decide_approval", {
+		request_id: id,
+		decision,
+		comment: comment ?? null
+	}));
+	return withBlockHooks({
+		request: ({ organizationId, subjectType, subjectId, action, reason, payload, ...extra }) => AsyncResult.from(() => extraFieldsArg(fields, extra)).andThen((more) => one("request_approval", {
+			tenant: organizationId,
+			subject_type: subjectType,
+			subject_id: subjectId,
+			action,
+			reason: reason ?? null,
+			payload: payload ?? {},
+			...more
+		})),
+		approve: (id, comment) => decide(id, "approved", comment),
+		reject: (id, comment) => decide(id, "rejected", comment),
+		delegate: (id, userId, comment) => asApprover(id, () => one("delegate_approval", {
+			request_id: id,
+			to_user: userId,
+			comment: comment ?? null
+		})),
+		cancel: (id) => one("cancel_approval", { request_id: id }),
+		get: getRequest,
+		list: (organizationId, list = {}) => call("list_approvals", {
+			tenant: organizationId,
+			status: list.status === void 0 ? "pending" : list.status,
+			assigned: list.assigned ?? false,
+			subject_type: list.subjectType ?? null,
+			subject_id: list.subjectId ?? null,
+			page_size: list.pageSize ?? null,
+			before: list.before?.toString() ?? null
+		}, (value) => recordsOf(value, "list_approvals").map((row) => [row, requestOf(row, "list_approvals")])).andThen((rows) => allWithFields(fields, rows)),
+		isApproved: (subjectType, subjectId, action) => call("is_approved", {
+			subject_type: subjectType,
+			subject_id: subjectId,
+			action
+		}, (value) => value === true)
+	}, options.hooks, {
+		block: "approvals",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+//#endregion
+//#region src/blocks/approvals/events.ts
+/** The `approvals` block's event types, for its manifest and `onBlockEvent`. */
+const approvalsEvents = defineEvents({
+	"approval.requested": event(),
+	"approval.approved": event(),
+	"approval.rejected": event(),
+	"approval.cancelled": event(),
+	"approval.expired": event(),
+	"approval.delegated": event()
+});
+//#endregion
+//#region src/blocks/approvals/manifest.ts
+/** The `approvals` block's manifest (ADR 0029). */
+const approvalsBlock = defineBlock({
+	name: "approvals",
+	sql: ["approvals"],
+	options: { approvals: approvalsSqlOptions },
+	events: approvalsEvents,
+	create: createApprovals,
+	category: "work",
+	recipes: ["approvals-queue"]
+});
+//#endregion
+export { approvalsBlock, approvalsEvents, createApprovals, dbTransport, rpcTransport, sqlTransport };

package/dist/blocks/attachments/index.d.ts

@@ -1,228 +1,19 @@
-/// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "../../result-BchM1XZn.js";
-import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-inD4fFq-.js";
-import { r as BlockTemporalOptions } from "../../block-helpers-C0Xj8War.js";
-import { m as JobHandler } from "../../types-D__3EN0q.js";
-import { i as EventSink } from "../../cloud-event-Dune0KI7.js";
-//#region src/blocks/attachments/attachments.d.ts
-interface StorageReply<T> {
-  readonly data: T | null;
-  readonly error: unknown;
-}
-/** The `supabase.storage.from(bucket)` methods attachments use. */
-interface AttachmentBucket {
-  createSignedUploadUrl(path: string): PromiseLike<StorageReply<{
-    readonly signedUrl: string;
-    readonly token: string;
-  }>>;
-  createSignedUrl(path: string, expiresIn: number, options?: {
-    download?: string | boolean;
-  }): PromiseLike<StorageReply<{
-    readonly signedUrl: string;
-  }>>;
-  download(path: string): PromiseLike<StorageReply<Blob>>;
-  remove(paths: string[]): PromiseLike<StorageReply<unknown>>;
-  /** Used by `put`, which uploads from the server. */
-  upload?(path: string, body: Blob | ArrayBuffer | Uint8Array, options?: {
-    readonly contentType?: string;
-    readonly upsert?: boolean;
-  }): PromiseLike<StorageReply<unknown>>;
-}
-/** `supabase.storage`, typed structurally. */
-interface AttachmentStorage {
-  from(bucket: string): AttachmentBucket;
-}
-interface AttachmentsOptions extends BlockTemporalOptions {
-  /** The caller's transport (`rpcTransport(supabase)`). */
-  readonly transport: BlockTransport;
-  /** The caller's `supabase.storage`, so the bucket policies apply. */
-  readonly storage: AttachmentStorage;
-  /** The module schema (`sql.modules.attachments.schema`), default `better_supabase`. */
-  readonly schema?: string;
-  readonly mappers?: readonly ErrorMapper[];
-  /** Must match `sql.modules.attachments.options.requireScan`. Default `true`. */
-  readonly requireScan?: boolean;
-  /** Lifetime of a signed download URL in seconds. Default 300. */
-  readonly downloadTtl?: number;
-}
-type AttachmentStatus = "pending" | "clean" | "infected" | "failed";
-interface Attachment {
-  readonly id: string;
-  /** `undefined` for a file of a subject without a tenant (`tenant: false`). */
-  readonly organizationId: string | undefined;
-  readonly subjectType: string | undefined;
-  readonly subjectId: string | undefined;
-  readonly bucket: string;
-  /** The object path in the bucket, `{organizationId}/attachments/{id}` unless `options.path` says otherwise. */
-  readonly path: string;
-  readonly name: string;
-  readonly mimeType: string;
-  readonly size: number;
-  readonly status: AttachmentStatus;
-  /** What the scanner reported, such as the signature it matched. */
-  readonly scanDetail: string | undefined;
-  /** What `upload` stored with the file; `{}` without any. */
-  readonly metadata: Readonly<Record<string, unknown>>;
-  readonly uploadedBy: string | undefined;
-  readonly createdAt: Temporal.Instant;
-  /** Set by `confirm()` once the object exists. */
-  readonly uploadedAt: Temporal.Instant | undefined;
-  readonly scannedAt: Temporal.Instant | undefined;
-}
-interface NewAttachment {
-  /** `null` for a subject type configured with `tenant: false`. */
-  readonly organizationId: string | null;
-  readonly name: string;
-  readonly mimeType: string;
-  /** Bytes; `confirm()` replaces it with the stored size. */
-  readonly size: number;
-  readonly subjectType?: string;
-  readonly subjectId?: string;
-  /** App data about the file, such as a caption or its source, kept with the record. */
-  readonly metadata?: Readonly<Record<string, unknown>>;
-}
-interface AttachmentUpload {
-  readonly attachment: Attachment;
-  /** PUT the file here, or pass `token` to `uploadToSignedUrl(path, token, file)`. */
-  readonly signedUrl: string;
-  readonly token: string;
-}
-interface AttachmentDownload {
-  readonly attachment: Attachment;
-  readonly signedUrl: string;
-}
-interface Attachments {
-  /**
-   * Creates the pending record and a signed upload URL for its path. When
-   * Storage refuses the URL, the record is deleted again.
-   */
-  upload(attachment: NewAttachment): AsyncResult<AttachmentUpload>;
-  /** Marks the upload done after the file is stored; emits `attachment.uploaded`. */
-  confirm(id: string): AsyncResult<Attachment>;
-  get(id: string): AsyncResult<Attachment>;
-  list(organizationId: string | null, subject?: {
-    readonly type: string;
-    readonly id: string;
-  }): AsyncResult<readonly Attachment[]>;
-  /**
-   * A signed URL for a file the scanner passed. `invalid_request` with hint
-   * `ATTACHMENT_NOT_SCANNED` until then, and for an infected file.
-   */
-  download(id: string, options?: {
-    readonly as?: string | boolean;
-  }): AsyncResult<AttachmentDownload>;
-  /** Deletes the file, then the record (the uploader, or `attachments.manage`). */
-  remove(id: string): AsyncResult<boolean>;
-  /**
-   * Creates the record, uploads `file` from the server and confirms it, for
-   * files the server makes or fetches (an export, a generated PDF, an
-   * import). Returns the confirmed attachment, which still waits for the
-   * scan when the module requires one. When Storage refuses the upload,
-   * the record is deleted again, so no pending record is left behind.
-   */
-  put(attachment: NewAttachment, file: Blob | ArrayBuffer | Uint8Array): AsyncResult<Attachment>;
-  /**
-   * The file's bytes, for server-side processing, behind the same scan gate
-   * as `download`: `ATTACHMENT_NOT_SCANNED` until the scan passes.
-   */
-  read(id: string): AsyncResult<{
-    readonly attachment: Attachment;
-    readonly file: Blob;
-  }>;
-}
-/** Attachments as the caller: the table's and the bucket's policies apply. */
-export declare function createAttachments(options: AttachmentsOptions): Attachments;
-/** A scanner's verdict on one file. */
-interface ScanVerdict {
-  readonly status: "clean" | "infected";
-  /** Stored as `scan_detail`, such as the matched signature. */
-  readonly detail?: string;
-}
-interface AttachmentScannerOptions extends BlockTemporalOptions {
-  /** A service-role transport: `set_attachment_status()` is granted to `service_role` only. */
-  readonly transport: BlockTransport;
-  /** A service-role `supabase.storage`, to read pending files. */
-  readonly storage: AttachmentStorage;
-  readonly schema?: string;
-  /** Scans the file (ClamAV, a scanning API). A throw records `failed` and rethrows. */
-  readonly scan: (file: Blob, attachment: Attachment, signal?: AbortSignal) => ScanVerdict | Promise<ScanVerdict>;
-  /** The outbox `typePrefix`. Default `dev.better-supabase`. */
-  readonly typePrefix?: string;
-}
-/** The payload `job` expects. */
-interface AttachmentScanJob {
-  readonly attachmentId: string;
-}
-interface AttachmentScanner {
-  /** Scans one uploaded file and records the verdict. */
-  scan(id: string, signal?: AbortSignal): AsyncResult<Attachment>;
-  /**
-   * A jobs handler: `queue.work('attachment-scans', scanner.job)`. A deleted
-   * attachment completes the job; other errors throw so the queue retries.
-   */
-  readonly job: JobHandler<AttachmentScanJob>;
-  /**
-   * An outbox sink that scans each `attachment.uploaded` event's file. An
-   * event for a deleted attachment is skipped, so it never holds up the
-   * events behind it; other errors throw so the relay retries the batch.
-   */
-  sink(): EventSink;
-}
-/**
- * Scans uploaded files with the app's `scan` function and records `clean`,
- * `infected` or `failed`. A file already clean or infected is not scanned
- * again, so replayed events and retried jobs are safe.
- */
-export declare function createAttachmentScanner(options: AttachmentScannerOptions): AttachmentScanner;
-/** A scanned object in any bucket (`scanned_objects`). */
-interface ScannedObject {
-  readonly bucket: string;
-  readonly path: string;
-  readonly status: AttachmentStatus;
-  readonly detail: string | undefined;
-  readonly scannedAt: Temporal.Instant | undefined;
-}
-interface ObjectScannerOptions extends BlockTemporalOptions {
-  /** A service-role transport: `set_object_scan()` is granted to `service_role` only. */
-  readonly transport: BlockTransport;
-  /** A service-role `supabase.storage`, to read the objects. */
-  readonly storage: AttachmentStorage;
-  readonly schema?: string;
-  /** Scans the file. A throw records `failed` and rethrows. */
-  readonly scan: (file: Blob, object: {
-    readonly bucket: string;
-    readonly path: string;
-  }, signal?: AbortSignal) => ScanVerdict | Promise<ScanVerdict>;
-  /** The outbox `typePrefix`. Default `dev.better-supabase`. */
-  readonly typePrefix?: string;
-}
-/** The payload `ObjectScanner.job` expects. */
-interface ObjectScanJob {
-  readonly bucket: string;
-  readonly path: string;
-}
-interface ObjectScanner {
-  /** Scans one object and records the verdict; a clean or infected object is not scanned again. */
-  scan(bucket: string, path: string, signal?: AbortSignal): AsyncResult<ScannedObject>;
-  /**
-   * A jobs handler: `queue.work('object-scans', scanner.job)`. An object
-   * deleted from storage completes the job; other errors throw.
-   */
-  readonly job: JobHandler<ObjectScanJob>;
-  /**
-   * An outbox sink that scans each `object.uploaded` event's object. An
-   * event for an object deleted from storage is skipped; other errors throw
-   * so the relay retries the batch.
-   */
-  sink(): EventSink;
-}
-/**
- * The scan gate for objects outside the attachments table, such as a file
- * drive or avatars: scans an object with the app's `scan` function and
- * records the verdict in `scanned_objects`, which storage policies read with
- * `object_clean(bucket_id, name)`. With `options.scanBuckets`, new objects in
- * those buckets get a pending row and an `object.uploaded` event.
- */
-export declare function createObjectScanner(options: ObjectScannerOptions): ObjectScanner;
+import { ot as StorageObjectEventData, wt as Events, y as AttachmentEventData } from "../../events-CTreRrgP.js";
+import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DaGGXjIw.js";
+import { s as BlockOf } from "../../define-block-CLZMEFeK.js";
+import { C as createAttachments, S as createAttachmentScanner, _ as ObjectScanJob, a as Attachment, b as ScanVerdict, c as AttachmentScanJob, d as AttachmentStatus, f as AttachmentStorage, g as NewAttachment, h as AttachmentsOptions, l as AttachmentScanner, m as Attachments, o as AttachmentBucket, p as AttachmentUpload, s as AttachmentDownload, u as AttachmentScannerOptions, v as ObjectScanner, w as createObjectScanner, x as ScannedObject, y as ObjectScannerOptions } from "../../ports-Ca63W4cW.js";
+//#region src/blocks/attachments/events.d.ts
+/** The events of the `attachments` block: type to data. */
+type AttachmentsEvents = {
+  readonly "object.uploaded": StorageObjectEventData;
+  readonly "attachment.uploaded": AttachmentEventData;
+  readonly "attachment.scanned": AttachmentEventData;
+};
+/** The `attachments` block's event types, for its manifest and `onBlockEvent`. */
+export declare const attachmentsEvents: Events<AttachmentsEvents>;
 //#endregion
-export { type Attachment, type AttachmentBucket, type AttachmentDownload, type AttachmentScanJob, type AttachmentScanner, type AttachmentScannerOptions, type AttachmentStatus, type AttachmentStorage, type AttachmentUpload, type Attachments, type AttachmentsOptions, type BlockTransport, type NewAttachment, type ObjectScanJob, type ObjectScanner, type ObjectScannerOptions, type ScanVerdict, type ScannedObject, dbTransport, rpcTransport, sqlTransport };
+//#region src/blocks/attachments/manifest.d.ts
+/** The `attachments` block's manifest (ADR 0029). */
+export declare const attachmentsBlock: BlockOf<"attachments", typeof createAttachments, AttachmentsEvents, Record<never, never>, "attachments">;
+//#endregion
+export { type Attachment, type AttachmentBucket, type AttachmentDownload, type AttachmentScanJob, type AttachmentScanner, type AttachmentScannerOptions, type AttachmentStatus, type AttachmentStorage, type AttachmentUpload, type Attachments, type AttachmentsEvents, type AttachmentsOptions, type BlockTransport, type NewAttachment, type ObjectScanJob, type ObjectScanner, type ObjectScannerOptions, type ScanVerdict, type ScannedObject, createAttachmentScanner, createAttachments, createObjectScanner, dbTransport, rpcTransport, sqlTransport };