better-supabase 0.9.0 → 0.10.0

package/dist/{topic-ByDz9edV.js → topic-DB-1YTMj.js}

@@ -1,12 +1,12 @@
 import { n as dbError } from "./errors-8i6tSICm.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-BlgnMB0H.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-COkvI9t5.js";
 import { a as tenantClaimPaths } from "./claims-PqzCxaTD.js";
-import { t as refreshRealtimeAuth } from "./auth-CdBKt0CS.js";
 import { a as sqlString, i as sqlIdent, n as parseTemplate, r as slug, t as claimSql } from "./template-DdgYjIZ5.js";
+import { a as isScopeName, i as fillTemplate, o as resolveProviderSql, r as accessCheck } from "./access-sql-DUSSMaC3.js";
+import { t as refreshRealtimeAuth } from "./auth-CdBKt0CS.js";
 import { t as allowedSubscribers } from "./subscribers-Cq--DL1E.js";
 import { t as joinTopic } from "./channels-C-GCoNLd.js";
 import { t as toApp } from "./casing-DdFWEtqr.js";
-import { a as isScopeName, i as fillTemplate, o as resolveProviderSql, r as accessCheck } from "./access-sql-DUSSMaC3.js";
 import { t as topicStatus } from "./realtime-status-D2dw1hOE.js";
 //#region src/realtime/fan-out.ts
 /** Runs the policy, then `send` for each subscriber it keeps, one at a time. */
@@ -61,21 +61,38 @@ function topicPermissionSql(input) {
 	if (tenant === void 0) throw new TypeError(`${where}: permission "${key}" needs the authorization provider's \`permitted\` template, or a tenant segment for the tenant check`);
 	return accessCheck(where, {}, key, tenant);
 }
+const splitTable = (table) => table.includes(".") ? [table.slice(0, table.indexOf(".")), table.slice(table.indexOf(".") + 1)] : ["public", table];
 function columnSql(meta, column, where) {
 	const db = meta.columns[column]?.db;
 	if (!db) throw new TypeError(`defineTopic: no column for ${where} on "${meta.key}" ("${column}")`);
 	return sqlIdent(db);
 }
-/** A trigger value as SQL on `rec`, with one subquery per lookup. */
-function triggerValueSql(tables, meta, value, where, depth = 0) {
-	if (typeof value === "string") return `rec.${columnSql(meta, value, where)}`;
+function lookupTarget(tables, value, where) {
 	const joined = tables[value.from];
 	if (!joined) throw new TypeError(`defineTopic: unknown table "${value.from}" for ${where}`);
 	const key = value.key ?? (joined.primaryKey.length === 1 ? joined.primaryKey[0] : void 0);
 	if (key === void 0) throw new TypeError(`defineTopic: "${value.from}" has no single-column primary key; name its key for ${where}`);
+	return {
+		relation: `${sqlIdent(joined.schema)}.${sqlIdent(joined.name)}`,
+		key: columnSql(joined, key, where),
+		select: columnSql(joined, value.select, where)
+	};
+}
+function rawLookupTarget(value) {
+	const [schema, name] = splitTable(value.from);
+	return {
+		relation: `${sqlIdent(schema)}.${sqlIdent(name)}`,
+		key: sqlIdent(value.key ?? "id"),
+		select: sqlIdent(value.select)
+	};
+}
+/** A trigger value as SQL on `rec`, with one subquery per lookup. */
+function triggerValueSql(tables, meta, value, where, depth = 0) {
+	if (typeof value === "string") return `rec.${meta ? columnSql(meta, value, where) : sqlIdent(value)}`;
+	const target = tables && meta ? lookupTarget(tables, value, where) : rawLookupTarget(value);
 	const alias = `j${String(depth)}`;
 	const via = triggerValueSql(tables, meta, value.via, where, depth + 1);
-	return `(select ${alias}.${columnSql(joined, value.select, where)} from ${sqlIdent(joined.schema)}.${sqlIdent(joined.name)} ${alias} where ${alias}.${columnSql(joined, key, where)} = ${via} limit 1)`;
+	return `(select ${alias}.${target.select} from ${target.relation} ${alias} where ${alias}.${target.key} = ${via} limit 1)`;
 }
 /** The event name: one for every operation, one per operation, or the operation. */
 function eventSql(event) {
@@ -168,7 +185,14 @@ function triggerFunctionSql(input) {
 }
 //#endregion
 //#region src/realtime/topic.ts
-const splitTable = (table) => table.includes(".") ? [table.slice(0, table.indexOf(".")), table.slice(table.indexOf(".") + 1)] : ["public", table];
+const columnsOnly = (values) => {
+	const columns = {};
+	for (const [param, value] of Object.entries(values ?? {})) {
+		if (typeof value === "object") return;
+		if (value !== void 0) columns[param] = value;
+	}
+	return columns;
+};
 const VALUE = /^[\w.@+=-]+$/;
 const snakeCase = (name) => name.replaceAll(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
 function validateValue(_name, value) {
@@ -279,11 +303,10 @@ function defineTopic(template, options = {}) {
 			for (const key of Object.keys(given ?? {})) if (!params.includes(key)) throw new TypeError(`${where}: "${key}" is not a placeholder of ${topic}`);
 		};
 		checkKeys(parsed.params, trigger.values, template);
-		if (!meta && extra.length === 0 && typeof trigger.event !== "object" && (payload === void 0 || typeof payload === "string")) {
-			const columns = trigger.values ?? {};
+		const columns = columnsOnly(trigger.values);
+		if (!meta && columns !== void 0 && extra.length === 0 && typeof trigger.event !== "object" && (payload === void 0 || typeof payload === "string")) {
 			const sqlTemplate = template.replaceAll(/\{([^}]+)\}/g, (_, param) => {
 				const column = columns[param] ?? snakeCase(param);
-				if (typeof column !== "string") throw new TypeError(`${where}: a lookup for {${param}} needs betterSupabase`);
 				if (/[{}=]/.test(column)) throw new TypeError(`${where}: the column for {${param}} can't contain braces or =`);
 				return column === param ? `{${param}}` : `{${param}=${column}}`;
 			});
@@ -298,11 +321,7 @@ function defineTopic(template, options = {}) {
 				""
 			].join("\n");
 		}
-		const valueSql = (value, label) => {
-			if (tables && meta) return triggerValueSql(tables, meta, value, label);
-			if (typeof value !== "string") throw new TypeError(`${where}: a lookup for ${label} needs betterSupabase`);
-			return `rec.${sqlIdent(value)}`;
-		};
+		const valueSql = (value, label) => triggerValueSql(tables, meta, value, label);
 		const topicValues = (params, given, topic) => Object.fromEntries(params.map((param) => {
 			const value = given?.[param] ?? (meta ? void 0 : snakeCase(param));
 			if (value === void 0) throw new TypeError(`defineTopic: no column for {${param}} of ${topic} on "${table}"`);

package/dist/{topic-cMS7UtM1.d.ts → topic-Dgs-eSYQ.d.ts}

@@ -1,10 +1,10 @@
 import { E as ValidationIssue, b as DbError, t as AsyncResult } from "./result-Cj3yWhjH.js";
-import { M as Row, a as AnyModels, i as AnyFunctions, r as AccessTopicPolicy, z as TableKey } from "./types-YfwpIE-d.js";
-import { t as AuthorizationFunctions } from "./authorization-DpRfs6Wx.js";
+import { M as Row, a as AnyModels, i as AnyFunctions, r as AccessTopicPolicy, z as TableKey } from "./types-BO8lVTun.js";
+import { t as AuthorizationFunctions } from "./authorization-CdJRoZgV.js";
 import { t as RealtimeStatus } from "./realtime-status-DcsO00Gw.js";
-import { J as TemplateValues, q as TemplateParams } from "./storage-api-Cx-1iWBd.js";
-import { t as BetterSupabase } from "./define-DxHHbNEb.js";
-import { g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, m as Subscriber } from "./authorization-hooks-DkmrnDX7.js";
+import { J as TemplateValues, q as TemplateParams } from "./storage-api-B4Ib2Zpo.js";
+import { t as BetterSupabase } from "./define-DXTC706J.js";
+import { g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, m as Subscriber } from "./authorization-hooks-Do5djkpz.js";
 import { RealtimeChannel, SupabaseClient } from "@supabase/supabase-js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/realtime/fan-out.d.ts
@@ -235,17 +235,30 @@ interface TriggerOptions<M extends AnyModels, T extends keyof M, P extends strin
   /** More topics the row change goes to, each with its own values. */
   readonly topics?: readonly TriggerTopic<TriggerValue<M, T>>[];
 }
-/** `topic.trigger()` with columns only. */
+interface TopicTriggerLookup {
+  readonly from: string;
+  readonly via: string | TopicTriggerLookup;
+  readonly select: string;
+  readonly key?: string;
+}
+type TopicTriggerValue = string | TopicTriggerLookup;
+/** `topic.trigger()` without `betterSupabase`: database names. */
 interface TopicTriggerOptions<P extends string> extends TriggerCommonOptions {
   /**
-   * The column that fills each placeholder. Defaults to the placeholder in
-   * snake_case (`{organizationId}` reads `organization_id`).
+   * The column or lookup that fills each placeholder. Defaults to the
+   * placeholder in snake_case (`{organizationId}` reads `organization_id`).
    */
-  readonly values?: { readonly [K in TemplateParams<P>]?: string; };
-  /** `"keys"` (default) or `"row"`, which bypasses column grants. */
-  readonly payload?: TriggerPayloadMode;
-  /** More topics the row change goes to, each with its own columns. */
-  readonly topics?: readonly TriggerTopic<string>[];
+  readonly values?: { readonly [K in TemplateParams<P>]?: TopicTriggerValue; };
+  /**
+   * `"keys"` (default), `"row"` (bypasses column grants), or the payload
+   * itself: each key is a column, a lookup, or `{ sql }`, an expression on
+   * the row `{row}` (`tg_op` is the operation).
+   */
+  readonly payload?: TriggerPayloadMode | Readonly<Record<string, TopicTriggerValue | {
+    readonly sql: string;
+  }>>;
+  /** More topics the row change goes to, each with its own values. */
+  readonly topics?: readonly TriggerTopic<TopicTriggerValue>[];
 }
 /** A row change sent with `payload: "row"`. */
 interface RowChange<R> {
@@ -306,10 +319,11 @@ interface Topic<P extends string, E extends EventSchemas, R extends PresenceSche
    * a value topics don't allow skips that topic with a warning instead of
    * failing the write.
    *
-   * With `betterSupabase`, `table` is a table key and values can be
-   * lookups; the statement creates a function for the topic. Without it,
-   * `table` is `table` or `schema.table`, and a single topic calls
+   * With `betterSupabase`, `table`, columns and lookup tables are app keys.
+   * Without it they are database names, and a single topic whose values
+   * are columns, with a mode payload and one event name, calls
    * `better_supabase.broadcast_topic()` from the `realtime-tables` module.
+   * Every other trigger creates a function for the topic.
    *
    * The payload carries keys only unless `payload` says otherwise:
    * `payload: "row"` sends whole rows and bypasses column grants.
@@ -356,4 +370,4 @@ declare function rowKeys<M extends AnyModels, D, F extends AnyFunctions, X, T ex
  */
 declare function rowChange<M extends AnyModels, D, F extends AnyFunctions, X, T extends TableKey<M>>(betterSupabase: BetterSupabase<M, D, F, X>, table: T, message: TopicMessage): RowChange<Row<M, T>> | null;
 //#endregion
-export { defineTopic as A, TopicSubscription as C, TriggerPayloadMode as D, TriggerOptions as E, rowKeys as M, FanOutResult as N, TriggerTopic as O, TopicFanOutOptions as P, TopicSubscribeOptions as S, TriggerLookup as T, TopicMessage as _, PresenceOutput as a, TopicPermission as b, RealtimeClient as c, SubscribeOptions as d, Subscription as f, TopicHandlers as g, TopicEvent as h, PresenceOptions as i, rowChange as j, TriggerValue as k, RowChange as l, Topic as m, PresenceInput as n, PresenceSchema as o, SubscriptionStatus as p, PresenceMember as r, PresenceSubscription as s, EventSchemas as t, RowKeys as u, TopicOptions as v, TopicTriggerOptions as w, TopicSqlOptions as x, TopicPayload as y };
+export { TriggerTopic as A, TopicSubscription as C, TriggerLookup as D, TopicTriggerValue as E, FanOutResult as F, TopicFanOutOptions as I, defineTopic as M, rowChange as N, TriggerOptions as O, rowKeys as P, TopicSubscribeOptions as S, TopicTriggerOptions as T, TopicMessage as _, PresenceOutput as a, TopicPermission as b, RealtimeClient as c, SubscribeOptions as d, Subscription as f, TopicHandlers as g, TopicEvent as h, PresenceOptions as i, TriggerValue as j, TriggerPayloadMode as k, RowChange as l, Topic as m, PresenceInput as n, PresenceSchema as o, SubscriptionStatus as p, PresenceMember as r, PresenceSubscription as s, EventSchemas as t, RowKeys as u, TopicOptions as v, TopicTriggerLookup as w, TopicSqlOptions as x, TopicPayload as y };

package/dist/{types-YfwpIE-d.d.ts → types-BO8lVTun.d.ts}

@@ -54,6 +54,12 @@ interface ColumnMeta {
   readonly insertable?: false;
   /** `false` when updates can't set this column. */
   readonly updatable?: false;
+  /**
+   * `false` when signed-in users can't read the column (an app table
+   * column with `access: "server"`). Reads without `select` leave it out;
+   * the service role can still select it by name.
+   */
+  readonly selectable?: false;
   readonly array?: boolean;
   readonly json?: boolean;
   /** Allowed values for enum columns and CHECK-constraint unions. */

package/dist/{types-D0W4fnsc.d.ts → types-C_GN-4ed.d.ts}

@@ -1,10 +1,10 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { i as CredentialRef, r as CredentialProvider } from "./provider-9gBq9W6k.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
+import { i as CredentialRef, r as CredentialProvider } from "./provider-CQ1SrhLa.js";
+import { t as BlockTransport } from "./block-transport-NbUJygA7.js";
+import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-7pMBVsE6.js";
+import { n as BlockHooks } from "./block-hooks-C_WaodoA.js";
 //#region src/blocks/ai-providers/types.d.ts
 /** A tenant's own key for a provider. The key itself stays in the credential provider. */
 interface AiProviderKey {

package/dist/types-DGHfTW8_.d.ts

@@ -0,0 +1,9 @@
+//#region src/create/types.d.ts
+/** One rendered file: its path, the SQL module it belongs to and its contents. */
+interface PresetMigrationFile {
+  readonly path: string;
+  readonly module: string;
+  readonly contents: string;
+}
+//#endregion
+export { PresetMigrationFile as t };

package/dist/{types-pNY_UpDs.d.ts → types-DM8q3IOr.d.ts}

@@ -2,9 +2,9 @@
 import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
 import { t as StandardSchemaV1 } from "./standard-C3_AAF3g.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
+import { t as BlockTransport } from "./block-transport-NbUJygA7.js";
+import { r as BlockTemporalOptions } from "./block-helpers-7pMBVsE6.js";
+import { n as BlockHooks } from "./block-hooks-C_WaodoA.js";
 import { r as FieldsOf } from "./block-fields-5UA84ZUg.js";
 import { i as AiMessage } from "./message-B0fNJgq8.js";
 //#region src/blocks/ai-files/types.d.ts

package/dist/{types-6oiy6rIa.d.ts → types-DOaUIJxW.d.ts}

@@ -1,10 +1,10 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
-import { n as Embedder } from "./knowledge-BXQ2-V0a.js";
+import { t as BlockTransport } from "./block-transport-NbUJygA7.js";
+import { r as BlockTemporalOptions } from "./block-helpers-7pMBVsE6.js";
+import { n as BlockHooks } from "./block-hooks-C_WaodoA.js";
+import { n as Embedder } from "./knowledge-BYtgA52P.js";
 //#region src/blocks/memory/types.d.ts
 type MemoryScope = "user" | "agent" | "chat" | "project" | "organization";
 type MemoryKind = "core" | "archival";

package/dist/{types-vaoP9S9_.d.ts → types-DZj8CZMH.d.ts}

@@ -2,14 +2,14 @@
 import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
 import { t as StandardSchemaV1 } from "./standard-C3_AAF3g.js";
-import { i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "./provider-9gBq9W6k.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
+import { i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "./provider-CQ1SrhLa.js";
+import { t as BlockTransport } from "./block-transport-NbUJygA7.js";
+import { r as BlockTemporalOptions } from "./block-helpers-7pMBVsE6.js";
+import { n as BlockHooks } from "./block-hooks-C_WaodoA.js";
 import { n as ExtraFields, r as FieldsOf } from "./block-fields-5UA84ZUg.js";
-import { i as AuthorizationHooks } from "./authorization-hooks-DkmrnDX7.js";
-import { h as FilterQuery, l as FilterFieldType } from "./filter-query-BKmRYrTE.js";
-import { f as WorkflowStarter, g as Workflows, p as WorkflowSubject, r as WorkflowRunMode, s as WorkflowSchedule } from "./workflows-DFQeXDAI.js";
+import { i as AuthorizationHooks } from "./authorization-hooks-Do5djkpz.js";
+import { h as FilterQuery, l as FilterFieldType } from "./filter-query-D3wOD1P_.js";
+import { f as WorkflowStarter, g as Workflows, p as WorkflowSubject, r as WorkflowRunMode, s as WorkflowSchedule } from "./workflows-DJXoxDZH.js";
 //#region src/blocks/workflow-builder/graph.d.ts
 type WorkflowNodeKind = "trigger" | "step" | "sleep" | "approval" | "condition";
 type WorkflowConditionOperator = "equals" | "notEquals" | "exists" | "truthy" | "greaterThan" | "lessThan" | "contains";
@@ -630,6 +630,20 @@ interface WorkflowBuilder<F extends object = Record<never, never>> {
       readonly batch?: number;
     }): AsyncResult<number>;
   };
+  /**
+   * An outbox consumer handler that passes each event to `triggers.onEvent`,
+   * for `outbox.consume("workflows", builder.sink())`. It
+   * throws when a start fails, so the outbox retries the event.
+   */
+  sink(): (events: readonly WorkflowSinkEvent[]) => Promise<void>;
+}
+/** An outbox row as a consumer hands it over; an `OutboxEvent` fits. */
+interface WorkflowSinkEvent {
+  readonly id: string;
+  readonly type: string;
+  readonly payload?: unknown;
+  readonly tenant?: string | null;
+  readonly actorId?: string | null;
 }
 //#endregion
-export { validateGraph as $, WorkflowVersion as A, WorkflowGraphDiff as B, WorkflowGrantAction as C, WorkflowStepInfo as D, WorkflowNodeRunStatus as E, WorkflowCondition as F, approved as G, WorkflowGraphNode as H, WorkflowConditionOperator as I, evaluateCondition as J, diffGraphs as K, WorkflowFilterCondition as L, WorkflowVersionStatus as M, GraphScope as N, WorkflowTrigger as O, TriggerEvent as P, triggerMatches as Q, WorkflowFilterField as R, WorkflowDefinitionScope as S, WorkflowNodeRun as T, WorkflowNodeCondition as U, WorkflowGraphEdge as V, WorkflowNodeKind as W, matchesFilter as X, filterConditionOf as Y, topologicalOrder as Z, WorkflowBuilder as _, CredentialInput as a, WorkflowDefinition as b, GraphCompiler as c, PublishOptions as d, RunInput as f, WorkflowAlert as g, VersionSaveOptions as h, BuilderStarter as i, WorkflowVersionOwner as j, WorkflowTriggerKind as k, NodeRunRecord as l, TriggerInput as m, BuilderOptions as n, DefinitionInput as o, TestRunInput as p, durationMs as q, BuilderStartCall as r, GrantInput as s, AlertInput as t, OutboxLikeEvent as u, WorkflowBuilderHooks as v, WorkflowGrantPrincipal as w, WorkflowDefinitionGrant as x, WorkflowCredential as y, WorkflowGraph as z };
+export { triggerMatches as $, WorkflowTriggerKind as A, WorkflowGraph as B, WorkflowGrantAction as C, WorkflowSinkEvent as D, WorkflowNodeRunStatus as E, TriggerEvent as F, WorkflowNodeKind as G, WorkflowGraphEdge as H, WorkflowCondition as I, durationMs as J, approved as K, WorkflowConditionOperator as L, WorkflowVersionOwner as M, WorkflowVersionStatus as N, WorkflowStepInfo as O, GraphScope as P, topologicalOrder as Q, WorkflowFilterCondition as R, WorkflowDefinitionScope as S, WorkflowNodeRun as T, WorkflowGraphNode as U, WorkflowGraphDiff as V, WorkflowNodeCondition as W, filterConditionOf as X, evaluateCondition as Y, matchesFilter as Z, WorkflowBuilder as _, CredentialInput as a, WorkflowDefinition as b, GraphCompiler as c, PublishOptions as d, validateGraph as et, RunInput as f, WorkflowAlert as g, VersionSaveOptions as h, BuilderStarter as i, WorkflowVersion as j, WorkflowTrigger as k, NodeRunRecord as l, TriggerInput as m, BuilderOptions as n, DefinitionInput as o, TestRunInput as p, diffGraphs as q, BuilderStartCall as r, GrantInput as s, AlertInput as t, OutboxLikeEvent as u, WorkflowBuilderHooks as v, WorkflowGrantPrincipal as w, WorkflowDefinitionGrant as x, WorkflowCredential as y, WorkflowFilterField as z };

package/dist/{types-CdP0z5tS.d.ts → types-P1S1cj6N.d.ts}

@@ -1,11 +1,11 @@
 /// <reference lib="esnext.temporal" />
 import { b as DbError, t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
-import { m as RequestContext, t as Actor } from "./plugin-CDLJRFFg.js";
+import { m as RequestContext, t as Actor } from "./plugin-D5OIaP93.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { n as SqlClient } from "./executor-BBHgjUJu.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
+import { n as SqlClient } from "./executor-DzJQVTE2.js";
+import { t as BlockTransport } from "./block-transport-NbUJygA7.js";
+import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-7pMBVsE6.js";
+import { n as BlockHooks } from "./block-hooks-C_WaodoA.js";
 import { t as BlockProblemOptions } from "./problem-CEjyhV5T.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/auth/delegation.d.ts

package/dist/{undo-CEGIRkPA.js → undo-0qM13zul.js}

@@ -1,8 +1,8 @@
 import { n as dbError } from "./errors-8i6tSICm.js";
-import { a as ok, t as AsyncResult } from "./result-BlgnMB0H.js";
+import { a as ok, t as AsyncResult } from "./result-COkvI9t5.js";
 import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { o as blockCall } from "./block-helpers-CfG_MvDR.js";
-import { r as withBlockHooks } from "./block-hooks-BsXncUlZ.js";
+import { o as blockCall } from "./block-helpers-BfVCR5Fc.js";
+import { r as withBlockHooks } from "./block-hooks-ByKlh8Qy.js";
 //#region src/blocks/undo/undo.ts
 /** The functions an undo token may call: the inverses the blocks return. */
 const UNDO_FUNCTIONS = [

package/dist/{undo-DGo0skyO.d.ts → undo-D42sPjCf.d.ts}

@@ -1,7 +1,7 @@
 import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
+import { t as BlockTransport } from "./block-transport-NbUJygA7.js";
+import { n as BlockHooks } from "./block-hooks-C_WaodoA.js";
 //#region src/blocks/undo/undo.d.ts
 /** One call that reverses part of a change. */
 interface UndoCall {

package/dist/{usage-CdlfuS3i.js → usage-BrJGPvCq.js}

@@ -1,6 +1,6 @@
 import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { C as optionalText, D as recordOf, I as textOf, M as seconds, R as toInstant, k as recordsOf, n as applyTemporal, o as blockCall, t as DEFAULT_BLOCK_SCHEMA, u as eachLimit, w as pageOf } from "./block-helpers-CfG_MvDR.js";
-import { r as withBlockHooks } from "./block-hooks-BsXncUlZ.js";
+import { C as optionalText, D as recordOf, I as textOf, M as seconds, R as toInstant, k as recordsOf, n as applyTemporal, o as blockCall, t as DEFAULT_BLOCK_SCHEMA, u as eachLimit, w as pageOf } from "./block-helpers-BfVCR5Fc.js";
+import { r as withBlockHooks } from "./block-hooks-ByKlh8Qy.js";
 import { t as lazyStripe } from "./stripe-XZrSmDTf.js";
 //#region src/blocks/usage/usage.ts
 const numberOf = (value) => typeof value === "number" ? value : Number(value);

package/dist/{usage-DM2rzczj.d.ts → usage-CnQHSM_r.d.ts}

@@ -1,10 +1,10 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult } from "./result-Cj3yWhjH.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { i as CursorPageOptions, n as BlockOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
-import { g as JobHandler } from "./types-CdP0z5tS.js";
+import { t as BlockTransport } from "./block-transport-NbUJygA7.js";
+import { i as CursorPageOptions, n as BlockOptions } from "./block-helpers-7pMBVsE6.js";
+import { n as BlockHooks } from "./block-hooks-C_WaodoA.js";
+import { g as JobHandler } from "./types-P1S1cj6N.js";
 import { n as StripeSource } from "./stripe-NVcNOhHy.js";
 //#region src/blocks/usage/usage.d.ts
 interface UsageOptions extends BlockOptions {

package/dist/{vault-tOkPLnMB.d.ts → vault-EnOQJWjn.d.ts}

@@ -1,6 +1,6 @@
 import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
-import { c as SetCredentialOptions, i as CredentialRef, r as CredentialProvider } from "./provider-9gBq9W6k.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
+import { c as SetCredentialOptions, i as CredentialRef, r as CredentialProvider } from "./provider-CQ1SrhLa.js";
+import { t as BlockTransport } from "./block-transport-NbUJygA7.js";
 //#region src/credentials/vault.d.ts
 /** How a request the third party sends is signed with the stored secret. */
 type VaultInboundScheme = "standard-webhooks" | "hmac-sha256" | "shared-secret";

package/dist/vercel-connect/index.d.ts

@@ -1,4 +1,4 @@
-import { a as CredentialSubject, r as CredentialProvider } from "../provider-9gBq9W6k.js";
+import { a as CredentialSubject, r as CredentialProvider } from "../provider-CQ1SrhLa.js";
 //#region src/vercel-connect/vercel-connect.d.ts
 interface ConnectTokenParams {
   subject: CredentialSubject;

package/dist/vercel-connect/index.js

@@ -1,6 +1,6 @@
 import { n as dbError } from "../errors-8i6tSICm.js";
 import { c as optionalTemporal } from "../temporal-CB5Fpo5d.js";
-import { a as ok, r as err, t as AsyncResult } from "../result-BlgnMB0H.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-COkvI9t5.js";
 import { n as isRecord } from "../guards-6F2bCtQR.js";
 import { t as importOptionalPeer } from "../optional-peer-Dx8TaYXw.js";
 //#region src/vercel-connect/vercel-connect.ts

package/dist/{verify-D63A2ALE.d.ts → verify-3NLjUIER.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { f as Result } from "./result-Cj3yWhjH.js";
-import { M as Row, a as AnyModels, i as AnyFunctions, z as TableKey } from "./types-YfwpIE-d.js";
-import { t as BetterSupabase } from "./define-DxHHbNEb.js";
+import { M as Row, a as AnyModels, i as AnyFunctions, z as TableKey } from "./types-BO8lVTun.js";
+import { t as BetterSupabase } from "./define-DXTC706J.js";
 import { n as VerifyOptions, r as WebhookInput, t as VerifiedWebhook } from "./signatures-BMdJ7neI.js";
 //#region src/blocks/webhooks/verify.d.ts
 /** The `Stripe-Signature` header for `body`, for tests and local replays. */

package/dist/{verify-EQcC3Khp.js → verify-C9D_jjsQ.js}

@@ -1,9 +1,9 @@
 import { n as dbError } from "./errors-8i6tSICm.js";
 import { c as optionalTemporal, s as nowInstant } from "./temporal-CB5Fpo5d.js";
 import { n as temporalMissing } from "./temporal-required-DqRzr7i0.js";
-import { a as ok, r as err } from "./result-BlgnMB0H.js";
+import { a as ok, r as err } from "./result-COkvI9t5.js";
 import { n as hmacHex, r as timingSafeEqual } from "./hmac-DCud0myt.js";
-import { a as unauthorized, n as header, r as replayed, s as verifyWebhook } from "./signatures-B41ApWXA.js";
+import { a as unauthorized, n as header, r as replayed, s as verifyWebhook } from "./signatures-C9CGYZS1.js";
 import { t as toApp } from "./casing-DdFWEtqr.js";
 //#region src/blocks/webhooks/verify.ts
 /** Stripe signs with the endpoint secret's UTF-8 bytes, not its base64 decoding. */

package/dist/{version-D87ZteKy.js → version-Bxj_xcUY.js}

@@ -1,4 +1,4 @@
 //#region src/core/version.ts
-const VERSION = "0.9.0";
+const VERSION = "0.10.0";
 //#endregion
 export { VERSION as t };

package/dist/{view-Dv0A949a.d.ts → view-SuASaomx.d.ts}

@@ -1,5 +1,5 @@
 import { b as DbError } from "./result-Cj3yWhjH.js";
-import { i as InvalidReason, r as AuthState } from "./resolve-w9EpHzuM.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-7atr-wWr.js";
 import { a as SessionActor, o as SessionDelegation } from "./actor-BAhb-d1S.js";
 import { n as Impersonator } from "./impersonation-D5chOkrO.js";
 import { n as AmrEntry, t as Aal } from "./mfa-DtflCXEt.js";

package/dist/vue/index.d.ts

@@ -1,11 +1,11 @@
 import { b as DbError } from "../result-Cj3yWhjH.js";
-import { J as TemplateValues } from "../storage-api-Cx-1iWBd.js";
-import { at as QuerySpec } from "../define-DxHHbNEb.js";
-import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-cMS7UtM1.js";
-import { t as AuthSnapshot } from "../bind-a7sUgvf4.js";
-import { t as AuthSession } from "../view-Dv0A949a.js";
-import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-CWXN_h_E.js";
-import { t as SupportView } from "../support-view-BbcZR7Io.js";
+import { J as TemplateValues } from "../storage-api-B4Ib2Zpo.js";
+import { at as QuerySpec } from "../define-DXTC706J.js";
+import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-Dgs-eSYQ.js";
+import { t as AuthSnapshot } from "../bind-DkaP_0iS.js";
+import { t as AuthSession } from "../view-SuASaomx.js";
+import { a as BroadcastOptions, c as LiveCountHookOptions, d as PresenceHookOptions, f as PresenceTopic, i as ActionState, l as LiveCountSource, m as UseActionOptions, n as ActionInputOf, o as ClaimsOf, p as ProfileOf, r as ActionResultOf, s as ClientLike, t as fieldErrorsOf, u as LiveQueryHookOptions } from "../field-errors-nFnYWvB0.js";
+import { t as SupportView } from "../support-view-CznLe4jq.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { App, ComputedRef, MaybeRefOrGetter, Ref } from "vue";
 import { QueryClient } from "@tanstack/query-core";

package/dist/{vue-controller-HPfMTDa2.d.ts → vue-controller-D_ohttBZ.d.ts}

@@ -1,4 +1,4 @@
-import { n as Controller } from "./controller-D845qKh2.js";
+import { n as Controller } from "./controller-CCb9tHw_.js";
 import { ShallowRef } from "vue";
 //#region src/blocks/vue-controller.d.ts
 /** A block controller in a Vue component: `state` follows the controller. */

package/dist/{watch-DT_B3CnJ.js → watch-Blj1mQ9n.js}

@@ -1,5 +1,5 @@
 import { r as isPlainObject } from "./clone-dN9XOL1K.js";
-import { r as err, s as toDbError } from "./result-BlgnMB0H.js";
+import { r as err, s as toDbError } from "./result-COkvI9t5.js";
 //#region src/core/share.ts
 function sameValue(prev, next) {
 	if (Object.is(prev, next)) return true;

package/dist/{watch-DDuWYv0Y.d.ts → watch-D1wwzZ04.d.ts}

@@ -1,9 +1,9 @@
 import { b as DbError, f as Result } from "./result-Cj3yWhjH.js";
-import { P as SchemaMeta, a as AnyModels, i as AnyFunctions, z as TableKey } from "./types-YfwpIE-d.js";
-import { t as BetterSupabase } from "./define-DxHHbNEb.js";
-import { i as ListDefinition } from "./list-query-PvP3pPGQ.js";
-import { c as SqliteCompilerOptions, p as SqlitePlan, t as PowerSyncDatabaseLike } from "./executor-DKrZr3AC.js";
-import { t as Compiler } from "./compiler-BVxepAY0.js";
+import { P as SchemaMeta, a as AnyModels, i as AnyFunctions, z as TableKey } from "./types-BO8lVTun.js";
+import { t as BetterSupabase } from "./define-DXTC706J.js";
+import { i as ListDefinition } from "./list-query-DWJIiVz_.js";
+import { c as SqliteCompilerOptions, p as SqlitePlan, t as PowerSyncDatabaseLike } from "./executor-CIxyatuB.js";
+import { t as Compiler } from "./compiler-C6E3WwIi.js";
 //#region src/powersync/compiler.d.ts
 declare const sqliteCompiler: Compiler<SqlitePlan>;
 interface CheckSqliteOptions extends SqliteCompilerOptions {

package/dist/{watch-topic-EFpOIIDE.d.ts → watch-topic-D-rpUg5n.d.ts}

@@ -1,4 +1,4 @@
-import { c as RealtimeClient, p as SubscriptionStatus } from "./topic-cMS7UtM1.js";
+import { c as RealtimeClient, p as SubscriptionStatus } from "./topic-Dgs-eSYQ.js";
 //#region src/realtime/watch-topic.d.ts
 interface TopicWatch {
   readonly onMessage: (event: string, payload: unknown) => void;

package/dist/{workflow-builder-OrglbXUh.js → workflow-builder-C5DBN7yq.js}

@@ -1,11 +1,11 @@
 import { n as dbError } from "./errors-8i6tSICm.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-BlgnMB0H.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-COkvI9t5.js";
 import { n as isRecord } from "./guards-6F2bCtQR.js";
 import { n as PERMISSION_CAP_CLAIM } from "./delegation-Dt8hMJWu.js";
 import { n as credentialRefInTenant, r as foreignCredentialRef } from "./provider-DKh2xFZb.js";
-import { A as requiredInstant, C as optionalText, D as recordOf, F as stringsOf, I as textOf, M as seconds, O as recordOrEmpty, S as optionalInstant, T as randomToken, d as enumOrThrow, k as recordsOf, n as applyTemporal, o as blockCall, p as injectableOf } from "./block-helpers-CfG_MvDR.js";
-import { r as withBlockHooks } from "./block-hooks-BsXncUlZ.js";
-import { n as blockFields } from "./block-fields-ffD6Gxe4.js";
+import { A as requiredInstant, C as optionalText, D as recordOf, F as stringsOf, I as textOf, M as seconds, O as recordOrEmpty, S as optionalInstant, T as randomToken, d as enumOrThrow, k as recordsOf, n as applyTemporal, o as blockCall, p as injectableOf } from "./block-helpers-BfVCR5Fc.js";
+import { r as withBlockHooks } from "./block-hooks-ByKlh8Qy.js";
+import { n as blockFields } from "./block-fields-BANwJ9Y_.js";
 import { d as triggerMatches, f as triggerWhenProblem, r as diffGraphs, s as graphOf } from "./graph-Cs28bOlK.js";
 //#region src/blocks/workflow-builder/rows.ts
 const VERSION_STATUSES = [
@@ -304,7 +304,7 @@ function createWorkflowBuilder(options) {
 		granted
 	}, (value) => value === true);
 	const credentialRow = (id) => serviceCall("workflow_credential_get", { credential: id }, (value) => isRecord(value) ? credentialOf(value) : void 0);
-	return hooked({
+	const builder = {
 		definitions: {
 			save: (input) => fields.args(input.fields).andThen((checked) => call("save_workflow_definition", {
 				tenant: input.tenant,
@@ -581,8 +581,10 @@ function createWorkflowBuilder(options) {
 			list: (definition) => call("workflow_alerts_list", { definition }, (value) => recordsOf(value, "workflow_alerts_list").map(alertOf)),
 			remove: (id) => call("remove_workflow_alert", { alert: id }, (value) => value === true),
 			check: (check = {}) => serviceCall("check_workflow_alerts", { batch: check.batch }, Number)
-		}
-	}, options);
+		},
+		sink: () => workflowSink((event) => builder.triggers.onEvent(event))
+	};
+	return hooked(builder, options);
 }
 /** The builder with `options.hooks` around `run`, `test` and each group's methods. */
 function hooked(builder, options) {
@@ -603,17 +605,31 @@ function hooked(builder, options) {
 		block: "workflow-builder",
 		...logger
 	});
+	const triggers = withBlockHooks(builder.triggers, hooks.triggers, block("triggers"));
 	return {
 		...builder,
 		run: top.run,
 		test: top.test,
 		definitions: withBlockHooks(builder.definitions, hooks.definitions, block("definitions")),
 		versions: withBlockHooks(builder.versions, hooks.versions, block("versions")),
-		triggers: withBlockHooks(builder.triggers, hooks.triggers, block("triggers")),
+		triggers,
 		credentials: withBlockHooks(builder.credentials, hooks.credentials, block("credentials")),
 		steps: withBlockHooks(builder.steps, hooks.steps, block("steps")),
 		nodeRuns: withBlockHooks(builder.nodeRuns, hooks.nodeRuns, block("nodeRuns")),
-		alerts: withBlockHooks(builder.alerts, hooks.alerts, block("alerts"))
+		alerts: withBlockHooks(builder.alerts, hooks.alerts, block("alerts")),
+		sink: () => workflowSink((event) => triggers.onEvent(event))
+	};
+}
+/** The outbox handler `sink()` returns, over a `triggers.onEvent`. */
+function workflowSink(onEvent) {
+	return async (events) => {
+		for (const event of events) await onEvent({
+			id: event.id,
+			type: event.type,
+			payload: event.payload,
+			...event.tenant == null ? {} : { tenant: event.tenant },
+			...event.actorId == null ? {} : { actorId: event.actorId }
+		}).orThrow();
 	};
 }
 /**

package/dist/workflow-sdk/builder/index.d.ts

@@ -1,6 +1,6 @@
-import { i as BuilderStarter, l as NodeRunRecord, z as WorkflowGraph } from "../../types-vaoP9S9_.js";
-import { a as GraphSubject, i as GraphStepCall, o as approvalToken, r as GraphRuntime, s as executeGraph, t as GraphApprovalCall } from "../../executor-BINiCFNp.js";
-import { s as WorkflowFn } from "../../workflow-sdk-q8cLwW1K.js";
+import { B as WorkflowGraph, i as BuilderStarter, l as NodeRunRecord } from "../../types-DZj8CZMH.js";
+import { a as GraphSubject, i as GraphStepCall, o as approvalToken, r as GraphRuntime, s as executeGraph, t as GraphApprovalCall } from "../../executor-CHRwEYqt.js";
+import { s as WorkflowFn } from "../../workflow-sdk-Di5pmCAu.js";
 import { World } from "@workflow/world";
 //#region src/workflow-sdk/builder/builder.d.ts
 /** The env flag the Workflow SDK reads before it starts or runs dynamic source. */

package/dist/workflow-sdk/builder/index.js

@@ -1,7 +1,7 @@
 import { n as subjectAttribute, t as WORKFLOW_ATTRIBUTES } from "../../attributes-D4mA7WhI.js";
 import { c as isGraphRecord, i as durationMs, p as validateGraph, u as topologicalOrder } from "../../graph-Cs28bOlK.js";
 import { i as startNodeOf, n as executeGraph, t as approvalToken } from "../../executor-D3K3tycZ.js";
-import { o as runForKey, r as contextAttributes } from "../../workflow-sdk-BZ6qsRlY.js";
+import { o as runForKey, r as contextAttributes } from "../../workflow-sdk-vjDWlnfX.js";
 import { start } from "workflow/api";
 import { getStepMetadata, getWorkflowMetadata } from "workflow";
 //#region src/workflow-sdk/builder/builder.ts

package/dist/workflow-sdk/index.d.ts

@@ -1,5 +1,5 @@
 /// <reference lib="esnext.temporal" />
-import { _ as workflowContext, a as StartOnEventOptions, c as WorkflowRunAs, d as authorizeHook, f as contextAttributes, g as startOnEvent, h as startFor, i as StartForOptions, l as WorkflowRunAsFor, m as protectWebHandler, n as HookForbiddenError, o as WorkflowContextOptions, p as hookMetadata, r as ProtectWebHandlerOptions, s as WorkflowFn, t as AuthorizeHookOptions, u as WorkflowStarterOptions, v as workflowStarter } from "../workflow-sdk-q8cLwW1K.js";
+import { _ as workflowContext, a as StartOnEventOptions, c as WorkflowRunAs, d as authorizeHook, f as contextAttributes, g as startOnEvent, h as startFor, i as StartForOptions, l as WorkflowRunAsFor, m as protectWebHandler, n as HookForbiddenError, o as WorkflowContextOptions, p as hookMetadata, r as ProtectWebHandlerOptions, s as WorkflowFn, t as AuthorizeHookOptions, u as WorkflowStarterOptions, v as workflowStarter } from "../workflow-sdk-Di5pmCAu.js";
 //#region src/workflow-sdk/approval-waiter.d.ts
 /** How `approvalWaiter.wait` ended. */
 type ApprovalWaitResult<P> = {