better-supabase 0.9.0 → 0.11.0

package/dist/{app-tables-BGl5_U2x.js → app-tables-BRjMcWhW.js}

@@ -29,6 +29,12 @@ const APP_ON_DELETE_ACTIONS = [
 * the value. `FIELD_FORMATS` lists the types each fits and its input.
 */
 const APP_COLUMN_FORMATS = FIELD_FORMAT_NAMES;
+const APP_COLUMN_ACCESS = ["read", "server"];
+const APP_TABLE_EVENT_KINDS = [
+	"created",
+	"updated",
+	"deleted"
+];
 const APP_ROLLUP_AGGREGATES = [
 	"count",
 	"sum",
@@ -37,6 +43,84 @@ const APP_ROLLUP_AGGREGATES = [
 	"avg"
 ];
 //#endregion
+//#region src/config/app-access.ts
+const PLACEHOLDER$1 = /\{([^}]*)\}/gu;
+/** `appTables.<t>.columns.<c>.access` checked. */
+function accessOf(where, value) {
+	if (value === void 0) return;
+	const access = APP_COLUMN_ACCESS.find((option) => option === value);
+	if (access === void 0) throw new TypeError(`${where} must be one of ${APP_COLUMN_ACCESS.join(", ")}`);
+	return access;
+}
+/** The own columns of `table` with `access` set to `access`, in config order. */
+function columnsWithAccess(table, access) {
+	return Object.entries(table.columns ?? {}).flatMap(([name, column]) => column.access === access ? [name] : []);
+}
+/** Whether `table` restricts any column with `access`. */
+function hasColumnAccess(table) {
+	return Object.values(table.columns ?? {}).some((column) => column.access !== void 0);
+}
+function urlColumns(url) {
+	return url === void 0 ? [] : [...url.matchAll(PLACEHOLDER$1)].flatMap((match) => match[1] === void 0 ? [] : [match[1]]);
+}
+/** Every place a table's config reads a column for signed-in users. */
+function readsOf(name, table, tables) {
+	const at = `appTables.${name}`;
+	const { subject } = table;
+	const versions = subject?.versions;
+	const rank = subject?.rank;
+	const own = (where, column) => ({
+		where: `${at}.${where}`,
+		table: name,
+		column
+	});
+	const lookupTarget = (via) => {
+		const reference = table.columns?.[via]?.references;
+		return reference === void 0 || "block" in reference ? void 0 : reference.table;
+	};
+	return [
+		own("subject.title", subject?.title),
+		own("subject.search.title", subject?.search?.title),
+		...(subject?.search?.body ?? []).map((column) => own("subject.search.body", column)),
+		...urlColumns(subject?.url).map((column) => own("subject.url", column)),
+		own("subject.rank.group", rank === true ? void 0 : rank?.group),
+		...versions === true || versions?.columns === void 0 ? [] : versions.columns.map((column) => own("subject.versions.columns", column)),
+		...(table.events === true ? [] : table.events?.include ?? []).map((column) => own("events.include", column)),
+		...Object.entries(table.rollups ?? {}).flatMap(([key, rollup]) => [
+			rollup.via,
+			rollup.column,
+			rollup.where?.column
+		].map((column) => ({
+			where: `${at}.rollups.${key}`,
+			table: rollup.table,
+			column
+		}))),
+		...Object.entries(table.lookups ?? {}).flatMap(([key, lookup]) => {
+			const target = lookupTarget(lookup.via);
+			return [own(`lookups.${key}.via`, lookup.via), {
+				where: `${at}.lookups.${key}.column`,
+				table: target ?? name,
+				column: target === void 0 ? void 0 : lookup.column
+			}];
+		})
+	].filter((use) => tables[use.table] !== void 0);
+}
+/**
+* Throws when a column with `access: "server"` is read where signed-in users
+* see the value: a subject's title, search, url, rank group or versioned
+* columns, an event payload, or a rollup or lookup (ADR 0051). Versions of
+* every column (`versions: true`) would copy it into the history, so such a
+* table lists `subject.versions.columns`.
+*/
+function checkColumnAccess(tables) {
+	for (const [name, table] of Object.entries(tables)) {
+		const hidden = columnsWithAccess(table, "server");
+		const versions = table.subject?.versions;
+		if (hidden.length > 0 && (versions === true || versions !== void 0 && !versions.columns)) throw new TypeError(`appTables.${name}.subject.versions: the history would copy ${hidden.join(", ")}, which has access server; list subject.versions.columns without it`);
+		for (const use of readsOf(name, table, tables)) if ((use.column === void 0 ? void 0 : tables[use.table]?.columns?.[use.column])?.access === "server") throw new TypeError(`${use.where}: ${use.table}.${String(use.column)} has access server, so signed-in users can't read it here; drop it or set access read`);
+	}
+}
+//#endregion
 //#region src/config/app-computed.ts
 const IDENT$1 = /^[a-z][a-z0-9_]{0,62}$/;
 /** Rollups and lookups together, per table. */
@@ -200,7 +284,8 @@ const TABLE_KEYS = /* @__PURE__ */ new Set([
 	"comment",
 	"subject",
 	"rollups",
-	"lookups"
+	"lookups",
+	"events"
 ]);
 const SUBJECT_KEYS = /* @__PURE__ */ new Set([
 	"type",
@@ -209,7 +294,8 @@ const SUBJECT_KEYS = /* @__PURE__ */ new Set([
 	"search",
 	"permissions",
 	"rank",
-	"softDelete"
+	"softDelete",
+	"versions"
 ]);
 /** The columns `subject.rank` and `subject.softDelete` add. */
 const APP_RANK_COLUMN = "rank";
@@ -226,7 +312,8 @@ const COLUMN_KEYS = /* @__PURE__ */ new Set([
 	"min",
 	"max",
 	"comment",
-	"identity"
+	"identity",
+	"access"
 ]);
 const NUMBER_TYPES = /* @__PURE__ */ new Set([
 	"integer",
@@ -351,6 +438,66 @@ function appReservedColumns(tenant = "organization") {
 		`${tenant}_id`
 	];
 }
+/** Postgres truncates identifiers past 63 bytes, so longer generated names collide. */
+const MAX_IDENTIFIER = 63;
+/** The longest app table or column name: `<table>_view` still fits in 63 bytes. */
+const APP_NAME_MAX = 58;
+/**
+* Why `name` can't name an app table or column, or `undefined` when it can:
+* lower snake case starting with a letter, not `pg_`, and at most
+* `APP_NAME_MAX` characters.
+*/
+function appIdentifierError(name) {
+	if (name === "") return "Enter a name.";
+	if (name.length > 58) return `Use at most ${String(58)} characters.`;
+	if (!IDENT.test(name)) return "Use lower-case letters, digits and underscores, starting with a letter.";
+	if (name.startsWith("pg_")) return "Names starting with pg_ are reserved by Postgres.";
+}
+/**
+* The first constraint or index name the SQL derives for `table` that is
+* longer than 63 bytes, which Postgres would truncate into a collision, as
+* a message; `undefined` when every name fits.
+*/
+function appNameLengthError(table, config) {
+	const long = [
+		...Object.entries(config.columns ?? {}).flatMap(([column, each]) => each.references !== void 0 || each.format !== void 0 || each.options !== void 0 || each.min !== void 0 || each.max !== void 0 ? [`${table}_${column}_check`] : []),
+		...(config.unique ?? []).map((set) => `${table}_${set.join("_")}_key`),
+		...(config.indexes ?? []).map((set) => `${table}_${set.join("_")}_idx`)
+	].find((name) => name.length > MAX_IDENTIFIER);
+	return long === void 0 ? void 0 : `${long} is longer than ${String(MAX_IDENTIFIER)} characters; use shorter table or column names`;
+}
+/** The defaults `isAppDefault` accepts, per type, as a message names them. */
+const DEFAULT_EXAMPLES = {
+	text: "a 'quoted' text",
+	integer: "a whole number",
+	bigint: "a whole number",
+	numeric: "a number",
+	boolean: "true or false",
+	uuid: "gen_random_uuid(), auth.uid() or a 'quoted' value",
+	timestamptz: "now() or a 'quoted' value",
+	date: "now() or a 'quoted' value",
+	jsonb: "'{}' or '[]'",
+	"text[]": "'{}'"
+};
+/**
+* Why `value` can't be the default of `column`, or `undefined` when it can:
+* it must be on the `isAppDefault` allowlist, one of the column's
+* `options`, and inside its bounds (`min`, `max`, or those of its format).
+*/
+function appDefaultError(column, value) {
+	const { type } = column;
+	if (!isAppDefault(type, value)) return `A ${type} column takes ${DEFAULT_EXAMPLES[type]} as its default.`;
+	const literal = TEXT_LITERAL.test(value) ? value.slice(1, -1).replaceAll("''", "'") : void 0;
+	if (type === "text" && column.options !== void 0 && literal !== void 0 && !column.options.includes(literal)) return `The default must be one of the options: ${column.options.join(", ")}.`;
+	const bounds = column.format === void 0 ? void 0 : FIELD_FORMATS[column.format].bounds;
+	const min = column.min ?? bounds?.[0];
+	const max = column.max ?? bounds?.[1];
+	const size = type === "text" ? literal?.length : NUMBER.test(value) ? Number(value) : void 0;
+	if (size === void 0) return;
+	const what = type === "text" ? "length" : "value";
+	if (min !== void 0 && size < min) return `The default's ${what} is below the minimum of ${String(min)}.`;
+	if (max !== void 0 && size > max) return `The default's ${what} is above the maximum of ${String(max)}.`;
+}
 /** Whether `value` is a default `type` accepts; see `AppColumnConfig.default`. */
 function isAppDefault(type, value) {
 	switch (value) {
@@ -407,8 +554,18 @@ function columnOf(where, value, tables) {
 	const max = boundOf(`${where}.max`, value["max"], type);
 	const comment = commentOf(`${where}.comment`, value["comment"]);
 	const identity = identityOf(`${where}.identity`, value["identity"], value, type);
+	const access = accessOf(`${where}.access`, value["access"]);
+	if (access !== void 0 && nullable === false && fallback === void 0 && identity !== true) throw new TypeError(`${where}: signed-in users can't write a column with access ${access}, so a required one needs a default`);
 	if (options !== void 0 && format !== void 0) throw new TypeError(`${where}: options make a select; drop the format ${format}`);
 	if (min !== void 0 && max !== void 0 && min > max) throw new TypeError(`${where}: min ${String(min)} is above max ${String(max)}`);
+	const outside = typeof fallback === "string" ? appDefaultError({
+		type,
+		...options === void 0 ? {} : { options },
+		...min === void 0 ? {} : { min },
+		...max === void 0 ? {} : { max },
+		...format === void 0 ? {} : { format }
+	}, fallback) : void 0;
+	if (outside !== void 0) throw new TypeError(`${where}.default: ${outside}`);
 	return {
 		type,
 		...nullable === void 0 ? {} : { nullable },
@@ -420,7 +577,8 @@ function columnOf(where, value, tables) {
 		...min === void 0 ? {} : { min },
 		...max === void 0 ? {} : { max },
 		...comment === void 0 ? {} : { comment },
-		...identity === void 0 ? {} : { identity }
+		...identity === void 0 ? {} : { identity },
+		...access === void 0 ? {} : { access }
 	};
 }
 function namedColumn(where, value, columns) {
@@ -450,10 +608,39 @@ function rankOf(where, value, columns) {
 	return value["group"] === void 0 ? {} : { group: namedColumn(`${where}.group`, value["group"], columns) };
 }
 /**
+* `subject.versions` checked: `true`, or `columns` from the table's own
+* columns (not its id, scope or timestamps, which a restore must not
+* write) and `auto`.
+*/
+function versionsOf(where, value, editable) {
+	if (value === void 0 || value === true) return value;
+	if (!isObject(value)) throw new TypeError(`${where} must be true or { columns, auto }`);
+	checkKeys(where, value, /* @__PURE__ */ new Set(["columns", "auto"]));
+	const { columns } = value;
+	if (columns !== void 0 && (!Array.isArray(columns) || columns.length === 0)) throw new TypeError(`${where}.columns must list one or more columns`);
+	const listed = columns?.map((name, index) => namedColumn(`${where}.columns[${index}]`, name, editable));
+	const auto = optionalBoolean(`${where}.auto`, value["auto"]);
+	return {
+		...listed === void 0 ? {} : { columns: [...new Set(listed)] },
+		...auto === void 0 ? {} : { auto }
+	};
+}
+/** The columns and snapshot mode `subject.versions` registers with the versions block. */
+function appTableVersions(table) {
+	const versions = table.subject?.versions;
+	if (versions === void 0) return;
+	const options = versions === true ? {} : versions;
+	return {
+		columns: options.columns ?? Object.keys(table.columns ?? {}),
+		auto: options.auto ?? true
+	};
+}
+/**
 * `subject` checked against the table's columns. `columns` holds every
-* column the table has, the ones `rank` and `softDelete` add included.
+* column the table has, the ones `rank` and `softDelete` add included;
+* `editable` holds the table's own columns.
 */
-function subjectOf(where, value, columns) {
+function subjectOf(where, value, columns, editable) {
 	if (value === void 0) return;
 	if (!isObject(value)) throw new TypeError(`${where} must be an object`);
 	checkKeys(where, value, SUBJECT_KEYS);
@@ -467,6 +654,7 @@ function subjectOf(where, value, columns) {
 	const permissions = permissionsOf(`${where}.permissions`, value["permissions"]);
 	const rank = rankOf(`${where}.rank`, value["rank"], columns);
 	const softDelete = optionalBoolean(`${where}.softDelete`, value["softDelete"]);
+	const versions = versionsOf(`${where}.versions`, value["versions"], editable);
 	return {
 		type,
 		...title === void 0 ? {} : { title: namedColumn(`${where}.title`, title, columns) },
@@ -474,7 +662,8 @@ function subjectOf(where, value, columns) {
 		...search === void 0 ? {} : { search },
 		...permissions === void 0 ? {} : { permissions },
 		...rank === void 0 ? {} : { rank },
-		...softDelete === void 0 ? {} : { softDelete }
+		...softDelete === void 0 ? {} : { softDelete },
+		...versions === void 0 ? {} : { versions }
 	};
 }
 /** The columns the subject adds, which `columns` may not name. */
@@ -482,6 +671,34 @@ function subjectColumnsOf(value) {
 	if (!isObject(value)) return [];
 	return [...value["rank"] === void 0 ? [] : [APP_RANK_COLUMN], ...value["softDelete"] === true ? [APP_DELETED_AT_COLUMN] : []];
 }
+/** The event kinds `events` turns on; empty without it. */
+function appTableEventKinds(table) {
+	const events = table.events;
+	if (events === void 0) return [];
+	return events === true ? APP_TABLE_EVENT_KINDS : events.on ?? APP_TABLE_EVENT_KINDS;
+}
+/** The event types an app table emits: `<subject type or table>.<kind>`. */
+function appTableEventTypes(name, table) {
+	const base = table.subject?.type ?? name;
+	return appTableEventKinds(table).map((kind) => `${base}.${kind}`);
+}
+function isEventKind(value) {
+	return APP_TABLE_EVENT_KINDS.some((kind) => kind === value);
+}
+/** `events` checked: `true`, or `on` from the event kinds and `include` from the table's columns. */
+function eventsOf(where, value, columns) {
+	if (value === void 0 || value === true) return value;
+	if (!isObject(value)) throw new TypeError(`${where} must be true or { on, include }`);
+	checkKeys(where, value, /* @__PURE__ */ new Set(["on", "include"]));
+	const { on, include } = value;
+	if (on !== void 0 && (!Array.isArray(on) || on.length === 0 || !on.every(isEventKind))) throw new TypeError(`${where}.on must list one or more of ${APP_TABLE_EVENT_KINDS.join(", ")}`);
+	if (include !== void 0 && !Array.isArray(include)) throw new TypeError(`${where}.include must be a list of columns`);
+	const included = include?.map((name, index) => namedColumn(`${where}.include[${index}]`, name, columns));
+	return {
+		...on === void 0 ? {} : { on: [...new Set(on)] },
+		...included === void 0 ? {} : { include: [...new Set(included)] }
+	};
+}
 function tableOf(where, value, tables, reserved) {
 	if (!isObject(value)) throw new TypeError(`${where} must be an object`);
 	checkKeys(where, value, TABLE_KEYS);
@@ -496,7 +713,8 @@ function tableOf(where, value, tables, reserved) {
 	const added = subjectColumnsOf(value["subject"]);
 	const resolved = Object.entries(columns ?? {}).map(([name, column]) => {
 		const at = `${where}.columns.${name}`;
-		if (!IDENT.test(name)) throw new TypeError(`${at}: "${name}" is not a lower snake identifier (a-z, 0-9 and _, starting with a letter)`);
+		const invalid = appIdentifierError(name);
+		if (invalid !== void 0) throw new TypeError(`${at}: "${name}" is not a column name. ${invalid}`);
 		if (reserved.has(name)) throw new TypeError(`${at}: "${name}" is a column every app table gets (${[...reserved].join(", ")})`);
 		if (added.includes(name)) throw new TypeError(`${at}: "${name}" is the column ${where}.subject adds; remove it from columns`);
 		return [name, columnOf(at, column, tables)];
@@ -505,6 +723,11 @@ function tableOf(where, value, tables, reserved) {
 		...reserved,
 		...added,
 		...resolved.map(([name]) => name)
+	]), new Set(resolved.map(([name]) => name)));
+	const events = eventsOf(`${where}.events`, value["events"], /* @__PURE__ */ new Set([
+		...reserved,
+		...added,
+		...resolved.map(([name]) => name)
 	]));
 	return {
 		...columns === void 0 ? {} : { columns: Object.fromEntries(resolved) },
@@ -514,7 +737,8 @@ function tableOf(where, value, tables, reserved) {
 		...unique === void 0 ? {} : { unique },
 		...indexes === void 0 ? {} : { indexes },
 		...comment === void 0 ? {} : { comment },
-		...subject === void 0 ? {} : { subject }
+		...subject === void 0 ? {} : { subject },
+		...events === void 0 ? {} : { events }
 	};
 }
 /**
@@ -531,10 +755,14 @@ function appTablesOf(value, tenant) {
 	const tables = new Map(Object.entries(value).map(([name, table]) => [name, isObject(table) && table["id"] === "bigint" ? "bigint" : "uuid"]));
 	const reserved = new Set(appReservedColumns(tenant));
 	const resolved = Object.fromEntries(Object.entries(value).map(([name, table]) => {
-		if (!IDENT.test(name) || name.startsWith("pg_")) throw new TypeError(`appTables.${name}: "${name}" is not a lower snake identifier (a-z, 0-9 and _, starting with a letter)`);
-		return [name, tableOf(`appTables.${name}`, table, tables, reserved)];
+		const invalid = appIdentifierError(name);
+		if (invalid !== void 0) throw new TypeError(`appTables.${name}: "${name}" is not a table name. ${invalid}`);
+		const checked = tableOf(`appTables.${name}`, table, tables, reserved);
+		const long = appNameLengthError(name, checked);
+		if (long !== void 0) throw new TypeError(`appTables.${name}: ${long}`);
+		return [name, checked];
 	}));
-	return Object.fromEntries(Object.entries(resolved).map(([name, table]) => {
+	const checked = Object.fromEntries(Object.entries(resolved).map(([name, table]) => {
 		const where = `appTables.${name}`;
 		const computed = computedOf(where, value[name], name, resolved, /* @__PURE__ */ new Set([
 			...reserved,
@@ -548,6 +776,8 @@ function appTablesOf(value, tenant) {
 		if (hasComputed(withComputed) && Object.hasOwn(resolved, `${name}_view`)) throw new TypeError(`${where}: its rollups and lookups go in the view ${name}_view, which is also an app table; rename one`);
 		return [name, withComputed];
 	}));
+	checkColumnAccess(checked);
+	return checked;
 }
 /**
 * `subjects` with the subject of every app table that sets one (ADR 0043):
@@ -572,6 +802,7 @@ function withAppTableSubjects(subjects, appTables, scope, tenant = "organization
 			...subject.search === void 0 ? {} : { search: subject.search },
 			...subject.permissions === void 0 ? {} : { permissions: subject.permissions },
 			...subject.softDelete === true ? { deletedAt: APP_DELETED_AT_COLUMN } : {},
+			...versionsEntry(table),
 			...subject.rank === void 0 ? {} : { rank: {
 				column: APP_RANK_COLUMN,
 				...subject.rank === true || subject.rank.group === void 0 ? {} : { group: subject.rank.group }
@@ -580,5 +811,9 @@ function withAppTableSubjects(subjects, appTables, scope, tenant = "organization
 	}
 	return merged;
 }
+function versionsEntry(table) {
+	const versions = appTableVersions(table);
+	return versions === void 0 ? {} : { versions };
+}
 //#endregion
-export { appTablesOf as a, hasComputed as c, APP_ON_DELETE_ACTIONS as d, APP_ROLLUP_AGGREGATES as f, appReservedColumns as i, APP_COLUMN_FORMATS as l, APP_RANK_COLUMN as n, isAppDefault as o, AUTH_USERS as r, withAppTableSubjects as s, APP_DELETED_AT_COLUMN as t, APP_COLUMN_TYPES as u };
+export { APP_TABLE_EVENT_KINDS as C, APP_ROLLUP_AGGREGATES as S, hasColumnAccess as _, appDefaultError as a, APP_COLUMN_TYPES as b, appReservedColumns as c, appTableVersions as d, appTablesOf as f, columnsWithAccess as g, hasComputed as h, AUTH_USERS as i, appTableEventKinds as l, withAppTableSubjects as m, APP_NAME_MAX as n, appIdentifierError as o, isAppDefault as p, APP_RANK_COLUMN as r, appNameLengthError as s, APP_DELETED_AT_COLUMN as t, appTableEventTypes as u, APP_COLUMN_ACCESS as v, APP_ON_DELETE_ACTIONS as x, APP_COLUMN_FORMATS as y };

package/dist/app-tables-BrMBjyuq.d.ts

@@ -0,0 +1,35 @@
+import { On as AppTableConfig, xn as AppColumnType, yn as AppColumnConfig } from "./codegen-C64C0NZG.js";
+//#region src/config/app-tables.d.ts
+/**
+ * The columns every app table gets, which `columns` may not name:
+ * `id`, `created_at`, `updated_at`, `user_id` and the tenant column
+ * (`organization_id`, or `<sql.naming.tenant>_id`), whatever the table's
+ * scope, so changing the scope never collides with a column.
+ */
+declare function appReservedColumns(tenant?: string): readonly string[];
+/** The longest app table or column name: `<table>_view` still fits in 63 bytes. */
+declare const APP_NAME_MAX: number;
+/**
+ * Why `name` can't name an app table or column, or `undefined` when it can:
+ * lower snake case starting with a letter, not `pg_`, and at most
+ * `APP_NAME_MAX` characters.
+ */
+declare function appIdentifierError(name: string): string | undefined;
+/**
+ * The first constraint or index name the SQL derives for `table` that is
+ * longer than 63 bytes, which Postgres would truncate into a collision, as
+ * a message; `undefined` when every name fits.
+ */
+declare function appNameLengthError(table: string, config: Pick<AppTableConfig, "columns" | "unique" | "indexes">): string | undefined;
+/**
+ * Why `value` can't be the default of `column`, or `undefined` when it can:
+ * it must be on the `isAppDefault` allowlist, one of the column's
+ * `options`, and inside its bounds (`min`, `max`, or those of its format).
+ */
+declare function appDefaultError(column: Pick<AppColumnConfig, "type" | "options" | "min" | "max" | "format">, value: string): string | undefined;
+/** Whether `value` is a default `type` accepts; see `AppColumnConfig.default`. */
+declare function isAppDefault(type: AppColumnType, value: string): boolean;
+/** The event types an app table emits: `<subject type or table>.<kind>`. */
+declare function appTableEventTypes(name: string, table: AppTableConfig): readonly string[];
+//#endregion
+export { appReservedColumns as a, appNameLengthError as i, appDefaultError as n, appTableEventTypes as o, appIdentifierError as r, isAppDefault as s, APP_NAME_MAX as t };

package/dist/{approvals-a2KmioBh.d.ts → approvals-CRZtzxNt.d.ts}

@@ -1,12 +1,12 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
+import { T as ErrorMapper, t as AsyncResult } from "./result-BREt7qOh.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as StandardSchemaV1 } from "./standard-C3_AAF3g.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
-import { r as FieldsOf } from "./block-fields-5UA84ZUg.js";
-import { i as AuthorizationHooks, n as Approver } from "./authorization-hooks-DkmrnDX7.js";
+import { t as StandardSchemaV1 } from "./standard-BcUQuUgu.js";
+import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
+import { r as BlockTemporalOptions } from "./block-helpers-CjcQM1yA.js";
+import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
+import { r as FieldsOf } from "./block-fields-DnaDbgZS.js";
+import { i as AuthorizationHooks, n as Approver } from "./authorization-hooks-mLi894KH.js";
 //#region src/blocks/approvals/approvals.d.ts
 interface ApprovalsOptions<S extends StandardSchemaV1 | undefined = undefined> extends BlockTemporalOptions {
   readonly transport: BlockTransport;

package/dist/arazzo/index.d.ts

@@ -1,7 +1,7 @@
 import { D as ResourceOperation, a as JsonSchema, i as JsonObject, w as ModelWorkflow, x as ModelStep } from "../model-lUafmeBQ.js";
 import { c as SpecDiagnostic, r as DocumentFormat } from "../format-CNwSjXUU.js";
-import { o as StandardLike } from "../resource-B4ka8dDH.js";
-import { A as WorkflowSource, C as ApiSource, n as DefineApiOptions } from "../api-TG3jE5aO.js";
+import { o as StandardLike } from "../resource-DYEtc-KN.js";
+import { A as WorkflowSource, C as ApiSource, n as DefineApiOptions } from "../api-DoWK3dTw.js";
 import { t as SPEC_PINS } from "../spec-pins-Dqpml2dZ.js";
 //#region src/arazzo/types.d.ts
 type Json = Record<string, unknown>;

package/dist/arazzo/index.js

@@ -1,7 +1,7 @@
 import { r as isPlainObject } from "../clone-dN9XOL1K.js";
 import { t as SPEC_PINS } from "../spec-pins-S4PymRxp.js";
-import { o as defineDocumentFormat, t as defineApi } from "../api-CFjuYKFY.js";
-import { c as pascal, r as safeKey, s as convertStandard } from "../build-Cm0T5MVG.js";
+import { o as defineDocumentFormat, t as defineApi } from "../api-C43_FYDp.js";
+import { c as pascal, r as safeKey, s as convertStandard } from "../build-CT6SPZkI.js";
 import "../types-BRTSpOIh.js";
 //#region src/arazzo/format.ts
 const ARAZZO_FIELD = {

package/dist/{assistant-Bf2cA6RO.d.ts → assistant-DZsHsYIx.d.ts}

@@ -1,9 +1,9 @@
-import { b as DbError } from "./result-Cj3yWhjH.js";
+import { b as DbError } from "./result-BREt7qOh.js";
 import { i as AiMessage } from "./message-B0fNJgq8.js";
-import { E as AiRunStatus, F as AiUserMessageTrigger, _ as AiModerationAction, i as AiChat, u as AiChatRecord } from "./ai-chat-3GBSlFR4.js";
+import { E as AiRunStatus, F as AiUserMessageTrigger, _ as AiModerationAction, i as AiChat, u as AiChatRecord } from "./ai-chat-D-2MH1sU.js";
 import { n as GatewayOptions } from "./gateway-options-ClvvfuuU.js";
-import { o as StreamStore } from "./store-B5qYKsTh.js";
-import { i as CostBackfillPayload, t as AiUsage } from "./gateway-Cup00l0w.js";
+import { o as StreamStore } from "./store-B18bIvKc.js";
+import { i as CostBackfillPayload, t as AiUsage } from "./gateway-Bq_tWwxE.js";
 import { LanguageModelUsage, ModelMessage, UIMessage, UIMessageChunk, UIMessageStreamOnEndCallback } from "ai";
 //#region src/ai-sdk/chat/assistant.d.ts
 /** Who asks, for one request. */

package/dist/astro/index.d.ts

@@ -1,10 +1,10 @@
-import { a as AnyModels, i as AnyFunctions } from "../types-YfwpIE-d.js";
-import { t as BetterSupabase } from "../define-DxHHbNEb.js";
-import { j as StorageImageOptions } from "../index-Bvw9r94Q.js";
-import { t as BetterServer } from "../server-types-OohhIQb2.js";
-import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-D5S7KNFe.js";
-import { t as RefusalRedirects } from "../refusal-oD3ISM9h.js";
-import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-DG5Bv39u.js";
+import { a as AnyModels, i as AnyFunctions } from "../types-BrpW5ixT.js";
+import { t as BetterSupabase } from "../define-M_r1d2AT.js";
+import { j as StorageImageOptions } from "../index-DHReeV74.js";
+import { n as BetterServer } from "../server-types-BKN_R4Ws.js";
+import { a as AuthorizedContext, c as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-BeZX2pR_.js";
+import { t as RefusalRedirects } from "../refusal-CufncwaN.js";
+import { n as FrameworkOptions, t as FrameworkLocals } from "../framework-D6IFkuAg.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/astro/index.d.ts
 /** The part of Astro's `APIContext` (middleware, pages, endpoints, actions) the integration uses. */
@@ -16,7 +16,7 @@ export interface AstroOptions extends FrameworkOptions {
   /** The host's env object for `getEnv`; defaults to `locals.runtime.env` (Cloudflare). */
   readonly platformEnv?: (context: AstroContextLike) => unknown;
 }
-export interface BetterAstro<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown> extends BetterServer<M, F, E, C, P> {
+export interface BetterAstro<M extends AnyModels, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown> extends BetterServer<M, F, E, C, P, B> {
   /**
    * Astro middleware: verifies the caller, refreshes the session cookie on
    * navigations and form posts, and puts `db`, `bs`, `auth`, `tenant` and
@@ -28,7 +28,7 @@ export interface BetterAstro<M extends AnyModels, F extends AnyFunctions, E, C =
    */
   readonly onRequest: (context: AstroContextLike, next: () => Promise<Response>) => Promise<Response>;
   /** The request's `locals`, typed. */
-  locals(context: AstroContextLike): FrameworkLocals<M, F, E, C, P>;
+  locals(context: AstroContextLike): FrameworkLocals<M, F, E, C, P, B>;
   /**
    * The refusal for a caller `options` refuses (a redirect to `signIn` or
    * `mfa`, else Problem Details), or `undefined`. Return it from a page's
@@ -46,7 +46,7 @@ export interface BetterAstro<M extends AnyModels, F extends AnyFunctions, E, C =
    * The caller, or a thrown refusal `Response`, for endpoints that return
    * whatever is thrown.
    */
-  require<R extends boolean = false>(context: AstroContextLike, options?: BlockRequireOptions<C, P, R>): Promise<FrameworkLocals<M, F, E, C, P> & AuthorizedContext<C, P, R>>;
+  require<R extends boolean = false>(context: AstroContextLike, options?: BlockRequireOptions<C, P, R>): Promise<FrameworkLocals<M, F, E, C, P, B> & AuthorizedContext<C, P, R>>;
   /**
    * The `handler` of `defineAction`, returning an `ActionResult`:
    *
@@ -56,10 +56,10 @@ export interface BetterAstro<M extends AnyModels, F extends AnyFunctions, E, C =
    * }
    * ```
    */
-  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: BlockActionOptions<S, C, P, R>, fn: (input: ActionParsed<S>, ctx: FrameworkLocals<M, F, E, C, P> & AuthorizedContext<C, P, R>) => T): (input: unknown, context: AstroContextLike) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
+  action<S extends StandardSchemaV1 | undefined, T, R extends boolean = false>(options: BlockActionOptions<S, C, P, R>, fn: (input: ActionParsed<S>, ctx: FrameworkLocals<M, F, E, C, P, B> & AuthorizedContext<C, P, R>) => T): (input: unknown, context: AstroContextLike) => Promise<ActionResult<Unwrapped<Awaited<T>>>>;
 }
 /** Astro integration: middleware, page guards and Actions. */
-export declare function createAstro<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P>, options?: AstroOptions): BetterAstro<M, F, E, C, P>;
+export declare function createAstro<M extends AnyModels, D, F extends AnyFunctions, E, C = unknown, P = unknown, B = unknown>(betterSupabase: BetterSupabase<M, D, F, E, C, P, B>, options?: AstroOptions): BetterAstro<M, F, E, C, P, B>;
 /** What Astro passes to an image service's `getURL`. */
 export interface AstroImageTransform {
   readonly src: string | {

package/dist/astro/index.js

@@ -1,10 +1,10 @@
-import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-CEjmtazZ.js";
-import { t as defaultExpose } from "../respond-DdhZ9Wbn.js";
-import { i as requireCaller, o as runAction } from "../kit-MUK34-ZG.js";
+import { c as extendServer, n as flushEvents, s as createServer } from "../adapter-B2WRsRIg.js";
+import { t as defaultExpose } from "../respond-Bhp3G__q.js";
+import { i as requireCaller, o as runAction } from "../kit-LTbHrWWD.js";
 import { t as storageImageUrl } from "../image-url-pIVlO6R1.js";
 import { t as around } from "../shared-BmMcMoW9.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-INbjMZX1.js";
-import { r as refusalResponse } from "../refusal-br4Ma9Cf.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-Ch8bMmQY.js";
+import { r as refusalResponse } from "../refusal-CFpfmjcS.js";
 //#region src/astro/index.ts
 function runtimeEnv(locals) {
 	const runtime = "runtime" in locals ? locals.runtime : void 0;

package/dist/asyncapi/index.d.ts

@@ -1,5 +1,5 @@
 import { c as SpecDiagnostic, r as DocumentFormat } from "../format-CNwSjXUU.js";
-import { C as ApiSource, F as EventsOptions, I as TopicInput, L as topicsFrom, M as BlockEventSchemas, N as CLOUD_EVENT_TRAIT, P as CloudEventsInput, j as BlockEventSchema, n as DefineApiOptions } from "../api-TG3jE5aO.js";
+import { C as ApiSource, F as EventsOptions, I as TopicInput, L as topicsFrom, M as BlockEventSchemas, N as CLOUD_EVENT_TRAIT, P as CloudEventsInput, j as BlockEventSchema, n as DefineApiOptions } from "../api-DoWK3dTw.js";
 import { t as SPEC_PINS } from "../spec-pins-Dqpml2dZ.js";
 //#region src/asyncapi/types.d.ts
 type Json = Record<string, unknown>;

package/dist/asyncapi/index.js

@@ -1,7 +1,7 @@
 import { r as isPlainObject } from "../clone-dN9XOL1K.js";
 import { t as SPEC_PINS } from "../spec-pins-S4PymRxp.js";
-import { o as defineDocumentFormat, t as defineApi } from "../api-CFjuYKFY.js";
-import { c as pascal, i as topicsFrom, n as CLOUD_EVENT_TRAIT, r as safeKey, u as pointerToken } from "../build-Cm0T5MVG.js";
+import { o as defineDocumentFormat, t as defineApi } from "../api-C43_FYDp.js";
+import { c as pascal, i as topicsFrom, n as CLOUD_EVENT_TRAIT, r as safeKey, u as pointerToken } from "../build-CT6SPZkI.js";
 import { t as ASYNCAPI_FILE_NAME } from "../types-BRTSpOIh.js";
 //#region src/asyncapi/format.ts
 const ASYNCAPI_FIELD = {

package/dist/{attachments-DAj2Yp95.js → attachments-Bk3tyeUF.js}

@@ -1,10 +1,10 @@
-import { n as dbError } from "./errors-8i6tSICm.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-BlgnMB0H.js";
+import { n as dbError } from "./errors-BV1SKTVs.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-DIeYscA3.js";
 import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { t as fromStorageError } from "./errors-PIpcoe4z.js";
-import { C as optionalText, D as recordOf, I as textOf, R as toInstant, S as optionalInstant, f as errorText, k as recordsOf, n as applyTemporal, o as blockCall } from "./block-helpers-CfG_MvDR.js";
-import { r as withBlockHooks } from "./block-hooks-BsXncUlZ.js";
-import { c as withFields, i as extraOf, n as blockFields, r as extraFieldsArg, t as allWithFields } from "./block-fields-ffD6Gxe4.js";
+import { t as fromStorageError } from "./errors-D3BR8iUk.js";
+import { C as optionalText, D as recordOf, I as textOf, R as toInstant, S as optionalInstant, f as errorText, k as recordsOf, n as applyTemporal, o as blockCall } from "./block-helpers-DkVZNDrj.js";
+import { r as withBlockHooks } from "./block-hooks-C22vuIUd.js";
+import { c as withFields, i as extraOf, n as blockFields, r as extraFieldsArg, t as allWithFields } from "./block-fields-Bv1hV855.js";
 //#region src/blocks/attachments/attachments.ts
 const STATUSES = [
 	"pending",

package/dist/{audit-log-BMMuGPdP.js → audit-log-ovUlF4Mk.js}

@@ -1,16 +1,16 @@
 import { t as DbException } from "./db-exception-CnWcYPxL.js";
-import { n as dbError } from "./errors-8i6tSICm.js";
-import { t as temporal } from "./temporal-required-DqRzr7i0.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-BlgnMB0H.js";
+import { n as dbError } from "./errors-BV1SKTVs.js";
+import { t as temporal } from "./temporal-required-nfZ87U-0.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-DIeYscA3.js";
 import { n as isRecord } from "./guards-6F2bCtQR.js";
 import { t as SPEC_PINS } from "./spec-pins-S4PymRxp.js";
+import { i as sqlIdent } from "./template-Dw3dTmKe.js";
+import { t as MAX_BATCH } from "./batch-limit-DKVQDz4o.js";
 import { r as toCsv } from "./csv-CVfXqaAu.js";
-import { i as sqlIdent } from "./template-DdgYjIZ5.js";
-import { C as optionalText, F as stringsOf, I as textOf, M as seconds, S as optionalInstant, c as chunksOf, i as batchResultsOf, j as run, m as instantArg, n as applyTemporal, o as blockCall, w as pageOf } from "./block-helpers-CfG_MvDR.js";
-import { r as withBlockHooks } from "./block-hooks-BsXncUlZ.js";
-import { i as undoToken } from "./undo-CEGIRkPA.js";
+import { C as optionalText, F as stringsOf, I as textOf, M as seconds, S as optionalInstant, c as chunksOf, i as batchResultsOf, j as run, m as instantArg, n as applyTemporal, o as blockCall, w as pageOf } from "./block-helpers-DkVZNDrj.js";
+import { r as withBlockHooks } from "./block-hooks-C22vuIUd.js";
+import { i as undoToken } from "./undo-B5LgpGLy.js";
 import { n as defineListQuery } from "./list-query-CBXNfJt4.js";
-import { t as MAX_BATCH } from "./batch-limit-DKVQDz4o.js";
 //#region src/blocks/audit/audit.ts
 function sqlPurgeCalls(sql) {
 	return {

package/dist/auth-module-DbZv2WrR.js

@@ -0,0 +1,10 @@
+//#region src/core/auth-module.ts
+/**
+* Whether the client has an auth module to follow. A client built by hand
+* for Storage or Realtime only (or a test stand-in) has none.
+*/
+function hasAuthModule(supabase) {
+	return typeof supabase.auth?.onAuthStateChange === "function";
+}
+//#endregion
+export { hasAuthModule as t };