better-supabase 0.9.0 → 0.11.0

package/dist/{topic-ByDz9edV.js → topic-mee21pux.js}

@@ -1,12 +1,12 @@
-import { n as dbError } from "./errors-8i6tSICm.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-BlgnMB0H.js";
+import { n as dbError } from "./errors-BV1SKTVs.js";
+import { a as ok, r as err, t as AsyncResult } from "./result-DIeYscA3.js";
 import { a as tenantClaimPaths } from "./claims-PqzCxaTD.js";
+import { a as sqlString, i as sqlIdent, n as parseTemplate, r as slug, t as claimSql } from "./template-Dw3dTmKe.js";
+import { a as isScopeName, i as fillTemplate, o as resolveProviderSql, r as accessCheck } from "./access-sql-CTJPHjCL.js";
 import { t as refreshRealtimeAuth } from "./auth-CdBKt0CS.js";
-import { a as sqlString, i as sqlIdent, n as parseTemplate, r as slug, t as claimSql } from "./template-DdgYjIZ5.js";
 import { t as allowedSubscribers } from "./subscribers-Cq--DL1E.js";
 import { t as joinTopic } from "./channels-C-GCoNLd.js";
 import { t as toApp } from "./casing-DdFWEtqr.js";
-import { a as isScopeName, i as fillTemplate, o as resolveProviderSql, r as accessCheck } from "./access-sql-DUSSMaC3.js";
 import { t as topicStatus } from "./realtime-status-D2dw1hOE.js";
 //#region src/realtime/fan-out.ts
 /** Runs the policy, then `send` for each subscriber it keeps, one at a time. */
@@ -61,21 +61,80 @@ function topicPermissionSql(input) {
 	if (tenant === void 0) throw new TypeError(`${where}: permission "${key}" needs the authorization provider's \`permitted\` template, or a tenant segment for the tenant check`);
 	return accessCheck(where, {}, key, tenant);
 }
+const splitTable = (table) => table.includes(".") ? [table.slice(0, table.indexOf(".")), table.slice(table.indexOf(".") + 1)] : ["public", table];
 function columnSql(meta, column, where) {
 	const db = meta.columns[column]?.db;
 	if (!db) throw new TypeError(`defineTopic: no column for ${where} on "${meta.key}" ("${column}")`);
 	return sqlIdent(db);
 }
-/** A trigger value as SQL on `rec`, with one subquery per lookup. */
-function triggerValueSql(tables, meta, value, where, depth = 0) {
-	if (typeof value === "string") return `rec.${columnSql(meta, value, where)}`;
+function lookupTarget(tables, value, where) {
 	const joined = tables[value.from];
 	if (!joined) throw new TypeError(`defineTopic: unknown table "${value.from}" for ${where}`);
 	const key = value.key ?? (joined.primaryKey.length === 1 ? joined.primaryKey[0] : void 0);
 	if (key === void 0) throw new TypeError(`defineTopic: "${value.from}" has no single-column primary key; name its key for ${where}`);
-	const alias = `j${String(depth)}`;
-	const via = triggerValueSql(tables, meta, value.via, where, depth + 1);
-	return `(select ${alias}.${columnSql(joined, value.select, where)} from ${sqlIdent(joined.schema)}.${sqlIdent(joined.name)} ${alias} where ${alias}.${columnSql(joined, key, where)} = ${via} limit 1)`;
+	return {
+		relation: `${sqlIdent(joined.schema)}.${sqlIdent(joined.name)}`,
+		key: columnSql(joined, key, where),
+		select: columnSql(joined, value.select, where)
+	};
+}
+function rawLookupTarget(value) {
+	const [schema, name] = splitTable(value.from);
+	return {
+		relation: `${sqlIdent(schema)}.${sqlIdent(name)}`,
+		key: sqlIdent(value.key ?? "id"),
+		select: sqlIdent(value.select)
+	};
+}
+/**
+* The lookups of one generated function. Each parent row is read once per
+* changed row, with every column the topics, values and payload need from
+* it, and a row comes before the rows that join through it.
+*/
+var TriggerLookups = class {
+	#byRow = /* @__PURE__ */ new Map();
+	add(target) {
+		const row = [
+			target.relation,
+			target.key,
+			target.via
+		].join("\0");
+		const known = this.#byRow.get(row);
+		if (known) {
+			if (!known.columns.includes(target.select)) known.columns.push(target.select);
+			return `${known.name}.${target.select}`;
+		}
+		const name = `lk_${String(this.#byRow.size)}`;
+		this.#byRow.set(row, {
+			name,
+			relation: target.relation,
+			key: target.key,
+			columns: [target.select],
+			via: target.via
+		});
+		return `${name}.${target.select}`;
+	}
+	get list() {
+		return [...this.#byRow.values()];
+	}
+};
+/** A trigger value as SQL on `rec`; each lookup becomes a variable in `lookups`. */
+function triggerValueSql(tables, meta, value, where, lookups) {
+	if (typeof value === "string") return `rec.${meta ? columnSql(meta, value, where) : sqlIdent(value)}`;
+	const target = tables && meta ? lookupTarget(tables, value, where) : rawLookupTarget(value);
+	const via = triggerValueSql(tables, meta, value.via, where, lookups);
+	return lookups.add({
+		...target,
+		via
+	});
+}
+/** The columns of `when.changed` as an `old`/`new` comparison. */
+function changedSql(meta, changed, where) {
+	if (changed.length === 0) throw new TypeError(`${where}: when.changed lists no columns`);
+	return changed.map((column) => {
+		const db = meta ? columnSql(meta, column, "when.changed") : sqlIdent(column);
+		return `old.${db} is distinct from new.${db}`;
+	}).join(" or ");
 }
 /** The event name: one for every operation, one per operation, or the operation. */
 function eventSql(event) {
@@ -86,6 +145,9 @@ function eventSql(event) {
 }
 //#endregion
 //#region src/realtime/topic-trigger.ts
+/** The start of the warning a delete raises when a lookup finds no row. */
+const LOOKUP_WARNING = "better-supabase: realtime lookup found no row";
+const LOOKUP_HINT = "The parent row was deleted in the same statement, such as a cascade, so the topic that reads it is skipped. Keep the topic value on the row itself, or add a topic trigger on the parent.";
 /** Marks a generated function that sends whole rows on purpose (doctor reads it). */
 const ROW_PAYLOAD_MARKER = "better-supabase: payload row";
 /** The primary key as `jsonb`, read from the catalog when the table's key isn't known. */
@@ -117,7 +179,16 @@ function payloadSql(payload) {
 */
 function triggerFunctionSql(input) {
 	const fn = `${sqlIdent(input.functionSchema)}.${sqlIdent(input.functionName)}`;
-	const payload = payloadSql(input.payload);
+	const payload = input.payload.kind === "custom" ? "body" : payloadSql(input.payload);
+	const declarations = input.lookups.map((lookup) => `  ${lookup.name} record;`);
+	const reads = input.lookups.flatMap((lookup) => [
+		`  select ${lookup.columns.map((column) => `j.${column}`).join(", ")} into ${lookup.name} from ${lookup.relation} j where j.${lookup.key} = ${lookup.via} limit 1;`,
+		`  if not found and tg_op = 'DELETE' and ${lookup.via} is not null then`,
+		`    raise warning '${LOOKUP_WARNING} for a delete on %.%: no % row where % = %', tg_table_schema, tg_table_name, ${sqlString(lookup.relation)}, ${sqlString(lookup.key)}, ${lookup.via}`,
+		`      using hint = ${sqlString(LOOKUP_HINT)};`,
+		"  end if;"
+	]);
+	const early = input.changed && !input.changed.when ? [`  if tg_op = 'UPDATE' and not (${input.changed.sql}) then return null; end if;`] : [];
 	const sends = input.topics.flatMap((topic) => {
 		const entries = Object.entries(topic.values);
 		const vals = entries.length === 0 ? "'{}'::jsonb" : `jsonb_build_object(${entries.map(([param, value]) => `${sqlString(param)}, (${value})::text`).join(", ")})`;
@@ -147,12 +218,17 @@ function triggerFunctionSql(input) {
 		"  rec record;",
 		"  vals jsonb;",
 		"  bad record;",
+		...input.payload.kind === "custom" ? ["  body jsonb;"] : [],
+		...declarations,
 		"begin",
 		"  if tg_when <> 'AFTER' then",
 		"    raise exception '% runs after the write; as a % trigger it would cancel the write', tg_name, lower(tg_when)",
 		"      using errcode = '39P01';",
 		"  end if;",
+		...early,
 		"  if tg_op = 'DELETE' then rec := old; else rec := new; end if;",
+		...reads,
+		...input.payload.kind === "custom" ? [`  body := ${input.payload.sql};`] : [],
 		...sends,
 		"  return null;",
 		"end;",
@@ -162,13 +238,20 @@ function triggerFunctionSql(input) {
 		"",
 		`drop trigger if exists ${sqlIdent(input.triggerName)} on ${input.target};`,
 		`create trigger ${sqlIdent(input.triggerName)} after ${input.events} on ${input.target}`,
-		`  for each row execute function ${fn}();`,
+		`  for each row${input.changed?.when ? ` when (${input.changed.sql})` : ""} execute function ${fn}();`,
 		""
 	].join("\n");
 }
 //#endregion
 //#region src/realtime/topic.ts
-const splitTable = (table) => table.includes(".") ? [table.slice(0, table.indexOf(".")), table.slice(table.indexOf(".") + 1)] : ["public", table];
+const columnsOnly = (values) => {
+	const columns = {};
+	for (const [param, value] of Object.entries(values ?? {})) {
+		if (typeof value === "object") return;
+		if (value !== void 0) columns[param] = value;
+	}
+	return columns;
+};
 const VALUE = /^[\w.@+=-]+$/;
 const snakeCase = (name) => name.replaceAll(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase();
 function validateValue(_name, value) {
@@ -270,20 +353,25 @@ function defineTopic(template, options = {}) {
 		const triggerName = `bs_broadcast_${name}`;
 		const extra = trigger.topics ?? [];
 		const { payload } = trigger;
-		const events = (trigger.events ?? [
+		const operations = trigger.events ?? [
 			"insert",
 			"update",
 			"delete"
-		]).join(" or ");
+		];
+		const events = operations.join(" or ");
+		if (trigger.when && !operations.includes("update")) throw new TypeError(`${where}: when.changed filters updates, but events has no "update"`);
+		const changed = trigger.when ? {
+			sql: changedSql(meta, trigger.when.changed, where),
+			when: operations.length === 1
+		} : void 0;
 		const checkKeys = (params, given, topic) => {
 			for (const key of Object.keys(given ?? {})) if (!params.includes(key)) throw new TypeError(`${where}: "${key}" is not a placeholder of ${topic}`);
 		};
 		checkKeys(parsed.params, trigger.values, template);
-		if (!meta && extra.length === 0 && typeof trigger.event !== "object" && (payload === void 0 || typeof payload === "string")) {
-			const columns = trigger.values ?? {};
+		const columns = columnsOnly(trigger.values);
+		if (!meta && columns !== void 0 && extra.length === 0 && typeof trigger.event !== "object" && (payload === void 0 || typeof payload === "string") && (changed === void 0 || changed.when)) {
 			const sqlTemplate = template.replaceAll(/\{([^}]+)\}/g, (_, param) => {
 				const column = columns[param] ?? snakeCase(param);
-				if (typeof column !== "string") throw new TypeError(`${where}: a lookup for {${param}} needs betterSupabase`);
 				if (/[{}=]/.test(column)) throw new TypeError(`${where}: the column for {${param}} can't contain braces or =`);
 				return column === param ? `{${param}}` : `{${param}=${column}}`;
 			});
@@ -294,15 +382,12 @@ function defineTopic(template, options = {}) {
 				`-- better-supabase: broadcast ${schema}.${relation} changes to ${template}`,
 				`drop trigger if exists ${sqlIdent(triggerName)} on ${target};`,
 				`create trigger ${sqlIdent(triggerName)} after ${events} on ${target}`,
-				`  for each row execute function better_supabase.broadcast_topic(${args.join(", ")});`,
+				`  for each row${changed ? ` when (${changed.sql})` : ""} execute function better_supabase.broadcast_topic(${args.join(", ")});`,
 				""
 			].join("\n");
 		}
-		const valueSql = (value, label) => {
-			if (tables && meta) return triggerValueSql(tables, meta, value, label);
-			if (typeof value !== "string") throw new TypeError(`${where}: a lookup for ${label} needs betterSupabase`);
-			return `rec.${sqlIdent(value)}`;
-		};
+		const lookups = new TriggerLookups();
+		const valueSql = (value, label) => triggerValueSql(tables, meta, value, label, lookups);
 		const topicValues = (params, given, topic) => Object.fromEntries(params.map((param) => {
 			const value = given?.[param] ?? (meta ? void 0 : snakeCase(param));
 			if (value === void 0) throw new TypeError(`defineTopic: no column for {${param}} of ${topic} on "${table}"`);
@@ -336,7 +421,9 @@ function defineTopic(template, options = {}) {
 			events,
 			event: eventSql(trigger.event),
 			topics,
-			payload: payloadSql
+			payload: payloadSql,
+			lookups: lookups.list,
+			...changed ? { changed } : {}
 		});
 	};
 	const api = {

package/dist/{types-6oiy6rIa.d.ts → types-B4zhT6dq.d.ts}

@@ -1,10 +1,10 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
+import { T as ErrorMapper, t as AsyncResult } from "./result-BREt7qOh.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
-import { n as Embedder } from "./knowledge-BXQ2-V0a.js";
+import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
+import { r as BlockTemporalOptions } from "./block-helpers-CjcQM1yA.js";
+import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
+import { n as Embedder } from "./knowledge-CRk1jOAJ.js";
 //#region src/blocks/memory/types.d.ts
 type MemoryScope = "user" | "agent" | "chat" | "project" | "organization";
 type MemoryKind = "core" | "archival";

package/dist/{types-CdP0z5tS.d.ts → types-BEEFkNFY.d.ts}

@@ -1,12 +1,12 @@
 /// <reference lib="esnext.temporal" />
-import { b as DbError, t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
-import { m as RequestContext, t as Actor } from "./plugin-CDLJRFFg.js";
+import { T as ErrorMapper, b as DbError, t as AsyncResult } from "./result-BREt7qOh.js";
+import { m as RequestContext, t as Actor } from "./plugin-D-95Q0w0.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { n as SqlClient } from "./executor-BBHgjUJu.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
-import { t as BlockProblemOptions } from "./problem-CEjyhV5T.js";
+import { n as SqlClient } from "./executor-D1hECPGG.js";
+import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
+import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-CjcQM1yA.js";
+import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
+import { t as BlockProblemOptions } from "./problem-DCDIQiTA.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/auth/delegation.d.ts
 /** One RFC 9396 `authorization_details` entry. */

package/dist/{types-vaoP9S9_.d.ts → types-Bq64h5nY.d.ts}

@@ -1,15 +1,15 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
+import { T as ErrorMapper, t as AsyncResult } from "./result-BREt7qOh.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as StandardSchemaV1 } from "./standard-C3_AAF3g.js";
-import { i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "./provider-9gBq9W6k.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
-import { n as ExtraFields, r as FieldsOf } from "./block-fields-5UA84ZUg.js";
-import { i as AuthorizationHooks } from "./authorization-hooks-DkmrnDX7.js";
-import { h as FilterQuery, l as FilterFieldType } from "./filter-query-BKmRYrTE.js";
-import { f as WorkflowStarter, g as Workflows, p as WorkflowSubject, r as WorkflowRunMode, s as WorkflowSchedule } from "./workflows-DFQeXDAI.js";
+import { t as StandardSchemaV1 } from "./standard-BcUQuUgu.js";
+import { i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "./provider-CNs0Jx0I.js";
+import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
+import { r as BlockTemporalOptions } from "./block-helpers-CjcQM1yA.js";
+import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
+import { n as ExtraFields, r as FieldsOf } from "./block-fields-DnaDbgZS.js";
+import { i as AuthorizationHooks } from "./authorization-hooks-mLi894KH.js";
+import { h as FilterQuery, l as FilterFieldType } from "./filter-query-Bc_Qa8V_.js";
+import { f as WorkflowStarter, g as Workflows, p as WorkflowSubject, r as WorkflowRunMode, s as WorkflowSchedule } from "./workflows-DQBCzrHC.js";
 //#region src/blocks/workflow-builder/graph.d.ts
 type WorkflowNodeKind = "trigger" | "step" | "sleep" | "approval" | "condition";
 type WorkflowConditionOperator = "equals" | "notEquals" | "exists" | "truthy" | "greaterThan" | "lessThan" | "contains";
@@ -630,6 +630,20 @@ interface WorkflowBuilder<F extends object = Record<never, never>> {
       readonly batch?: number;
     }): AsyncResult<number>;
   };
+  /**
+   * An outbox consumer handler that passes each event to `triggers.onEvent`,
+   * for `outbox.consume("workflows", builder.sink())`. It
+   * throws when a start fails, so the outbox retries the event.
+   */
+  sink(): (events: readonly WorkflowSinkEvent[]) => Promise<void>;
+}
+/** An outbox row as a consumer hands it over; an `OutboxEvent` fits. */
+interface WorkflowSinkEvent {
+  readonly id: string;
+  readonly type: string;
+  readonly payload?: unknown;
+  readonly tenant?: string | null;
+  readonly actorId?: string | null;
 }
 //#endregion
-export { validateGraph as $, WorkflowVersion as A, WorkflowGraphDiff as B, WorkflowGrantAction as C, WorkflowStepInfo as D, WorkflowNodeRunStatus as E, WorkflowCondition as F, approved as G, WorkflowGraphNode as H, WorkflowConditionOperator as I, evaluateCondition as J, diffGraphs as K, WorkflowFilterCondition as L, WorkflowVersionStatus as M, GraphScope as N, WorkflowTrigger as O, TriggerEvent as P, triggerMatches as Q, WorkflowFilterField as R, WorkflowDefinitionScope as S, WorkflowNodeRun as T, WorkflowNodeCondition as U, WorkflowGraphEdge as V, WorkflowNodeKind as W, matchesFilter as X, filterConditionOf as Y, topologicalOrder as Z, WorkflowBuilder as _, CredentialInput as a, WorkflowDefinition as b, GraphCompiler as c, PublishOptions as d, RunInput as f, WorkflowAlert as g, VersionSaveOptions as h, BuilderStarter as i, WorkflowVersionOwner as j, WorkflowTriggerKind as k, NodeRunRecord as l, TriggerInput as m, BuilderOptions as n, DefinitionInput as o, TestRunInput as p, durationMs as q, BuilderStartCall as r, GrantInput as s, AlertInput as t, OutboxLikeEvent as u, WorkflowBuilderHooks as v, WorkflowGrantPrincipal as w, WorkflowDefinitionGrant as x, WorkflowCredential as y, WorkflowGraph as z };
+export { triggerMatches as $, WorkflowTriggerKind as A, WorkflowGraph as B, WorkflowGrantAction as C, WorkflowSinkEvent as D, WorkflowNodeRunStatus as E, TriggerEvent as F, WorkflowNodeKind as G, WorkflowGraphEdge as H, WorkflowCondition as I, durationMs as J, approved as K, WorkflowConditionOperator as L, WorkflowVersionOwner as M, WorkflowVersionStatus as N, WorkflowStepInfo as O, GraphScope as P, topologicalOrder as Q, WorkflowFilterCondition as R, WorkflowDefinitionScope as S, WorkflowNodeRun as T, WorkflowGraphNode as U, WorkflowGraphDiff as V, WorkflowNodeCondition as W, filterConditionOf as X, evaluateCondition as Y, matchesFilter as Z, WorkflowBuilder as _, CredentialInput as a, WorkflowDefinition as b, GraphCompiler as c, PublishOptions as d, validateGraph as et, RunInput as f, WorkflowAlert as g, VersionSaveOptions as h, BuilderStarter as i, WorkflowVersion as j, WorkflowTrigger as k, NodeRunRecord as l, TriggerInput as m, BuilderOptions as n, DefinitionInput as o, TestRunInput as p, diffGraphs as q, BuilderStartCall as r, GrantInput as s, AlertInput as t, OutboxLikeEvent as u, WorkflowBuilderHooks as v, WorkflowGrantPrincipal as w, WorkflowDefinitionGrant as x, WorkflowCredential as y, WorkflowFilterField as z };

package/dist/{types-YfwpIE-d.d.ts → types-BrpW5ixT.d.ts}

@@ -54,6 +54,12 @@ interface ColumnMeta {
   readonly insertable?: false;
   /** `false` when updates can't set this column. */
   readonly updatable?: false;
+  /**
+   * `false` when signed-in users can't read the column (an app table
+   * column with `access: "server"`). Reads without `select` leave it out;
+   * the service role can still select it by name.
+   */
+  readonly selectable?: false;
   readonly array?: boolean;
   readonly json?: boolean;
   /** Allowed values for enum columns and CHECK-constraint unions. */
@@ -315,6 +321,13 @@ interface Schema<M extends AnyModels = AnyModels, D = unknown, F extends AnyFunc
     readonly subjects: S;
   };
 }
+/**
+ * Columns of `T` that `Insert` can set: generated columns (`?: never` in
+ * `Insert`) are left out.
+ */
+type WritableColumns<M extends AnyModels, T extends keyof M> = [M[T]["Insert"]] extends [never] ? never : { [K in keyof M[T]["Insert"]]-?: [Exclude<M[T]["Insert"][K], undefined>] extends [never] ? never : K; }[keyof M[T]["Insert"]];
+/** Columns of `T` the database fills (generated or identity `always`): in `Row`, never in `Insert`. */
+type GeneratedColumns<M extends AnyModels, T extends keyof M> = [M[T]["Insert"]] extends [never] ? never : Exclude<keyof M[T]["Insert"], WritableColumns<M, T>>;
 type ModelsOf<S> = S extends Schema<infer M> ? M : never;
 type DatabaseOf<S> = S extends Schema<AnyModels, infer D> ? D : never;
 type FunctionsOf<S> = S extends Schema<AnyModels, unknown, infer F> ? F : never;
@@ -354,4 +367,4 @@ type IsUnion<T, U = T> = T extends unknown ? [U] extends [T] ? false : true : ne
 type PrimaryKeyValue<M extends AnyModels, T extends keyof M> = true extends IsUnion<PrimaryKeyColumn<M, T>> ? { readonly [K in PrimaryKeyColumn<M, T>]: Row<M, T>[K]; } : Row<M, T>[PrimaryKeyColumn<M, T>];
 type Simplify<T> = { [K in keyof T]: T[K]; } & {};
 //#endregion
-export { Relations as A, TableMeta as B, ModelTypes as C, RealtimeTableMeta as D, PrimaryKeyValue as E, Simplify as F, BucketLifecycle as G, UniqueKeyName as H, SubjectRef as I, VersioningStatus as J, BucketLifecycleRule as K, SubjectTypeOf as L, Row as M, Schema as N, RelationMeta as O, SchemaMeta as P, TableFlags as R, ModelFlags as S, PrimaryKeyColumn as T, UniqueWhere as U, UniqueConstraint as V, Update as W, FunctionResult as _, AnyModels as a, FunctionsOf as b, Casing as c, Codec as d, ColumnMeta as f, FunctionMeta as g, ForeignKeyConstraint as h, AnyFunctions as i, ResultColumn as j, RelationTypes as k, CheckConstraint as l, Flags as m, AccessPolicySql as n, BucketMeta as o, DatabaseOf as p, ObjectVersion as q, AccessTopicPolicy as r, BucketPolicyName as s, AccessBucketPolicy as t, ClaimsMeta as u, FunctionSignature as v, ModelsOf as w, Insert as x, FunctionTypes as y, TableKey as z };
+export { RelationTypes as A, TableKey as B, ModelFlags as C, PrimaryKeyValue as D, PrimaryKeyColumn as E, SchemaMeta as F, Update as G, UniqueConstraint as H, Simplify as I, BucketLifecycleRule as J, WritableColumns as K, SubjectRef as L, ResultColumn as M, Row as N, RealtimeTableMeta as O, Schema as P, SubjectTypeOf as R, Insert as S, ModelsOf as T, UniqueKeyName as U, TableMeta as V, UniqueWhere as W, VersioningStatus as X, ObjectVersion as Y, FunctionResult as _, AnyModels as a, FunctionsOf as b, Casing as c, Codec as d, ColumnMeta as f, FunctionMeta as g, ForeignKeyConstraint as h, AnyFunctions as i, Relations as j, RelationMeta as k, CheckConstraint as l, Flags as m, AccessPolicySql as n, BucketMeta as o, DatabaseOf as p, BucketLifecycle as q, AccessTopicPolicy as r, BucketPolicyName as s, AccessBucketPolicy as t, ClaimsMeta as u, FunctionSignature as v, ModelTypes as w, GeneratedColumns as x, FunctionTypes as y, TableFlags as z };

package/dist/{types-D0W4fnsc.d.ts → types-DDQ-Rsep.d.ts}

@@ -1,10 +1,10 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
+import { T as ErrorMapper, t as AsyncResult } from "./result-BREt7qOh.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { i as CredentialRef, r as CredentialProvider } from "./provider-9gBq9W6k.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
+import { i as CredentialRef, r as CredentialProvider } from "./provider-CNs0Jx0I.js";
+import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
+import { i as CursorPageOptions, r as BlockTemporalOptions } from "./block-helpers-CjcQM1yA.js";
+import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
 //#region src/blocks/ai-providers/types.d.ts
 /** A tenant's own key for a provider. The key itself stays in the credential provider. */
 interface AiProviderKey {

package/dist/types-DGHfTW8_.d.ts

@@ -0,0 +1,9 @@
+//#region src/create/types.d.ts
+/** One rendered file: its path, the SQL module it belongs to and its contents. */
+interface PresetMigrationFile {
+  readonly path: string;
+  readonly module: string;
+  readonly contents: string;
+}
+//#endregion
+export { PresetMigrationFile as t };

package/dist/{types-pNY_UpDs.d.ts → types-DO9xWsGC.d.ts}

@@ -1,11 +1,11 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
+import { T as ErrorMapper, t as AsyncResult } from "./result-BREt7qOh.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as StandardSchemaV1 } from "./standard-C3_AAF3g.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { r as BlockTemporalOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
-import { r as FieldsOf } from "./block-fields-5UA84ZUg.js";
+import { t as StandardSchemaV1 } from "./standard-BcUQuUgu.js";
+import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
+import { r as BlockTemporalOptions } from "./block-helpers-CjcQM1yA.js";
+import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
+import { r as FieldsOf } from "./block-fields-DnaDbgZS.js";
 import { i as AiMessage } from "./message-B0fNJgq8.js";
 //#region src/blocks/ai-files/types.d.ts
 interface StorageReply<T> {

package/dist/{undo-CEGIRkPA.js → undo-B5LgpGLy.js}

@@ -1,8 +1,8 @@
-import { n as dbError } from "./errors-8i6tSICm.js";
-import { a as ok, t as AsyncResult } from "./result-BlgnMB0H.js";
+import { n as dbError } from "./errors-BV1SKTVs.js";
+import { a as ok, t as AsyncResult } from "./result-DIeYscA3.js";
 import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { o as blockCall } from "./block-helpers-CfG_MvDR.js";
-import { r as withBlockHooks } from "./block-hooks-BsXncUlZ.js";
+import { o as blockCall } from "./block-helpers-DkVZNDrj.js";
+import { r as withBlockHooks } from "./block-hooks-C22vuIUd.js";
 //#region src/blocks/undo/undo.ts
 /** The functions an undo token may call: the inverses the blocks return. */
 const UNDO_FUNCTIONS = [

package/dist/{undo-DGo0skyO.d.ts → undo-BsdYRox7.d.ts}

@@ -1,7 +1,7 @@
-import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
+import { T as ErrorMapper, t as AsyncResult } from "./result-BREt7qOh.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
+import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
+import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
 //#region src/blocks/undo/undo.d.ts
 /** One call that reverses part of a change. */
 interface UndoCall {

package/dist/{usage-DM2rzczj.d.ts → usage-C504GF55.d.ts}

@@ -1,10 +1,10 @@
 /// <reference lib="esnext.temporal" />
-import { t as AsyncResult } from "./result-Cj3yWhjH.js";
+import { t as AsyncResult } from "./result-BREt7qOh.js";
 import { n as Logger } from "./logger-DWVYUmwi.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
-import { i as CursorPageOptions, n as BlockOptions } from "./block-helpers-C86hPEjI.js";
-import { n as BlockHooks } from "./block-hooks-BLPWD3Jt.js";
-import { g as JobHandler } from "./types-CdP0z5tS.js";
+import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
+import { i as CursorPageOptions, n as BlockOptions } from "./block-helpers-CjcQM1yA.js";
+import { n as BlockHooks } from "./block-hooks-DcPJHztl.js";
+import { g as JobHandler } from "./types-BEEFkNFY.js";
 import { n as StripeSource } from "./stripe-NVcNOhHy.js";
 //#region src/blocks/usage/usage.d.ts
 interface UsageOptions extends BlockOptions {
@@ -87,6 +87,10 @@ interface UsageMeterInfo {
   readonly unit?: string;
   readonly category?: string;
   readonly label?: string;
+  /** `counter` when the catalog gives no kind. */
+  readonly kind?: "counter" | "distinct" | "computed";
+  /** The window a distinct or computed meter measures. */
+  readonly period?: UsagePeriod;
 }
 interface UsageStatus {
   readonly meter: string;
@@ -108,6 +112,20 @@ interface UsageStatus {
 interface Usage {
   /** Adds usage without checking the quota (metering only). */
   record(organizationId: string, meter: string, options?: RecordUsageOptions): AsyncResult<UsageRecorded>;
+  /**
+   * Counts `subject` once in the current period of a `distinct` meter (active
+   * users, say). Repeating a subject changes nothing, and quotas and Stripe
+   * reporting read the meter like a counter.
+   */
+  track(organizationId: string, meter: string, subject: string, options?: {
+    readonly period?: UsagePeriod;
+  }): AsyncResult<UsageRecorded>;
+  /**
+   * Recomputes `computed` meters from their query for every tenant it returns,
+   * or for one meter. Service role only; returns the rows written. The
+   * migration schedules it hourly when pg_cron is installed.
+   */
+  refresh(meter?: string): AsyncResult<number>;
   /** Adds usage when it fits the quota, or returns `quota_exceeded`. */
   consume(organizationId: string, meter: string, options?: RecordUsageOptions): AsyncResult<UsageRecorded>;
   /**

package/dist/{usage-CdlfuS3i.js → usage-DdqT13_X.js}

@@ -1,6 +1,6 @@
 import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { C as optionalText, D as recordOf, I as textOf, M as seconds, R as toInstant, k as recordsOf, n as applyTemporal, o as blockCall, t as DEFAULT_BLOCK_SCHEMA, u as eachLimit, w as pageOf } from "./block-helpers-CfG_MvDR.js";
-import { r as withBlockHooks } from "./block-hooks-BsXncUlZ.js";
+import { C as optionalText, D as recordOf, I as textOf, M as seconds, R as toInstant, k as recordsOf, n as applyTemporal, o as blockCall, t as DEFAULT_BLOCK_SCHEMA, u as eachLimit, w as pageOf } from "./block-helpers-DkVZNDrj.js";
+import { r as withBlockHooks } from "./block-hooks-C22vuIUd.js";
 import { t as lazyStripe } from "./stripe-XZrSmDTf.js";
 //#region src/blocks/usage/usage.ts
 const numberOf = (value) => typeof value === "number" ? value : Number(value);
@@ -43,10 +43,14 @@ function meterInfo(row) {
 	const unit = optionalText(row["unit"]);
 	const category = optionalText(row["category"]);
 	const label = optionalText(row["label"]);
+	const kind = optionalText(row["kind"]);
+	const period = optionalText(row["period"]);
 	return {
 		...unit === void 0 ? {} : { unit },
 		...category === void 0 ? {} : { category },
-		...label === void 0 ? {} : { label }
+		...label === void 0 ? {} : { label },
+		...kind === "counter" || kind === "distinct" || kind === "computed" ? { kind } : {},
+		...period === "day" || period === "week" || period === "month" || period === "year" || period === "billing" ? { period } : {}
 	};
 }
 /** Usage metering and quotas over the `usage` module's functions. */
@@ -99,6 +103,13 @@ function createUsage(options) {
 			events: await purgeEvents(jobOptions.events).orThrow()
 		}),
 		record: (organizationId, meter, record) => call("record_usage", args(organizationId, meter, record), recordedOf),
+		track: (organizationId, meter, subject, trackOptions = {}) => call("track_usage", {
+			tenant: organizationId,
+			meter,
+			subject,
+			period: trackOptions.period ?? "month"
+		}, recordedOf),
+		refresh: (meter) => call("usage_refresh", { meter }, (value) => Number(value ?? 0)),
 		consume: (organizationId, meter, record) => call("consume_quota", args(organizationId, meter, record), recordedOf),
 		recordMany: batch(false),
 		consumeMany: batch(true),

package/dist/{vault-tOkPLnMB.d.ts → vault-DR2-zOjz.d.ts}

@@ -1,6 +1,6 @@
-import { t as AsyncResult, w as ErrorMapper } from "./result-Cj3yWhjH.js";
-import { c as SetCredentialOptions, i as CredentialRef, r as CredentialProvider } from "./provider-9gBq9W6k.js";
-import { t as BlockTransport } from "./block-transport-DaGGXjIw.js";
+import { T as ErrorMapper, t as AsyncResult } from "./result-BREt7qOh.js";
+import { c as SetCredentialOptions, i as CredentialRef, r as CredentialProvider } from "./provider-CNs0Jx0I.js";
+import { t as BlockTransport } from "./block-transport-DezJPPA0.js";
 //#region src/credentials/vault.d.ts
 /** How a request the third party sends is signed with the stored secret. */
 type VaultInboundScheme = "standard-webhooks" | "hmac-sha256" | "shared-secret";

package/dist/vercel-connect/index.d.ts

@@ -1,4 +1,4 @@
-import { a as CredentialSubject, r as CredentialProvider } from "../provider-9gBq9W6k.js";
+import { a as CredentialSubject, r as CredentialProvider } from "../provider-CNs0Jx0I.js";
 //#region src/vercel-connect/vercel-connect.d.ts
 interface ConnectTokenParams {
   subject: CredentialSubject;

package/dist/vercel-connect/index.js

@@ -1,6 +1,6 @@
-import { n as dbError } from "../errors-8i6tSICm.js";
+import { n as dbError } from "../errors-BV1SKTVs.js";
 import { c as optionalTemporal } from "../temporal-CB5Fpo5d.js";
-import { a as ok, r as err, t as AsyncResult } from "../result-BlgnMB0H.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-DIeYscA3.js";
 import { n as isRecord } from "../guards-6F2bCtQR.js";
 import { t as importOptionalPeer } from "../optional-peer-Dx8TaYXw.js";
 //#region src/vercel-connect/vercel-connect.ts

package/dist/{verify-D63A2ALE.d.ts → verify-BucYsoKq.d.ts}

@@ -1,8 +1,8 @@
 /// <reference lib="esnext.temporal" />
-import { f as Result } from "./result-Cj3yWhjH.js";
-import { M as Row, a as AnyModels, i as AnyFunctions, z as TableKey } from "./types-YfwpIE-d.js";
-import { t as BetterSupabase } from "./define-DxHHbNEb.js";
-import { n as VerifyOptions, r as WebhookInput, t as VerifiedWebhook } from "./signatures-BMdJ7neI.js";
+import { f as Result } from "./result-BREt7qOh.js";
+import { B as TableKey, N as Row, a as AnyModels, i as AnyFunctions } from "./types-BrpW5ixT.js";
+import { t as BetterSupabase } from "./define-M_r1d2AT.js";
+import { n as VerifyOptions, r as WebhookInput, t as VerifiedWebhook } from "./signatures-BXlDXV3D.js";
 //#region src/blocks/webhooks/verify.d.ts
 /** The `Stripe-Signature` header for `body`, for tests and local replays. */
 declare function signStripeWebhook(secret: string, body: string, timestamp?: Temporal.Instant): Promise<string>;

package/dist/{verify-EQcC3Khp.js → verify-DnU-uWU2.js}

@@ -1,9 +1,9 @@
-import { n as dbError } from "./errors-8i6tSICm.js";
+import { n as dbError } from "./errors-BV1SKTVs.js";
 import { c as optionalTemporal, s as nowInstant } from "./temporal-CB5Fpo5d.js";
-import { n as temporalMissing } from "./temporal-required-DqRzr7i0.js";
-import { a as ok, r as err } from "./result-BlgnMB0H.js";
-import { n as hmacHex, r as timingSafeEqual } from "./hmac-DCud0myt.js";
-import { a as unauthorized, n as header, r as replayed, s as verifyWebhook } from "./signatures-B41ApWXA.js";
+import { n as temporalMissing } from "./temporal-required-nfZ87U-0.js";
+import { a as ok, r as err } from "./result-DIeYscA3.js";
+import { n as hmacHex, r as timingSafeEqual } from "./hmac-BgpThYQW.js";
+import { a as unauthorized, n as header, r as replayed, s as verifyWebhook } from "./signatures-CeIoAelK.js";
 import { t as toApp } from "./casing-DdFWEtqr.js";
 //#region src/blocks/webhooks/verify.ts
 /** Stripe signs with the endpoint secret's UTF-8 bytes, not its base64 decoding. */

package/dist/{version-D87ZteKy.js → version-TXpQEfh1.js}

@@ -1,4 +1,4 @@
 //#region src/core/version.ts
-const VERSION = "0.9.0";
+const VERSION = "0.11.0";
 //#endregion
 export { VERSION as t };

package/dist/{view-Dv0A949a.d.ts → view-Bf7e07rQ.d.ts}

@@ -1,8 +1,8 @@
-import { b as DbError } from "./result-Cj3yWhjH.js";
-import { i as InvalidReason, r as AuthState } from "./resolve-w9EpHzuM.js";
+import { b as DbError } from "./result-BREt7qOh.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-Bqb8TMTt.js";
 import { a as SessionActor, o as SessionDelegation } from "./actor-BAhb-d1S.js";
 import { n as Impersonator } from "./impersonation-D5chOkrO.js";
-import { n as AmrEntry, t as Aal } from "./mfa-DtflCXEt.js";
+import { n as AmrEntry, t as Aal } from "./mfa-YzkRjNad.js";
 import { JWTClaims, UserClaims } from "@supabase/server";
 //#region src/auth/view.d.ts
 /**

package/dist/{view-DZ63nqwt.js → view-CYX1wsgp.js}

@@ -1,6 +1,6 @@
-import { n as dbError } from "./errors-8i6tSICm.js";
-import { a as invalidActorError, i as delegationOf, n as actorOf } from "./actor-KHDOKGb1.js";
-import { r as impersonatorOf } from "./impersonation-CDeCzZP6.js";
+import { n as dbError } from "./errors-BV1SKTVs.js";
+import { a as invalidActorError, i as delegationOf, n as actorOf } from "./actor-CAL8mMih.js";
+import { r as impersonatorOf } from "./impersonation-DxU6yHJV.js";
 //#region src/auth/mfa.ts
 /** The session's assurance level from its claims; anything but `aal2` reads as `aal1`. */
 function aalOf(claims) {