@protobase/server 0.7.0 → 0.8.0

package/dist/files/upload.js

@@ -0,0 +1,124 @@
+import { HttpProblem, badRequest } from "../problem.js";
+import { accepts } from "./media-types.js";
+import { cleanName, tenantSegment } from "./uri.js";
+import { tenantScope } from "../tenant.js";
+import { requestAccess, requireOperation, writableFields } from "../request-access.js";
+import { issueTicket } from "./ticket.js";
+import { ticketScope } from "./attach.js";
+import { ticketSeconds } from "./runtime.js";
+import { decideType } from "./detect.js";
+import { FileTooLarge, incomingFile, limitedStream, readHead, tooLarge } from "./upload-body.js";
+//#region src/files/upload.ts
+/** How many first bytes processors get as `head`: enough for image headers, EXIF included. */
+const headBytes = 262144;
+const uploadField = (access, name) => {
+	if (!access.resolved.operations.create && !access.resolved.operations.update) requireOperation(access, "update");
+	const field = name !== void 0 && Object.hasOwn(access.readable.fields, name) ? access.full.fields[name] : void 0;
+	if (!field?.file) throw badRequest("invalid-parameter", `"${name ?? ""}" is not a file field of ${access.entry.name}`, { errors: [{
+		parameter: "field",
+		message: "Not a file field"
+	}] });
+	if (!writableFields(access, "create").includes(field.name) && !writableFields(access, "update").includes(field.name)) throw badRequest("invalid-parameter", `"${field.name}" is read-only`, { errors: [{
+		parameter: "field",
+		message: "Read-only"
+	}] });
+	return field;
+};
+const deriveValues = async (entry, field, input) => {
+	const source = entry.source.state.fields?.[field.name];
+	const derived = {};
+	for (const [target, processor] of Object.entries(source?.meta.file?.derive ?? {})) {
+		const value = !processor.accepts || accepts(processor.accepts, input.type) ? await processor.run({
+			name: input.name,
+			type: input.type,
+			size: input.size,
+			head: input.head,
+			read: async () => {
+				const body = await input.store.read(input.path);
+				if (!body) throw new Error(`The upload ${input.path} is gone from its store`);
+				return body;
+			}
+		}) : null;
+		const schema = entry.source.state.fields?.[target]?.schema;
+		const normalized = value === void 0 ? null : value;
+		if (schema && !schema.safeParse(normalized).success) throw new Error(`The processor for "${target}" of ${entry.name} returned ${JSON.stringify(normalized)}, which that field refuses`);
+		derived[target] = normalized;
+	}
+	return derived;
+};
+/**
+* `POST /{resource}:upload?field=<field>`: streams one file to the field's provider and answers with a ticket for a
+* write. The type is decided from the first bytes before anything is stored, a refused type gets 415 and a file over
+* `maxSize` 413. The field's processors then compute its derived values, which the ticket carries signed. An upload no
+* write ever uses is deleted after the ticket expires.
+*/
+const uploadFile = async (deps, entry, session, request) => {
+	const files = deps.files;
+	const access = await requestAccess(deps, entry, session);
+	const field = uploadField(access, new URL(request.url).searchParams.get("field") ?? void 0);
+	if (!files) throw new Error(`Resource "${entry.name}" has file fields but no file runtime`);
+	const { accept, maxSize, provider: providerName } = field.file;
+	const provider = files.providers[providerName];
+	const incoming = await incomingFile(request, maxSize);
+	const reader = incoming.body.getReader();
+	const { head, complete } = await readHead(reader, headBytes);
+	if (head.length > maxSize) {
+		await reader.cancel();
+		throw tooLarge(maxSize);
+	}
+	const name = cleanName(incoming.name);
+	const decision = await decideType({
+		head,
+		complete,
+		name,
+		accept,
+		...incoming.declared && { declared: incoming.declared }
+	});
+	if (!accepts(accept, decision.type)) {
+		await reader.cancel();
+		throw new HttpProblem(415, "unsupported-type", "Unsupported Media Type", `This field takes ${accept.join(", ")}; the file is ${decision.type}`, {
+			detected: decision.type,
+			accept
+		});
+	}
+	const expires = Math.floor(Date.now() / 1e3) + ticketSeconds;
+	const path = `${await tenantSegment(tenantScope(entry, session)?.tenantValue)}/${crypto.randomUUID()}.${decision.extension}`;
+	await files.schedule.add([{
+		provider: providerName,
+		path,
+		due: /* @__PURE__ */ new Date((expires + 3600) * 1e3)
+	}]);
+	let size;
+	try {
+		size = (await provider.store.put(path, limitedStream(head, reader, maxSize))).size;
+	} catch (error) {
+		if (error instanceof FileTooLarge) throw tooLarge(maxSize);
+		throw error;
+	}
+	const derived = await deriveValues(entry, field, {
+		name,
+		type: decision.type,
+		size,
+		head,
+		store: provider.store,
+		path
+	});
+	const ref = {
+		provider: providerName,
+		path,
+		name,
+		size
+	};
+	return {
+		value: await issueTicket(files.signer, ref, derived, ticketScope(access, field.name), expires),
+		file: {
+			name,
+			type: decision.type,
+			size
+		},
+		derived,
+		...decision.corrected && { corrected: decision.corrected }
+	};
+};
+//#endregion
+export { headBytes, uploadFile };

package/dist/files/uri.js

@@ -0,0 +1,47 @@
+import { sha256Hex } from "../hash.js";
+//#region src/files/uri.ts
+const provider = /^[a-z][a-z0-9-]{0,31}$/;
+const segment = /^[A-Za-z0-9_-][A-Za-z0-9._-]{0,127}$/;
+const maxPath = 512;
+const isFilePath = (path) => path.length <= maxPath && path.split("/").every((part) => segment.test(part));
+/** The identity of a value or ticket: `{provider}:{path}`. */
+const baseOf = (value) => value.split("?", 1)[0];
+const formatUri = (ref) => {
+	const query = new URLSearchParams({
+		name: ref.name,
+		...ref.size !== void 0 && { size: String(ref.size) }
+	});
+	return `${ref.provider}:${ref.path}?${query}`;
+};
+const lastSegment = (path) => path.slice(path.lastIndexOf("/") + 1);
+/** The file a value names, or `undefined` when it does not parse. */
+const parseUri = (value) => {
+	const match = /^([a-z][a-z0-9-]*):([^?#]+)(?:\?([^#]*))?$/.exec(value);
+	if (!match || !provider.test(match[1]) || !isFilePath(match[2])) return void 0;
+	const query = new URLSearchParams(match[3] ?? "");
+	const size = query.get("size");
+	if (size !== null && !/^\d{1,15}$/.test(size)) return void 0;
+	return {
+		provider: match[1],
+		path: match[2],
+		name: query.get("name") || lastSegment(match[2]),
+		...size !== null && { size: Number(size) }
+	};
+};
+const encoder = new TextEncoder();
+/** The uploader's file name without a path or control characters, at most 255 bytes; `file` when nothing is left. */
+const cleanName = (name) => {
+	const text = name ?? "";
+	let clean = text.slice(Math.max(text.lastIndexOf("/"), text.lastIndexOf("\\")) + 1).replace(/[\u0000-\u001f\u007f]/g, "").trim();
+	while (encoder.encode(clean).length > 255) clean = clean.slice(0, -1);
+	return clean || "file";
+};
+const tenantText = /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/;
+/** The first path segment of an upload: the row's tenant as it is when it fits, a hash of it when not, `_` without one. */
+const tenantSegment = async (tenant) => {
+	if (tenant === void 0) return "_";
+	const text = String(tenant);
+	return tenantText.test(text) ? text : `t${(await sha256Hex(text)).slice(0, 32)}`;
+};
+//#endregion
+export { baseOf, cleanName, formatUri, isFilePath, parseUri, tenantSegment };

package/dist/functions/define-function.d.ts

@@ -0,0 +1,71 @@
+import { Session } from "../types.js";
+import { FunctionRecords } from "./records.js";
+import { Db } from "@protobase/query";
+//#region src/functions/define-function.d.ts
+/** What every function gets: its name and the raw database. */
+export type PublicFunctionContext = {
+  /** The function's name, as in `/api/functions/<name>`. */
+  name: string;
+  /** The database itself, with no access rules, row filters or tenant scope: privileged work only. */
+  db: Db;
+  /** The caller, through the app's own `authenticate`: rejects with a 401 problem when the request carries no valid token. */
+  caller: () => Promise<FunctionCaller>;
+};
+/** Who called a function, and the app's resources as them. */
+export type FunctionCaller = {
+  session: Session;
+  /** The app's resources as this caller, under the same access rules, row filters and tenant scope as the REST API. */
+  records: FunctionRecords;
+};
+/** What a function that needs a signed-in caller gets: the caller resolved before it runs. */
+export type FunctionContext = PublicFunctionContext & FunctionCaller;
+/** A Web-standard handler. Its request's path is the part after `/api/functions/<name>`: `/` or `/more/parts`. */
+export type FunctionHandler = (request: Request, context: FunctionContext) => Response | Promise<Response>;
+export type PublicFunctionHandler = (request: Request, context: PublicFunctionContext) => Response | Promise<Response>;
+/** Any app with a Hono-style `fetch`, such as `new Hono()`: its `c.env` is the function's context. */
+export type FunctionApp<Context = FunctionContext> = {
+  fetch: (request: Request, env: Context) => Response | Promise<Response>;
+};
+/** `hono/cors` options: an origin, a list of them, or a function of the request's origin. */
+export type CorsOptions = {
+  origin: string | string[] | ((origin: string) => string | undefined | null);
+  allowMethods?: string[];
+  allowHeaders?: string[];
+  exposeHeaders?: string[];
+  maxAge?: number;
+  credentials?: boolean;
+};
+type SharedOptions = {
+  /** Answers CORS preflights before authentication and adds the CORS headers to every response, problems included. */
+  cors?: CorsOptions;
+};
+/** A function anyone may call, such as a webhook; it can still ask for a caller with `context.caller()`. */
+export type PublicFunctionOptions = SharedOptions & {
+  public: true;
+};
+export type ProtectedFunctionOptions = SharedOptions & {
+  public?: false;
+  /** The caller needs one of these roles, otherwise the call is a 403 problem. */
+  roles?: string[];
+};
+export type FunctionOptions = PublicFunctionOptions | ProtectedFunctionOptions;
+/** A function as `createAdmin` serves it: its options and what answers its requests. */
+export type ApiFunction = {
+  kind: 'function';
+  options: PublicFunctionOptions;
+  handler: PublicFunctionHandler | FunctionApp<PublicFunctionContext>;
+} | {
+  kind: 'function';
+  options: ProtectedFunctionOptions;
+  handler: FunctionHandler | FunctionApp;
+};
+/** What a function file may default-export: `defineFunction(...)`, a bare handler or a Hono app (both protected). */
+export type FunctionSource = ApiFunction | FunctionHandler | FunctionApp;
+/**
+ * A function of your own, served at `/api/functions/<name>`. Without options it needs a signed-in caller, through the
+ * app's `authenticate`; `{ public: true }` opens it to anyone, as for a webhook.
+ */
+export declare function defineFunction(handler: FunctionHandler | FunctionApp): ApiFunction;
+export declare function defineFunction(options: PublicFunctionOptions, handler: PublicFunctionHandler | FunctionApp<PublicFunctionContext>): ApiFunction;
+export declare function defineFunction(options: ProtectedFunctionOptions, handler: FunctionHandler | FunctionApp): ApiFunction;
+//#endregion

package/dist/functions/define-function.js

@@ -0,0 +1,36 @@
+//#region src/functions/define-function.ts
+function defineFunction(first, handler) {
+	if (handler === void 0) return {
+		kind: "function",
+		options: {},
+		handler: first
+	};
+	return {
+		kind: "function",
+		options: first,
+		handler
+	};
+}
+const isApp = (value) => typeof value === "object" && value !== null && typeof value.fetch === "function";
+const isApiFunction = (value) => typeof value === "object" && value !== null && value.kind === "function";
+/** A function's name is its URL segment: letters, digits, `-` and `_`, starting with a letter or digit. */
+const functionNamePattern = /^[A-Za-z0-9][A-Za-z0-9_-]*$/;
+/** The function a source stands for; anything else is an error naming it. */
+const toApiFunction = (name, source) => {
+	if (!functionNamePattern.test(name)) throw new Error(`The function name "${name}" is not a URL segment: use letters, digits, - and _`);
+	if (isApiFunction(source)) {
+		if (typeof source.handler !== "function" && !isApp(source.handler)) throw new Error(`The function "${name}" has no handler: pass a (request, context) function or a Hono app`);
+		return source;
+	}
+	if (typeof source === "function" || isApp(source)) return defineFunction(source);
+	throw new Error(`The function "${name}" must default-export defineFunction(...), a (request, context) handler or a Hono app`);
+};
+/** Calls a function's handler or app with its request and context; anything but a Response is an error. */
+const invokeFunction = async (name, fn, request, context) => {
+	const { handler } = fn;
+	const response = isApp(handler) ? await handler.fetch(request, context) : await handler(request, context);
+	if (!(response instanceof Response)) throw new Error(`The function "${name}" returned no Response`);
+	return response;
+};
+//#endregion
+export { defineFunction, functionNamePattern, invokeFunction, toApiFunction };

package/dist/functions/function-app.d.ts

@@ -0,0 +1,17 @@
+import { FunctionContext, PublicFunctionContext } from "./define-function.js";
+import { Env, Hono } from "hono";
+//#region src/functions/function-app.d.ts
+/** A Hono app's env for a protected function: `c.env` is its context, `c.env.records` the caller's records. */
+export type FunctionEnv = {
+  Bindings: FunctionContext;
+};
+/** A Hono app's env for a public function. */
+export type PublicFunctionEnv = {
+  Bindings: PublicFunctionContext;
+};
+/**
+ * `new Hono()` for a function, whose errors and unknown paths reach the app's own error handling: problems as
+ * problem+json, anything else a 500 the app reports. A plain Hono app answers them itself.
+ */
+export declare const functionApp: <E extends Env = FunctionEnv>() => Hono<E, import("hono/types").BlankSchema, "/">;
+//#endregion

package/dist/functions/function-app.js

@@ -0,0 +1,19 @@
+import { notFound } from "../problem.js";
+import { Hono } from "hono";
+//#region src/functions/function-app.ts
+/**
+* `new Hono()` for a function, whose errors and unknown paths reach the app's own error handling: problems as
+* problem+json, anything else a 500 the app reports. A plain Hono app answers them itself.
+*/
+const functionApp = () => {
+	const app = new Hono();
+	app.onError((error) => {
+		throw error;
+	});
+	app.notFound((c) => {
+		throw notFound(`There is no route at ${c.req.path}`);
+	});
+	return app;
+};
+//#endregion
+export { functionApp };

package/dist/functions/read-json.d.ts

@@ -0,0 +1,35 @@
+//#region src/functions/read-json.d.ts
+type Issue = {
+  message: string;
+  path?: ReadonlyArray<PropertyKey | {
+    key: PropertyKey;
+  }>;
+};
+/** A Standard Schema (https://standardschema.dev), such as a zod 4, Valibot or ArkType schema. */
+export type StandardSchema<Output = unknown> = {
+  readonly '~standard': {
+    readonly version: 1;
+    readonly validate: (value: unknown) => {
+      value: Output;
+      issues?: undefined;
+    } | {
+      issues: ReadonlyArray<Issue>;
+    } | Promise<{
+      value: Output;
+      issues?: undefined;
+    } | {
+      issues: ReadonlyArray<Issue>;
+    }>;
+    readonly types?: {
+      readonly input: unknown;
+      readonly output: Output;
+    };
+  };
+};
+/**
+ * The request's JSON body, checked against `schema` when one is given. A body that is no JSON is a 400 `malformed-json`
+ * problem, one the schema refuses a 400 `invalid-body` problem listing each issue by field.
+ */
+export declare function readJson(request: Request): Promise<unknown>;
+export declare function readJson<Output>(request: Request, schema: StandardSchema<Output>): Promise<Output>;
+//#endregion

package/dist/functions/read-json.js

@@ -0,0 +1,24 @@
+import { badRequest } from "../problem.js";
+//#region src/functions/read-json.ts
+const fieldOf = (issue) => (issue.path ?? []).map((part) => String(typeof part === "object" ? part.key : part)).join(".");
+async function readJson(request, schema) {
+	const text = await request.text();
+	let body;
+	try {
+		body = JSON.parse(text);
+	} catch (error) {
+		if (error instanceof SyntaxError) throw badRequest("malformed-json", "The request body is not valid JSON");
+		throw error;
+	}
+	if (!schema) return body;
+	const result = await schema["~standard"].validate(body);
+	if (!result.issues) return result.value;
+	const errors = result.issues.map((issue) => ({
+		field: fieldOf(issue),
+		message: issue.message
+	}));
+	const first = errors[0];
+	throw badRequest("invalid-body", `The request body is invalid: ${first.field ? `${first.field}: ` : ""}${first.message}`, { errors });
+}
+//#endregion
+export { readJson };

package/dist/functions/records.d.ts

@@ -0,0 +1,43 @@
+import { Row } from "../types.js";
+import "../deps.js";
+import { RecordKeyInput, ToolRecord, ToolRecords } from "../assistant/records.js";
+//#region src/functions/records.d.ts
+/** The list parameters of the REST API (AIP-132), as values rather than query text. */
+export type ListParams = {
+  filter?: string;
+  order_by?: string;
+  page_size?: number;
+  page_token?: string;
+  fields?: string[];
+  count?: 'exact';
+  show_deleted?: boolean;
+};
+/**
+ * A page of records as the REST API lists it: each item with its `etag` and, unless the resource opts out, whether the
+ * caller may update and delete it; and the token of the next page, empty on the last.
+ */
+export type RecordPage = {
+  items: Array<Row & {
+    etag?: string;
+    permissions?: {
+      update: boolean;
+      delete: boolean;
+    };
+  }>;
+  next_page_token: string;
+  total_size_estimate: number;
+  total_size?: number;
+};
+/**
+ * The app's resources as the caller: their access rules, row filters, tenant scope, validation and write hooks apply as
+ * in the REST API. A refusal or a missing record rejects with an `HttpProblem`, which becomes the function's response
+ * when it is not caught.
+ */
+export type FunctionRecords = ToolRecords & {
+  list: (resource: string, params?: ListParams) => Promise<RecordPage>;
+  /** With `etag`, fails with 412 when the record changed since it was read. Resolves to the record as it was. */
+  delete: (resource: string, key: RecordKeyInput, options?: {
+    etag?: string;
+  }) => Promise<ToolRecord>;
+};
+//#endregion

package/dist/functions/records.js

@@ -0,0 +1,31 @@
+import { notFound } from "../problem.js";
+import { decodeKeyText } from "../key.js";
+import { runWrite } from "../write-pipeline.js";
+import { assistantRecords } from "../assistant/records.js";
+import { listRecords } from "../list-service.js";
+import { encodeKey } from "@protobase/schema";
+//#region src/functions/records.ts
+const filterLength = 2e5;
+/** `FunctionRecords` over the admin's resources for `session`. */
+const callerRecords = (deps, session) => {
+	const entryOf = (resource) => {
+		const entry = deps.registry.find(resource);
+		if (!entry) throw notFound(`There is no resource "${resource}"`);
+		return entry;
+	};
+	return {
+		...assistantRecords(deps, session),
+		list: async (resource, params = {}) => (await listRecords(deps, entryOf(resource), session, params, filterLength)).body,
+		delete: async (resource, input, { etag } = {}) => {
+			const entry = entryOf(resource);
+			const key = decodeKeyText(entry, Array.isArray(input) ? encodeKey(input) : String(input));
+			return runWrite(deps, entry, session, {
+				operation: "delete",
+				key,
+				ifMatch: etag ?? "*"
+			});
+		}
+	};
+};
+//#endregion
+export { callerRecords };

package/dist/functions/require-env.d.ts

@@ -0,0 +1,7 @@
+//#region src/functions/require-env.d.ts
+/**
+ * An environment variable the function cannot work without, such as an API key: `protobase dev` reads it from `.env`,
+ * `protobase serve` from its environment. A missing one is an error, so the call is a 500 the app reports.
+ */
+export declare const requireEnv: (name: string) => any;
+//#endregion

package/dist/functions/require-env.js

@@ -0,0 +1,12 @@
+//#region src/functions/require-env.ts
+/**
+* An environment variable the function cannot work without, such as an API key: `protobase dev` reads it from `.env`,
+* `protobase serve` from its environment. A missing one is an error, so the call is a 500 the app reports.
+*/
+const requireEnv = (name) => {
+	const value = globalThis.process?.env?.[name];
+	if (!value) throw new Error(`The environment variable ${name} is not set`);
+	return value;
+};
+//#endregion
+export { requireEnv };

package/dist/functions/routes.js

@@ -0,0 +1,60 @@
+import { forbidden, notFound } from "../problem.js";
+import { invokeFunction } from "./define-function.js";
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+//#region src/functions/routes.ts
+const relativeRequest = (request, prefix) => {
+	const url = new URL(request.url);
+	url.pathname = url.pathname.slice(prefix.length) || "/";
+	return new Request(url, request);
+};
+const requireRoles = (name, session, roles) => {
+	if (!roles || roles.some((role) => session.user.roles.includes(role))) return;
+	throw forbidden("function-forbidden", `You may not call the function "${name}"`);
+};
+/**
+* Every function at `<basePath>/<name>` and below, any method. A protected function authenticates the request first, so
+* a call without a valid token is the authenticator's 401 problem; a public one gets the caller only when it asks.
+*/
+const functionRoutes = ({ basePath, functions, authenticate, db, records, onError }) => {
+	const app = new Hono().basePath(basePath);
+	app.onError(onError);
+	const callerOf = async (request) => {
+		const session = await authenticate(request);
+		return {
+			session,
+			records: records(session)
+		};
+	};
+	for (const [name, fn] of Object.entries(functions)) {
+		const prefix = `${basePath}/${name}`;
+		const { options } = fn;
+		if (options.cors) app.use(`/${name}/*`, cors(options.cors));
+		app.all(`/${name}/*`, async (c) => {
+			const request = relativeRequest(c.req.raw, prefix);
+			if (options.public) {
+				let caller;
+				return invokeFunction(name, fn, request, {
+					name,
+					db,
+					caller: () => caller ??= callerOf(c.req.raw)
+				});
+			}
+			const caller = await callerOf(c.req.raw);
+			requireRoles(name, caller.session, options.roles);
+			const context = {
+				name,
+				db,
+				...caller,
+				caller: async () => caller
+			};
+			return invokeFunction(name, fn, request, context);
+		});
+	}
+	app.all("/*", (c) => {
+		throw notFound(`There is no function at ${c.req.path}`);
+	});
+	return app;
+};
+//#endregion
+export { functionRoutes };

package/dist/functions/verify-signature.d.ts

@@ -0,0 +1,32 @@
+//#region src/functions/verify-signature.d.ts
+export type SignatureOptions = {
+  /** The shared secret, as the sender shows it. */
+  secret: string;
+  /** The header that carries the signature, such as `x-hub-signature-256`. */
+  header: string;
+  /** Text before the signature in that header, such as `sha256=`. */
+  prefix?: string;
+  /** How the signature is written. Default `hex`. */
+  encoding?: 'hex' | 'base64';
+  /** Default `SHA-256`. */
+  hash?: 'SHA-1' | 'SHA-256' | 'SHA-512';
+};
+/**
+ * The request's body as text, once its HMAC signature checks out against `secret`, as GitHub, Shopify and many others
+ * sign their webhooks. A missing or wrong signature is a 401 `invalid-signature` problem.
+ */
+export declare const verifySignature: (request: Request, { secret, header, prefix, encoding, hash }: SignatureOptions) => Promise<string>;
+export type StandardWebhookOptions = {
+  /** The endpoint's secret, `whsec_` and base64. */
+  secret: string;
+  /** How old, or how far ahead, a message may be. Default 300. */
+  toleranceSeconds?: number;
+  /** The current time in milliseconds; for tests. */
+  now?: () => number;
+};
+/**
+ * The request's body as text, once its Standard Webhooks signature checks out (https://www.standardwebhooks.com), as
+ * Supabase Auth hooks, Svix, Resend and others sign theirs. A missing, stale or wrong signature is a 401 problem.
+ */
+export declare const verifyStandardWebhook: (request: Request, { secret, toleranceSeconds, now }: StandardWebhookOptions) => Promise<string>;
+//#endregion

package/dist/functions/verify-signature.js

@@ -0,0 +1,49 @@
+import { HttpProblem } from "../problem.js";
+//#region src/functions/verify-signature.ts
+const invalid = (detail) => new HttpProblem(401, "invalid-signature", "Unauthorized", detail);
+const decodeHex = (text) => /^(?:[0-9a-f]{2})+$/i.test(text) ? new Uint8Array(text.match(/../g).map((pair) => parseInt(pair, 16))) : void 0;
+const decodeBase64 = (text) => /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(text) && text.length > 0 ? Uint8Array.from(atob(text), (char) => char.charCodeAt(0)) : void 0;
+const verifyHmac = async (key, hash, signature, content) => {
+	const cryptoKey = await crypto.subtle.importKey("raw", key, {
+		name: "HMAC",
+		hash
+	}, false, ["verify"]);
+	return crypto.subtle.verify("HMAC", cryptoKey, signature, new TextEncoder().encode(content));
+};
+/**
+* The request's body as text, once its HMAC signature checks out against `secret`, as GitHub, Shopify and many others
+* sign their webhooks. A missing or wrong signature is a 401 `invalid-signature` problem.
+*/
+const verifySignature = async (request, { secret, header, prefix = "", encoding = "hex", hash = "SHA-256" }) => {
+	const body = await request.text();
+	const value = request.headers.get(header);
+	if (!value?.startsWith(prefix)) throw invalid(`The request has no ${header} signature`);
+	const text = value.slice(prefix.length).trim();
+	const signature = encoding === "hex" ? decodeHex(text) : decodeBase64(text);
+	if (!signature || !await verifyHmac(new TextEncoder().encode(secret), hash, signature, body)) throw invalid(`The ${header} signature does not match the body`);
+	return body;
+};
+/**
+* The request's body as text, once its Standard Webhooks signature checks out (https://www.standardwebhooks.com), as
+* Supabase Auth hooks, Svix, Resend and others sign theirs. A missing, stale or wrong signature is a 401 problem.
+*/
+const verifyStandardWebhook = async (request, { secret, toleranceSeconds = 300, now = Date.now }) => {
+	const body = await request.text();
+	const id = request.headers.get("webhook-id");
+	const timestamp = request.headers.get("webhook-timestamp");
+	const signatures = request.headers.get("webhook-signature");
+	if (!id || !timestamp || !signatures) throw invalid("The request has no webhook-id, webhook-timestamp and webhook-signature headers");
+	const seconds = Number(timestamp);
+	if (!Number.isInteger(seconds) || Math.abs(now() / 1e3 - seconds) > toleranceSeconds) throw invalid("The webhook-timestamp is too old or too far ahead");
+	const key = decodeBase64(secret.replace(/^whsec_/, ""));
+	if (!key) throw new Error("The Standard Webhooks secret is not base64 (whsec_...)");
+	const content = `${id}.${timestamp}.${body}`;
+	for (const entry of signatures.split(" ")) {
+		const [version, text = ""] = entry.split(",");
+		const signature = decodeBase64(text);
+		if (version === "v1" && signature && await verifyHmac(key, "SHA-256", signature, content)) return body;
+	}
+	throw invalid("No webhook-signature matches the body");
+};
+//#endregion
+export { verifySignature, verifyStandardWebhook };