@splitin/verification-server 0.1.0-beta.0

package/dist/supabase.cjs

@@ -0,0 +1,678 @@
+'use strict';
+
+var verificationAdapterSdk = require('@splitin/verification-adapter-sdk');
+
+// src/handler.ts
+var VerificationHttpError = class extends Error {
+  constructor(status, code, message, retryAfterSeconds = null) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.retryAfterSeconds = retryAfterSeconds;
+    this.name = "VerificationHttpError";
+  }
+  status;
+  code;
+  retryAfterSeconds;
+};
+var SECRET_PATTERN = /sk_|rk_|whsec_|client_secret|ephemeral|password|bearer\s+[a-z0-9._-]+/i;
+function scrubUnsafeMessage(value) {
+  if (SECRET_PATTERN.test(value) || /provider\s+body|raw\s+webhook/i.test(value)) {
+    return "The verification request could not be completed.";
+  }
+  return value;
+}
+function toSafeErrorEnvelope(error, supportPath) {
+  if (error instanceof VerificationHttpError) {
+    return {
+      status: error.status,
+      retryAfterSeconds: error.retryAfterSeconds,
+      body: envelope(error.code, scrubUnsafeMessage(error.message), error.retryAfterSeconds, supportPath)
+    };
+  }
+  if (error instanceof verificationAdapterSdk.ProviderError) {
+    const status = error.retryable ? error.code === "RATE_LIMITED" ? 429 : 503 : 409;
+    return {
+      status,
+      retryAfterSeconds: error.retryAfterSeconds ?? null,
+      body: envelope(error.safeCode, scrubUnsafeMessage(error.message), error.retryAfterSeconds ?? null, supportPath)
+    };
+  }
+  const safe = verificationAdapterSdk.toSafeProviderFailure(error);
+  return {
+    status: 503,
+    retryAfterSeconds: safe.retryAfterSeconds ?? null,
+    body: envelope(safe.safeCode, "The verification request could not be completed.", safe.retryAfterSeconds ?? null, supportPath)
+  };
+}
+function envelope(code, message, retryAfterSeconds, supportPath) {
+  return {
+    contractVersion: "1.0.0",
+    error: {
+      code,
+      message,
+      retryable: retryAfterSeconds !== null || /retry|unavailable|rate/i.test(code)
+    },
+    safeErrorCode: code,
+    retryAfter: retryAfterSeconds,
+    supportPath
+  };
+}
+
+// src/auth.ts
+var IDEMPOTENCY_KEY = /^[A-Za-z0-9._:~-]{8,128}$/;
+var OPERATOR_ROLES = /* @__PURE__ */ new Set(["operator", "admin", "reviewer", "approver"]);
+var SYSTEM_ROLES = /* @__PURE__ */ new Set(["system", "worker"]);
+function isCookieAuthenticated(request, override) {
+  if (override) return override(request);
+  const authorization = request.headers.get("authorization") ?? "";
+  if (/^bearer\s+/i.test(authorization)) return false;
+  return Boolean(request.headers.get("cookie"));
+}
+function requireCsrf(request, route, allowedOrigins) {
+  if (!route.csrf) return;
+  const origin = request.headers.get("origin") ?? originFromReferer(request.headers.get("referer"));
+  if (!origin) {
+    throw new VerificationHttpError(403, "CSRF_REJECTED", "Cookie-authenticated mutations require a trusted Origin.");
+  }
+  if (!allowedOrigins.includes(origin)) {
+    throw new VerificationHttpError(403, "ORIGIN_NOT_ALLOWED", "Request origin is not allowed.");
+  }
+}
+function requireOriginWhenPresent(request, allowedOrigins) {
+  const origin = request.headers.get("origin");
+  if (!origin) return;
+  if (!allowedOrigins.includes(origin)) {
+    throw new VerificationHttpError(403, "ORIGIN_NOT_ALLOWED", "Request origin is not allowed.");
+  }
+}
+function requireIdempotencyKey(request, route) {
+  if (!route.idempotency) return void 0;
+  const key = request.headers.get("idempotency-key")?.trim();
+  if (!key) {
+    throw new VerificationHttpError(400, "IDEMPOTENCY_KEY_REQUIRED", "Mutations require an Idempotency-Key header.");
+  }
+  if (!IDEMPOTENCY_KEY.test(key)) {
+    throw new VerificationHttpError(400, "INVALID_IDEMPOTENCY_KEY", "Idempotency-Key is invalid.");
+  }
+  return key;
+}
+function authorizeActor(actor, auth) {
+  if (auth === "none") return;
+  if (!actor.actorId || !actor.tenantKey) {
+    throw new VerificationHttpError(401, "UNAUTHENTICATED", "Authentication is required.");
+  }
+  if (auth === "actor") {
+    if (actor.actorType === "system" && !hasRole(actor, SYSTEM_ROLES) && !hasRole(actor, OPERATOR_ROLES)) {
+      throw new VerificationHttpError(403, "FORBIDDEN", "This actor cannot access subject verification sessions.");
+    }
+    return;
+  }
+  if (auth === "operator") {
+    if (actor.actorType !== "operator" && !hasRole(actor, OPERATOR_ROLES)) {
+      throw new VerificationHttpError(403, "FORBIDDEN", "Operator authorization is required.");
+    }
+    return;
+  }
+  if (auth === "system") {
+    if (actor.actorType !== "system" && !hasRole(actor, SYSTEM_ROLES)) {
+      throw new VerificationHttpError(403, "FORBIDDEN", "Worker authorization is required.");
+    }
+  }
+}
+function authorizeSubjectScope(actor, subjectReference) {
+  if (!subjectReference) return;
+  if (actor.actorType === "operator" || actor.actorType === "system") return;
+  if (subjectReference === actor.actorId) return;
+  if (actor.authorizedSubjectScope.includes("*")) return;
+  if (actor.authorizedSubjectScope.includes(subjectReference)) return;
+  throw new VerificationHttpError(403, "FORBIDDEN", "The actor is not authorized for this subject.");
+}
+function assertSeparationOfDuties(actor, otherActorId, action) {
+  if (!otherActorId) return;
+  if (otherActorId === actor.actorId) {
+    throw new VerificationHttpError(
+      403,
+      "SEPARATION_OF_DUTIES",
+      `A different authorized operator must ${action}.`
+    );
+  }
+}
+function hasRole(actor, allowed) {
+  return actor.roles.some((role) => allowed.has(role));
+}
+function originFromReferer(referer) {
+  if (!referer) return null;
+  try {
+    return new URL(referer).origin;
+  } catch {
+    return null;
+  }
+}
+function corsHeaders(request, allowedOrigins) {
+  const origin = request.headers.get("origin");
+  const allowOrigin = origin && allowedOrigins.includes(origin) ? origin : allowedOrigins[0] ?? "";
+  return {
+    Vary: "Origin",
+    "Access-Control-Allow-Origin": allowOrigin,
+    "Access-Control-Allow-Headers": "Authorization, Content-Type, Idempotency-Key, X-CSRF-Token",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Credentials": "true"
+  };
+}
+
+// src/catalog.ts
+var V1_ROUTES = Object.freeze([
+  { id: "sessions.create", method: "POST", path: "/v1/sessions", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "sessions.resume", method: "POST", path: "/v1/sessions/:id/resume", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "sessions.get", method: "GET", path: "/v1/sessions/:id", auth: "actor", csrf: false, idempotency: false, mutation: false },
+  { id: "sessions.retry", method: "POST", path: "/v1/sessions/:id/retry", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "sessions.pause", method: "POST", path: "/v1/sessions/:id/pause", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "sessions.cancel", method: "POST", path: "/v1/sessions/:id/cancel", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "appeals.create", method: "POST", path: "/v1/appeals", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "support.escalations", method: "POST", path: "/v1/support/escalations", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "webhooks.ingest", method: "POST", path: "/v1/webhooks/:provider", auth: "none", csrf: false, idempotency: false, mutation: true },
+  { id: "protectedActions.evaluate", method: "POST", path: "/v1/protected-actions/evaluate", auth: "actor", csrf: true, idempotency: true, mutation: true },
+  { id: "admin.health", method: "GET", path: "/v1/admin/health", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.routes.get", method: "GET", path: "/v1/admin/routes", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.routes.mutate", method: "POST", path: "/v1/admin/routes", auth: "operator", csrf: true, idempotency: true, mutation: true },
+  { id: "admin.circuits.get", method: "GET", path: "/v1/admin/circuits", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.circuits.mutate", method: "POST", path: "/v1/admin/circuits", auth: "operator", csrf: true, idempotency: true, mutation: true },
+  { id: "admin.attempts", method: "GET", path: "/v1/admin/attempts", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.review.get", method: "GET", path: "/v1/admin/review", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.review.mutate", method: "POST", path: "/v1/admin/review", auth: "operator", csrf: true, idempotency: true, mutation: true },
+  { id: "admin.audit", method: "GET", path: "/v1/admin/audit", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.reconciliation.get", method: "GET", path: "/v1/admin/reconciliation", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.reconciliation.mutate", method: "POST", path: "/v1/admin/reconciliation", auth: "operator", csrf: true, idempotency: true, mutation: true },
+  { id: "admin.redaction.get", method: "GET", path: "/v1/admin/redaction", auth: "operator", csrf: false, idempotency: false, mutation: false },
+  { id: "admin.redaction.mutate", method: "POST", path: "/v1/admin/redaction", auth: "operator", csrf: true, idempotency: true, mutation: true },
+  { id: "workers.claim", method: "POST", path: "/v1/workers/claim", auth: "system", csrf: false, idempotency: true, mutation: true },
+  { id: "workers.process", method: "POST", path: "/v1/workers/process", auth: "system", csrf: false, idempotency: true, mutation: true }
+]);
+function matchV1Route(method, pathname, basePath = "") {
+  const relative = stripBasePath(pathname, basePath);
+  const normalizedMethod = method.toUpperCase();
+  if (normalizedMethod === "OPTIONS") {
+    const found = V1_ROUTES.find((route) => matchPath(route.path, relative));
+    return found ? { route: { ...found, method: "OPTIONS", csrf: false, idempotency: false, mutation: false }, params: matchPath(found.path, relative) ?? {} } : null;
+  }
+  for (const route of V1_ROUTES) {
+    if (route.method !== normalizedMethod) continue;
+    const params = matchPath(route.path, relative);
+    if (params) return { route, params };
+  }
+  return null;
+}
+function stripBasePath(pathname, basePath) {
+  const normalized = normalizePath(pathname);
+  const base = normalizePath(basePath);
+  if (!base || base === "/") return normalized;
+  if (normalized === base) return "/";
+  if (normalized.startsWith(`${base}/`)) return normalized.slice(base.length) || "/";
+  return normalized;
+}
+function normalizePath(value) {
+  const path = value.split("?")[0] ?? "/";
+  if (!path.startsWith("/")) return `/${path}`;
+  return path.replace(/\/+$/, "") || "/";
+}
+function matchPath(pattern, pathname) {
+  const patternParts = normalizePath(pattern).split("/").filter(Boolean);
+  const pathParts = normalizePath(pathname).split("/").filter(Boolean);
+  if (patternParts.length !== pathParts.length) return null;
+  const params = {};
+  for (let index = 0; index < patternParts.length; index += 1) {
+    const expected = patternParts[index];
+    const actual = pathParts[index];
+    if (expected.startsWith(":")) {
+      params[expected.slice(1)] = decodeURIComponent(actual);
+      continue;
+    }
+    if (expected !== actual) return null;
+  }
+  return params;
+}
+
+// src/types.ts
+var FORBIDDEN_CLIENT_FIELDS = [
+  "provider",
+  "launcherKey",
+  "templateId",
+  "workflowId",
+  "apiOrigin",
+  "environment",
+  "configurationRevision",
+  "adapter",
+  "adapterVersion",
+  "routePolicyId"
+];
+
+// src/json.ts
+function jsonResponse(body, status, extra = {}) {
+  const headers = new Headers({
+    "Cache-Control": "no-store",
+    "Content-Type": "application/json; charset=utf-8",
+    ...extra
+  });
+  if (typeof extra["Retry-After"] === "string") headers.set("Retry-After", extra["Retry-After"]);
+  return new Response(JSON.stringify(body), { status, headers });
+}
+async function readLimitedBody(request, maxBodyBytes) {
+  if (request.method === "GET" || request.method === "HEAD" || request.method === "OPTIONS") {
+    return request;
+  }
+  const raw = new Uint8Array(await request.arrayBuffer());
+  if (raw.byteLength > maxBodyBytes) {
+    throw new VerificationHttpError(413, "PAYLOAD_TOO_LARGE", "Request body exceeds the allowed size.");
+  }
+  return new Request(request.url, {
+    method: request.method,
+    headers: request.headers,
+    body: raw.byteLength > 0 ? raw : void 0
+  });
+}
+async function parseJsonObject(request, allowedKeys, options = {}) {
+  const contentType = request.headers.get("content-type") ?? "";
+  if (contentType && !contentType.toLowerCase().includes("application/json")) {
+    throw new VerificationHttpError(415, "INVALID_REQUEST", "Content-Type must be application/json.");
+  }
+  let body;
+  try {
+    const text = await request.text();
+    body = text.trim() ? JSON.parse(text) : {};
+  } catch {
+    throw new VerificationHttpError(400, "INVALID_JSON", "Request body must be valid JSON.");
+  }
+  if (!isPlainRecord(body)) {
+    throw new VerificationHttpError(400, "INVALID_REQUEST", "Request body must be an object.");
+  }
+  for (const key of Object.keys(body)) {
+    if (options.rejectRoutingFields && FORBIDDEN_CLIENT_FIELDS.includes(key)) {
+      throw new VerificationHttpError(400, "UNSUPPORTED_REQUEST_FIELD", `Unsupported request field: ${key}.`);
+    }
+    if (!allowedKeys.includes(key)) {
+      throw new VerificationHttpError(400, "UNSUPPORTED_REQUEST_FIELD", `Unsupported request field: ${key}.`);
+    }
+  }
+  return body;
+}
+function requiredString(body, field, pattern, maxLength) {
+  const value = body[field];
+  if (typeof value !== "string" || !pattern.test(value) || value.length > maxLength) {
+    throw new VerificationHttpError(400, "INVALID_REQUEST", `Invalid ${field}.`);
+  }
+  return value;
+}
+function optionalString(body, field, pattern, maxLength) {
+  const value = body[field];
+  if (value === void 0 || value === null) return void 0;
+  if (typeof value !== "string" || !pattern.test(value) || value.length > maxLength) {
+    throw new VerificationHttpError(400, "INVALID_REQUEST", `Invalid ${field}.`);
+  }
+  return value;
+}
+function optionalBoolean(body, field) {
+  const value = body[field];
+  if (value === void 0) return void 0;
+  if (typeof value !== "boolean") {
+    throw new VerificationHttpError(400, "INVALID_REQUEST", `Invalid ${field}.`);
+  }
+  return value;
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+// src/handler.ts
+var PACKAGE = /^[a-z0-9][a-z0-9_.-]{1,80}$/;
+var ACTION = /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/;
+var IDENTIFIER = /^[A-Za-z0-9._:~-]{4,128}$/;
+var REASON = /^[a-z][a-z0-9_.-]{2,127}$/;
+var COUNTRY = /^[A-Z]{2}$/;
+var HASH = /^[a-f0-9]{64}$/;
+var ATTEMPT_ID = /^[A-Za-z0-9._:~-]{8,128}$/;
+var SESSION_KEYS = [
+  "packageCode",
+  "countryCode",
+  "action",
+  "resourceType",
+  "resourceReference",
+  "subjectReference",
+  "continuationToken",
+  "continuationKey",
+  "legalFirstName",
+  "legalLastName",
+  "email",
+  "organization",
+  "relationship",
+  "associatedPerson",
+  "evidenceReferences",
+  "metadata"
+];
+var APPEAL_KEYS = ["attemptId", "reasonCode", "nonBiometricPathRequested", "details"];
+var SUPPORT_KEYS = ["attemptId", "appealId", "reasonCode", "message"];
+var PROTECTED_KEYS = ["action", "resourceType", "resourceReference"];
+var ROUTE_KEYS = ["operation", "targetRoutePolicyId", "requestId", "action", "reasonCode"];
+var CIRCUIT_KEYS = ["provider", "providerEnvironment", "status", "errorCode", "circuitOpenUntil"];
+var REVIEW_KEYS = [
+  "operation",
+  "appealId",
+  "requestId",
+  "packageCode",
+  "decision",
+  "reasonCode",
+  "policyVersionId",
+  "evidenceReferenceHash",
+  "expiresAt"
+];
+var RECONCILE_KEYS = ["attemptId"];
+var REDACT_KEYS = ["privacyRequestId"];
+var WORKER_CLAIM_KEYS = ["queue", "limit"];
+var WORKER_PROCESS_KEYS = ["leaseId", "jobId"];
+function createVerificationFetchHandler(platform, options) {
+  const allowedOrigins = options.allowedOrigins ?? [];
+  const supportPath = options.supportPath ?? null;
+  const maxBodyBytes = options.maxBodyBytes ?? 1024 * 1024;
+  return async (incoming) => {
+    const extra = corsHeaders(incoming, allowedOrigins);
+    try {
+      requireOriginWhenPresent(incoming, allowedOrigins.length > 0 ? allowedOrigins : [incoming.headers.get("origin") ?? ""]);
+      const request = await readLimitedBody(incoming, maxBodyBytes);
+      const url = new URL(request.url);
+      const matched = matchV1Route(request.method, url.pathname, options.basePath);
+      if (!matched) {
+        if (request.method === "OPTIONS") {
+          return new Response(null, { status: 204, headers: extra });
+        }
+        throw new VerificationHttpError(404, "NOT_FOUND", "The verification endpoint was not found.");
+      }
+      const { route, params } = matched;
+      if (route.method === "OPTIONS") {
+        return new Response(null, { status: 204, headers: extra });
+      }
+      if (route.id === "webhooks.ingest") {
+        const provider = params.provider ?? "";
+        if (!verificationAdapterSdk.isProviderCode(provider)) {
+          throw new VerificationHttpError(400, "INVALID_REQUEST", "Invalid provider.");
+        }
+        const result = await platform.ingestWebhook(provider, request);
+        return jsonResponse(result, result.accepted ? 202 : 400, extra);
+      }
+      if (isCookieAuthenticated(request, options.isCookieAuthenticated) && route.csrf) {
+        if (allowedOrigins.length === 0) {
+          throw new VerificationHttpError(403, "CSRF_REJECTED", "Cookie-authenticated mutations require an origin allowlist.");
+        }
+        requireCsrf(request, route, allowedOrigins);
+      }
+      const actor = await options.resolveActor(request);
+      authorizeActor(actor, route.auth);
+      const idempotencyKey = requireIdempotencyKey(request, route) ?? "";
+      if (options.rateLimit) {
+        const budget = await options.rateLimit(actor, route.id);
+        if (!budget.allowed) {
+          throw new VerificationHttpError(429, "RATE_LIMITED", "Please wait before retrying.", budget.retryAfterSeconds ?? 30);
+        }
+      }
+      const body = route.mutation && route.method === "POST" && route.id !== "sessions.get" ? await parseBodyForRoute(route.id, request) : {};
+      const payload = await dispatch(platform, route.id, {
+        actor,
+        params,
+        body,
+        idempotencyKey,
+        request
+      });
+      return jsonResponse(payload, route.mutation && route.method === "POST" ? 200 : 200, extra);
+    } catch (error) {
+      const mapped = toSafeErrorEnvelope(error, supportPath);
+      const headers = { ...extra };
+      if (mapped.retryAfterSeconds !== null) headers["Retry-After"] = String(Math.max(1, Math.ceil(mapped.retryAfterSeconds)));
+      return jsonResponse(mapped.body, mapped.status, headers);
+    }
+  };
+}
+async function parseBodyForRoute(routeId, request) {
+  switch (routeId) {
+    case "sessions.create":
+      return parseJsonObject(request, SESSION_KEYS, { rejectRoutingFields: true });
+    case "sessions.resume":
+    case "sessions.retry":
+    case "sessions.pause":
+    case "sessions.cancel":
+      return parseJsonObject(request, []);
+    case "appeals.create":
+      return parseJsonObject(request, APPEAL_KEYS);
+    case "support.escalations":
+      return parseJsonObject(request, SUPPORT_KEYS);
+    case "protectedActions.evaluate":
+      return parseJsonObject(request, PROTECTED_KEYS);
+    case "admin.routes.mutate":
+      return parseJsonObject(request, ROUTE_KEYS, { rejectRoutingFields: false });
+    case "admin.circuits.mutate":
+      return parseJsonObject(request, CIRCUIT_KEYS, { rejectRoutingFields: false });
+    case "admin.review.mutate":
+      return parseJsonObject(request, REVIEW_KEYS, { rejectRoutingFields: false });
+    case "admin.reconciliation.mutate":
+      return parseJsonObject(request, RECONCILE_KEYS, { rejectRoutingFields: false });
+    case "admin.redaction.mutate":
+      return parseJsonObject(request, REDACT_KEYS, { rejectRoutingFields: false });
+    case "workers.claim":
+      return parseJsonObject(request, WORKER_CLAIM_KEYS, { rejectRoutingFields: false });
+    case "workers.process":
+      return parseJsonObject(request, WORKER_PROCESS_KEYS, { rejectRoutingFields: false });
+    default:
+      return {};
+  }
+}
+async function dispatch(platform, routeId, ctx) {
+  const attemptId = ctx.params.id;
+  switch (routeId) {
+    case "sessions.create": {
+      const input = parseStartInput(ctx.body);
+      authorizeSubjectScope(ctx.actor, input.subjectReference);
+      return platform.startSession(ctx.actor, input, ctx.idempotencyKey, ctx.request);
+    }
+    case "sessions.resume":
+      return platform.resumeSession(ctx.actor, { attemptId: requireAttemptId(attemptId), idempotencyKey: ctx.idempotencyKey }, ctx.request);
+    case "sessions.get":
+      return platform.getSession(ctx.actor, requireAttemptId(attemptId));
+    case "sessions.retry":
+      return platform.retrySession(ctx.actor, { attemptId: requireAttemptId(attemptId), idempotencyKey: ctx.idempotencyKey }, ctx.request);
+    case "sessions.pause":
+      return platform.pauseSession(ctx.actor, { attemptId: requireAttemptId(attemptId), idempotencyKey: ctx.idempotencyKey });
+    case "sessions.cancel":
+      return platform.cancelSession(ctx.actor, { attemptId: requireAttemptId(attemptId), idempotencyKey: ctx.idempotencyKey });
+    case "appeals.create":
+      return platform.createAppeal(ctx.actor, {
+        attemptId: optionalString(ctx.body, "attemptId", ATTEMPT_ID, 128),
+        reasonCode: requiredString(ctx.body, "reasonCode", REASON, 128),
+        nonBiometricPathRequested: optionalBoolean(ctx.body, "nonBiometricPathRequested"),
+        details: optionalString(ctx.body, "details", /^[\s\S]{1,2000}$/, 2e3)
+      }, ctx.idempotencyKey);
+    case "support.escalations":
+      return platform.createSupportEscalation(ctx.actor, {
+        attemptId: optionalString(ctx.body, "attemptId", ATTEMPT_ID, 128),
+        appealId: optionalString(ctx.body, "appealId", ATTEMPT_ID, 128),
+        reasonCode: requiredString(ctx.body, "reasonCode", REASON, 128),
+        message: optionalString(ctx.body, "message", /^[\s\S]{1,2000}$/, 2e3)
+      }, ctx.idempotencyKey);
+    case "protectedActions.evaluate":
+      return platform.evaluateProtectedAction(ctx.actor, parseProtectedAction(ctx.body), ctx.idempotencyKey);
+    case "admin.health":
+      return platform.admin.health(ctx.actor);
+    case "admin.routes.get":
+      return platform.admin.routes(ctx.actor);
+    case "admin.routes.mutate":
+      return mutateRoute(platform, ctx.actor, ctx.body, ctx.idempotencyKey);
+    case "admin.circuits.get":
+      return platform.admin.circuits(ctx.actor);
+    case "admin.circuits.mutate":
+      return platform.admin.setCircuit(ctx.actor, parseCircuit(ctx.body), ctx.idempotencyKey);
+    case "admin.attempts":
+      return platform.admin.attempts(ctx.actor);
+    case "admin.review.get":
+      return platform.admin.review(ctx.actor);
+    case "admin.review.mutate":
+      return mutateReview(platform, ctx.actor, ctx.body, ctx.idempotencyKey);
+    case "admin.audit":
+      return platform.admin.audit(ctx.actor);
+    case "admin.reconciliation.get":
+      return platform.admin.reconciliation(ctx.actor);
+    case "admin.reconciliation.mutate":
+      return platform.admin.enqueueReconciliation(ctx.actor, {
+        attemptId: requiredString(ctx.body, "attemptId", ATTEMPT_ID, 128)
+      }, ctx.idempotencyKey);
+    case "admin.redaction.get":
+      return platform.admin.redaction(ctx.actor);
+    case "admin.redaction.mutate":
+      return platform.admin.approveRedaction(ctx.actor, {
+        privacyRequestId: requiredString(ctx.body, "privacyRequestId", IDENTIFIER, 128)
+      }, ctx.idempotencyKey);
+    case "workers.claim":
+      return platform.workers.claim(ctx.actor, {
+        queue: parseWorkerQueue(ctx.body.queue),
+        limit: typeof ctx.body.limit === "number" ? ctx.body.limit : void 0
+      }, ctx.idempotencyKey);
+    case "workers.process":
+      return platform.workers.process(ctx.actor, {
+        leaseId: requiredString(ctx.body, "leaseId", IDENTIFIER, 128),
+        jobId: requiredString(ctx.body, "jobId", IDENTIFIER, 128)
+      }, ctx.idempotencyKey);
+    default:
+      throw new VerificationHttpError(404, "NOT_FOUND", "The verification endpoint was not found.");
+  }
+}
+function parseStartInput(body) {
+  const packageCode = requiredString(body, "packageCode", PACKAGE, 80);
+  if (!verificationAdapterSdk.isPackageCode(packageCode)) {
+    throw new VerificationHttpError(400, "INVALID_REQUEST", "Invalid packageCode.");
+  }
+  return {
+    packageCode,
+    countryCode: optionalString(body, "countryCode", COUNTRY, 2),
+    action: optionalString(body, "action", ACTION, 160),
+    resourceType: optionalString(body, "resourceType", /^[a-z][a-z0-9_]{1,63}$/, 64),
+    resourceReference: optionalString(body, "resourceReference", IDENTIFIER, 128),
+    subjectReference: optionalString(body, "subjectReference", IDENTIFIER, 128),
+    continuationToken: optionalString(body, "continuationToken", HASH, 64),
+    continuationKey: optionalString(body, "continuationKey", /^[a-z][a-z0-9_.-]{2,127}$/, 128),
+    legalFirstName: optionalString(body, "legalFirstName", /^[\p{L}\p{M}\s'.-]{1,80}$/u, 80) ?? null,
+    legalLastName: optionalString(body, "legalLastName", /^[\p{L}\p{M}\s'.-]{1,80}$/u, 80) ?? null,
+    email: optionalString(body, "email", /^[^\s@]+@[^\s@]+\.[^\s@]+$/, 254) ?? null,
+    organization: isRecord(body.organization) ? body.organization : void 0,
+    relationship: isRecord(body.relationship) ? body.relationship : void 0,
+    associatedPerson: isRecord(body.associatedPerson) ? body.associatedPerson : void 0,
+    evidenceReferences: Array.isArray(body.evidenceReferences) ? body.evidenceReferences.filter((value) => typeof value === "string") : void 0,
+    metadata: isRecord(body.metadata) ? sanitizeMetadata(body.metadata) : void 0
+  };
+}
+function parseProtectedAction(body) {
+  return {
+    action: requiredString(body, "action", ACTION, 160),
+    resourceType: optionalString(body, "resourceType", /^[a-z][a-z0-9_]{1,63}$/, 64),
+    resourceReference: optionalString(body, "resourceReference", IDENTIFIER, 128)
+  };
+}
+function parseCircuit(body) {
+  const status = requiredString(body, "status", /^(healthy|degraded|unavailable|circuit_open)$/, 32);
+  const environment = requiredString(body, "providerEnvironment", /^(sandbox|production)$/, 16);
+  return {
+    provider: requiredString(body, "provider", /^[a-z][a-z0-9_]{1,63}$/, 64),
+    providerEnvironment: environment,
+    status,
+    errorCode: optionalString(body, "errorCode", /^[A-Z][A-Z0-9_]{2,127}$/, 128),
+    circuitOpenUntil: optionalString(body, "circuitOpenUntil", /^\d{4}-\d{2}-\d{2}T/, 40)
+  };
+}
+async function mutateRoute(platform, actor, body, idempotencyKey) {
+  const operation = requiredString(body, "operation", /^(propose|approve|apply)$/, 16);
+  const input = {
+    operation,
+    targetRoutePolicyId: optionalString(body, "targetRoutePolicyId", IDENTIFIER, 128),
+    requestId: optionalString(body, "requestId", IDENTIFIER, 128),
+    action: optionalString(body, "action", /^(activate|drain|rollback)$/, 16),
+    reasonCode: optionalString(body, "reasonCode", REASON, 128)
+  };
+  if (operation !== "propose") {
+    const snapshot = await platform.admin.routes(actor);
+    const change = snapshot.routeChanges.find((row) => row.id === input.requestId);
+    if (operation === "approve") assertSeparationOfDuties(actor, stringField(change, "proposedBy"), "approve this route change");
+    if (operation === "apply") assertSeparationOfDuties(actor, stringField(change, "approvedBy"), "apply this route change");
+  }
+  return platform.admin.mutateRoute(actor, input, idempotencyKey);
+}
+async function mutateReview(platform, actor, body, idempotencyKey) {
+  const operation = requiredString(
+    body,
+    "operation",
+    /^(begin_appeal_review|propose_manual_exception|approve_manual_exception|apply_manual_exception)$/,
+    40
+  );
+  const input = {
+    operation,
+    appealId: optionalString(body, "appealId", IDENTIFIER, 128),
+    requestId: optionalString(body, "requestId", IDENTIFIER, 128),
+    packageCode: optionalString(body, "packageCode", PACKAGE, 80),
+    decision: optionalString(body, "decision", /^(approve|deny|revoke|request_more_information)$/, 40),
+    reasonCode: optionalString(body, "reasonCode", REASON, 128),
+    policyVersionId: optionalString(body, "policyVersionId", IDENTIFIER, 128),
+    evidenceReferenceHash: optionalString(body, "evidenceReferenceHash", HASH, 64),
+    expiresAt: optionalString(body, "expiresAt", /^\d{4}-\d{2}-\d{2}T/, 40)
+  };
+  if (operation === "approve_manual_exception" || operation === "apply_manual_exception") {
+    const snapshot = await platform.admin.review(actor);
+    const exception = snapshot.manualExceptions.find((row) => row.id === input.requestId);
+    if (operation === "approve_manual_exception") {
+      assertSeparationOfDuties(actor, stringField(exception, "proposedBy"), "approve this manual exception");
+    }
+    if (operation === "apply_manual_exception") {
+      assertSeparationOfDuties(actor, stringField(exception, "approvedBy"), "apply this manual exception");
+    }
+  }
+  return platform.admin.mutateReview(actor, input, idempotencyKey);
+}
+function parseWorkerQueue(value) {
+  if (value === "webhook" || value === "reconciliation" || value === "redaction" || value === "dead_letter") return value;
+  throw new VerificationHttpError(400, "INVALID_REQUEST", "Invalid queue.");
+}
+function requireAttemptId(value) {
+  if (!value || !ATTEMPT_ID.test(value)) {
+    throw new VerificationHttpError(400, "INVALID_REQUEST", "Invalid attempt id.");
+  }
+  return value;
+}
+function sanitizeMetadata(value) {
+  const result = {};
+  for (const [key, nested] of Object.entries(value)) {
+    if (typeof nested === "string" || typeof nested === "number" || typeof nested === "boolean" || nested === null) {
+      result[key] = nested;
+    }
+  }
+  return result;
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringField(record, key) {
+  const value = record?.[key];
+  return typeof value === "string" ? value : null;
+}
+
+// src/supabase.ts
+function createVerificationSupabaseHandler(platform, options) {
+  return createVerificationFetchHandler(platform, {
+    allowedOrigins: options.allowedOrigins,
+    isCookieAuthenticated: options.isCookieAuthenticated,
+    basePath: options.basePath,
+    maxBodyBytes: options.maxBodyBytes,
+    supportPath: options.supportPath,
+    rateLimit: options.rateLimit,
+    resolveActor: async (request) => {
+      const user = await options.getUser(request);
+      return options.resolveActor(request, user);
+    }
+  });
+}
+
+exports.createVerificationSupabaseHandler = createVerificationSupabaseHandler;
+//# sourceMappingURL=supabase.cjs.map
+//# sourceMappingURL=supabase.cjs.map