better-supabase 0.11.0 → 0.13.0

package/dist/blocks/webhooks/index.d.ts

@@ -1,20 +1,20 @@
 /// <reference lib="esnext.temporal" />
-import { T as ErrorMapper, f as Result, t as AsyncResult } from "../../result-BREt7qOh.js";
-import { U as IncomingWebhookEventData, ht as WebhookEventData, o as EventHub, wt as Events } from "../../events-P3raDX2E.js";
-import { m as RequestContext } from "../../plugin-D-95Q0w0.js";
-import { i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "../../provider-CNs0Jx0I.js";
-import { n as SqlClient } from "../../executor-D1hECPGG.js";
-import { a as dbTransport, i as RpcClient, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DezJPPA0.js";
-import { r as BlockTemporalOptions } from "../../block-helpers-CjcQM1yA.js";
-import { n as BlockHooks } from "../../block-hooks-DcPJHztl.js";
-import { _ as Jobs, g as JobHandler, x as QueueSchemas } from "../../types-BEEFkNFY.js";
-import { t as BlockProblemOptions } from "../../problem-DCDIQiTA.js";
-import { i as EventSink, t as CloudEvent } from "../../cloud-event-DXkNoI6v.js";
-import { g as SubscriberPolicy, i as AuthorizationHooks } from "../../authorization-hooks-mLi894KH.js";
-import { s as BlockOf } from "../../define-block-CPyJ95rq.js";
-import { a as verifySharedSecret, i as signWebhook, n as VerifyOptions, o as verifyWebhook, r as WebhookInput, t as VerifiedWebhook } from "../../signatures-BXlDXV3D.js";
-import { a as DatabaseWebhookPayload, c as hookError, d as stripeInboxVerify, f as verifyStripeWebhook, i as DatabaseChange, l as isDatabaseWebhook, n as AuthHookKind, o as authHook, r as AuthHooks, s as databaseChange, t as AuthHookError, u as signStripeWebhook } from "../../verify-BucYsoKq.js";
-import { A as IncomingVerify, C as isPublicAddress, D as IncomingDelivery, E as CreatedIncomingWebhook, F as UpdateIncomingWebhookInput, I as UpdatedIncomingWebhook, M as IncomingWebhooks, N as IncomingWebhooksOptions, O as IncomingDestination, P as RotatedIncomingSecret, S as ResolveHost, T as CreateIncomingWebhookInput, _ as WebhookResponse, a as WebhookSignInput, b as AllowUrl, c as standardWebhooks, d as RotateSecretOptions, f as WebhookSecretStore, g as WebhookRequest, h as WebhookPolicyError, i as StandardWebhooksOptions, j as IncomingWebhook, k as IncomingDestinationResult, l as standardWebhooksAsymmetric, m as FetchTransportOptions, n as HmacSignerOptions, o as WebhookSigner, p as sqlSecretStore, r as RawSigner, s as hmacSigner, t as AsymmetricWebhooksOptions, u as webhookPublicKey, v as WebhookTransport, w as publicUrl, x as PublicUrlOptions, y as fetchTransport } from "../../signers-BwKV-9S6.js";
+import { T as ErrorMapper, f as Result, t as AsyncResult } from "../../result-mijqfoJN.js";
+import { U as IncomingWebhookEventData, ht as WebhookEventData, o as EventHub, wt as Events } from "../../events-DhGgwqQA.js";
+import { m as RequestContext } from "../../plugin-DouW0Kvg.js";
+import { i as CredentialRef, o as CredentialToken, r as CredentialProvider } from "../../provider-Dmsbl8ug.js";
+import { n as SqlClient } from "../../executor-DXfgDsKd.js";
+import { a as dbTransport, i as RpcClient, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DBPhgF3W.js";
+import { r as BlockTemporalOptions } from "../../block-helpers-DyA5BAW4.js";
+import { n as BlockHooks } from "../../block-hooks-BadAniNI.js";
+import { _ as Jobs, g as JobHandler, x as QueueSchemas } from "../../types-CB5MvzuE.js";
+import { t as BlockProblemOptions } from "../../problem-D_DEBfMn.js";
+import { i as EventSink, t as CloudEvent } from "../../cloud-event-CidL9jiw.js";
+import { g as SubscriberPolicy, i as AuthorizationHooks } from "../../authorization-hooks-HXVZXxUk.js";
+import { s as BlockOf } from "../../define-block-MyM4lH42.js";
+import { a as verifySharedSecret, i as signWebhook, n as VerifyOptions, o as verifyWebhook, r as WebhookInput, t as VerifiedWebhook } from "../../signatures-CzqfLlfV.js";
+import { a as DatabaseWebhookPayload, c as hookError, d as stripeInboxVerify, f as verifyStripeWebhook, i as DatabaseChange, l as isDatabaseWebhook, n as AuthHookKind, o as authHook, r as AuthHooks, s as databaseChange, t as AuthHookError, u as signStripeWebhook } from "../../verify-BTAEsJbF.js";
+import { A as IncomingVerify, C as isPublicAddress, D as IncomingDelivery, E as CreatedIncomingWebhook, F as UpdateIncomingWebhookInput, I as UpdatedIncomingWebhook, M as IncomingWebhooks, N as IncomingWebhooksOptions, O as IncomingDestination, P as RotatedIncomingSecret, S as ResolveHost, T as CreateIncomingWebhookInput, _ as WebhookResponse, a as WebhookSignInput, b as AllowUrl, c as standardWebhooks, d as RotateSecretOptions, f as WebhookSecretStore, g as WebhookRequest, h as WebhookPolicyError, i as StandardWebhooksOptions, j as IncomingWebhook, k as IncomingDestinationResult, l as standardWebhooksAsymmetric, m as FetchTransportOptions, n as HmacSignerOptions, o as WebhookSigner, p as sqlSecretStore, r as RawSigner, s as hmacSigner, t as AsymmetricWebhooksOptions, u as webhookPublicKey, v as WebhookTransport, w as publicUrl, x as PublicUrlOptions, y as fetchTransport } from "../../signers-BuVQKDfK.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/hmac.d.ts
 /** Constant-time string comparison. */
@@ -25,18 +25,17 @@ export declare function timingSafeEqual(a: string, b: string): boolean;
 export declare const INCOMING_ENDPOINT_HEADER = "x-bs-endpoint-id";
 /**
  * Tenant-owned trigger URLs over the `webhooks-in` SQL module: create
- * endpoints, then route `/hooks/<token>` to `receive`. Deliveries land in
- * the webhook inbox (`createWebhookInbox`), where a worker processes them,
- * or in `options.destination`.
+ * endpoints, then route `/hooks/<token>` to `receive`. Deliveries land in the
+ * webhook inbox (`createWebhookInbox`), where a worker processes them, or in
+ * `options.destination`.
  */
 export declare function createIncomingWebhooks(options: IncomingWebhooksOptions): IncomingWebhooks;
 //#endregion
 //#region src/blocks/webhooks/destinations.d.ts
 /**
- * Stores deliveries in the webhook inbox under `source` (the delivery's
- * source when unset), with the endpoint's tenant and the id
- * `<endpoint id>:<message id>`. The default destination of
- * `createIncomingWebhooks`.
+ * Stores deliveries in the webhook inbox under `source` (the delivery's source
+ * when unset), with the endpoint's tenant and the id `<endpoint id>:<message
+ * id>`. The default destination of `createIncomingWebhooks`.
  */
 export declare function inboxDestination(sql: SqlClient, options?: {
   readonly source?: string;
@@ -73,9 +72,9 @@ interface WebhookEncoded {
   readonly headers: Readonly<Record<string, string>>;
 }
 /**
- * What a response means when the status alone doesn't tell: a collector
- * that answers 200 with an error code, or accepts part of a batch.
- * `retry` tries the delivery again; `dead` dead-letters it.
+ * What a response means when the status alone doesn't tell: a collector that
+ * answers 200 with an error code, or accepts part of a batch. `retry` tries the
+ * delivery again; `dead` dead-letters it.
  */
 interface WebhookVerdict {
   readonly outcome: "succeeded" | "retry" | "dead";
@@ -83,29 +82,38 @@ interface WebhookVerdict {
 }
 /**
  * Turns claimed deliveries, as CloudEvents, into the request one endpoint
- * `format` expects. Versioned: a breaking change to this contract ships a
- * new `apiVersion`.
+ * `format` expects. Versioned: a breaking change to this contract ships a new
+ * `apiVersion`.
  */
 interface WebhookEncoder {
   readonly apiVersion: 1;
   /** The endpoint `format` it serves: lowercase letters, digits and dashes. */
   readonly name: string;
   /**
-   * Adds the Standard Webhooks signature headers. Collectors that
-   * authenticate with a token from `credential_ref` don't need them.
+   * Adds the Standard Webhooks signature headers. Collectors that authenticate
+   * with a token from `credential_ref` don't need them.
    */
   readonly signed: boolean;
   encode(events: readonly CloudEvent[], target: WebhookEncodeTarget): WebhookEncoded | Promise<WebhookEncoded>;
-  /** The headers a `credential_ref` token becomes. Defaults to the token's own `headers`. */
+  /**
+   * The headers a `credential_ref` token becomes. Defaults to the token's own
+   * `headers`.
+   */
   authorize?(token: CredentialToken): Readonly<Record<string, string>>;
-  /** Reads the response; `undefined` leaves it to the status and the retry policy. */
+  /**
+   * Reads the response; `undefined` leaves it to the status and the retry
+   * policy.
+   */
   classify?(response: WebhookResponse): WebhookVerdict | undefined;
 }
-/** The default format: CloudEvents over HTTP, structured or batched per endpoint. */
+/**
+ * The default format: CloudEvents over HTTP, structured or batched per
+ * endpoint.
+ */
 export declare function cloudEvents(): WebhookEncoder;
 /**
- * The 0.8 body, `{ type, timestamp, data }`, with `data` from `transform`;
- * a batch is a JSON array of them. Signed with Standard Webhooks like
+ * The 0.8 body, `{ type, timestamp, data }`, with `data` from `transform`; a
+ * batch is a JSON array of them. Signed with Standard Webhooks like
  * `cloudevents`.
  */
 export declare function standardEnvelope(): WebhookEncoder;
@@ -119,8 +127,8 @@ interface OtlpLogsOptions {
 }
 /**
  * OTLP/HTTP logs in the JSON encoding: one `ExportLogsServiceRequest` per
- * request, a log record per event with the CloudEvents attributes. Point
- * the endpoint at a collector's `/v1/logs`.
+ * request, a log record per event with the CloudEvents attributes. Point the
+ * endpoint at a collector's `/v1/logs`.
  */
 export declare function otlpLogs(options?: OtlpLogsOptions): WebhookEncoder;
 interface SplunkHecOptions {
@@ -133,15 +141,15 @@ interface SplunkHecOptions {
   readonly host?: string;
 }
 /**
- * The Splunk HTTP Event Collector's event format: one JSON object per
- * event, the CloudEvent as `event`. Point the endpoint at
- * `/services/collector/event` and set `credential_ref` to the HEC token.
+ * The Splunk HTTP Event Collector's event format: one JSON object per event,
+ * the CloudEvent as `event`. Point the endpoint at `/services/collector/event`
+ * and set `credential_ref` to the HEC token.
  */
 export declare function splunkHec(options?: SplunkHecOptions): WebhookEncoder;
 /**
- * RFC 8935 push delivery of Security Event Tokens: the body is the compact
- * SET from the delivery's `data.set`, one per request. The shared-signals
- * block creates these endpoints (`format: 'set'`) and dispatches to them.
+ * RFC 8935 push delivery of Security Event Tokens: the body is the compact SET
+ * from the delivery's `data.set`, one per request. The shared-signals block
+ * creates these endpoints (`format: 'set'`) and dispatches to them.
  */
 export declare function securityEvents(): WebhookEncoder;
 //#endregion
@@ -160,11 +168,14 @@ interface WebhookDelivery {
   readonly runId: string | null;
   /** The CloudEvents `subject`, such as `invoices/123`, when the event has one. */
   readonly subject: string | null;
-  /** The user who owns the endpoint, or `null` for a service principal's endpoint. */
+  /**
+   * The user who owns the endpoint, or `null` for a service principal's
+   * endpoint.
+   */
   readonly owner: string | null;
   /**
-   * The tenant's default service principal, which an endpoint without an
-   * owner runs as, when the service-principals module is installed.
+   * The tenant's default service principal, which an endpoint without an owner
+   * runs as, when the service-principals module is installed.
    */
   readonly principal: string | null;
   /** The permissions a service principal's endpoint declares. */
@@ -173,7 +184,10 @@ interface WebhookDelivery {
   readonly batch: boolean;
   /** `v1` signs with the endpoint's secrets, `v1a` with `asymmetricSigner`. */
   readonly signing: "v1" | "v1a";
-  /** The encoder that writes the request body, such as `cloudevents` or `otlp-logs`. */
+  /**
+   * The encoder that writes the request body, such as `cloudevents` or
+   * `otlp-logs`.
+   */
   readonly format: string;
   /** The credential whose token authenticates the request, if any. */
   readonly credentialRef: CredentialRef | null;
@@ -184,18 +198,27 @@ interface RetryPolicy {
   readonly maxAttempts?: number;
   /**
    * Seconds before the next attempt. Defaults to 5 seconds, 5 minutes, 30
-   * minutes, 2 hours, 5 hours, then 10 hours. Each wait is at least half
-   * its step and at least a second, plus a random share of the rest. A
-   * receiver's `Retry-After` wins when it asks for longer, up to a day.
+   * minutes, 2 hours, 5 hours, then 10 hours. Each wait is at least half its
+   * step and at least a second, plus a random share of the rest. A receiver's
+   * `Retry-After` wins when it asks for longer, up to a day.
    */
   readonly backoff?: (attempt: number) => number;
-  /** Statuses worth retrying. Defaults to 408, 429 and 5xx; network errors always retry. */
+  /**
+   * Statuses worth retrying. Defaults to 408, 429 and 5xx; network errors
+   * always retry.
+   */
   readonly retryable?: (status: number) => boolean;
 }
 interface WebhooksOptions extends BlockTemporalOptions {
-  /** `sqlTransport(postgres.admin)` for the worker, or the user's connection to manage. */
+  /**
+   * `sqlTransport(postgres.admin)` for the worker, or the user's connection to
+   * manage.
+   */
   readonly transport: BlockTransport;
-  /** The module schema, or its API schema: `defineBlocks` passes it from `blocks.generated.ts`. Default `better_supabase`. */
+  /**
+   * The module schema, or its API schema: `defineBlocks` passes it from
+   * `blocks.generated.ts`. Default `better_supabase`.
+   */
   readonly schema?: string;
   /** Defaults to `fetchTransport({ allowUrl })`. */
   readonly http?: WebhookTransport;
@@ -205,29 +228,28 @@ interface WebhooksOptions extends BlockTemporalOptions {
   readonly signer?: WebhookSigner;
   /**
    * Signs deliveries to endpoints with `signing = 'v1a'`, usually
-   * `standardWebhooksAsymmetric({ signer })`. Without it those deliveries
-   * are dead-lettered.
+   * `standardWebhooksAsymmetric({ signer })`. Without it those deliveries are
+   * dead-lettered.
    */
   readonly asymmetricSigner?: WebhookSigner;
   /** Defaults to `sqlSecretStore(transport)`. */
   readonly secrets?: WebhookSecretStore;
   /**
    * Encoders for endpoint `format`s beyond, or replacing, the built-in
-   * `cloudevents`, `standard`, `otlp-logs`, `splunk-hec` and `set`. A
-   * delivery to a format without an encoder is dead-lettered.
+   * `cloudevents`, `standard`, `otlp-logs`, `splunk-hec` and `set`. A delivery
+   * to a format without an encoder is dead-lettered.
    */
   readonly encoders?: readonly WebhookEncoder[];
   /**
-   * The format of an endpoint whose row has none, such as an adopted table
-   * that doesn't map `format` or holds `null`.
+   * The format of an endpoint whose row has none, such as an adopted table that
+   * doesn't map `format` or holds `null`.
    * `blocks.webhooks-out.options.defaultFormat`, which `defineBlocks` passes,
    * and the column default. Defaults to `cloudevents`.
    */
   readonly defaultFormat?: string;
   /**
-   * Resolves an endpoint's `credential_ref` to the token that
-   * authenticates its requests. Without it, such deliveries are
-   * dead-lettered.
+   * Resolves an endpoint's `credential_ref` to the token that authenticates its
+   * requests. Without it, such deliveries are dead-lettered.
    */
   readonly credentials?: CredentialProvider;
   readonly retry?: RetryPolicy;
@@ -245,24 +267,24 @@ interface WebhooksOptions extends BlockTemporalOptions {
   /** Prepended to each type with a dot, such as `com.example`. Defaults to none. */
   readonly typePrefix?: string;
   /**
-   * The CloudEvents `dataschema`: an absolute URI, or a function that picks
-   * one per delivery or leaves it out with `undefined`.
+   * The CloudEvents `dataschema`: an absolute URI, or a function that picks one
+   * per delivery or leaves it out with `undefined`.
    */
   readonly dataschema?: string | ((delivery: WebhookDelivery) => string | undefined);
   /**
    * The W3C `traceparent` of the delivery, sent as the CloudEvents
-   * `traceparent` extension. A value that is not a valid trace context is
-   * left out.
+   * `traceparent` extension. A value that is not a valid trace context is left
+   * out.
    */
   readonly traceparent?: (delivery: WebhookDelivery) => string | undefined;
   /**
-   * Narrows each event's claimed deliveries to the endpoints whose owner
-   * may read it. A delivery it leaves out is canceled; a throw retries every
+   * Narrows each event's claimed deliveries to the endpoints whose owner may
+   * read it. A delivery it leaves out is canceled; a throw retries every
    * delivery of the event. Each delivery is checked against its own stored
    * `subject`. Defaults to `authorization.delivery.subscribers`; with
-   * `authorization` but no such policy, to `subjectReaders(transport)`, so
-   * an event about a `config.subjects` record only reaches endpoints whose
-   * owner (or service principal) may read that record.
+   * `authorization` but no such policy, to `subjectReaders(transport)`, so an
+   * event about a `config.subjects` record only reaches endpoints whose owner
+   * (or service principal) may read that record.
    */
   readonly subscribers?: SubscriberPolicy;
   /** `server.authorization`, for its `delivery.subscribers` policy. */
@@ -273,10 +295,16 @@ interface WebhooksOptions extends BlockTemporalOptions {
   readonly responseBodyLimit?: number;
   /** `betterSupabase.events`, for `webhook.*` block events. */
   readonly events?: EventHub;
-  /** `withBlockHooks` hooks around the client's methods, such as a check before `publish`. */
+  /**
+   * `withBlockHooks` hooks around the client's methods, such as a check before
+   * `publish`.
+   */
   readonly hooks?: BlockHooks<Webhooks>;
   readonly context?: RequestContext;
-  /** Error mappers that run before the built-in ones, as in `betterSupabase.mapError()`. */
+  /**
+   * Error mappers that run before the built-in ones, as in
+   * `betterSupabase.mapError()`.
+   */
   readonly mappers?: readonly ErrorMapper[];
 }
 interface PublishInput {
@@ -288,9 +316,9 @@ interface PublishInput {
   /** What the event is about, such as `invoices/123`: the CloudEvents `subject`. */
   readonly subject?: string;
   /**
-   * The permission an endpoint owner needs in the tenant to receive the
-   * event, such as `invoices.read`. Defaults to the module's view
-   * permission (`webhooks.read`).
+   * The permission an endpoint owner needs in the tenant to receive the event,
+   * such as `invoices.read`. Defaults to the module's view permission
+   * (`webhooks.read`).
    */
   readonly readPermission?: string;
 }
@@ -333,8 +361,8 @@ interface Webhooks {
   publish(event: PublishInput): AsyncResult<number>;
   /**
    * Queues up to 1000 events in one `publish_webhook_events` call, with
-   * `publish`'s checks per event: one `Result` (how many endpoints) per
-   * event, in order. The outer result fails only when the call does.
+   * `publish`'s checks per event: one `Result` (how many endpoints) per event,
+   * in order. The outer result fails only when the call does.
    */
   publishMany(events: readonly PublishInput[]): AsyncResult<readonly Result<number>[]>;
   /** Sends to one endpoint outside its subscriptions; returns the delivery id. */
@@ -345,7 +373,10 @@ interface Webhooks {
   rotateSecret(endpointId: string, options?: RotateSecretOptions): AsyncResult<string>;
   /** Sends due deliveries. Run it from a cron route or a job. */
   deliver(options?: DeliverWebhooksOptions): Promise<DeliverWebhooksResult>;
-  /** A `GET`/`POST` handler for Vercel Cron that runs `deliver` behind a bearer secret. */
+  /**
+   * A `GET`/`POST` handler for Vercel Cron that runs `deliver` behind a bearer
+   * secret.
+   */
   deliverRoute(options: WebhooksRouteOptions): (request: Request) => Promise<Response>;
   /**
    * An `EventSink` that publishes CloudEvents, e.g. from the outbox relay.
@@ -355,8 +386,8 @@ interface Webhooks {
   sink(options?: WebhookSinkOptions): EventSink;
   /**
    * Deletes up to `batch` finished deliveries created before `olderThan`
-   * (`purge_webhook_deliveries`); returns how many. Keep `olderThan` above
-   * the window you republish in: a purged event id can be queued again.
+   * (`purge_webhook_deliveries`); returns how many. Keep `olderThan` above the
+   * window you republish in: a purged event id can be queued again.
    */
   purge(options?: PurgeWebhookDeliveriesOptions): AsyncResult<number>;
   /** A job handler that runs `purge`; schedule it nightly. */
@@ -393,7 +424,10 @@ interface SafeFetchOptions extends PublicUrlOptions {
   readonly timeoutMs?: number;
   readonly sensitiveHeaders?: readonly string[];
 }
-/** A request `safeFetch` refused: a URL outside the policy or too many redirects. */
+/**
+ * A request `safeFetch` refused: a URL outside the policy or too many
+ * redirects.
+ */
 export declare class UnsafeUrlError extends Error {
   override readonly name = "UnsafeUrlError";
 }
@@ -402,12 +436,12 @@ export declare class UrlCheckError extends Error {
 }
 /**
  * A `fetch` for URLs that users or tenants supply (link previews, imports,
- * avatars by URL, callback URLs): it refuses private, loopback and
- * link-local addresses, non-HTTPS URLs and credentials in the URL, checks
- * every redirect against the same policy before following it, and stops
- * after `timeoutMs`. It throws `UnsafeUrlError` for a refused URL and
- * `UrlCheckError` when the check itself failed (a DNS lookup error). A redirect
- * to another origin drops the credential headers and `sensitiveHeaders`.
+ * avatars by URL, callback URLs): it refuses private, loopback and link-local
+ * addresses, non-HTTPS URLs and credentials in the URL, checks every redirect
+ * against the same policy before following it, and stops after `timeoutMs`. It
+ * throws `UnsafeUrlError` for a refused URL and `UrlCheckError` when the check
+ * itself failed (a DNS lookup error). A redirect to another origin drops the
+ * credential headers and `sensitiveHeaders`.
  *
  * DNS can change between the check and the connection; route the requests
  * through an egress proxy when that matters.
@@ -433,7 +467,10 @@ type IncomingWebhooksEvents = {
   readonly "incoming_webhook.secret_rotated": IncomingWebhookEventData;
   readonly "incoming_webhook.deleted": IncomingWebhookEventData;
 };
-/** The `incoming-webhooks` block's event types, for its manifest and `onBlockEvent`. */
+/**
+ * The `incoming-webhooks` block's event types, for its manifest and
+ * `onBlockEvent`.
+ */
 export declare const incomingWebhooksEvents: Events<IncomingWebhooksEvents>;
 //#endregion
 //#region src/blocks/webhooks/manifest.d.ts

package/dist/blocks/webhooks/index.js

@@ -1,33 +1,32 @@
 import { t as DbException } from "../../db-exception-CnWcYPxL.js";
-import { n as dbError } from "../../errors-BV1SKTVs.js";
-import { t as temporal } from "../../temporal-required-nfZ87U-0.js";
-import { a as ok, r as err, s as toDbError, t as AsyncResult } from "../../result-DIeYscA3.js";
+import { n as dbError } from "../../errors-D7u24ZJH.js";
+import { t as temporal } from "../../temporal-required-Dt4mcPsi.js";
+import { a as ok, r as err, s as toDbError, t as AsyncResult } from "../../result-DIT_qp4G.js";
 import { n as isRecord } from "../../guards-6F2bCtQR.js";
-import { i as toBase64, r as fromBase64 } from "../../base64-D4aqdnDR.js";
-import { a as methodNotAllowed, o as problemResponse } from "../../problem-JRCohp1j.js";
+import { i as toBase64, r as fromBase64 } from "../../base64-B9Wlsdj7.js";
+import { a as methodNotAllowed, o as problemResponse } from "../../problem-D0KDiYPk.js";
 import { t as MAX_BATCH } from "../../batch-limit-DKVQDz4o.js";
 import { n as webhooksOutSqlOptions, t as webhooksInSqlOptions } from "../../options-D7f2VKzj.js";
-import { a as stripTypePrefix } from "../../cloud-event-CTh9Sr5w.js";
-import { n as credentialRefInTenant, r as foreignCredentialRef } from "../../provider-C-Ti38J6.js";
-import { n as event, t as defineEvents } from "../../event-map-Dy2vKHai.js";
-import { r as blockEmitter } from "../../block-events-DD9Q_NUz.js";
-import { n as hmacHex, r as timingSafeEqual } from "../../hmac-BgpThYQW.js";
-import { i as signWebhook, o as verifySharedSecret, s as verifyWebhook, t as PUBLIC_KEY_PREFIX } from "../../signatures-CeIoAelK.js";
-import { t as cronRoute } from "../../cron-route-mTvWhork.js";
-import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../../block-transport-J7ZepTq2.js";
-import { C as optionalText, D as recordOf, E as readBodyCapped, L as toBlockError, M as seconds, R as toInstant, c as chunksOf, f as errorText, i as batchResultsOf, k as recordsOf, n as applyTemporal, o as blockCall, r as asDbError, s as budget } from "../../block-helpers-DkVZNDrj.js";
-import { t as subjectReaders } from "../../subject-readers-BpwUFJtp.js";
-import { r as withBlockHooks } from "../../block-hooks-C22vuIUd.js";
-import { n as hitRateLimit, o as receiveWebhook } from "../../rate-limit-I3AncmM8.js";
+import { a as stripTypePrefix } from "../../cloud-event-XsM53POL.js";
+import { n as credentialRefInTenant, r as foreignCredentialRef } from "../../provider-BhIkKBOh.js";
+import { n as event, t as defineEvents } from "../../event-map-CtPFhcOp.js";
+import { r as blockEmitter } from "../../block-events-BURaqwyp.js";
+import { n as hmacHex, r as timingSafeEqual } from "../../hmac-B3CTTlfv.js";
+import { i as signWebhook, o as verifySharedSecret, s as verifyWebhook, t as PUBLIC_KEY_PREFIX } from "../../signatures-D8IoN3Rw.js";
+import { t as cronRoute } from "../../cron-route-BbVtwXZz.js";
+import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../../block-transport-Ds0C2mUf.js";
+import { C as optionalText, D as recordOf, E as readBodyCapped, L as toBlockError, M as seconds, R as toInstant, c as chunksOf, f as errorText, i as batchResultsOf, k as recordsOf, n as applyTemporal, o as blockCall, r as asDbError, s as budget } from "../../block-helpers-DwE32_gT.js";
+import { t as subjectReaders } from "../../subject-readers-BJzh7WF7.js";
+import { r as withBlockHooks } from "../../block-hooks-C1r-R2r0.js";
+import { n as hitRateLimit, o as receiveWebhook } from "../../rate-limit-CpTD_WHm.js";
 import { n as defineBlock } from "../../define-block-B6Gjs57G.js";
-import { a as signStripeWebhook, i as isDatabaseWebhook, n as databaseChange, o as stripeInboxVerify, r as hookError, s as verifyStripeWebhook, t as authHook } from "../../verify-DnU-uWU2.js";
+import { a as signStripeWebhook, i as isDatabaseWebhook, n as databaseChange, o as stripeInboxVerify, r as hookError, s as verifyStripeWebhook, t as authHook } from "../../verify-BCmBaHlN.js";
 import { toHttp } from "../../events/index.js";
 //#region src/blocks/webhooks/destinations.ts
 /**
-* Stores deliveries in the webhook inbox under `source` (the delivery's
-* source when unset), with the endpoint's tenant and the id
-* `<endpoint id>:<message id>`. The default destination of
-* `createIncomingWebhooks`.
+* Stores deliveries in the webhook inbox under `source` (the delivery's source
+* when unset), with the endpoint's tenant and the id `<endpoint id>:<message
+* id>`. The default destination of `createIncomingWebhooks`.
 */
 function inboxDestination(sql, options = {}) {
 	return {
@@ -78,9 +77,9 @@ function verifyOf(value) {
 }
 /**
 * Tenant-owned trigger URLs over the `webhooks-in` SQL module: create
-* endpoints, then route `/hooks/<token>` to `receive`. Deliveries land in
-* the webhook inbox (`createWebhookInbox`), where a worker processes them,
-* or in `options.destination`.
+* endpoints, then route `/hooks/<token>` to `receive`. Deliveries land in the
+* webhook inbox (`createWebhookInbox`), where a worker processes them, or in
+* `options.destination`.
 */
 function createIncomingWebhooks(options) {
 	applyTemporal(options);
@@ -278,7 +277,10 @@ function createIncomingWebhooks(options) {
 }
 //#endregion
 //#region src/blocks/webhooks/encoders.ts
-/** The default format: CloudEvents over HTTP, structured or batched per endpoint. */
+/**
+* The default format: CloudEvents over HTTP, structured or batched per
+* endpoint.
+*/
 function cloudEvents() {
 	return {
 		apiVersion: 1,
@@ -291,8 +293,8 @@ function cloudEvents() {
 	};
 }
 /**
-* The 0.8 body, `{ type, timestamp, data }`, with `data` from `transform`;
-* a batch is a JSON array of them. Signed with Standard Webhooks like
+* The 0.8 body, `{ type, timestamp, data }`, with `data` from `transform`; a
+* batch is a JSON array of them. Signed with Standard Webhooks like
 * `cloudevents`.
 */
 function standardEnvelope() {
@@ -348,8 +350,8 @@ const OTLP_RETRYABLE = /* @__PURE__ */ new Set([
 ]);
 /**
 * OTLP/HTTP logs in the JSON encoding: one `ExportLogsServiceRequest` per
-* request, a log record per event with the CloudEvents attributes. Point
-* the endpoint at a collector's `/v1/logs`.
+* request, a log record per event with the CloudEvents attributes. Point the
+* endpoint at a collector's `/v1/logs`.
 */
 function otlpLogs(options = {}) {
 	const resource = attributes({
@@ -422,9 +424,9 @@ function jsonOf(body) {
 /** HEC codes worth a retry: internal error and server busy. */
 const HEC_RETRYABLE = /* @__PURE__ */ new Set([8, 9]);
 /**
-* The Splunk HTTP Event Collector's event format: one JSON object per
-* event, the CloudEvent as `event`. Point the endpoint at
-* `/services/collector/event` and set `credential_ref` to the HEC token.
+* The Splunk HTTP Event Collector's event format: one JSON object per event,
+* the CloudEvent as `event`. Point the endpoint at `/services/collector/event`
+* and set `credential_ref` to the HEC token.
 */
 function splunkHec(options = {}) {
 	return {
@@ -461,9 +463,9 @@ function splunkHec(options = {}) {
 /** RFC 8935 error codes a transmitter can't fix by sending the SET again. */
 const SET_RETRYABLE = /* @__PURE__ */ new Set(["invalid_key"]);
 /**
-* RFC 8935 push delivery of Security Event Tokens: the body is the compact
-* SET from the delivery's `data.set`, one per request. The shared-signals
-* block creates these endpoints (`format: 'set'`) and dispatches to them.
+* RFC 8935 push delivery of Security Event Tokens: the body is the compact SET
+* from the delivery's `data.set`, one per request. The shared-signals block
+* creates these endpoints (`format: 'set'`) and dispatches to them.
 */
 function securityEvents() {
 	return {
@@ -613,12 +615,12 @@ function builtinResolver() {
 	})).map((entry) => entry.address);
 }
 /**
-* The default `allowUrl`: HTTPS only, no credentials in the URL, no local
-* host names, and every address the host resolves to must be public. The
-* delivery transport calls it again for each redirect.
+* The default `allowUrl`: HTTPS only, no credentials in the URL, no local host
+* names, and every address the host resolves to must be public. The delivery
+* transport calls it again for each redirect.
 *
-* DNS can change between this check and the connection. Route webhooks
-* through an egress proxy when that matters.
+* DNS can change between this check and the connection. Route webhooks through
+* an egress proxy when that matters.
 */
 function publicUrl(options = {}) {
 	const resolve = options.resolve === false ? void 0 : options.resolve ?? builtinResolver();
@@ -638,7 +640,10 @@ function publicUrl(options = {}) {
 }
 //#endregion
 //#region src/blocks/webhooks/safe-fetch.ts
-/** A request `safeFetch` refused: a URL outside the policy or too many redirects. */
+/**
+* A request `safeFetch` refused: a URL outside the policy or too many
+* redirects.
+*/
 var UnsafeUrlError = class extends Error {
 	name = "UnsafeUrlError";
 };
@@ -665,12 +670,12 @@ const CREDENTIALS = [
 ];
 /**
 * A `fetch` for URLs that users or tenants supply (link previews, imports,
-* avatars by URL, callback URLs): it refuses private, loopback and
-* link-local addresses, non-HTTPS URLs and credentials in the URL, checks
-* every redirect against the same policy before following it, and stops
-* after `timeoutMs`. It throws `UnsafeUrlError` for a refused URL and
-* `UrlCheckError` when the check itself failed (a DNS lookup error). A redirect
-* to another origin drops the credential headers and `sensitiveHeaders`.
+* avatars by URL, callback URLs): it refuses private, loopback and link-local
+* addresses, non-HTTPS URLs and credentials in the URL, checks every redirect
+* against the same policy before following it, and stops after `timeoutMs`. It
+* throws `UnsafeUrlError` for a refused URL and `UrlCheckError` when the check
+* itself failed (a DNS lookup error). A redirect to another origin drops the
+* credential headers and `sensitiveHeaders`.
 *
 * DNS can change between the check and the connection; route the requests
 * through an egress proxy when that matters.
@@ -699,7 +704,7 @@ function createSafeFetch(options = {}) {
 		let method = request.method;
 		const headers = new Headers(request.headers);
 		let body = method === "GET" || method === "HEAD" ? void 0 : await request.arrayBuffer();
-		for (let hop = 0;; hop++) {
+		for (let hop = 0;; hop += 1) {
 			if (hop > 0) await check(url);
 			const response = await send(url, {
 				method,
@@ -765,8 +770,8 @@ async function readCapped(response, limit) {
 	}
 }
 /**
-* A check that threw (a DNS lookup that timed out) is not a refusal: it
-* throws `UrlCheckError`, which the delivery retries.
+* A check that threw (a DNS lookup that timed out) is not a refusal: it throws
+* `UrlCheckError`, which the delivery retries.
 */
 async function allowed(allowUrl, url) {
 	try {
@@ -788,7 +793,7 @@ function fetchTransport(options = {}) {
 			const timeout = AbortSignal.timeout(timeoutMs);
 			const signal = request.signal ? AbortSignal.any([request.signal, timeout]) : timeout;
 			let url = new URL(request.url);
-			for (let hop = 0;; hop++) {
+			for (let hop = 0;; hop += 1) {
 				if (options.allowUrl && !await allowed(options.allowUrl, url)) throw new WebhookPolicyError(`Endpoint URL is not allowed: ${url.host}`);
 				const response = await send(url, {
 					method: "POST",
@@ -841,9 +846,9 @@ function needSecrets(secrets) {
 	if (secrets.length === 0) throw new TypeError("The endpoint has no signing secret");
 }
 /**
-* Signs with the [Standard Webhooks](https://www.standardwebhooks.com/)
-* scheme: `webhook-id`, `webhook-timestamp` and one `v1,` signature per
-* secret in `webhook-signature`. `verifyWebhook` checks it.
+* Signs with the [Standard Webhooks](https://www.standardwebhooks.com/) scheme:
+* `webhook-id`, `webhook-timestamp` and one `v1,` signature per secret in
+* `webhook-signature`. `verifyWebhook` checks it.
 */
 function standardWebhooks(options = {}) {
 	const names = {
@@ -871,9 +876,9 @@ function standardWebhooks(options = {}) {
 }
 /**
 * Signs with the Standard Webhooks asymmetric scheme: one `v1a,` Ed25519
-* signature over `id.timestamp.body` in `webhook-signature`. Receivers
-* verify it with the `whpk_` key `webhookPublicKey` returns, through
-* `verifyWebhook`. Endpoints opt in with `signing = 'v1a'`.
+* signature over `id.timestamp.body` in `webhook-signature`. Receivers verify
+* it with the `whpk_` key `webhookPublicKey` returns, through `verifyWebhook`.
+* Endpoints opt in with `signing = 'v1a'`.
 */
 function standardWebhooksAsymmetric(options) {
 	const names = {
@@ -1117,7 +1122,10 @@ function createWebhooks(options) {
 		});
 		return ok(encoder.authorize?.(token.data) ?? token.data.headers);
 	}
-	/** The Standard Webhooks headers, from the endpoint's secrets or `asymmetricSigner`. */
+	/**
+	* The Standard Webhooks headers, from the endpoint's secrets or
+	* `asymmetricSigner`.
+	*/
 	async function signatureHeaders(deliveries, body) {
 		const first = deliveries[0];
 		const sign = first.signing === "v1a" ? options.asymmetricSigner : signer;
@@ -1418,7 +1426,10 @@ const webhooksEvents = defineEvents({
 	"webhook.disabled": event(),
 	"webhook.secret_rotated": event()
 });
-/** The `incoming-webhooks` block's event types, for its manifest and `onBlockEvent`. */
+/**
+* The `incoming-webhooks` block's event types, for its manifest and
+* `onBlockEvent`.
+*/
 const incomingWebhooksEvents = defineEvents({
 	"incoming_webhook.created": event(),
 	"incoming_webhook.updated": event(),