better-supabase 0.12.0 → 0.13.0

package/dist/workflow-sdk/world/index.js

@@ -1,15 +1,15 @@
-import { n as dbError } from "../../errors-BV1SKTVs.js";
-import { o as problemResponse } from "../../problem-JRCohp1j.js";
-import { i as sqlIdent } from "../../template-Dw3dTmKe.js";
-import { i as WORLD_POSTGRES_VERSION, r as WORKFLOW_VAULT_SECRETS } from "../../workflow-sdk-world-QzcxaaCD.js";
-import { n as hmacHex, r as timingSafeEqual } from "../../hmac-BgpThYQW.js";
-import { t as watchPoolErrors } from "../../pool-errors-CGqvTQOC.js";
-import { n as memoized } from "../../optional-peer-Dx8TaYXw.js";
+import { n as dbError } from "../../errors-D7u24ZJH.js";
+import { o as problemResponse } from "../../problem-D0KDiYPk.js";
+import { i as sqlIdent } from "../../template-DXsGm_R0.js";
+import { i as WORLD_POSTGRES_VERSION, r as WORKFLOW_VAULT_SECRETS } from "../../workflow-sdk-world-BOEsvWmx.js";
+import { n as hmacHex, r as timingSafeEqual } from "../../hmac-B3CTTlfv.js";
+import { t as watchPoolErrors } from "../../pool-errors-DOZ3oDeS.js";
+import { n as memoized } from "../../optional-peer-C1NbBRJm.js";
 import { Pool } from "pg";
 import { reenqueueActiveRuns } from "@workflow/world";
 import { createWorld as createWorld$1 } from "@workflow/world-postgres";
 //#region src/workflow-sdk/world/analytics.ts
-/** world-postgres stores UTC in `timestamp without time zone` columns. */
+/** World-postgres stores UTC in `timestamp without time zone` columns. */
 const utc = (column) => `(${column} at time zone 'UTC')`;
 /** The column every keyset query adds: the row's sort key as `text[]`. */
 const CURSOR = "__cursor";
@@ -38,7 +38,10 @@ const EVENT_COLUMNS = `
   case when e.payload ? 'resumeAt' then (e.payload ->> 'resumeAt')::timestamptz end as "resumeAt",
   case when e.payload ? 'retryAfter' then (e.payload ->> 'retryAfter')::timestamptz end as "retryAfter",
   e.payload ->> 'errorCode' as "errorCode"`;
-/** world-postgres keys waits `<runId>-<correlationId>`; analytics names them by the correlation id, as steps and hooks. */
+/**
+* World-postgres keys waits `<runId>-<correlationId>`; analytics names them by
+* the correlation id, as steps and hooks.
+*/
 const WAIT_COLUMNS = `
   w.run_id as "runId",
   case when starts_with(w.wait_id, w.run_id || '-')
@@ -46,7 +49,10 @@ const WAIT_COLUMNS = `
   w.status::text as status,
   ${utc("w.resume_at")} as "resumeAt", ${utc("w.created_at")} as "createdAt",
   ${utc("w.updated_at")} as "updatedAt", ${utc("w.completed_at")} as "completedAt"`;
-/** Hooks keep their row only while active, so the status comes from the event log. */
+/**
+* Hooks keep their row only while active, so the status comes from the event
+* log.
+*/
 const HOOKS = `
   select e.run_id as "runId", e.correlation_id as "hookId",
     case
@@ -103,7 +109,10 @@ function keyset(columns, { after, order }, values) {
 function cursorColumn(columns) {
 	return `array[${columns.map((column) => `(${column})::text`).join(", ")}] as "${CURSOR}"`;
 }
-/** Converts SQL nulls to the optional fields the analytics schemas allow, and drops the cursor column. */
+/**
+* Converts SQL nulls to the optional fields the analytics schemas allow, and
+* drops the cursor column.
+*/
 function compact(row) {
 	const out = {};
 	for (const [key, value] of Object.entries(row)) if (value !== null && key !== CURSOR) out[key] = value;
@@ -121,8 +130,8 @@ const LIMIT = 100;
 const MAX_ATTRIBUTE_FILTERS = 8;
 /**
 * The World's `analytics` namespace over the world-postgres tables: the run
-* listing filters by status, name, window and latest attributes (the GIN
-* index on `workflow_runs.attributes` serves the filter).
+* listing filters by status, name, window and latest attributes (the GIN index
+* on `workflow_runs.attributes` serves the filter).
 */
 function createAnalytics(pool) {
 	const rows = async (sql, params) => {
@@ -386,7 +395,10 @@ async function signDelivery(secret, job, body, now = Date.now()) {
 	const t = String(Math.floor(now / 1e3));
 	return `t=${t},v1=${await hmacHex(secret, `${t}.${job}.${body}`)}`;
 }
-/** Whether `header` signs `job` and `body` with `secret` within five minutes of `now`. */
+/**
+* Whether `header` signs `job` and `body` with `secret` within five minutes of
+* `now`.
+*/
 async function verifyDelivery(secret, header, job, body, now = Date.now()) {
 	if (header === null) return false;
 	const parts = new Map(header.split(",").map((part) => {
@@ -399,14 +411,20 @@ async function verifyDelivery(secret, header, job, body, now = Date.now()) {
 	if (Math.abs(now / 1e3 - Number(t)) > 300) return false;
 	return timingSafeEqual(await hmacHex(secret, `${t}.${job}.${body}`), v1);
 }
-/** Unsigned poll deliveries are accepted only when `NODE_ENV` is `development` or `test`. */
+/**
+* Unsigned poll deliveries are accepted only when `NODE_ENV` is `development`
+* or `test`.
+*/
 function unsignedAllowed() {
 	const mode = env("NODE_ENV");
 	return mode === "development" || mode === "test";
 }
 //#endregion
 //#region src/workflow-sdk/world/world.ts
-/** JSON with Uint8Array values as `{ __type: "Uint8Array", data: <base64> }`, as world-postgres sends them. */
+/**
+* JSON with Uint8Array values as `{ __type: "Uint8Array", data: <base64> }`, as
+* world-postgres sends them.
+*/
 function serialize(value) {
 	return Buffer.from(JSON.stringify(value, (_key, inner) => inner instanceof Uint8Array ? {
 		__type: "Uint8Array",
@@ -421,13 +439,16 @@ function isStoredMessage(value) {
 function deliveryProblem(kind, detail) {
 	return problemResponse(dbError(kind, detail, { code: "WORKFLOW_DELIVERY_REJECTED" }), { expose: true });
 }
-/** Retry delay after a failed delivery, as world-postgres (exp(min(attempt, 10)) seconds). */
+/**
+* Retry delay after a failed delivery, as world-postgres (exp(min(attempt, 10))
+* seconds).
+*/
 const backoffSeconds = (attempt) => Math.ceil(Math.exp(Math.min(attempt, 10)));
 /**
 * A Workflow SDK World on Supabase Postgres: the run, step, event, hook and
 * stream tables of `@workflow/world-postgres` (installed by the
-* `workflow-sdk-world` SQL module), with messages in the jobs module's
-* queue instead of graphile-worker.
+* `workflow-sdk-world` SQL module), with messages in the jobs module's queue
+* instead of graphile-worker.
 *
 * ```ts
 * // workflow.config or WORKFLOW_TARGET_WORLD=better-supabase/workflow-sdk/world
@@ -458,7 +479,10 @@ function createSupabaseWorld(options = {}) {
 		pool,
 		...options.namespace === void 0 ? {} : { namespace: options.namespace }
 	});
-	/** The Vault secret, `undefined` when no row has the name; a failed read rejects. */
+	/**
+	* The Vault secret, `undefined` when no row has the name; a failed read
+	* rejects.
+	*/
 	const vault = async (name) => {
 		return (await pool.query("select decrypted_secret as secret from vault.decrypted_secrets where name = $1", [name])).rows[0]?.secret ?? void 0;
 	};
@@ -632,7 +656,7 @@ function createSupabaseWorld(options = {}) {
 	const claimInto = async (room) => {
 		try {
 			const jobs = await claim(room);
-			jobs.forEach(track);
+			for (const job of jobs) track(job);
 			return jobs.length;
 		} catch {
 			return 0;
@@ -749,9 +773,8 @@ function createSupabaseWorld(options = {}) {
 * `WORKFLOW_POSTGRES_POLL_INTERVAL_MS`, and the pool settings
 * `WORKFLOW_POSTGRES_MAX_CONNECTIONS`,
 * `WORKFLOW_POSTGRES_CONNECTION_TIMEOUT_MS`,
-* `WORKFLOW_POSTGRES_IDLE_TIMEOUT_MS`,
-* `WORKFLOW_POSTGRES_STATEMENT_TIMEOUT_MS` and
-* `WORKFLOW_POSTGRES_IDLE_IN_TRANSACTION_TIMEOUT_MS`.
+* `WORKFLOW_POSTGRES_IDLE_TIMEOUT_MS`, `WORKFLOW_POSTGRES_STATEMENT_TIMEOUT_MS`
+* and `WORKFLOW_POSTGRES_IDLE_IN_TRANSACTION_TIMEOUT_MS`.
 */
 function createWorld() {
 	return createSupabaseWorld(worldOptionsFromEnv());

package/dist/workflow-sdk-BXwl1THQ.d.ts

@@ -0,0 +1,163 @@
+import { m as RequestContext } from "./plugin-DouW0Kvg.js";
+import { f as WorkflowStarter, l as WorkflowStartCall, p as WorkflowSubject, t as WorkflowPrincipalKind } from "./workflows-BHyYAR6c.js";
+import { a as OutboxEvent, o as OutboxHandler } from "./outbox-Bsk-HJnq.js";
+import { Hook, Run } from "workflow/api";
+import { World } from "@workflow/world";
+//#region src/workflow-sdk/workflow-sdk.d.ts
+/** A workflow function (a `"use workflow"` export), typed structurally. */
+type WorkflowFn<TArgs extends unknown[] = unknown[], TResult = unknown> = (...args: TArgs) => Promise<TResult>;
+interface WorkflowContextOptions {
+  /** The opaque ticket `bs.forContext` resolves; wins over `context.ticket`. */
+  readonly ticket?: string;
+}
+/**
+ * The actor, tenant and ticket of `context` as plain data, to pass into a
+ * workflow as an argument; inside a step, `bs.forContext(context)` runs as that
+ * user with RLS. A delegated token's `client_id`, `scope`,
+ * `authorization_details` and `act` chain stay in `claims`, so the step is as
+ * narrow as the token; other claims stay out of the run's serialized state.
+ * Throws a `TypeError` for an invalid `act` chain or ticket.
+ */
+declare function workflowContext(context: RequestContext, options?: WorkflowContextOptions): RequestContext;
+/** The `bs.tenant`, `bs.actor` and `bs.ticket` attributes for `context`. */
+declare function contextAttributes(context: RequestContext, options?: WorkflowContextOptions): Record<string, string>;
+interface StartForOptions {
+  /**
+   * Starting again with the same key returns the run the first start created,
+   * while that run is in the World. Schedules and admission pass
+   * `schedule:{id}:{fireAt}` and `admission:{id}`.
+   */
+  readonly idempotencyKey?: string;
+  /**
+   * More attributes for the run; `bs.*` keys are set from the context, and
+   * `bs.principal_kind` and `bs.principal` only by `runAs` starts.
+   */
+  readonly attributes?: Readonly<Record<string, string>>;
+  /** The record the run belongs to, stored as `bs.subject`. */
+  readonly subject?: WorkflowSubject;
+  /** The World to look the key up in. Defaults to the configured one. */
+  readonly world?: World;
+  /**
+   * An opaque ticket, stored as the `bs.ticket` attribute instead of
+   * `context.ticket`. Pass `workflowContext(context, { ticket })` as an
+   * argument too, so a step's `bs.forContext` resolves it.
+   */
+  readonly ticket?: string;
+}
+/**
+ * `start(workflow, args)` for the caller in `context`: the run carries
+ * `bs.tenant` and `bs.actor`, so `workflow_runs` lists it to the tenant and the
+ * actor under RLS. With `idempotencyKey`, a run that already has the key is
+ * returned instead of starting another (the key lookup needs a World with
+ * `analytics`, as the Supabase World has).
+ */
+declare function startFor<TArgs extends unknown[], TResult>(context: RequestContext, workflow: WorkflowFn<TArgs, TResult>, args: TArgs, options?: StartForOptions): Promise<Run<TResult>>;
+/**
+ * Who an event or schedule start runs as: the publisher, a user who holds the
+ * permissions, and the permission keys its steps may use. A step's
+ * `bs.forContext(context)` runs as the publisher, capped to `permissions`, so a
+ * publisher who lost one fails the step. The event actor or schedule creator is
+ * the run's actor (and `bs.trigger`) and grants nothing; the publisher is
+ * recorded as the run's principal.
+ */
+interface WorkflowRunAs {
+  readonly publisher: string;
+  readonly permissions: readonly string[];
+  /** The tenant the steps run in. Defaults to the event's or schedule's. */
+  readonly tenant?: string;
+  /**
+   * What the publisher is, recorded as the run's `principal_kind`: `user`
+   * (default), or `service_principal` for the app's service principal (an auth
+   * user too, so steps still run as it).
+   */
+  readonly principalKind?: WorkflowPrincipalKind;
+}
+/** A fixed `WorkflowRunAs`, or one per start; `null` refuses the start. */
+type WorkflowRunAsFor<T> = WorkflowRunAs | ((source: T) => WorkflowRunAs | null | undefined | Promise<WorkflowRunAs | null | undefined>);
+interface WorkflowStarterOptions extends Pick<StartForOptions, "world"> {
+  /**
+   * The publisher a start runs as. Required for schedules: a schedule start
+   * without it, or with `null` for it, throws and the tick records the failure.
+   * An admission request runs as its actor unless this is set.
+   */
+  readonly runAs?: WorkflowRunAsFor<WorkflowStartCall>;
+  /**
+   * The workflow's arguments. Defaults to the stored input. `context` is the
+   * context the run starts as, to pass to the workflow for its steps.
+   */
+  readonly args?: (call: WorkflowStartCall, context: RequestContext) => readonly unknown[];
+}
+/**
+ * The `start` callback for `schedules.tick` and `admission.tick` of
+ * `better-supabase/blocks/workflows`: looks the workflow up by the name the
+ * schedule or request stored and starts it with `startFor`, keyed by the tick's
+ * idempotency key. A schedule runs as its `runAs` publisher.
+ */
+declare function workflowStarter(workflows: Readonly<Record<string, WorkflowFn<never[]>>>, options?: WorkflowStarterOptions): WorkflowStarter;
+/**
+ * Hook metadata that `authorizeHook` checks: the actor and tenant of `context`,
+ * and the permission a tenant member needs to resume it instead.
+ */
+declare function hookMetadata(context: RequestContext, permission?: string): Record<string, string>;
+/** `authorizeHook` refused the caller. */
+declare class HookForbiddenError extends Error {
+  readonly status = 403;
+  constructor(message: string);
+}
+interface AuthorizeHookOptions {
+  /**
+   * Whether the caller holds `permission` in `tenant`, for hooks created with
+   * `hookMetadata(context, permission)`, such as an approval any admin of the
+   * tenant may give.
+   */
+  readonly can?: (tenant: string, permission: string) => boolean | Promise<boolean>;
+}
+/**
+ * The hook for `token` when the caller in `context` may resume it: the actor in
+ * its `hookMetadata`, or a member of its tenant whom `can` grants its
+ * permission. Throws `HookForbiddenError` otherwise, so a leaked token alone
+ * never resumes a run.
+ */
+declare function authorizeHook(token: string, context: RequestContext, options?: AuthorizeHookOptions): Promise<Hook>;
+interface StartOnEventOptions<TArgs extends unknown[]> {
+  /** Type patterns such as `invoice.paid` or `organization.*`. */
+  readonly types: readonly string[];
+  /**
+   * The workflow's arguments for an event. Defaults to `[event.payload]`.
+   * `context` is the event's `workflowContext`, with its ticket.
+   */
+  readonly args?: (event: OutboxEvent, context: RequestContext) => TArgs;
+  /**
+   * The opaque ticket for an event's run, stored as `bs.ticket`; `undefined`
+   * for none.
+   */
+  readonly ticket?: (event: OutboxEvent) => string | undefined;
+  /**
+   * The publisher each run starts as. The event's actor is recorded as
+   * `bs.trigger` and grants nothing; `null` for an event starts nothing.
+   */
+  readonly runAs: WorkflowRunAsFor<OutboxEvent>;
+  readonly world?: World;
+}
+/**
+ * An outbox handler (`outbox.consume(name, handler)`) that starts `workflow`
+ * for each matching event, as its `runAs` publisher in the event's tenant,
+ * keyed by `event:{id}` so a redelivered batch starts nothing twice.
+ */
+declare function startOnEvent<TArgs extends unknown[]>(workflow: WorkflowFn<TArgs>, options: StartOnEventOptions<TArgs>): OutboxHandler;
+interface ProtectWebHandlerOptions {
+  /**
+   * Whether the request's caller holds `permission`: resolve the session
+   * (`server.context(request)`) and check it, e.g. with `member_can`. Return
+   * `undefined` when there is no session (401).
+   */
+  readonly can: (request: Request, permission: string) => boolean | undefined | Promise<boolean | undefined>;
+}
+/**
+ * Puts a route of the workflow web UI or a run's stream behind `permission`:
+ * answers 401 without a session and 403 without the permission, as
+ * `application/problem+json`.
+ */
+declare function protectWebHandler(handler: (request: Request) => Response | Promise<Response>, permission: string, options: ProtectWebHandlerOptions): (request: Request) => Promise<Response>;
+//#endregion
+export { workflowContext as _, StartOnEventOptions as a, WorkflowRunAs as c, authorizeHook as d, contextAttributes as f, startOnEvent as g, startFor as h, StartForOptions as i, WorkflowRunAsFor as l, protectWebHandler as m, HookForbiddenError as n, WorkflowContextOptions as o, hookMetadata as p, ProtectWebHandlerOptions as r, WorkflowFn as s, AuthorizeHookOptions as t, WorkflowStarterOptions as u, workflowStarter as v };

package/dist/workflow-sdk-CPGiFE1B.js

@@ -0,0 +1,242 @@
+import { n as PERMISSION_CAP_CLAIM } from "./delegation-DeAJehLk.js";
+import { n as withContext, t as unwrap } from "./envelope-BDShQQ7-.js";
+import { n as subjectAttribute, t as WORKFLOW_ATTRIBUTES } from "./attributes-BOFl922R.js";
+import { getHookByToken, getRun, start } from "workflow/api";
+import { getWorld } from "workflow/runtime";
+//#region src/workflow-sdk/workflow-sdk.ts
+/**
+* The actor, tenant and ticket of `context` as plain data, to pass into a
+* workflow as an argument; inside a step, `bs.forContext(context)` runs as that
+* user with RLS. A delegated token's `client_id`, `scope`,
+* `authorization_details` and `act` chain stay in `claims`, so the step is as
+* narrow as the token; other claims stay out of the run's serialized state.
+* Throws a `TypeError` for an invalid `act` chain or ticket.
+*/
+function workflowContext(context, options = {}) {
+	return unwrap(withContext(null, context, options)).context;
+}
+/** The `bs.tenant`, `bs.actor` and `bs.ticket` attributes for `context`. */
+function contextAttributes(context, options = {}) {
+	const recorded = workflowContext(context, options);
+	const ticket = recorded["ticket"];
+	return {
+		...recorded.tenant === void 0 ? {} : { [WORKFLOW_ATTRIBUTES.tenant]: recorded.tenant },
+		...recorded.actor?.kind === "user" ? { [WORKFLOW_ATTRIBUTES.actor]: recorded.actor.id } : {},
+		...typeof ticket === "string" ? { [WORKFLOW_ATTRIBUTES.ticket]: ticket } : {}
+	};
+}
+/** The run a start with idempotency `key` created, while it is in the World. */
+async function runForKey(key, world) {
+	const target = world ?? await getWorld();
+	if (target.analytics === void 0) return;
+	return (await target.analytics.runs.list({
+		attributes: { [WORKFLOW_ATTRIBUTES.key]: key },
+		pagination: { limit: 1 }
+	})).data[0]?.runId;
+}
+/**
+* `start(workflow, args)` for the caller in `context`: the run carries
+* `bs.tenant` and `bs.actor`, so `workflow_runs` lists it to the tenant and the
+* actor under RLS. With `idempotencyKey`, a run that already has the key is
+* returned instead of starting another (the key lookup needs a World with
+* `analytics`, as the Supabase World has).
+*/
+function startFor(context, workflow, args, options = {}) {
+	return startRun(context, workflow, args, options, {});
+}
+const RUN_AS_ATTRIBUTES = /* @__PURE__ */ new Set([WORKFLOW_ATTRIBUTES.principalKind, WORKFLOW_ATTRIBUTES.principal]);
+/**
+* `startFor` with `trusted` applied last: a `runAs` start sets the principal
+* and replaces `bs.actor` with the user who triggered it (`undefined` removes a
+* key).
+*/
+async function startRun(context, workflow, args, options, trusted) {
+	const key = options.idempotencyKey;
+	if (key !== void 0) {
+		const existing = await runForKey(key, options.world);
+		if (existing !== void 0) return getRun(existing);
+	}
+	const attributes = {};
+	for (const [name, value] of Object.entries(options.attributes ?? {})) if (!RUN_AS_ATTRIBUTES.has(name)) attributes[name] = value;
+	Object.assign(attributes, contextAttributes(context, options.ticket === void 0 ? {} : { ticket: options.ticket }), options.subject === void 0 ? {} : { [WORKFLOW_ATTRIBUTES.subject]: subjectAttribute(options.subject) }, key === void 0 ? {} : { [WORKFLOW_ATTRIBUTES.key]: key });
+	for (const [name, value] of Object.entries(trusted)) if (value === void 0) delete attributes[name];
+	else attributes[name] = value;
+	return start(workflow, args, {
+		attributes,
+		...options.world === void 0 ? {} : { world: options.world }
+	});
+}
+const PRINCIPAL_KINDS = [
+	"user",
+	"service_principal",
+	"system",
+	"external"
+];
+async function resolveRunAs(runAs, source) {
+	const resolved = typeof runAs === "function" ? await runAs(source) : runAs;
+	if (resolved === null || resolved === void 0) return;
+	if (typeof resolved.publisher !== "string" || resolved.publisher === "" || !Array.isArray(resolved.permissions) || !resolved.permissions.every((key) => typeof key === "string") || resolved.principalKind !== void 0 && !PRINCIPAL_KINDS.includes(resolved.principalKind)) throw new TypeError("better-supabase: runAs needs a publisher and a list of permission keys");
+	return resolved;
+}
+/**
+* The context and attributes of a start that runs as `runAs`; `trusted`
+* replaces the context's `bs.actor` with the trigger and records the
+* principal.
+*/
+function runAsStart(runAs, start) {
+	const tenant = runAs.tenant ?? start.tenant;
+	return {
+		context: workflowContext({
+			actor: {
+				id: runAs.publisher,
+				kind: "user"
+			},
+			...tenant === void 0 ? {} : { tenant },
+			claims: { [PERMISSION_CAP_CLAIM]: [...runAs.permissions] },
+			...start.ticket === void 0 ? {} : { ticket: start.ticket }
+		}),
+		attributes: {
+			[WORKFLOW_ATTRIBUTES.publisher]: runAs.publisher,
+			...start.trigger === void 0 ? {} : { [WORKFLOW_ATTRIBUTES.trigger]: start.trigger }
+		},
+		trusted: {
+			[WORKFLOW_ATTRIBUTES.actor]: start.trigger,
+			[WORKFLOW_ATTRIBUTES.principalKind]: runAs.principalKind ?? "user",
+			[WORKFLOW_ATTRIBUTES.principal]: runAs.publisher
+		}
+	};
+}
+function userContext(call) {
+	const actor = call.actor === void 0 ? void 0 : {
+		id: call.actor,
+		kind: "user"
+	};
+	return {
+		...actor === void 0 ? {} : { actor },
+		...call.tenant === void 0 ? {} : { tenant: call.tenant }
+	};
+}
+/**
+* The `start` callback for `schedules.tick` and `admission.tick` of
+* `better-supabase/blocks/workflows`: looks the workflow up by the name the
+* schedule or request stored and starts it with `startFor`, keyed by the tick's
+* idempotency key. A schedule runs as its `runAs` publisher.
+*/
+function workflowStarter(workflows, options = {}) {
+	return async (call) => {
+		const workflow = workflows[call.workflow];
+		if (workflow === void 0) throw new Error(`better-supabase: no workflow named "${call.workflow}" was passed to workflowStarter`);
+		const runAs = options.runAs === void 0 ? void 0 : await resolveRunAs(options.runAs, call);
+		if (runAs === void 0 && (call.source === "schedule" || options.runAs)) throw new Error(options.runAs === void 0 ? `better-supabase: the schedule for "${call.workflow}" needs a runAs publisher: pass workflowStarter(workflows, { runAs })` : `better-supabase: runAs refused the start of "${call.workflow}"`);
+		const started = runAs === void 0 ? {
+			context: userContext(call),
+			attributes: {},
+			trusted: {}
+		} : runAsStart(runAs, {
+			tenant: call.tenant,
+			trigger: call.actor
+		});
+		const input = Array.isArray(call.input) ? call.input : [call.input];
+		const args = options.args?.(call, started.context) ?? input;
+		return (await startRun(started.context, workflow, args, {
+			idempotencyKey: call.idempotencyKey,
+			attributes: started.attributes,
+			...call.subject === void 0 ? {} : { subject: call.subject },
+			...options.world === void 0 ? {} : { world: options.world }
+		}, started.trusted)).runId;
+	};
+}
+/**
+* Hook metadata that `authorizeHook` checks: the actor and tenant of `context`,
+* and the permission a tenant member needs to resume it instead.
+*/
+function hookMetadata(context, permission) {
+	return {
+		...contextAttributes(context),
+		...permission === void 0 ? {} : { "bs.permission": permission }
+	};
+}
+/** `authorizeHook` refused the caller. */
+var HookForbiddenError = class extends Error {
+	status = 403;
+	constructor(message) {
+		super(message);
+		this.name = "HookForbiddenError";
+	}
+};
+function stringField(value, key) {
+	if (typeof value !== "object" || value === null) return;
+	const field = { ...value }[key];
+	return typeof field === "string" ? field : void 0;
+}
+/**
+* The hook for `token` when the caller in `context` may resume it: the actor in
+* its `hookMetadata`, or a member of its tenant whom `can` grants its
+* permission. Throws `HookForbiddenError` otherwise, so a leaked token alone
+* never resumes a run.
+*/
+async function authorizeHook(token, context, options = {}) {
+	const hook = await getHookByToken(token);
+	const metadata = await hook.metadata;
+	const actor = context.actor?.kind === "user" ? context.actor.id : void 0;
+	const owner = stringField(metadata, WORKFLOW_ATTRIBUTES.actor);
+	if (actor !== void 0 && owner === actor) return hook;
+	const tenant = stringField(metadata, WORKFLOW_ATTRIBUTES.tenant);
+	const permission = stringField(metadata, "bs.permission");
+	if (actor !== void 0 && tenant !== void 0 && permission !== void 0 && options.can !== void 0 && await options.can(tenant, permission)) return hook;
+	throw new HookForbiddenError("better-supabase: the caller may not resume this workflow hook");
+}
+/** Whether `type` matches `pattern` (`invoice.paid`, `organization.*` or `*`). */
+function matches(pattern, type) {
+	if (pattern === "*" || pattern === type) return true;
+	return pattern.endsWith(".*") && type.startsWith(pattern.slice(0, -1));
+}
+/**
+* An outbox handler (`outbox.consume(name, handler)`) that starts `workflow`
+* for each matching event, as its `runAs` publisher in the event's tenant,
+* keyed by `event:{id}` so a redelivered batch starts nothing twice.
+*/
+function startOnEvent(workflow, options) {
+	return async (events) => {
+		for (const event of events) {
+			if (!options.types.some((pattern) => matches(pattern, event.type))) continue;
+			const runAs = await resolveRunAs(options.runAs, event);
+			if (runAs === void 0) continue;
+			const { context, attributes, trusted } = runAsStart(runAs, {
+				tenant: event.tenant ?? void 0,
+				trigger: event.actorId ?? void 0,
+				ticket: options.ticket?.(event)
+			});
+			await startRun(context, workflow, options.args?.(event, context) ?? [event.payload], {
+				idempotencyKey: `event:${event.id}`,
+				attributes,
+				...options.world === void 0 ? {} : { world: options.world }
+			}, trusted);
+		}
+	};
+}
+function problem(status) {
+	return Response.json({
+		type: "about:blank",
+		title: status === 401 ? "Unauthorized" : "Forbidden",
+		status
+	}, {
+		status,
+		headers: { "content-type": "application/problem+json" }
+	});
+}
+/**
+* Puts a route of the workflow web UI or a run's stream behind `permission`:
+* answers 401 without a session and 403 without the permission, as
+* `application/problem+json`.
+*/
+function protectWebHandler(handler, permission, options) {
+	return async (request) => {
+		const allowed = await options.can(request, permission);
+		if (allowed === void 0) return problem(401);
+		if (!allowed) return problem(403);
+		return handler(request);
+	};
+}
+//#endregion
+export { protectWebHandler as a, startOnEvent as c, hookMetadata as i, workflowContext as l, authorizeHook as n, runForKey as o, contextAttributes as r, startFor as s, HookForbiddenError as t, workflowStarter as u };