better-supabase 0.12.0 → 0.14.0

package/dist/signers-D6ecZl22.d.ts

@@ -0,0 +1,390 @@
+/// <reference lib="esnext.temporal" />
+import { T as ErrorMapper, f as Result, t as AsyncResult } from "./result-C6jDfedy.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { r as BlockTemporalOptions } from "./block-helpers-BaugZlJV.js";
+import { n as SqlClient } from "./executor-CsTaO3AT.js";
+import { t as BlockTransport } from "./block-transport-d53POsem.js";
+import { n as BlockHooks } from "./block-hooks-CmjPKqQ_.js";
+import { t as BlockProblemOptions } from "./problem-DpHB7tWl.js";
+//#region src/blocks/webhooks/incoming-types.d.ts
+/** How a delivery proves it came from the sender. */
+type IncomingVerify = "none" | "standard-webhooks" | "hmac-sha256" | "shared-secret";
+interface IncomingWebhooksOptions extends BlockProblemOptions, BlockTemporalOptions {
+  /**
+   * A service SQL connection (`postgres.admin`): `receive` looks endpoints up
+   * by token, counts the rate limit and stores deliveries with it.
+   */
+  readonly sql: SqlClient;
+  /**
+   * The caller's transport for `create`, `list`, `update` and the other
+   * management calls, so `webhooks.manage` is checked for them. Defaults to
+   * `sqlTransport(sql)`.
+   */
+  readonly transport?: BlockTransport;
+  readonly mappers?: readonly ErrorMapper[];
+  /** `withBlockHooks` hooks around the management methods. */
+  readonly hooks?: BlockHooks<IncomingWebhooks>;
+  /** Receives the errors `after` hooks throw. */
+  readonly logger?: Logger;
+  /** The schema of the `webhooks-in` module. Defaults to `better_supabase`. */
+  readonly schema?: string;
+  /**
+   * The webhook inbox source deliveries are stored under. Defaults to
+   * `webhook-in`.
+   */
+  readonly source?: string;
+  /**
+   * Deliveries per endpoint and period, counted with the `rate-limit` module's
+   * `hit_rate_limit`. Unset: no limit.
+   */
+  readonly rateLimit?: {
+    readonly max: number;
+    /** Seconds, or a Postgres interval such as `1 minute`. */
+    readonly period: number | string;
+  };
+  /** Request headers stored with each delivery. Defaults to none. */
+  readonly keepHeaders?: readonly string[];
+  /**
+   * Where verified deliveries go. Defaults to `inboxDestination(sql, { source
+   * })`, the webhook inbox; `jobsDestination(jobs, { queue })` sends them to a
+   * jobs queue. A destination can route on the endpoint's metadata.
+   */
+  readonly destination?: IncomingDestination;
+}
+/** A verified delivery, handed to the destination. */
+interface IncomingDelivery {
+  readonly endpoint: {
+    readonly id: string;
+    readonly tenant: string;
+    readonly metadata: Readonly<Record<string, unknown>>;
+  };
+  /** `options.source`. */
+  readonly source: string;
+  /**
+   * Unique per endpoint and delivery: the signed `webhook-id`, the HMAC, the
+   * `webhook-id` header or a random id. A repeated delivery repeats it.
+   */
+  readonly messageId: string;
+  /** The payload's `type` when it is a string. */
+  readonly type: string | null;
+  /** The parsed JSON body, or `{ body }` when it isn't JSON. */
+  readonly payload: unknown;
+  /** `options.keepHeaders` and the endpoint id header, lowercased. */
+  readonly headers: Readonly<Record<string, string>>;
+}
+interface IncomingDestinationResult {
+  readonly id: string | number;
+  /** True when the destination had the delivery already; `receive` answers 200. */
+  readonly duplicate: boolean;
+}
+/**
+ * Stores or forwards verified deliveries. It must detect a repeated
+ * `endpoint.id` and `messageId` and report it as a duplicate. Versioned:
+ * `apiVersion: 1`.
+ */
+interface IncomingDestination {
+  readonly apiVersion: 1;
+  readonly name: string;
+  deliver(delivery: IncomingDelivery): Promise<IncomingDestinationResult>;
+}
+interface CreateIncomingWebhookInput {
+  readonly tenant: string;
+  readonly name: string;
+  /** Defaults to `none`: the token in the URL is the only credential. */
+  readonly verify?: IncomingVerify;
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  /**
+   * The header that carries the HMAC for `hmac-sha256`. Defaults to
+   * `x-signature`.
+   */
+  readonly signatureHeader?: string;
+  /** The record the endpoint belongs to, a type from `options.subjects`. */
+  readonly subject?: {
+    readonly type: string;
+    readonly id: string;
+  };
+}
+/** An endpoint as members see it: everything but the token and secret. */
+interface IncomingWebhook {
+  readonly id: string;
+  readonly tenant: string;
+  readonly name: string;
+  readonly verify: IncomingVerify;
+  readonly signatureHeader: string | null;
+  readonly enabled: boolean;
+  readonly maxBodyBytes: number;
+  readonly receiveCount: number;
+  readonly lastReceivedAt: string | null;
+  readonly lastStatus: number | null;
+  readonly metadata: Readonly<Record<string, unknown>>;
+  readonly subject: {
+    readonly type: string;
+    readonly id: string;
+  } | null;
+  readonly createdBy: string | null;
+  readonly createdAt: string;
+}
+/** A new endpoint: its token (for the URL) and secret are shown once. */
+interface CreatedIncomingWebhook {
+  readonly id: string;
+  readonly tenant: string;
+  readonly name: string;
+  readonly verify: IncomingVerify;
+  readonly token: string;
+  readonly secret: string | null;
+  readonly signatureHeader: string | null;
+  readonly subject: {
+    readonly type: string;
+    readonly id: string;
+  } | null;
+}
+interface UpdateIncomingWebhookInput {
+  readonly name?: string;
+  readonly metadata?: Readonly<Record<string, unknown>>;
+  readonly verify?: IncomingVerify;
+  readonly signatureHeader?: string;
+}
+interface UpdatedIncomingWebhook {
+  readonly id: string;
+  readonly tenant: string;
+  readonly name: string;
+  readonly verify: IncomingVerify;
+  readonly secret: string | null;
+  readonly signatureHeader: string | null;
+  readonly metadata: Readonly<Record<string, unknown>>;
+}
+interface RotatedIncomingSecret {
+  readonly secret: string;
+  readonly previousSecretExpiresAt: Temporal.Instant | null;
+}
+interface IncomingWebhooks {
+  /**
+   * The route for `/hooks/<token>`: finds the endpoint, checks the body size,
+   * the rate limit and the signature, stores the delivery in the webhook inbox
+   * with the endpoint's tenant and answers 202 (200 for a repeated delivery). A
+   * delivery repeats when its signed `webhook-id` does (`standard-webhooks`),
+   * when its body does (`hmac-sha256`, whose signature covers only the body),
+   * or when its `webhook-id` header does (`none`). Needs a service connection.
+   */
+  receive(request: Request, token: string): Promise<Response>;
+  /** Creates an endpoint for a tenant; the caller needs `webhooks.manage`. */
+  create(input: CreateIncomingWebhookInput): AsyncResult<CreatedIncomingWebhook>;
+  /** A new token, and with `rotateSecret` a new secret. */
+  rotate(id: string, options?: {
+    readonly rotateSecret?: boolean;
+  }): AsyncResult<{
+    readonly token: string;
+    readonly secret: string | null;
+  }>;
+  rotateSecret(id: string, options?: {
+    readonly grace?: Temporal.Duration | string;
+  }): AsyncResult<RotatedIncomingSecret>;
+  update(id: string, input: UpdateIncomingWebhookInput): AsyncResult<UpdatedIncomingWebhook>;
+  setEnabled(id: string, enabled: boolean): AsyncResult<boolean>;
+  remove(id: string): AsyncResult<boolean>;
+  /**
+   * A tenant's endpoints, or one subject's, as the caller sees them (the read
+   * policy hides endpoints whose subject they can't read).
+   */
+  list(tenant: string, subject?: {
+    readonly type: string;
+    readonly id?: string;
+  }): AsyncResult<readonly IncomingWebhook[]>;
+}
+//#endregion
+//#region src/blocks/webhooks/url-policy.d.ts
+/**
+ * Decides whether a webhook may be sent to `url`. Throwing means the check
+ * itself failed (a DNS lookup error): deliveries retry it, and `safeFetch`
+ * throws `UrlCheckError`.
+ */
+type AllowUrl = (url: URL) => boolean | Promise<boolean>;
+/** The addresses a host name resolves to. */
+type ResolveHost = (hostname: string) => Promise<readonly string[]>;
+interface PublicUrlOptions {
+  /**
+   * Resolves host names so each address can be checked. Defaults to `node:dns`
+   * where the runtime has it (Node, Bun, Deno); pass one on other runtimes, or
+   * `false` to check only the URL.
+   */
+  readonly resolve?: ResolveHost | false;
+  /** Allow `http:` URLs, e.g. for local development. */
+  readonly allowHttp?: boolean;
+  /** Host names that skip every check, e.g. an internal receiver you trust. */
+  readonly allowHosts?: readonly string[];
+}
+/**
+ * Whether an IP address is reachable on the public internet: not loopback,
+ * private, link-local (cloud metadata), carrier-grade NAT, multicast or
+ * reserved. Returns `false` for anything that isn't an IP address.
+ */
+declare function isPublicAddress(address: string): boolean;
+/**
+ * The default `allowUrl`: HTTPS only, no credentials in the URL, no local host
+ * names, and every address the host resolves to must be public. The delivery
+ * transport calls it again for each redirect.
+ *
+ * DNS can change between this check and the connection. Route webhooks through
+ * an egress proxy when that matters.
+ */
+declare function publicUrl(options?: PublicUrlOptions): AllowUrl;
+//#endregion
+//#region src/blocks/webhooks/http.d.ts
+interface WebhookRequest {
+  readonly url: string;
+  readonly headers: Readonly<Record<string, string>>;
+  readonly body: string;
+  readonly signal?: AbortSignal;
+}
+interface WebhookResponse {
+  readonly status: number;
+  readonly body: string;
+  /** Seconds from the `Retry-After` header, when the receiver sent one. */
+  readonly retryAfter?: number;
+}
+/**
+ * Sends one signed webhook request. Throw `WebhookPolicyError` when the request
+ * must never be retried (a blocked URL); any other error retries.
+ */
+interface WebhookTransport {
+  readonly apiVersion: 1;
+  readonly name: string;
+  send(request: WebhookRequest): Promise<WebhookResponse>;
+}
+/** A delivery that must not be retried, e.g. a URL `allowUrl` rejected. */
+declare class WebhookPolicyError extends Error {
+  override readonly name = "WebhookPolicyError";
+}
+interface FetchTransportOptions {
+  readonly fetch?: typeof fetch;
+  /** Checked before the first request and before each redirect. */
+  readonly allowUrl?: AllowUrl;
+  /**
+   * Defaults to 0: a redirect fails the delivery without a retry. Each hop you
+   * allow is checked with `allowUrl` first.
+   */
+  readonly maxRedirects?: number;
+  /** Per request. Defaults to 10 seconds. */
+  readonly timeoutMs?: number;
+  /** The response body bytes kept; the rest is not read. Defaults to 64 KiB. */
+  readonly maxResponseBytes?: number;
+}
+/** Sends webhooks with `fetch`, following redirects only to allowed URLs. */
+declare function fetchTransport(options?: FetchTransportOptions): WebhookTransport;
+//#endregion
+//#region src/blocks/webhooks/secrets.d.ts
+interface RotateSecretOptions {
+  /** How long older secrets keep signing, e.g. `'24 hours'` (the default). */
+  readonly overlap?: string;
+  /** Use this secret instead of a generated one, e.g. when migrating. */
+  readonly secret?: string;
+}
+/**
+ * Where endpoint signing secrets live. `sqlSecretStore` (Vault or a column, set
+ * in `blocks.webhooks-out.options.secretStorage`) is the default; implement it
+ * for a KMS or a secrets manager.
+ */
+interface WebhookSecretStore {
+  readonly apiVersion: 1;
+  /** The live secrets of an endpoint, newest first. */
+  secrets(endpointId: string): Promise<readonly string[]>;
+  /** Creates a new secret and returns it once. */
+  rotate?(endpointId: string, options?: RotateSecretOptions): Promise<string>;
+}
+/** The module's `webhook_secrets` and `rotate_webhook_secret` functions. */
+declare function sqlSecretStore(transport: BlockTransport, options?: {
+  readonly schema?: string;
+}): WebhookSecretStore;
+//#endregion
+//#region src/blocks/webhooks/signers.d.ts
+interface WebhookSignInput {
+  /** The delivery id, the same on every retry so receivers can deduplicate. */
+  readonly id: string;
+  readonly body: string;
+  readonly timestamp: Temporal.Instant;
+  /** The endpoint's live secrets, newest first. Sign with each while rotating. */
+  readonly secrets: readonly string[];
+}
+/**
+ * Adds the signature headers to an outgoing webhook. `standardWebhooks()` is
+ * the default; `hmacSigner()` covers custom header and payload formats.
+ */
+interface WebhookSigner {
+  readonly apiVersion: 1;
+  readonly name: string;
+  sign(input: WebhookSignInput): Readonly<Record<string, string>> | Promise<Readonly<Record<string, string>>>;
+}
+interface StandardWebhooksOptions {
+  /** Header names, for receivers that expect a prefix such as `svix-`. */
+  readonly headers?: {
+    readonly id?: string;
+    readonly timestamp?: string;
+    readonly signature?: string;
+  };
+}
+/**
+ * Signs with the [Standard Webhooks](https://www.standardwebhooks.com/) scheme:
+ * `webhook-id`, `webhook-timestamp` and one `v1,` signature per secret in
+ * `webhook-signature`. `verifyWebhook` checks it.
+ */
+declare function standardWebhooks(options?: StandardWebhooksOptions): WebhookSigner;
+/**
+ * Signs raw bytes with an Ed25519 key, such as
+ * `createSigningKeys(options).signer(owner)` from
+ * `better-supabase/blocks/signing-keys`.
+ */
+interface RawSigner {
+  sign(data: Uint8Array): PromiseLike<Result<{
+    readonly alg: string;
+    readonly signature: Uint8Array;
+  }>>;
+}
+interface AsymmetricWebhooksOptions extends StandardWebhooksOptions {
+  readonly signer: RawSigner;
+  /**
+   * Also sends a `v1,` HMAC signature per endpoint secret, for receivers that
+   * move from secrets to the public key. Default: false.
+   */
+  readonly hmac?: boolean;
+}
+/**
+ * Signs with the Standard Webhooks asymmetric scheme: one `v1a,` Ed25519
+ * signature over `id.timestamp.body` in `webhook-signature`. Receivers verify
+ * it with the `whpk_` key `webhookPublicKey` returns, through `verifyWebhook`.
+ * Endpoints opt in with `signing = 'v1a'`.
+ */
+declare function standardWebhooksAsymmetric(options: AsymmetricWebhooksOptions): WebhookSigner;
+/** The `whpk_` public key of an Ed25519 JWK, for receivers of `v1a` signatures. */
+declare function webhookPublicKey(jwk: {
+  readonly kty: string;
+  readonly crv?: string;
+  readonly x?: string;
+}): string;
+interface HmacSignerOptions {
+  readonly name?: string;
+  /** E.g. `x-acme-signature`. */
+  readonly signatureHeader: string;
+  /** Sends the epoch-seconds timestamp in this header. */
+  readonly timestampHeader?: string;
+  /** Sends the delivery id in this header. */
+  readonly idHeader?: string;
+  /** The signed text. Defaults to `${timestamp}.${body}`. */
+  readonly content?: (input: {
+    readonly id: string;
+    readonly timestamp: string;
+    readonly body: string;
+  }) => string;
+  /** Defaults to `hex`. */
+  readonly encoding?: "hex" | "base64";
+  /** Written before each signature. Defaults to `v1=`. */
+  readonly prefix?: string;
+  /** Joins the signatures of several secrets. Defaults to `,`. */
+  readonly separator?: string;
+}
+/**
+ * HMAC-SHA256 with the secret's UTF-8 bytes as the key, for receivers that
+ * verify an existing format, e.g. `v1=<hex>` over `timestamp.body`.
+ */
+declare function hmacSigner(options: HmacSignerOptions): WebhookSigner;
+//#endregion
+export { IncomingVerify as A, isPublicAddress as C, IncomingDelivery as D, CreatedIncomingWebhook as E, UpdateIncomingWebhookInput as F, UpdatedIncomingWebhook as I, IncomingWebhooks as M, IncomingWebhooksOptions as N, IncomingDestination as O, RotatedIncomingSecret as P, ResolveHost as S, CreateIncomingWebhookInput as T, WebhookResponse as _, WebhookSignInput as a, AllowUrl as b, standardWebhooks as c, RotateSecretOptions as d, WebhookSecretStore as f, WebhookRequest as g, WebhookPolicyError as h, StandardWebhooksOptions as i, IncomingWebhook as j, IncomingDestinationResult as k, standardWebhooksAsymmetric as l, FetchTransportOptions as m, HmacSignerOptions as n, WebhookSigner as o, sqlSecretStore as p, RawSigner as r, hmacSigner as s, AsymmetricWebhooksOptions as t, webhookPublicKey as u, WebhookTransport as v, publicUrl as w, PublicUrlOptions as x, fetchTransport as y };

package/dist/signing-keys-B3RHGMMu.d.ts

@@ -0,0 +1,119 @@
+/// <reference lib="esnext.temporal" />
+import { t as AsyncResult } from "./result-C6jDfedy.js";
+import { n as Logger } from "./logger-DWVYUmwi.js";
+import { n as BlockOptions } from "./block-helpers-BaugZlJV.js";
+import { n as BlockHooks } from "./block-hooks-CmjPKqQ_.js";
+import { i as JwsAlgorithm, n as Jwks, o as SigningAlgorithm, t as Jwk } from "./jws-D0toeQlA.js";
+//#region src/blocks/signing-keys/signing-keys.d.ts
+interface SigningKeysOptions extends BlockOptions {
+  /**
+   * The JWS `alg` an Ed25519 key signs with: `EdDSA` (RFC 8037), which most
+   * verifiers read, or the fully specified `Ed25519` (RFC 9864). Default:
+   * `EdDSA`.
+   */
+  readonly ed25519Alg?: "EdDSA" | "Ed25519";
+  /** How long a signer keeps the imported private key, in seconds. Default: 300. */
+  readonly cacheSeconds?: number;
+  /** `withBlockHooks` hooks around the client's methods. */
+  readonly hooks?: NoInfer<BlockHooks<SigningKeys>>;
+  /** Receives the errors `after` hooks throw. Default: `console`. */
+  readonly logger?: Logger;
+}
+/** Who a key belongs to: an organization, an app, a stream. */
+interface SigningKeyOwner {
+  /** Lowercase letters, digits, `-` and `_`, such as `organization`. */
+  readonly type: string;
+  readonly id: string;
+}
+/**
+ * The owner of the platform's own keys, for a single authorization server that
+ * signs for every tenant. A key per tenant uses `{ type, id }` of the tenant
+ * instead, such as `{ type: "environment", id: environment.id }`.
+ */
+declare const PLATFORM_OWNER: SigningKeyOwner;
+/**
+ * The `typ` header for a token kind of your own: `jwtType("invite")` is
+ * `vnd.invite+jwt`. Sign with `{ typ }` and verify with `verifyCompact(..., {
+ * typ })` so a token of one kind can't be replayed as another (RFC 8725 section
+ * 3.11). Throws a `TypeError` for a name outside lower-case letters, digits and
+ * `-`.
+ */
+declare function jwtType(name: string): string;
+/** What `create` and `rotate` return. The private key never leaves Vault again. */
+interface CreatedSigningKey {
+  readonly kid: string;
+  readonly alg: SigningAlgorithm;
+  readonly publicKey: Jwk;
+  /**
+   * The kid the new key replaced, which stays in the JWKS until its tokens
+   * expire.
+   */
+  readonly retired: string | null;
+}
+/** What `sign` returns. */
+interface Signature {
+  readonly kid: string;
+  readonly alg: JwsAlgorithm;
+  readonly signature: Uint8Array;
+}
+/** Signs with an owner's active key. */
+interface Signer {
+  readonly owner: SigningKeyOwner;
+  /** The raw signature of `data` with the active key. */
+  sign(data: Uint8Array): AsyncResult<Signature>;
+  /**
+   * A compact JWS over `claims`, with `alg`, `kid` and `typ: "JWT"` in the
+   * header unless `header` sets them. A custom `typ` has to be `JWT` or end in
+   * `+jwt` (see `jwtType`); anything else fails with `SIGNING_TYP_INVALID`. A
+   * numeric `exp` keeps the key in the JWKS until then
+   * (`note_signing_key_exp`), so a rotation can't strand the token.
+   */
+  signJwt(claims: Readonly<Record<string, unknown>>, header?: Readonly<Record<string, unknown>>): AsyncResult<string>;
+}
+interface JwksOptions {
+  /**
+   * How long a retired key stays published past its last `exp`. Default:
+   * `blocks.signing-keys.options.jwksGrace`.
+   */
+  readonly grace?: Temporal.Duration;
+}
+interface JwksResponseOptions extends JwksOptions {
+  /** The `Cache-Control` max-age, in seconds. Default: 300. */
+  readonly maxAge?: number;
+}
+interface SignerOptions {
+  /**
+   * Creates a key of this type when the owner has none, instead of failing with
+   * `SIGNING_KEY_MISSING`.
+   */
+  readonly create?: SigningAlgorithm;
+}
+interface SigningKeys {
+  /**
+   * Generates a key for the owner and makes it active; the previous key is
+   * retired.
+   */
+  create(owner: SigningKeyOwner, alg?: SigningAlgorithm): AsyncResult<CreatedSigningKey>;
+  /** `create` with the active key's type, or `alg` when given. */
+  rotate(owner: SigningKeyOwner, alg?: SigningAlgorithm): AsyncResult<CreatedSigningKey>;
+  /** Retires a key without a replacement. `false` when it was not active. */
+  retire(kid: string): AsyncResult<boolean>;
+  /** Keeps a key published until at least `exp`. `false` for an unknown kid. */
+  noteExp(kid: string, exp: Temporal.Instant): AsyncResult<boolean>;
+  /** The owner's public keys still in use, as a JWK Set. */
+  jwks(owner: SigningKeyOwner, options?: JwksOptions): AsyncResult<Jwks>;
+  /** `jwks` as an `application/jwk-set+json` response with `Cache-Control`. */
+  jwksResponse(owner: SigningKeyOwner, options?: JwksResponseOptions): Promise<Response>;
+  /** Deletes every key of the owner. */
+  remove(owner: SigningKeyOwner): AsyncResult<number>;
+  /** Deletes retired keys no token can still need. */
+  purge(options?: JwksOptions): AsyncResult<number>;
+  signer(owner: SigningKeyOwner, options?: SignerOptions): Signer;
+}
+/**
+ * The `signing-keys` SQL module as typed calls: keys are generated and used
+ * with WebCrypto here, kept in Supabase Vault there. Service role only.
+ */
+declare function createSigningKeys(options: SigningKeysOptions): SigningKeys;
+//#endregion
+export { Signature as a, SigningKeyOwner as c, createSigningKeys as d, jwtType as f, PLATFORM_OWNER as i, SigningKeys as l, JwksOptions as n, Signer as o, JwksResponseOptions as r, SignerOptions as s, CreatedSigningKey as t, SigningKeysOptions as u };

package/dist/signing-keys-fWapUzi0.js

@@ -0,0 +1,164 @@
+import { n as dbError } from "./errors-03ysrOt4.js";
+import { t as temporal } from "./temporal-required-B8qQHYbI.js";
+import { t as AsyncResult } from "./result-B3m7xtRY.js";
+import { n as isRecord } from "./guards-6F2bCtQR.js";
+import { D as recordOf, I as textOf, d as enumOrThrow, j as run, n as applyTemporal, o as blockCall } from "./block-helpers-CiKtrb6g.js";
+import { r as withBlockHooks } from "./block-hooks-BymdcD0V.js";
+import { a as jwksOf, n as generateSigningKey, o as signBytes, r as importSigningKey, s as signCompact } from "./jws-DOgHJKHb.js";
+//#region src/blocks/signing-keys/signing-keys.ts
+const ALGORITHMS = ["Ed25519", "ES256"];
+/**
+* The owner of the platform's own keys, for a single authorization server that
+* signs for every tenant. A key per tenant uses `{ type, id }` of the tenant
+* instead, such as `{ type: "environment", id: environment.id }`.
+*/
+const PLATFORM_OWNER = {
+	type: "platform",
+	id: "default"
+};
+const TYPE_NAME = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const JWT_TYPE = /^(?:JWT|[a-z0-9][a-z0-9.-]{0,126}\+jwt)$/i;
+/**
+* The `typ` header for a token kind of your own: `jwtType("invite")` is
+* `vnd.invite+jwt`. Sign with `{ typ }` and verify with `verifyCompact(..., {
+* typ })` so a token of one kind can't be replayed as another (RFC 8725 section
+* 3.11). Throws a `TypeError` for a name outside lower-case letters, digits and
+* `-`.
+*/
+function jwtType(name) {
+	if (!TYPE_NAME.test(name)) throw new TypeError(`jwtType name must be lower-case letters, digits and "-", got ${JSON.stringify(name)}`);
+	return `vnd.${name}+jwt`;
+}
+const HOUR = 3600;
+const interval = (duration) => duration === void 0 ? null : `${String(duration.total({ unit: "seconds" }))} seconds`;
+const ownerArgs = (owner) => ({
+	owner_type: owner.type,
+	owner_id: owner.id
+});
+/**
+* The `signing-keys` SQL module as typed calls: keys are generated and used
+* with WebCrypto here, kept in Supabase Vault there. Service role only.
+*/
+function createSigningKeys(options) {
+	applyTemporal(options);
+	const call = blockCall(options.transport, options.schema, options.mappers);
+	const ed25519Alg = options.ed25519Alg ?? "EdDSA";
+	const cacheMs = (options.cacheSeconds ?? 300) * 1e3;
+	const keys = /* @__PURE__ */ new Map();
+	const noted = /* @__PURE__ */ new Map();
+	const jwsAlg = (alg) => alg === "Ed25519" ? ed25519Alg : "ES256";
+	const add = (owner, alg) => run(() => generateSigningKey(alg)).andThen((generated) => call("add_signing_key", {
+		...ownerArgs(owner),
+		kid: generated.kid,
+		alg,
+		public_jwk: generated.publicKey,
+		private_jwk: JSON.stringify(generated.privateKey)
+	}, (value) => {
+		const row = recordOf(value, "add_signing_key");
+		keys.delete(`${owner.type}:${owner.id}`);
+		return {
+			kid: generated.kid,
+			alg,
+			publicKey: generated.publicKey,
+			retired: typeof row["retired"] === "string" ? row["retired"] : null
+		};
+	}));
+	const stored = (owner) => call("signing_key", ownerArgs(owner), (value) => {
+		if (value === null || value === void 0) return null;
+		const row = recordOf(value, "signing_key");
+		return {
+			kid: textOf(row["kid"]),
+			alg: enumOrThrow(row["alg"], ALGORITHMS, "signing key alg"),
+			privateKey: textOf(row["privateKey"])
+		};
+	});
+	const active = (owner, create) => {
+		const cacheKey = `${owner.type}:${owner.id}`;
+		const cached = keys.get(cacheKey);
+		if (cached && Date.now() - cached.at < cacheMs) return AsyncResult.ok(cached);
+		return stored(owner).andThen((found) => {
+			if (found) return run(async () => {
+				const parsed = JSON.parse(found.privateKey);
+				if (!isRecord(parsed) || typeof parsed["kty"] !== "string") throw new TypeError("The stored signing key is not a JWK");
+				const key = await importSigningKey(parsed);
+				const entry = {
+					kid: found.kid,
+					alg: found.alg,
+					key,
+					at: Date.now()
+				};
+				keys.set(cacheKey, entry);
+				return entry;
+			});
+			if (create === void 0) return AsyncResult.err(dbError("not_found", `${cacheKey} has no signing key`, { hint: "SIGNING_KEY_MISSING" }));
+			return add(owner, create).andThen(() => active(owner, void 0));
+		});
+	};
+	const noteExp = (kid, exp) => call("note_signing_key_exp", {
+		kid,
+		exp: exp.toString()
+	}, (value) => value === true);
+	const client = {
+		create: (owner, alg = "Ed25519") => add(owner, alg),
+		rotate: (owner, alg) => alg === void 0 ? stored(owner).andThen((found) => add(owner, found?.alg ?? "Ed25519")) : add(owner, alg),
+		retire: (kid) => call("retire_signing_key", { kid }, (value) => {
+			for (const [owner, entry] of keys) if (entry.kid === kid) keys.delete(owner);
+			return value === true;
+		}),
+		noteExp,
+		jwks: (owner, jwksOptions = {}) => call("signing_jwks", {
+			...ownerArgs(owner),
+			grace: interval(jwksOptions.grace)
+		}, jwksOf),
+		jwksResponse: async (owner, responseOptions = {}) => {
+			const result = await client.jwks(owner, responseOptions);
+			if (!result.ok) return Response.json({
+				title: "The key set is unavailable",
+				status: 503
+			}, {
+				status: 503,
+				headers: { "content-type": "application/problem+json" }
+			});
+			return Response.json(result.data, { headers: {
+				"content-type": "application/jwk-set+json",
+				"cache-control": `public, max-age=${String(responseOptions.maxAge ?? 300)}`
+			} });
+		},
+		remove: (owner) => call("delete_signing_keys", ownerArgs(owner), (value) => {
+			keys.delete(`${owner.type}:${owner.id}`);
+			return Number(value);
+		}),
+		purge: (purgeOptions = {}) => call("purge_signing_keys", { grace: interval(purgeOptions.grace) }, Number),
+		signer: (owner, signerOptions = {}) => ({
+			owner,
+			sign: (data) => active(owner, signerOptions.create).andThen((key) => run(async () => ({
+				kid: key.kid,
+				alg: jwsAlg(key.alg),
+				signature: await signBytes(key.key, key.alg, data)
+			}))),
+			signJwt: (claims, header = {}) => {
+				const typ = header["typ"];
+				if (typ !== void 0 && (typeof typ !== "string" || !JWT_TYPE.test(typ))) return AsyncResult.err(dbError("invalid_input", "The typ header is not a JWT media type", { hint: "SIGNING_TYP_INVALID" }));
+				return active(owner, signerOptions.create).andThen((key) => {
+					const exp = claims["exp"];
+					const until = typeof exp === "number" && Number.isFinite(exp) ? Math.ceil(exp / HOUR) * HOUR : void 0;
+					return (until !== void 0 && until > (noted.get(key.kid) ?? 0) ? noteExp(key.kid, temporal().Instant.fromEpochMilliseconds(until * 1e3)).map((known) => {
+						noted.set(key.kid, until);
+						return known;
+					}) : AsyncResult.ok(true)).andThen(() => run(() => signCompact(key.key, key.alg, {
+						alg: jwsAlg(key.alg),
+						kid: key.kid,
+						typ: "JWT",
+						...header
+					}, claims)));
+				});
+			}
+		})
+	};
+	return withBlockHooks(client, options.hooks, {
+		block: "signing-keys",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+//#endregion
+export { createSigningKeys as n, jwtType as r, PLATFORM_OWNER as t };