better-supabase 0.13.0 → 0.14.0

package/dist/signatures-D8IoN3Rw.js

@@ -1,145 +0,0 @@
-import { n as dbError } from "./errors-D7u24ZJH.js";
-import { c as optionalTemporal, s as nowInstant } from "./temporal-DLZlWbOi.js";
-import { n as temporalMissing } from "./temporal-required-Dt4mcPsi.js";
-import { a as ok, r as err } from "./result-DIT_qp4G.js";
-import { i as toBase64, r as fromBase64 } from "./base64-B9Wlsdj7.js";
-import { r as timingSafeEqual, t as encoder } from "./hmac-B3CTTlfv.js";
-//#region src/core/signatures.ts
-/** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
-function secretBytes(secret) {
-	const raw = secret.replace(/^v1,/, "").replace(/^whsec_/, "");
-	try {
-		return fromBase64(raw);
-	} catch {
-		throw new TypeError("Webhook secret is not valid base64");
-	}
-}
-const keys = /* @__PURE__ */ new Map();
-function keyFor(secret) {
-	let key = keys.get(secret);
-	if (!key) {
-		key = crypto.subtle.importKey("raw", secretBytes(secret), {
-			name: "HMAC",
-			hash: "SHA-256"
-		}, false, ["sign", "verify"]);
-		if (keys.size < 16) {
-			keys.set(secret, key);
-			key.catch(() => keys.delete(secret));
-		}
-	}
-	return key;
-}
-/** The prefix of a Standard Webhooks Ed25519 public key (`v1a` signatures). */
-const PUBLIC_KEY_PREFIX = "whpk_";
-const publicKeys = /* @__PURE__ */ new Map();
-function publicKeyFor(key) {
-	let imported = publicKeys.get(key);
-	if (!imported) {
-		imported = crypto.subtle.importKey("raw", fromBase64(key.slice(5)), { name: "Ed25519" }, false, ["verify"]);
-		if (publicKeys.size < 16) {
-			publicKeys.set(key, imported);
-			imported.catch(() => publicKeys.delete(key));
-		}
-	}
-	return imported;
-}
-async function signature(secret, content) {
-	return toBase64(new Uint8Array(await crypto.subtle.sign("HMAC", await keyFor(secret), encoder.encode(content))));
-}
-function decodeSignature(value) {
-	try {
-		return fromBase64(value);
-	} catch {
-		return;
-	}
-}
-function header(headers, name) {
-	if (headers instanceof Headers) return headers.get(name);
-	return Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1] ?? null;
-}
-const unauthorized = (code, message) => dbError("unauthorized", message, { code });
-/**
-* The error for a webhook id `options.seen` already recorded, or for a `seen`
-* that throws; `undefined` for a first delivery or without `seen`.
-*/
-async function replayed(options, id, until) {
-	if (!options.seen || id === "") return;
-	try {
-		if (!await options.seen(id, until)) return;
-	} catch {
-		return dbError("unexpected", "Could not check the webhook id for a replay", { code: "WEBHOOK_DEDUPE_FAILED" });
-	}
-	return dbError("conflict", "Webhook was already received", { code: "WEBHOOK_REPLAYED" });
-}
-/** Headers for a signed Standard Webhooks request. */
-async function signWebhook(secret, message) {
-	const timestamp = String(Math.floor((message.timestamp ?? nowInstant()).epochMilliseconds / 1e3));
-	return {
-		"webhook-id": message.id,
-		"webhook-timestamp": timestamp,
-		"webhook-signature": `v1,${await signature(secret, `${message.id}.${timestamp}.${message.body}`)}`
-	};
-}
-/**
-* Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
-* `webhook-signature`, or the `svix-` names Svix-based senders use) and parses
-* the JSON body. Pass several secrets while rotating.
-*/
-async function verifyWebhook(input, secrets, options = {}) {
-	const headers = input.headers;
-	const prefix = header(headers, "webhook-id") === null ? "svix" : "webhook";
-	const id = header(headers, `${prefix}-id`);
-	const timestamp = header(headers, `${prefix}-timestamp`);
-	const signatures = header(headers, `${prefix}-signature`);
-	if (!id || !timestamp || !signatures) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing webhook signature headers"));
-	const seconds = Number(timestamp);
-	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
-	const namespace = optionalTemporal();
-	if (namespace === void 0) return err(temporalMissing());
-	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
-	const tolerance = options.tolerance ?? 300;
-	if (seconds < now - tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_OLD", "Webhook timestamp is too old"));
-	if (seconds > now + tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_NEW", "Webhook timestamp is in the future"));
-	const body = input instanceof Request ? await input.text() : input.body;
-	const content = encoder.encode(`${id}.${timestamp}.${body}`);
-	const entries = signatures.split(" ").map((entry) => entry.split(","));
-	const offered = (version) => entries.filter(([name, value]) => name === version && value).flatMap(([, value]) => decodeSignature(value) ?? []);
-	const symmetric = offered("v1");
-	const asymmetric = offered("v1a");
-	let valid = false;
-	let malformed = false;
-	for (const secret of typeof secrets === "string" ? [secrets] : secrets) {
-		const isPublic = secret.startsWith(PUBLIC_KEY_PREFIX);
-		let key;
-		try {
-			key = await (isPublic ? publicKeyFor(secret) : keyFor(secret));
-		} catch {
-			malformed = true;
-			continue;
-		}
-		for (const candidate of isPublic ? asymmetric : symmetric) if (await crypto.subtle.verify(isPublic ? "Ed25519" : "HMAC", key, candidate, content)) valid = true;
-	}
-	if (!valid && malformed) return err(dbError("unexpected", "Webhook secret is not whsec_ or whpk_ followed by base64", { code: "WEBHOOK_INVALID_SECRET" }));
-	if (!valid) return err(unauthorized("WEBHOOK_INVALID_SIGNATURE", "Invalid webhook signature"));
-	let payload;
-	try {
-		payload = JSON.parse(body);
-	} catch {
-		return err(dbError("invalid_request", "Webhook body is not JSON"));
-	}
-	const replay = await replayed(options, id, namespace.Instant.fromEpochMilliseconds((seconds + tolerance) * 1e3));
-	if (replay) return err(replay);
-	return ok({
-		id,
-		timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
-		payload,
-		body
-	});
-}
-/** Checks a shared-secret header (database webhooks), in constant time. */
-function verifySharedSecret(request, secret, headerName = "authorization") {
-	const token = (request.headers.get(headerName) ?? "").replace(/^Bearer\s+/i, "");
-	return timingSafeEqual(token, secret);
-}
-//#endregion
-export { unauthorized as a, signWebhook as i, header as n, verifySharedSecret as o, replayed as r, verifyWebhook as s, PUBLIC_KEY_PREFIX as t };

package/dist/signers-BuVQKDfK.d.ts

@@ -1,390 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { T as ErrorMapper, f as Result, t as AsyncResult } from "./result-mijqfoJN.js";
-import { n as Logger } from "./logger-DWVYUmwi.js";
-import { n as SqlClient } from "./executor-DXfgDsKd.js";
-import { t as BlockTransport } from "./block-transport-DBPhgF3W.js";
-import { r as BlockTemporalOptions } from "./block-helpers-DyA5BAW4.js";
-import { n as BlockHooks } from "./block-hooks-BadAniNI.js";
-import { t as BlockProblemOptions } from "./problem-D_DEBfMn.js";
-//#region src/blocks/webhooks/incoming-types.d.ts
-/** How a delivery proves it came from the sender. */
-type IncomingVerify = "none" | "standard-webhooks" | "hmac-sha256" | "shared-secret";
-interface IncomingWebhooksOptions extends BlockProblemOptions, BlockTemporalOptions {
-  /**
-   * A service SQL connection (`postgres.admin`): `receive` looks endpoints up
-   * by token, counts the rate limit and stores deliveries with it.
-   */
-  readonly sql: SqlClient;
-  /**
-   * The caller's transport for `create`, `list`, `update` and the other
-   * management calls, so `webhooks.manage` is checked for them. Defaults to
-   * `sqlTransport(sql)`.
-   */
-  readonly transport?: BlockTransport;
-  readonly mappers?: readonly ErrorMapper[];
-  /** `withBlockHooks` hooks around the management methods. */
-  readonly hooks?: BlockHooks<IncomingWebhooks>;
-  /** Receives the errors `after` hooks throw. */
-  readonly logger?: Logger;
-  /** The schema of the `webhooks-in` module. Defaults to `better_supabase`. */
-  readonly schema?: string;
-  /**
-   * The webhook inbox source deliveries are stored under. Defaults to
-   * `webhook-in`.
-   */
-  readonly source?: string;
-  /**
-   * Deliveries per endpoint and period, counted with the `rate-limit` module's
-   * `hit_rate_limit`. Unset: no limit.
-   */
-  readonly rateLimit?: {
-    readonly max: number;
-    /** Seconds, or a Postgres interval such as `1 minute`. */
-    readonly period: number | string;
-  };
-  /** Request headers stored with each delivery. Defaults to none. */
-  readonly keepHeaders?: readonly string[];
-  /**
-   * Where verified deliveries go. Defaults to `inboxDestination(sql, { source
-   * })`, the webhook inbox; `jobsDestination(jobs, { queue })` sends them to a
-   * jobs queue. A destination can route on the endpoint's metadata.
-   */
-  readonly destination?: IncomingDestination;
-}
-/** A verified delivery, handed to the destination. */
-interface IncomingDelivery {
-  readonly endpoint: {
-    readonly id: string;
-    readonly tenant: string;
-    readonly metadata: Readonly<Record<string, unknown>>;
-  };
-  /** `options.source`. */
-  readonly source: string;
-  /**
-   * Unique per endpoint and delivery: the signed `webhook-id`, the HMAC, the
-   * `webhook-id` header or a random id. A repeated delivery repeats it.
-   */
-  readonly messageId: string;
-  /** The payload's `type` when it is a string. */
-  readonly type: string | null;
-  /** The parsed JSON body, or `{ body }` when it isn't JSON. */
-  readonly payload: unknown;
-  /** `options.keepHeaders` and the endpoint id header, lowercased. */
-  readonly headers: Readonly<Record<string, string>>;
-}
-interface IncomingDestinationResult {
-  readonly id: string | number;
-  /** True when the destination had the delivery already; `receive` answers 200. */
-  readonly duplicate: boolean;
-}
-/**
- * Stores or forwards verified deliveries. It must detect a repeated
- * `endpoint.id` and `messageId` and report it as a duplicate. Versioned:
- * `apiVersion: 1`.
- */
-interface IncomingDestination {
-  readonly apiVersion: 1;
-  readonly name: string;
-  deliver(delivery: IncomingDelivery): Promise<IncomingDestinationResult>;
-}
-interface CreateIncomingWebhookInput {
-  readonly tenant: string;
-  readonly name: string;
-  /** Defaults to `none`: the token in the URL is the only credential. */
-  readonly verify?: IncomingVerify;
-  readonly metadata?: Readonly<Record<string, unknown>>;
-  /**
-   * The header that carries the HMAC for `hmac-sha256`. Defaults to
-   * `x-signature`.
-   */
-  readonly signatureHeader?: string;
-  /** The record the endpoint belongs to, a type from `options.subjects`. */
-  readonly subject?: {
-    readonly type: string;
-    readonly id: string;
-  };
-}
-/** An endpoint as members see it: everything but the token and secret. */
-interface IncomingWebhook {
-  readonly id: string;
-  readonly tenant: string;
-  readonly name: string;
-  readonly verify: IncomingVerify;
-  readonly signatureHeader: string | null;
-  readonly enabled: boolean;
-  readonly maxBodyBytes: number;
-  readonly receiveCount: number;
-  readonly lastReceivedAt: string | null;
-  readonly lastStatus: number | null;
-  readonly metadata: Readonly<Record<string, unknown>>;
-  readonly subject: {
-    readonly type: string;
-    readonly id: string;
-  } | null;
-  readonly createdBy: string | null;
-  readonly createdAt: string;
-}
-/** A new endpoint: its token (for the URL) and secret are shown once. */
-interface CreatedIncomingWebhook {
-  readonly id: string;
-  readonly tenant: string;
-  readonly name: string;
-  readonly verify: IncomingVerify;
-  readonly token: string;
-  readonly secret: string | null;
-  readonly signatureHeader: string | null;
-  readonly subject: {
-    readonly type: string;
-    readonly id: string;
-  } | null;
-}
-interface UpdateIncomingWebhookInput {
-  readonly name?: string;
-  readonly metadata?: Readonly<Record<string, unknown>>;
-  readonly verify?: IncomingVerify;
-  readonly signatureHeader?: string;
-}
-interface UpdatedIncomingWebhook {
-  readonly id: string;
-  readonly tenant: string;
-  readonly name: string;
-  readonly verify: IncomingVerify;
-  readonly secret: string | null;
-  readonly signatureHeader: string | null;
-  readonly metadata: Readonly<Record<string, unknown>>;
-}
-interface RotatedIncomingSecret {
-  readonly secret: string;
-  readonly previousSecretExpiresAt: Temporal.Instant | null;
-}
-interface IncomingWebhooks {
-  /**
-   * The route for `/hooks/<token>`: finds the endpoint, checks the body size,
-   * the rate limit and the signature, stores the delivery in the webhook inbox
-   * with the endpoint's tenant and answers 202 (200 for a repeated delivery). A
-   * delivery repeats when its signed `webhook-id` does (`standard-webhooks`),
-   * when its body does (`hmac-sha256`, whose signature covers only the body),
-   * or when its `webhook-id` header does (`none`). Needs a service connection.
-   */
-  receive(request: Request, token: string): Promise<Response>;
-  /** Creates an endpoint for a tenant; the caller needs `webhooks.manage`. */
-  create(input: CreateIncomingWebhookInput): AsyncResult<CreatedIncomingWebhook>;
-  /** A new token, and with `rotateSecret` a new secret. */
-  rotate(id: string, options?: {
-    readonly rotateSecret?: boolean;
-  }): AsyncResult<{
-    readonly token: string;
-    readonly secret: string | null;
-  }>;
-  rotateSecret(id: string, options?: {
-    readonly grace?: Temporal.Duration | string;
-  }): AsyncResult<RotatedIncomingSecret>;
-  update(id: string, input: UpdateIncomingWebhookInput): AsyncResult<UpdatedIncomingWebhook>;
-  setEnabled(id: string, enabled: boolean): AsyncResult<boolean>;
-  remove(id: string): AsyncResult<boolean>;
-  /**
-   * A tenant's endpoints, or one subject's, as the caller sees them (the read
-   * policy hides endpoints whose subject they can't read).
-   */
-  list(tenant: string, subject?: {
-    readonly type: string;
-    readonly id?: string;
-  }): AsyncResult<readonly IncomingWebhook[]>;
-}
-//#endregion
-//#region src/blocks/webhooks/url-policy.d.ts
-/**
- * Decides whether a webhook may be sent to `url`. Throwing means the check
- * itself failed (a DNS lookup error): deliveries retry it, and `safeFetch`
- * throws `UrlCheckError`.
- */
-type AllowUrl = (url: URL) => boolean | Promise<boolean>;
-/** The addresses a host name resolves to. */
-type ResolveHost = (hostname: string) => Promise<readonly string[]>;
-interface PublicUrlOptions {
-  /**
-   * Resolves host names so each address can be checked. Defaults to `node:dns`
-   * where the runtime has it (Node, Bun, Deno); pass one on other runtimes, or
-   * `false` to check only the URL.
-   */
-  readonly resolve?: ResolveHost | false;
-  /** Allow `http:` URLs, e.g. for local development. */
-  readonly allowHttp?: boolean;
-  /** Host names that skip every check, e.g. an internal receiver you trust. */
-  readonly allowHosts?: readonly string[];
-}
-/**
- * Whether an IP address is reachable on the public internet: not loopback,
- * private, link-local (cloud metadata), carrier-grade NAT, multicast or
- * reserved. Returns `false` for anything that isn't an IP address.
- */
-declare function isPublicAddress(address: string): boolean;
-/**
- * The default `allowUrl`: HTTPS only, no credentials in the URL, no local host
- * names, and every address the host resolves to must be public. The delivery
- * transport calls it again for each redirect.
- *
- * DNS can change between this check and the connection. Route webhooks through
- * an egress proxy when that matters.
- */
-declare function publicUrl(options?: PublicUrlOptions): AllowUrl;
-//#endregion
-//#region src/blocks/webhooks/http.d.ts
-interface WebhookRequest {
-  readonly url: string;
-  readonly headers: Readonly<Record<string, string>>;
-  readonly body: string;
-  readonly signal?: AbortSignal;
-}
-interface WebhookResponse {
-  readonly status: number;
-  readonly body: string;
-  /** Seconds from the `Retry-After` header, when the receiver sent one. */
-  readonly retryAfter?: number;
-}
-/**
- * Sends one signed webhook request. Throw `WebhookPolicyError` when the request
- * must never be retried (a blocked URL); any other error retries.
- */
-interface WebhookTransport {
-  readonly apiVersion: 1;
-  readonly name: string;
-  send(request: WebhookRequest): Promise<WebhookResponse>;
-}
-/** A delivery that must not be retried, e.g. a URL `allowUrl` rejected. */
-declare class WebhookPolicyError extends Error {
-  override readonly name = "WebhookPolicyError";
-}
-interface FetchTransportOptions {
-  readonly fetch?: typeof fetch;
-  /** Checked before the first request and before each redirect. */
-  readonly allowUrl?: AllowUrl;
-  /**
-   * Defaults to 0: a redirect fails the delivery without a retry. Each hop you
-   * allow is checked with `allowUrl` first.
-   */
-  readonly maxRedirects?: number;
-  /** Per request. Defaults to 10 seconds. */
-  readonly timeoutMs?: number;
-  /** The response body bytes kept; the rest is not read. Defaults to 64 KiB. */
-  readonly maxResponseBytes?: number;
-}
-/** Sends webhooks with `fetch`, following redirects only to allowed URLs. */
-declare function fetchTransport(options?: FetchTransportOptions): WebhookTransport;
-//#endregion
-//#region src/blocks/webhooks/secrets.d.ts
-interface RotateSecretOptions {
-  /** How long older secrets keep signing, e.g. `'24 hours'` (the default). */
-  readonly overlap?: string;
-  /** Use this secret instead of a generated one, e.g. when migrating. */
-  readonly secret?: string;
-}
-/**
- * Where endpoint signing secrets live. `sqlSecretStore` (Vault or a column, set
- * in `blocks.webhooks-out.options.secretStorage`) is the default; implement it
- * for a KMS or a secrets manager.
- */
-interface WebhookSecretStore {
-  readonly apiVersion: 1;
-  /** The live secrets of an endpoint, newest first. */
-  secrets(endpointId: string): Promise<readonly string[]>;
-  /** Creates a new secret and returns it once. */
-  rotate?(endpointId: string, options?: RotateSecretOptions): Promise<string>;
-}
-/** The module's `webhook_secrets` and `rotate_webhook_secret` functions. */
-declare function sqlSecretStore(transport: BlockTransport, options?: {
-  readonly schema?: string;
-}): WebhookSecretStore;
-//#endregion
-//#region src/blocks/webhooks/signers.d.ts
-interface WebhookSignInput {
-  /** The delivery id, the same on every retry so receivers can deduplicate. */
-  readonly id: string;
-  readonly body: string;
-  readonly timestamp: Temporal.Instant;
-  /** The endpoint's live secrets, newest first. Sign with each while rotating. */
-  readonly secrets: readonly string[];
-}
-/**
- * Adds the signature headers to an outgoing webhook. `standardWebhooks()` is
- * the default; `hmacSigner()` covers custom header and payload formats.
- */
-interface WebhookSigner {
-  readonly apiVersion: 1;
-  readonly name: string;
-  sign(input: WebhookSignInput): Readonly<Record<string, string>> | Promise<Readonly<Record<string, string>>>;
-}
-interface StandardWebhooksOptions {
-  /** Header names, for receivers that expect a prefix such as `svix-`. */
-  readonly headers?: {
-    readonly id?: string;
-    readonly timestamp?: string;
-    readonly signature?: string;
-  };
-}
-/**
- * Signs with the [Standard Webhooks](https://www.standardwebhooks.com/) scheme:
- * `webhook-id`, `webhook-timestamp` and one `v1,` signature per secret in
- * `webhook-signature`. `verifyWebhook` checks it.
- */
-declare function standardWebhooks(options?: StandardWebhooksOptions): WebhookSigner;
-/**
- * Signs raw bytes with an Ed25519 key, such as
- * `createSigningKeys(options).signer(owner)` from
- * `better-supabase/blocks/signing-keys`.
- */
-interface RawSigner {
-  sign(data: Uint8Array): PromiseLike<Result<{
-    readonly alg: string;
-    readonly signature: Uint8Array;
-  }>>;
-}
-interface AsymmetricWebhooksOptions extends StandardWebhooksOptions {
-  readonly signer: RawSigner;
-  /**
-   * Also sends a `v1,` HMAC signature per endpoint secret, for receivers that
-   * move from secrets to the public key. Default: false.
-   */
-  readonly hmac?: boolean;
-}
-/**
- * Signs with the Standard Webhooks asymmetric scheme: one `v1a,` Ed25519
- * signature over `id.timestamp.body` in `webhook-signature`. Receivers verify
- * it with the `whpk_` key `webhookPublicKey` returns, through `verifyWebhook`.
- * Endpoints opt in with `signing = 'v1a'`.
- */
-declare function standardWebhooksAsymmetric(options: AsymmetricWebhooksOptions): WebhookSigner;
-/** The `whpk_` public key of an Ed25519 JWK, for receivers of `v1a` signatures. */
-declare function webhookPublicKey(jwk: {
-  readonly kty: string;
-  readonly crv?: string;
-  readonly x?: string;
-}): string;
-interface HmacSignerOptions {
-  readonly name?: string;
-  /** E.g. `x-acme-signature`. */
-  readonly signatureHeader: string;
-  /** Sends the epoch-seconds timestamp in this header. */
-  readonly timestampHeader?: string;
-  /** Sends the delivery id in this header. */
-  readonly idHeader?: string;
-  /** The signed text. Defaults to `${timestamp}.${body}`. */
-  readonly content?: (input: {
-    readonly id: string;
-    readonly timestamp: string;
-    readonly body: string;
-  }) => string;
-  /** Defaults to `hex`. */
-  readonly encoding?: "hex" | "base64";
-  /** Written before each signature. Defaults to `v1=`. */
-  readonly prefix?: string;
-  /** Joins the signatures of several secrets. Defaults to `,`. */
-  readonly separator?: string;
-}
-/**
- * HMAC-SHA256 with the secret's UTF-8 bytes as the key, for receivers that
- * verify an existing format, e.g. `v1=<hex>` over `timestamp.body`.
- */
-declare function hmacSigner(options: HmacSignerOptions): WebhookSigner;
-//#endregion
-export { IncomingVerify as A, isPublicAddress as C, IncomingDelivery as D, CreatedIncomingWebhook as E, UpdateIncomingWebhookInput as F, UpdatedIncomingWebhook as I, IncomingWebhooks as M, IncomingWebhooksOptions as N, IncomingDestination as O, RotatedIncomingSecret as P, ResolveHost as S, CreateIncomingWebhookInput as T, WebhookResponse as _, WebhookSignInput as a, AllowUrl as b, standardWebhooks as c, RotateSecretOptions as d, WebhookSecretStore as f, WebhookRequest as g, WebhookPolicyError as h, StandardWebhooksOptions as i, IncomingWebhook as j, IncomingDestinationResult as k, standardWebhooksAsymmetric as l, FetchTransportOptions as m, HmacSignerOptions as n, WebhookSigner as o, sqlSecretStore as p, RawSigner as r, hmacSigner as s, AsymmetricWebhooksOptions as t, webhookPublicKey as u, WebhookTransport as v, publicUrl as w, PublicUrlOptions as x, fetchTransport as y };

package/dist/signing-keys-i2Rsll6L.d.ts

@@ -1,119 +0,0 @@
-/// <reference lib="esnext.temporal" />
-import { t as AsyncResult } from "./result-mijqfoJN.js";
-import { n as Logger } from "./logger-DWVYUmwi.js";
-import { n as BlockOptions } from "./block-helpers-DyA5BAW4.js";
-import { n as BlockHooks } from "./block-hooks-BadAniNI.js";
-import { i as JwsAlgorithm, n as Jwks, o as SigningAlgorithm, t as Jwk } from "./jws-D0toeQlA.js";
-//#region src/blocks/signing-keys/signing-keys.d.ts
-interface SigningKeysOptions extends BlockOptions {
-  /**
-   * The JWS `alg` an Ed25519 key signs with: `EdDSA` (RFC 8037), which most
-   * verifiers read, or the fully specified `Ed25519` (RFC 9864). Default:
-   * `EdDSA`.
-   */
-  readonly ed25519Alg?: "EdDSA" | "Ed25519";
-  /** How long a signer keeps the imported private key, in seconds. Default: 300. */
-  readonly cacheSeconds?: number;
-  /** `withBlockHooks` hooks around the client's methods. */
-  readonly hooks?: NoInfer<BlockHooks<SigningKeys>>;
-  /** Receives the errors `after` hooks throw. Default: `console`. */
-  readonly logger?: Logger;
-}
-/** Who a key belongs to: an organization, an app, a stream. */
-interface SigningKeyOwner {
-  /** Lowercase letters, digits, `-` and `_`, such as `organization`. */
-  readonly type: string;
-  readonly id: string;
-}
-/**
- * The owner of the platform's own keys, for a single authorization server that
- * signs for every tenant. A key per tenant uses `{ type, id }` of the tenant
- * instead, such as `{ type: "environment", id: environment.id }`.
- */
-declare const PLATFORM_OWNER: SigningKeyOwner;
-/**
- * The `typ` header for a token kind of your own: `jwtType("invite")` is
- * `vnd.invite+jwt`. Sign with `{ typ }` and verify with `verifyCompact(..., {
- * typ })` so a token of one kind can't be replayed as another (RFC 8725 section
- * 3.11). Throws a `TypeError` for a name outside lower-case letters, digits and
- * `-`.
- */
-declare function jwtType(name: string): string;
-/** What `create` and `rotate` return. The private key never leaves Vault again. */
-interface CreatedSigningKey {
-  readonly kid: string;
-  readonly alg: SigningAlgorithm;
-  readonly publicKey: Jwk;
-  /**
-   * The kid the new key replaced, which stays in the JWKS until its tokens
-   * expire.
-   */
-  readonly retired: string | null;
-}
-/** What `sign` returns. */
-interface Signature {
-  readonly kid: string;
-  readonly alg: JwsAlgorithm;
-  readonly signature: Uint8Array;
-}
-/** Signs with an owner's active key. */
-interface Signer {
-  readonly owner: SigningKeyOwner;
-  /** The raw signature of `data` with the active key. */
-  sign(data: Uint8Array): AsyncResult<Signature>;
-  /**
-   * A compact JWS over `claims`, with `alg`, `kid` and `typ: "JWT"` in the
-   * header unless `header` sets them. A custom `typ` has to be `JWT` or end in
-   * `+jwt` (see `jwtType`); anything else fails with `SIGNING_TYP_INVALID`. A
-   * numeric `exp` keeps the key in the JWKS until then
-   * (`note_signing_key_exp`), so a rotation can't strand the token.
-   */
-  signJwt(claims: Readonly<Record<string, unknown>>, header?: Readonly<Record<string, unknown>>): AsyncResult<string>;
-}
-interface JwksOptions {
-  /**
-   * How long a retired key stays published past its last `exp`. Default:
-   * `blocks.signing-keys.options.jwksGrace`.
-   */
-  readonly grace?: Temporal.Duration;
-}
-interface JwksResponseOptions extends JwksOptions {
-  /** The `Cache-Control` max-age, in seconds. Default: 300. */
-  readonly maxAge?: number;
-}
-interface SignerOptions {
-  /**
-   * Creates a key of this type when the owner has none, instead of failing with
-   * `SIGNING_KEY_MISSING`.
-   */
-  readonly create?: SigningAlgorithm;
-}
-interface SigningKeys {
-  /**
-   * Generates a key for the owner and makes it active; the previous key is
-   * retired.
-   */
-  create(owner: SigningKeyOwner, alg?: SigningAlgorithm): AsyncResult<CreatedSigningKey>;
-  /** `create` with the active key's type, or `alg` when given. */
-  rotate(owner: SigningKeyOwner, alg?: SigningAlgorithm): AsyncResult<CreatedSigningKey>;
-  /** Retires a key without a replacement. `false` when it was not active. */
-  retire(kid: string): AsyncResult<boolean>;
-  /** Keeps a key published until at least `exp`. `false` for an unknown kid. */
-  noteExp(kid: string, exp: Temporal.Instant): AsyncResult<boolean>;
-  /** The owner's public keys still in use, as a JWK Set. */
-  jwks(owner: SigningKeyOwner, options?: JwksOptions): AsyncResult<Jwks>;
-  /** `jwks` as an `application/jwk-set+json` response with `Cache-Control`. */
-  jwksResponse(owner: SigningKeyOwner, options?: JwksResponseOptions): Promise<Response>;
-  /** Deletes every key of the owner. */
-  remove(owner: SigningKeyOwner): AsyncResult<number>;
-  /** Deletes retired keys no token can still need. */
-  purge(options?: JwksOptions): AsyncResult<number>;
-  signer(owner: SigningKeyOwner, options?: SignerOptions): Signer;
-}
-/**
- * The `signing-keys` SQL module as typed calls: keys are generated and used
- * with WebCrypto here, kept in Supabase Vault there. Service role only.
- */
-declare function createSigningKeys(options: SigningKeysOptions): SigningKeys;
-//#endregion
-export { Signature as a, SigningKeyOwner as c, createSigningKeys as d, jwtType as f, PLATFORM_OWNER as i, SigningKeys as l, JwksOptions as n, Signer as o, JwksResponseOptions as r, SignerOptions as s, CreatedSigningKey as t, SigningKeysOptions as u };

package/dist/solid-controller-7TxGaJNy.js

@@ -1,33 +0,0 @@
-import { n as useContext$1 } from "./context-B8_p3MXo.js";
-import { n as withEnv, t as blockEnv } from "./block-env-YfPmSNa1.js";
-import { from, onCleanup, onMount } from "solid-js";
-//#region src/blocks/solid-controller.ts
-/**
-* Makes a controller once and reads it through `from`. Its work starts on mount
-* (never during server rendering), and the controller is disposed with the
-* owner.
-*/
-function useBlockController(create, options, usesEnv = true) {
-	const controller = create(withEnv(options, usesEnv ? () => blockEnv(useContext$1().client) : void 0));
-	const state = from({ subscribe: (next) => {
-		next(controller.getSnapshot());
-		let stop;
-		onMount(() => {
-			stop = controller.subscribe(() => {
-				next(controller.getSnapshot());
-			});
-			next(controller.getSnapshot());
-		});
-		return () => stop?.();
-	} }, controller.getSnapshot());
-	onCleanup(() => {
-		controller.dispose();
-	});
-	return {
-		state,
-		actions: controller.actions,
-		controller
-	};
-}
-//#endregion
-export { useBlockController as t };