better-supabase 0.13.0 → 0.15.0

package/dist/blocks/shared-signals/index.js

@@ -1,886 +0,0 @@
-import { n as dbError } from "../../errors-D7u24ZJH.js";
-import { a as ok, r as err, t as AsyncResult } from "../../result-DIT_qp4G.js";
-import { t as consoleLogger } from "../../logger-glM28NVN.js";
-import { n as isRecord } from "../../guards-6F2bCtQR.js";
-import { o as problemResponse } from "../../problem-D0KDiYPk.js";
-import { n as SSF_PUSH, r as sharedSignalsSqlOptions, t as SSF_POLL } from "../../methods-7u6vSgz_.js";
-import { n as event, t as defineEvents } from "../../event-map-CtPFhcOp.js";
-import { i as sqlTransport } from "../../block-transport-Ds0C2mUf.js";
-import { A as requiredInstant, D as recordOf, E as readBodyCapped, F as stringsOf, I as textOf, f as errorText, k as recordsOf, n as applyTemporal, o as blockCall, y as nullableText } from "../../block-helpers-DwE32_gT.js";
-import { a as jwksOf, c as verifyCompact, t as JwsError } from "../../jws-DOgHJKHb.js";
-import { r as withBlockHooks } from "../../block-hooks-C1r-R2r0.js";
-import { n as defineBlock } from "../../define-block-B6Gjs57G.js";
-//#region src/blocks/shared-signals/set.ts
-/** The `typ` header of a Security Event Token (RFC 8417 §2.3). */
-const SET_TYP = "secevent+jwt";
-/** The media type a pushed SET is sent with (RFC 8935 §2). */
-const SET_CONTENT_TYPE = "application/secevent+jwt";
-/** The SSF 1.0 stream events (§8.1.4, §8.1.5). */
-const SSF_EVENTS = {
-	verification: "https://schemas.openid.net/secevent/ssf/event-type/verification",
-	streamUpdated: "https://schemas.openid.net/secevent/ssf/event-type/stream-updated"
-};
-/** The CAEP 1.0 event types (§3). */
-const CAEP_EVENTS = {
-	sessionRevoked: "https://schemas.openid.net/secevent/caep/event-type/session-revoked",
-	tokenClaimsChange: "https://schemas.openid.net/secevent/caep/event-type/token-claims-change",
-	credentialChange: "https://schemas.openid.net/secevent/caep/event-type/credential-change",
-	assuranceLevelChange: "https://schemas.openid.net/secevent/caep/event-type/assurance-level-change",
-	deviceComplianceChange: "https://schemas.openid.net/secevent/caep/event-type/device-compliance-change",
-	sessionEstablished: "https://schemas.openid.net/secevent/caep/event-type/session-established",
-	sessionPresented: "https://schemas.openid.net/secevent/caep/event-type/session-presented",
-	riskLevelChange: "https://schemas.openid.net/secevent/caep/event-type/risk-level-change"
-};
-/** The RISC 1.0 event types (§2), without the deprecated `sessions-revoked`. */
-const RISC_EVENTS = {
-	accountCredentialChangeRequired: "https://schemas.openid.net/secevent/risc/event-type/account-credential-change-required",
-	accountPurged: "https://schemas.openid.net/secevent/risc/event-type/account-purged",
-	accountDisabled: "https://schemas.openid.net/secevent/risc/event-type/account-disabled",
-	accountEnabled: "https://schemas.openid.net/secevent/risc/event-type/account-enabled",
-	identifierChanged: "https://schemas.openid.net/secevent/risc/event-type/identifier-changed",
-	identifierRecycled: "https://schemas.openid.net/secevent/risc/event-type/identifier-recycled",
-	credentialCompromise: "https://schemas.openid.net/secevent/risc/event-type/credential-compromise",
-	optIn: "https://schemas.openid.net/secevent/risc/event-type/opt-in",
-	optOutInitiated: "https://schemas.openid.net/secevent/risc/event-type/opt-out-initiated",
-	optOutCancelled: "https://schemas.openid.net/secevent/risc/event-type/opt-out-cancelled",
-	optOutEffective: "https://schemas.openid.net/secevent/risc/event-type/opt-out-effective",
-	recoveryActivated: "https://schemas.openid.net/secevent/risc/event-type/recovery-activated",
-	recoveryInformationChanged: "https://schemas.openid.net/secevent/risc/event-type/recovery-information-changed"
-};
-/**
-* A signed SET (RFC 8417) with the SSF profile: `typ: secevent+jwt`, a
-* top-level `sub_id`, exactly one event, and no `sub` or `exp` claim.
-*/
-function mintSet(signer, input) {
-	const jti = crypto.randomUUID().replaceAll("-", "");
-	const audience = typeof input.audience === "string" ? input.audience : input.audience.length === 1 ? input.audience[0] : [...input.audience];
-	return signer.signJwt({
-		iss: input.issuer,
-		jti,
-		iat: Math.floor(Date.now() / 1e3),
-		aud: audience,
-		...input.txn === void 0 ? {} : { txn: input.txn },
-		sub_id: input.subject,
-		events: { [input.event.type]: input.event.claims }
-	}, { typ: SET_TYP }).map((token) => ({
-		jti,
-		token
-	}));
-}
-const SSF_MEMBERS = [
-	"user",
-	"device",
-	"session",
-	"application",
-	"tenant",
-	"org_unit",
-	"group"
-];
-const fail = (err, description) => ({
-	ok: false,
-	err,
-	description
-});
-const jwsFailure = (cause) => {
-	if (!(cause instanceof JwsError)) throw cause;
-	switch (cause.code) {
-		case "JWS_MALFORMED":
-		case "JWS_TYP": return fail("invalid_request", cause.message);
-		default: return fail("invalid_key", cause.message);
-	}
-};
-/**
-* Verifies a SET as an RFC 8935 receiver: the signature against `jwks`, `typ`,
-* `iss`, `aud`, `jti`, `iat`, one event and an SSF `sub_id`. A failure carries
-* the error code to answer the transmitter with.
-*/
-async function verifySet(token, options) {
-	let header;
-	let payload;
-	try {
-		({header, payload} = await verifyCompact(token, options.jwks));
-	} catch (cause) {
-		return jwsFailure(cause);
-	}
-	const typ = typeof header["typ"] === "string" ? header["typ"].toLowerCase() : "";
-	if (typ !== "secevent+jwt" && typ !== "application/secevent+jwt") return fail("invalid_request", `The typ must be ${SET_TYP}`);
-	if (payload["iss"] !== options.issuer) return fail("invalid_issuer", "The iss is not the transmitter's issuer");
-	const aud = payload["aud"];
-	const audience = typeof aud === "string" ? [aud] : Array.isArray(aud) ? aud.filter((value) => typeof value === "string") : [];
-	if (!audience.includes(options.audience)) return fail("invalid_audience", "The aud does not name this receiver");
-	const jti = payload["jti"];
-	if (typeof jti !== "string" || jti === "") return fail("invalid_request", "The SET has no jti");
-	const iat = payload["iat"];
-	if (typeof iat !== "number" || !Number.isFinite(iat)) return fail("invalid_request", "The SET has no iat");
-	if (iat > Date.now() / 1e3 + (options.skewSeconds ?? 300)) return fail("invalid_request", "The iat is in the future");
-	const events = payload["events"];
-	const entries = isRecord(events) ? Object.entries(events) : [];
-	const [entry] = entries;
-	if (entry === void 0 || entries.length !== 1 || !isRecord(entry[1])) return fail("invalid_request", "A SET carries exactly one event");
-	const subject = payload["sub_id"];
-	if (!isRecord(subject) || typeof subject["format"] !== "string") return fail("invalid_request", "The SET has no sub_id");
-	const understood = options.understoodSubjectMembers ?? SSF_MEMBERS;
-	const unknown = (options.criticalSubjectMembers ?? []).find((member) => member in subject && !understood.includes(member));
-	if (unknown !== void 0) return fail("invalid_request", `The critical subject member ${unknown} is not understood`);
-	const txn = payload["txn"];
-	return {
-		ok: true,
-		set: {
-			jti,
-			issuer: options.issuer,
-			issuedAt: iat,
-			audience,
-			subject,
-			type: entry[0],
-			claims: entry[1],
-			txn: typeof txn === "string" ? txn : void 0,
-			token
-		}
-	};
-}
-//#endregion
-//#region src/blocks/shared-signals/receiver.ts
-const failure$1 = (code, description) => ({
-	ok: false,
-	err: code,
-	description
-});
-const rejected = (code, description, status = 400) => Response.json({
-	err: code,
-	description
-}, { status });
-function wellKnown(issuer) {
-	const parsed = new URL(issuer);
-	const path = parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/$/, "");
-	return `${parsed.origin}/.well-known/ssf-configuration${path}`;
-}
-/**
-* An SSF receiver: verifies pushed or polled SETs with the transmitter's keys,
-* drops replays through the `shared-signals` module's `(iss, jti)` table, and
-* calls the handler for the event type. Service role only.
-*/
-function createSsfReceiver(options) {
-	applyTemporal(options);
-	const call = blockCall(options.service ?? options.transport, options.schema, options.mappers);
-	const http = options.fetch ?? fetch;
-	const cacheMs = (options.cacheSeconds ?? 300) * 1e3;
-	const maxBody = options.maxBodyBytes ?? 65536;
-	const logger = options.logger ?? consoleLogger;
-	let metadata;
-	let keys;
-	const getJson = async (url, init = {}) => {
-		let response;
-		try {
-			const headers = new Headers(init.headers);
-			if (!headers.has("accept")) headers.set("accept", "application/json");
-			response = await http(url, {
-				...init,
-				headers
-			});
-		} catch (cause) {
-			return err(dbError("network", `${url}: ${errorText(cause)}`));
-		}
-		if (!response.ok) return err(dbError(response.status === 404 ? "not_found" : "unexpected", `${url} answered ${String(response.status)}`));
-		if (response.status === 204) return ok(null);
-		try {
-			const value = await response.json();
-			return ok(value);
-		} catch {
-			return err(dbError("unexpected", `${url} did not answer JSON`));
-		}
-	};
-	const discover = () => AsyncResult.from(async () => {
-		if (metadata && Date.now() - metadata.at < cacheMs) return ok(metadata.value);
-		const fetched = await getJson(wellKnown(options.issuer));
-		if (!fetched.ok) return fetched;
-		if (!isRecord(fetched.data) || fetched.data["issuer"] !== options.issuer) return err(dbError("unexpected", "The transmitter metadata names another issuer", { hint: "SSF_ISSUER_MISMATCH" }));
-		metadata = {
-			value: fetched.data,
-			at: Date.now()
-		};
-		return ok(fetched.data);
-	});
-	const jwks = async (refresh) => {
-		if (options.jwks !== void 0) return ok(typeof options.jwks === "function" ? await options.jwks() : options.jwks);
-		if (keys && !refresh && Date.now() - keys.at < cacheMs) return ok(keys.value);
-		if (keys && refresh && Date.now() - keys.at < 3e4) return ok(keys.value);
-		const meta = await discover();
-		if (!meta.ok) return meta;
-		const uri = meta.data["jwks_uri"];
-		if (typeof uri !== "string") return err(dbError("unexpected", "The transmitter metadata has no jwks_uri"));
-		const fetched = await getJson(uri);
-		if (!fetched.ok) return fetched;
-		keys = {
-			value: jwksOf(fetched.data),
-			at: Date.now()
-		};
-		return ok(keys.value);
-	};
-	const verify = async (token) => {
-		for (const refresh of [false, true]) {
-			const found = await jwks(refresh);
-			if (!found.ok) return failure$1("invalid_key", found.error.message);
-			const verified = await verifySet(token, {
-				jwks: found.data,
-				issuer: options.issuer,
-				audience: options.audience,
-				...options.criticalSubjectMembers === void 0 ? {} : { criticalSubjectMembers: options.criticalSubjectMembers }
-			});
-			if (verified.ok || verified.err !== "invalid_key" || options.jwks !== void 0) return verified;
-		}
-		return failure$1("invalid_key", "No transmitter key verifies the SET");
-	};
-	const receive = async (token) => {
-		const verified = await verify(token);
-		if (!verified.ok) return verified;
-		const { set } = verified;
-		const fresh = await call("record_ssf_received", {
-			issuer: set.issuer,
-			jti: set.jti
-		}, (value) => value === true);
-		if (!fresh.ok) throw new Error(fresh.error.message, { cause: fresh.error });
-		if (!fresh.data) return {
-			ok: true,
-			set,
-			duplicate: true
-		};
-		const handler = options.handlers?.[set.type] ?? options.handlers?.["*"];
-		try {
-			await handler?.(set);
-		} catch (cause) {
-			await call("forget_ssf_received", {
-				issuer: set.issuer,
-				jti: set.jti
-			}, () => void 0);
-			throw cause;
-		}
-		return {
-			ok: true,
-			set,
-			duplicate: false
-		};
-	};
-	const pushHandler = () => async (request) => {
-		if (request.method !== "POST") return new Response(null, {
-			status: 405,
-			headers: { allow: "POST" }
-		});
-		if (options.authorization !== void 0 && request.headers.get("authorization") !== options.authorization) return rejected("authentication_failed", "The Authorization header is not accepted", 401);
-		if ((request.headers.get("content-type") ?? "").split(";")[0]?.trim().toLowerCase() !== "application/secevent+jwt") return rejected("invalid_request", `The content type must be ${SET_CONTENT_TYPE}`);
-		const token = await readBodyCapped(request, maxBody);
-		if (token === void 0) return rejected("invalid_request", "The SET is too large");
-		try {
-			const result = await receive(token.trim());
-			return result.ok ? new Response(null, { status: 202 }) : rejected(result.err, result.description);
-		} catch (cause) {
-			logger.error("shared-signals: a SET handler failed", { error: errorText(cause) });
-			return new Response(null, { status: 500 });
-		}
-	};
-	const poll = (pollOptions) => AsyncResult.from(async () => {
-		const totals = {
-			received: 0,
-			rejected: 0,
-			failed: 0
-		};
-		let ack = [];
-		let setErrs = {};
-		let more = true;
-		const maxRequests = pollOptions.maxRequests ?? 10;
-		for (let request = 0; request < maxRequests && more; request += 1) {
-			const response = await getJson(pollOptions.endpoint, {
-				method: "POST",
-				headers: {
-					authorization: pollOptions.authorization,
-					"content-type": "application/json"
-				},
-				body: JSON.stringify({
-					maxEvents: pollOptions.maxEvents ?? 100,
-					returnImmediately: true,
-					ack,
-					...Object.keys(setErrs).length === 0 ? {} : { setErrs }
-				})
-			});
-			if (!response.ok) return response;
-			const body = isRecord(response.data) ? response.data : {};
-			const sets = isRecord(body["sets"]) ? body["sets"] : {};
-			ack = [];
-			setErrs = {};
-			for (const [jti, token] of Object.entries(sets)) {
-				if (typeof token !== "string") continue;
-				try {
-					const result = await receive(token);
-					if (result.ok) {
-						ack.push(jti);
-						totals.received += result.duplicate ? 0 : 1;
-					} else {
-						setErrs[jti] = {
-							err: result.err,
-							description: result.description
-						};
-						totals.rejected += 1;
-					}
-				} catch (cause) {
-					logger.error("shared-signals: a SET handler failed", { error: errorText(cause) });
-					totals.failed += 1;
-				}
-			}
-			more = body["moreAvailable"] === true;
-		}
-		if (ack.length > 0 || Object.keys(setErrs).length > 0) {
-			const final = await getJson(pollOptions.endpoint, {
-				method: "POST",
-				headers: {
-					authorization: pollOptions.authorization,
-					"content-type": "application/json"
-				},
-				body: JSON.stringify({
-					maxEvents: 0,
-					returnImmediately: true,
-					ack,
-					...Object.keys(setErrs).length === 0 ? {} : { setErrs }
-				})
-			});
-			if (!final.ok) return final;
-		}
-		return ok({
-			...totals,
-			moreAvailable: more
-		});
-	});
-	const streams = (authorization) => {
-		const endpoint = (key) => discover().andThen((meta) => {
-			const value = meta[key];
-			return Promise.resolve(typeof value === "string" ? ok(value) : err(dbError("unsupported", `The transmitter publishes no ${key}`)));
-		});
-		const send = (key, method, body, query) => endpoint(key).andThen((url) => getJson(query === void 0 ? url : `${url}?stream_id=${encodeURIComponent(query)}`, {
-			method,
-			headers: {
-				authorization,
-				...body === void 0 ? {} : { "content-type": "application/json" }
-			},
-			...body === void 0 ? {} : { body: JSON.stringify(body) }
-		}));
-		const record = (value) => isRecord(value) ? value : {};
-		return {
-			create: (request) => send("configuration_endpoint", "POST", {
-				delivery: {
-					method: request.method === "push" ? SSF_PUSH : SSF_POLL,
-					...request.endpointUrl === void 0 ? {} : { endpoint_url: request.endpointUrl },
-					...request.authorizationHeader === void 0 ? {} : { authorization_header: request.authorizationHeader }
-				},
-				events_requested: request.eventsRequested,
-				...request.description === void 0 ? {} : { description: request.description }
-			}).andThen((value) => {
-				const config = record(value);
-				const aud = config["aud"];
-				const audience = typeof aud === "string" ? [aud] : Array.isArray(aud) ? aud : [];
-				return Promise.resolve(audience.includes(options.audience) ? ok(config) : err(dbError("unexpected", "The created stream's aud does not name this receiver", { hint: "SSF_AUDIENCE_MISMATCH" })));
-			}),
-			read: (streamId) => send("configuration_endpoint", "GET", void 0, streamId).map(record),
-			remove: (streamId) => send("configuration_endpoint", "DELETE", void 0, streamId).map(() => void 0),
-			status: (streamId) => send("status_endpoint", "GET", void 0, streamId).map(record),
-			setStatus: (streamId, status, reason) => send("status_endpoint", "POST", {
-				stream_id: streamId,
-				status,
-				...reason === void 0 ? {} : { reason }
-			}).map(record),
-			verify: (streamId, state) => endpoint("verification_endpoint").andThen(async (url) => {
-				let response;
-				try {
-					response = await http(url, {
-						method: "POST",
-						headers: {
-							authorization,
-							"content-type": "application/json"
-						},
-						body: JSON.stringify({
-							stream_id: streamId,
-							...state === void 0 ? {} : { state }
-						})
-					});
-				} catch (cause) {
-					return err(dbError("network", errorText(cause)));
-				}
-				if (response.status === 429) return ok(false);
-				return response.ok ? ok(true) : err(dbError("unexpected", `${url} answered ${String(response.status)}`));
-			})
-		};
-	};
-	return withBlockHooks({
-		discover,
-		receive,
-		pushHandler,
-		poll,
-		streams,
-		purge: (olderThan) => call("purge_shared_signals", { older_than: olderThan === void 0 ? null : `${String(olderThan.total({ unit: "seconds" }))} seconds` }, Number)
-	}, options.hooks, {
-		block: "shared-signals",
-		logger
-	});
-}
-//#endregion
-//#region src/blocks/shared-signals/transmitter.ts
-const METHODS = {
-	push: SSF_PUSH,
-	poll: SSF_POLL
-};
-const methodOf = (urn) => urn === "urn:ietf:rfc:8935" ? "push" : "poll";
-const STATUSES = [
-	"enabled",
-	"paused",
-	"disabled"
-];
-const statusOf = (value) => {
-	const found = STATUSES.find((status) => status === value);
-	if (found === void 0) throw new TypeError(`Unknown stream status ${String(value)}`);
-	return found;
-};
-function streamOf(value) {
-	const row = recordOf(value, "ssf_stream");
-	return {
-		id: textOf(row["id"]),
-		tenant: nullableText(row["tenant"]),
-		receiver: textOf(row["receiver"]),
-		audience: stringsOf(row["audience"]),
-		description: nullableText(row["description"]),
-		eventsRequested: stringsOf(row["eventsRequested"]),
-		eventsDelivered: stringsOf(row["eventsDelivered"]),
-		method: methodOf(row["method"]),
-		endpointUrl: nullableText(row["endpointUrl"]),
-		status: statusOf(row["status"]),
-		reason: nullableText(row["reason"]),
-		createdAt: requiredInstant(row["createdAt"], "createdAt"),
-		updatedAt: requiredInstant(row["updatedAt"], "updatedAt")
-	};
-}
-const interval = (seconds) => `${String(seconds)} seconds`;
-const invalid = (message) => dbError("invalid_input", message, { hint: "SSF_REQUEST_INVALID" });
-const json = (body, status = 200, headers = {}) => Response.json(body, {
-	status,
-	headers: noStore(headers)
-});
-const noStore = (init) => {
-	const headers = new Headers(init);
-	if (!headers.has("cache-control")) headers.set("cache-control", "no-store");
-	return headers;
-};
-const strings = (value) => Array.isArray(value) && value.every((item) => typeof item === "string") ? value : void 0;
-/**
-* An SSF transmitter: streams and their status live in the `shared-signals`
-* module, push SETs go out through webhooks-out endpoints with format `set`,
-* and poll SETs wait in the module's queue. Service role only.
-*/
-function createSsfTransmitter(options) {
-	applyTemporal(options);
-	const call = blockCall(options.service ?? options.transport, options.schema, options.mappers);
-	const issuer = options.issuer.replace(/\/$/, "");
-	const base = (options.basePath ?? "/ssf").replace(/\/$/, "");
-	const url = (path) => `${issuer}${base}${path}`;
-	const supported = options.eventsSupported ?? [...Object.values(CAEP_EVENTS), ...Object.values(RISC_EVENTS)];
-	const methods = options.deliveryMethods ?? ["push", "poll"];
-	const minVerification = options.minVerificationInterval ?? 30;
-	const maxBody = options.maxBodyBytes ?? 65536;
-	const delivered = (requested) => requested.filter((type) => supported.includes(type));
-	const queue = (stream, jti, token) => call("queue_ssf_set", {
-		stream_id: stream,
-		jti,
-		token
-	}, textOf);
-	const send = (stream, audience, subject, event, txn) => mintSet(options.signer, {
-		issuer,
-		audience,
-		subject,
-		event,
-		...txn === void 0 ? {} : { txn }
-	}).andThen(({ jti, token }) => queue(stream, jti, token));
-	const streamSubject = (id) => ({
-		format: "opaque",
-		id
-	});
-	const stream = (id) => call("ssf_stream", { id }, (value) => value === null || value === void 0 ? null : streamOf(value));
-	const createStream = (input) => AsyncResult.from(async () => {
-		if (!methods.includes(input.method)) return err(invalid(`The delivery method ${input.method} is not supported`));
-		const id = crypto.randomUUID();
-		const identity = input.receiver;
-		const tenant = identity.tenant ?? null;
-		const audience = identity.audience ?? identity.receiver;
-		let credentialRef = null;
-		if (input.method === "push") {
-			if (input.endpointUrl === void 0 || !/^https:\/\//i.test(input.endpointUrl)) return err(invalid("A push stream needs an https endpoint_url"));
-			if (input.authorizationHeader !== void 0) {
-				if (options.credentials === void 0) return err(invalid("This transmitter does not accept an authorization_header"));
-				credentialRef = {
-					provider: "vault",
-					secret: `ssf/${id}`,
-					header: "authorization",
-					scheme: null,
-					...tenant === null ? {} : { tenant }
-				};
-				const stored = await options.credentials.set(credentialRef, input.authorizationHeader);
-				if (!stored.ok) return stored;
-			}
-		}
-		return call("create_ssf_stream", {
-			id,
-			receiver: identity.receiver,
-			tenant,
-			audience: typeof audience === "string" ? [audience] : [...audience],
-			delivery_method: METHODS[input.method],
-			events_requested: [...input.eventsRequested],
-			events_delivered: delivered(input.eventsRequested),
-			description: input.description ?? null,
-			endpoint_url: input.method === "push" ? input.endpointUrl ?? null : null,
-			credential_ref: credentialRef
-		}, streamOf);
-	});
-	const setStatus = (id, status, reason) => stream(id).andThen(async (found) => {
-		if (found === null) return err(dbError("not_found", "Stream not found", { hint: "SSF_STREAM_NOT_FOUND" }));
-		const update = {
-			type: SSF_EVENTS.streamUpdated,
-			claims: {
-				status,
-				...reason === void 0 ? {} : { reason }
-			}
-		};
-		if (found.status === "enabled" && status !== "enabled") {
-			const sent = await send(id, found.audience, streamSubject(id), update);
-			if (!sent.ok) return sent;
-		}
-		const previous = await call("set_ssf_stream_status", {
-			id,
-			status,
-			reason: reason ?? null
-		}, statusOf);
-		if (!previous.ok) return previous;
-		if (status === "enabled" && previous.data !== "enabled") {
-			const sent = await send(id, found.audience, streamSubject(id), update);
-			if (!sent.ok) return sent;
-		}
-		return ok(previous.data);
-	});
-	const verify = (id, state) => stream(id).andThen((found) => found === null ? AsyncResult.err(dbError("not_found", "Stream not found", { hint: "SSF_STREAM_NOT_FOUND" })) : send(id, found.audience, streamSubject(id), {
-		type: SSF_EVENTS.verification,
-		claims: state === void 0 ? {} : { state }
-	}));
-	const emit = (input) => call("ssf_streams_for_event", {
-		tenant: input.tenant ?? null,
-		event_type: input.event.type
-	}, (value) => recordsOf(value, "ssf_streams_for_event").map((row) => ({
-		id: textOf(row["id"]),
-		audience: stringsOf(row["audience"])
-	}))).andThen(async (targets) => {
-		const counts = {
-			dispatched: 0,
-			queued: 0,
-			held: 0
-		};
-		for (const target of targets) {
-			const sent = await send(target.id, target.audience, input.subject, input.event, input.txn);
-			if (!sent.ok) return sent;
-			if (sent.data === "dispatched" || sent.data === "queued" || sent.data === "held") counts[sent.data] += 1;
-		}
-		return ok({
-			streams: targets.length,
-			...counts
-		});
-	});
-	const poll = (id, request) => call("poll_ssf_events", {
-		stream_id: id,
-		max_events: request.maxEvents ?? null,
-		ack: [...request.ack ?? []],
-		errors: request.setErrs ?? {}
-	}, (value) => {
-		const row = recordOf(value, "poll_ssf_events");
-		const sets = isRecord(row["sets"]) ? row["sets"] : {};
-		return {
-			sets: Object.fromEntries(Object.entries(sets).map(([jti, token]) => [jti, textOf(token)])),
-			moreAvailable: row["moreAvailable"] === true
-		};
-	});
-	const hooked = withBlockHooks({
-		metadata: () => ({
-			spec_version: "1_0",
-			issuer,
-			jwks_uri: options.jwksUri,
-			delivery_methods_supported: methods.map((method) => METHODS[method]),
-			configuration_endpoint: url("/stream"),
-			status_endpoint: url("/status"),
-			verification_endpoint: url("/verify"),
-			authorization_schemes: options.authorizationSchemes ?? [{ spec_urn: "urn:ietf:rfc:6749" }],
-			default_subjects: "ALL"
-		}),
-		createStream,
-		stream,
-		streams: (receiver) => call("ssf_streams", { receiver }, (value) => recordsOf(value, "ssf_streams").map(streamOf)),
-		updateStream: (id, input) => call("update_ssf_stream", {
-			id,
-			patch: {
-				...input.description === void 0 ? {} : { description: input.description },
-				...input.eventsRequested === void 0 ? {} : {
-					eventsRequested: input.eventsRequested,
-					eventsDelivered: delivered(input.eventsRequested)
-				},
-				...input.endpointUrl === void 0 ? {} : { endpointUrl: input.endpointUrl }
-			}
-		}, (value) => value === null || value === void 0 ? null : streamOf(value)),
-		deleteStream: (id) => stream(id).andThen(async (found) => {
-			if (found === null) return ok(false);
-			const deleted = await call("delete_ssf_stream", { id }, (value) => value === true);
-			if (deleted.ok && found.method === "push" && options.credentials !== void 0) await options.credentials.revoke({
-				provider: "vault",
-				secret: `ssf/${id}`,
-				...found.tenant === null ? {} : { tenant: found.tenant }
-			}, { subject: { type: "app" } });
-			return deleted;
-		}),
-		setStatus,
-		verify,
-		emit,
-		poll,
-		purge: (olderThan) => call("purge_shared_signals", { older_than: olderThan === void 0 ? null : interval(olderThan.total({ unit: "seconds" })) }, Number),
-		handler: () => routes(hooked, {
-			base,
-			authorize: options.authorize,
-			maxBody,
-			minVerification,
-			call,
-			supported
-		})
-	}, options.hooks, {
-		block: "shared-signals",
-		...options.logger ? { logger: options.logger } : {}
-	});
-	return hooked;
-}
-const failure = (error) => problemResponse(error);
-const unauthorized = () => failure(dbError("unauthorized", "The request is not authorized", { hint: "SSF_UNAUTHORIZED" }));
-const notFound = () => failure(dbError("not_found", "Stream not found", { hint: "SSF_STREAM_NOT_FOUND" }));
-async function bodyOf(request, limit) {
-	const text = await readBodyCapped(request, limit);
-	if (text === void 0 || text === "") return;
-	try {
-		const value = JSON.parse(text);
-		return isRecord(value) ? value : void 0;
-	} catch {
-		return;
-	}
-}
-function configOf(stream, issuer, supported, minVerification, pollUrl) {
-	return {
-		stream_id: stream.id,
-		iss: issuer,
-		aud: stream.audience.length === 1 ? stream.audience[0] : stream.audience,
-		events_supported: supported,
-		events_requested: stream.eventsRequested,
-		events_delivered: stream.eventsDelivered,
-		delivery: {
-			method: METHODS[stream.method],
-			endpoint_url: stream.method === "push" ? stream.endpointUrl : pollUrl
-		},
-		min_verification_interval: minVerification,
-		...stream.description === null ? {} : { description: stream.description }
-	};
-}
-function routes(transmitter, context) {
-	const metadata = transmitter.metadata();
-	const issuer = textOf(metadata["issuer"]);
-	const pollUrl = (id) => `${issuer}${context.base}/poll/${id}`;
-	const config = (stream) => configOf(stream, issuer, context.supported, context.minVerification, pollUrl(stream.id));
-	/** The stream when it belongs to the receiver; another receiver's stream is a 404. */
-	const owned = async (id, identity) => {
-		if (typeof id !== "string" || id === "") return failure(invalid("stream_id is required"));
-		if (!/^[0-9a-f-]{36}$/i.test(id)) return notFound();
-		const found = await transmitter.stream(id);
-		if (!found.ok) return failure(found.error);
-		if (found.data === null || found.data.receiver !== identity.receiver) return notFound();
-		return found.data;
-	};
-	const manage = async (request, identity) => {
-		const query = new URL(request.url).searchParams;
-		switch (request.method) {
-			case "GET": {
-				const id = query.get("stream_id");
-				if (id === null) {
-					const all = await transmitter.streams(identity.receiver);
-					return all.ok ? json(all.data.map(config)) : failure(all.error);
-				}
-				const found = await owned(id, identity);
-				return found instanceof Response ? found : json(config(found));
-			}
-			case "POST": {
-				const body = await bodyOf(request, context.maxBody);
-				const delivery = isRecord(body?.["delivery"]) ? body["delivery"] : {};
-				const method = delivery["method"] === "urn:ietf:rfc:8935" ? "push" : delivery["method"] === "urn:ietf:rfc:8936" ? "poll" : void 0;
-				const requested = strings(body?.["events_requested"]) ?? [];
-				if (body === void 0 || method === void 0) return failure(invalid("delivery.method must be a supported delivery method"));
-				const endpoint = delivery["endpoint_url"];
-				const authorization = delivery["authorization_header"];
-				const created = await transmitter.createStream({
-					receiver: identity,
-					method,
-					eventsRequested: requested,
-					...typeof endpoint === "string" ? { endpointUrl: endpoint } : {},
-					...typeof authorization === "string" ? { authorizationHeader: authorization } : {},
-					...typeof body["description"] === "string" ? { description: body["description"] } : {}
-				});
-				return created.ok ? json(config(created.data), 201) : failure(created.error);
-			}
-			case "PATCH":
-			case "PUT": {
-				const body = await bodyOf(request, context.maxBody);
-				if (body === void 0) return failure(invalid("The body must be a stream configuration"));
-				const found = await owned(textOf(body["stream_id"] ?? ""), identity);
-				if (found instanceof Response) return found;
-				const replace = request.method === "PUT";
-				const delivery = isRecord(body["delivery"]) ? body["delivery"] : void 0;
-				if (delivery?.["method"] !== void 0 && delivery["method"] !== METHODS[found.method]) return failure(invalid("The delivery method of a stream can't change"));
-				const requested = strings(body["events_requested"]);
-				const endpoint = delivery?.["endpoint_url"];
-				const description = body["description"];
-				const updated = await transmitter.updateStream(found.id, {
-					...typeof description === "string" ? { description } : replace ? { description: null } : {},
-					...requested === void 0 ? replace ? { eventsRequested: [] } : {} : { eventsRequested: requested },
-					...found.method === "push" && typeof endpoint === "string" ? { endpointUrl: endpoint } : {}
-				});
-				if (!updated.ok) return failure(updated.error);
-				return updated.data === null ? notFound() : json(config(updated.data));
-			}
-			case "DELETE": {
-				const found = await owned(query.get("stream_id"), identity);
-				if (found instanceof Response) return found;
-				const deleted = await transmitter.deleteStream(found.id);
-				return deleted.ok ? new Response(null, { status: 204 }) : failure(deleted.error);
-			}
-			default: return new Response(null, {
-				status: 405,
-				headers: { allow: "GET, POST, PATCH, PUT, DELETE" }
-			});
-		}
-	};
-	const status = async (request, identity) => {
-		if (request.method === "GET") {
-			const found = await owned(new URL(request.url).searchParams.get("stream_id"), identity);
-			if (found instanceof Response) return found;
-			return json({
-				stream_id: found.id,
-				status: found.status,
-				...found.reason === null ? {} : { reason: found.reason }
-			});
-		}
-		if (request.method !== "POST") return new Response(null, {
-			status: 405,
-			headers: { allow: "GET, POST" }
-		});
-		const body = await bodyOf(request, context.maxBody);
-		const found = await owned(typeof body?.["stream_id"] === "string" ? body["stream_id"] : void 0, identity);
-		if (found instanceof Response) return found;
-		const next = STATUSES.find((value) => value === body?.["status"]);
-		if (next === void 0) return failure(invalid("status is enabled, paused or disabled"));
-		const reason = typeof body?.["reason"] === "string" ? body["reason"] : void 0;
-		const changed = await transmitter.setStatus(found.id, next, reason);
-		if (!changed.ok) return failure(changed.error);
-		return json({
-			stream_id: found.id,
-			status: next,
-			...reason === void 0 ? {} : { reason }
-		});
-	};
-	const verification = async (request, identity) => {
-		if (request.method !== "POST") return new Response(null, {
-			status: 405,
-			headers: { allow: "POST" }
-		});
-		const body = await bodyOf(request, context.maxBody);
-		const found = await owned(typeof body?.["stream_id"] === "string" ? body["stream_id"] : void 0, identity);
-		if (found instanceof Response) return found;
-		const noted = await context.call("note_ssf_verification", {
-			stream_id: found.id,
-			min_interval: interval(context.minVerification)
-		}, (value) => value === true);
-		if (!noted.ok) return failure(noted.error);
-		if (!noted.data) return new Response(null, {
-			status: 429,
-			headers: { "retry-after": String(context.minVerification) }
-		});
-		const state = body?.["state"];
-		const sent = await transmitter.verify(found.id, typeof state === "string" ? state : void 0);
-		return sent.ok ? new Response(null, { status: 204 }) : failure(sent.error);
-	};
-	const pollRoute = async (request, identity, id) => {
-		if (request.method !== "POST") return new Response(null, {
-			status: 405,
-			headers: { allow: "POST" }
-		});
-		const found = await owned(id, identity);
-		if (found instanceof Response) return found;
-		if (found.method !== "poll") return notFound();
-		const body = await bodyOf(request, context.maxBody) ?? {};
-		const max = body["maxEvents"];
-		const errs = isRecord(body["setErrs"]) ? body["setErrs"] : {};
-		const polled = await transmitter.poll(found.id, {
-			...typeof max === "number" ? { maxEvents: max } : {},
-			ack: strings(body["ack"]) ?? [],
-			setErrs: Object.fromEntries(Object.entries(errs).flatMap(([jti, value]) => isRecord(value) && typeof value["err"] === "string" ? [[jti, { err: value["err"] }]] : []))
-		});
-		return polled.ok ? json(polled.data) : failure(polled.error);
-	};
-	return async (request) => {
-		const path = new URL(request.url).pathname;
-		if (path.includes("/.well-known/ssf-configuration")) return request.method === "GET" ? json(metadata, 200, { "cache-control": "public, max-age=300" }) : new Response(null, {
-			status: 405,
-			headers: { allow: "GET" }
-		});
-		const route = path.startsWith(context.base) ? path.slice(context.base.length) : void 0;
-		if (route === void 0) return notFound();
-		const identity = await context.authorize(request);
-		if (identity === null) return unauthorized();
-		if (route === "/stream") return manage(request, identity);
-		if (route === "/status") return status(request, identity);
-		if (route === "/verify") return verification(request, identity);
-		if (route.startsWith("/poll/")) return pollRoute(request, identity, route.slice(6));
-		return notFound();
-	};
-}
-//#endregion
-//#region src/blocks/shared-signals/shared-signals.ts
-/**
-* What `createBlocks` builds: each transmitter and receiver takes the block's
-* transport.
-*/
-function createSharedSignals(options) {
-	return {
-		transmitter: (config) => createSsfTransmitter({
-			...options,
-			...config
-		}),
-		receiver: (config) => createSsfReceiver({
-			...options,
-			...config
-		})
-	};
-}
-//#endregion
-//#region src/blocks/shared-signals/events.ts
-/**
-* The `shared-signals` block's event types, for its manifest and
-* `onBlockEvent`.
-*/
-const sharedSignalsEvents = defineEvents({
-	"ssf_stream.created": event(),
-	"ssf_stream.status_changed": event(),
-	"ssf_stream.deleted": event()
-});
-//#endregion
-//#region src/blocks/shared-signals/manifest.ts
-/** The `shared-signals` block's manifest (ADR 0029). */
-const sharedSignalsBlock = defineBlock({
-	name: "shared-signals",
-	sql: ["shared-signals"],
-	options: { "shared-signals": sharedSignalsSqlOptions },
-	events: sharedSignalsEvents,
-	create: createSharedSignals,
-	category: "developer"
-});
-//#endregion
-export { CAEP_EVENTS, RISC_EVENTS, SET_CONTENT_TYPE, SET_TYP, SSF_EVENTS, SSF_POLL, SSF_PUSH, createSharedSignals, createSsfReceiver, createSsfTransmitter, mintSet, sharedSignalsBlock, sharedSignalsEvents, sqlTransport, verifySet };