better-supabase 0.2.0 → 0.3.0

package/dist/testing/index.js

@@ -1,24 +1,20 @@
 import { n as dbError } from "../errors-Bl3rkOzo.js";
+import { i as temporalText } from "../temporal-BwshQk0W.js";
+import { t as temporal } from "../temporal-required-CMxeSVPo.js";
 import { i as ok } from "../result-DWXatkd6.js";
-import { t as BetterSupabase } from "../define-BXMYD9AY.js";
+import { t as BetterSupabase } from "../define-DF341GDj.js";
+import { a as toBase64Url, r as fromBase64, t as base64ToText } from "../base64-CQeB1eSf.js";
+import { r as resolveConfig } from "../config-Be4GwsqI.js";
 import { t as isList } from "../guards-BnzDvFrz.js";
-import { r as resolveConfig } from "../config-ClDXmVtY.js";
-import { t as ENV_VARIABLES } from "../env-BEToab0I.js";
-import { n as postgresExecutor } from "../executor-DeppvirK.js";
-import { o as toCloudEvents } from "../events-BuzTgn2D.js";
-import { n as isSeed, t as defineSeed } from "../seed-CzecODcJ.js";
+import { ENV_VARIABLES } from "../env/index.js";
+import { n as postgresExecutor } from "../executor-C57jx2pn.js";
+import { toCloudEvents } from "../events/index.js";
 import { createClient } from "@supabase/supabase-js";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 //#region src/testing/jwt.ts
 const encoder = new TextEncoder();
-function base64url(input) {
-	const bytes = typeof input === "string" ? encoder.encode(input) : input;
-	let binary = "";
-	for (const byte of bytes) binary += String.fromCharCode(byte);
-	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
-}
 /**
 * Signs an HS256 access token the local Supabase stack accepts. Test-only:
 * production tokens come from Supabase Auth.
@@ -34,21 +30,17 @@ async function signTestJwt(secret, claims) {
 		exp: now + expiresIn,
 		...rest
 	};
-	const header = base64url(JSON.stringify({
+	const header = toBase64Url(JSON.stringify({
 		alg: "HS256",
 		typ: "JWT"
 	}));
-	const body = base64url(JSON.stringify(payload));
+	const body = toBase64Url(JSON.stringify(payload));
 	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
 		name: "HMAC",
 		hash: "SHA-256"
 	}, false, ["sign"]);
 	const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(`${header}.${body}`));
-	return `${header}.${body}.${base64url(new Uint8Array(signature))}`;
-}
-function base64urlDecode(input) {
-	const binary = atob(input.replaceAll("-", "+").replaceAll("_", "/"));
-	return Uint8Array.from(binary, (char) => char.charCodeAt(0));
+	return `${header}.${body}.${toBase64Url(new Uint8Array(signature))}`;
 }
 /**
 * Accepts `signTestJwt` tokens as users, for API servers tested against the
@@ -65,9 +57,9 @@ function localAuth(secret) {
 		async resolve(request) {
 			const token = /^Bearer (.+)$/i.exec(request.headers.get("authorization") ?? "")?.[1];
 			const [header, body, signature] = token?.split(".") ?? [];
-			if (!token || !header || !body || !signature) return void 0;
-			if (!await crypto.subtle.verify("HMAC", await key, base64urlDecode(signature), encoder.encode(`${header}.${body}`)).catch(() => false)) return void 0;
-			const claims = JSON.parse(new TextDecoder().decode(base64urlDecode(body)));
+			if (!token || !header || !body || !signature) return;
+			if (!await crypto.subtle.verify("HMAC", await key, fromBase64(signature), encoder.encode(`${header}.${body}`)).catch(() => false)) return;
+			const claims = JSON.parse(base64ToText(body));
 			if (typeof claims.exp === "number" && claims.exp * 1e3 < Date.now()) return {
 				kind: "invalid",
 				error: dbError("unauthorized", "The token has expired")
@@ -98,17 +90,17 @@ async function signEs256(key, kid, claims) {
 		exp: now + expiresIn,
 		...rest
 	};
-	const header = base64url(JSON.stringify({
+	const header = toBase64Url(JSON.stringify({
 		alg: "ES256",
 		typ: "JWT",
 		kid
 	}));
-	const body = base64url(JSON.stringify(payload));
+	const body = toBase64Url(JSON.stringify(payload));
 	const signature = await crypto.subtle.sign({
 		name: "ECDSA",
 		hash: "SHA-256"
 	}, key, encoder.encode(`${header}.${body}`));
-	return `${header}.${body}.${base64url(new Uint8Array(signature))}`;
+	return `${header}.${body}.${toBase64Url(new Uint8Array(signature))}`;
 }
 /**
 * Signs an ES256 access token with a private JWK, the way the local stack
@@ -247,7 +239,9 @@ function settle(promise, ms) {
 	let timer;
 	return Promise.race([promise, new Promise((done) => {
 		timer = setTimeout(done, ms);
-	})]).finally(() => clearTimeout(timer));
+	})]).finally(() => {
+		clearTimeout(timer);
+	});
 }
 /**
 * Measures every document and RSC navigation response during `during` and
@@ -367,7 +361,9 @@ function tableKey(sb, table) {
 	if (!key || !(key in sb.meta.tables)) throw new TypeError(`better-supabase: unknown table "${String(key)}"`);
 	return key;
 }
-const hasName = (subject) => ["has a name", () => expect(typeof subject.name === "string" && subject.name.length > 0, "name must be a non-empty string")];
+const hasName = (subject) => ["has a name", () => {
+	expect(typeof subject.name === "string" && subject.name.length > 0, "name must be a non-empty string");
+}];
 /**
 * Proves an `Executor` meets the contract: rows keyed by the selection's
 * aliases, counts, `aborted` errors, failures returned as `Result`s rather
@@ -655,12 +651,14 @@ function testPlugin(plugin, options) {
 		schema: sb.meta,
 		context,
 		options: {},
-		now: () => /* @__PURE__ */ new Date(0)
+		now: () => temporal().Instant.fromEpochMilliseconds(0)
 	});
 	const create = options.create;
 	return conform(`Plugin "${plugin.name}"`, [
 		hasName(plugin),
-		["targets plugin API v1", () => expect(plugin.apiVersion === 1, `apiVersion is ${String(plugin.apiVersion)}`)],
+		["targets plugin API v1", () => {
+			expect(plugin.apiVersion === 1, `apiVersion is ${String(plugin.apiVersion)}`);
+		}],
 		["installs and builds repositories", () => {
 			const db = sb.use(plugin).connect(recorder([]), context);
 			for (const key of Object.keys(sb.meta.tables)) expect(db[key], `db.${key} is missing`);
@@ -816,4 +814,105 @@ async function expectTenantIsolation(sb, options) {
 	}
 }
 //#endregion
+//#region src/testing/seed.ts
+const SEED = Symbol.for("better-supabase.seed");
+function isSeed(value) {
+	return typeof value === "object" && value !== null && SEED in value;
+}
+const quote = (text) => `'${text.replaceAll("'", "''")}'`;
+function arrayLiteral(values) {
+	return `{${values.map((value) => {
+		if (value === null) return "NULL";
+		if (Array.isArray(value)) return arrayLiteral(value);
+		return `"${(temporalText(value) ?? String(value)).replaceAll(/[\\"]/g, "\\$&")}"`;
+	}).join(",")}}`;
+}
+function literal(value, column, where) {
+	if (value === null) return "null";
+	if (column.json) return quote(JSON.stringify(value));
+	if (Array.isArray(value)) return quote(arrayLiteral(value));
+	const temporalValue = temporalText(value);
+	if (temporalValue !== void 0) return quote(temporalValue);
+	const kind = typeof value;
+	switch (kind) {
+		case "string": return quote(value);
+		case "boolean":
+		case "bigint": return String(value);
+		case "number":
+			if (!Number.isFinite(value)) throw new TypeError(`${where}: ${String(value)} is not a finite number`);
+			return String(value);
+		case "object":
+		case "function":
+		case "symbol":
+		case "undefined": throw new TypeError(`${where}: unsupported value of type ${kind}`);
+		default: throw new TypeError(`${where}: unsupported value of type ${String(kind)}`);
+	}
+}
+const ident = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+/** Parents first (by forward relations), otherwise in the order given. */
+function order(meta, keys) {
+	const sorted = [];
+	const visiting = /* @__PURE__ */ new Set();
+	const visit = (key) => {
+		if (sorted.includes(key) || visiting.has(key)) return;
+		visiting.add(key);
+		for (const relation of Object.values(meta.tables[key]?.relations ?? {})) if (relation.direction === "forward" && relation.table !== key && keys.includes(relation.table)) visit(relation.table);
+		visiting.delete(key);
+		sorted.push(key);
+	};
+	for (const key of keys) visit(key);
+	return sorted;
+}
+function statement(table, rows) {
+	const entries = Object.entries(rows);
+	if (entries.length === 0) return void 0;
+	const columns = [];
+	for (const [, row] of entries) for (const [key, value] of Object.entries(row)) {
+		if (value === void 0 || columns.includes(key)) continue;
+		const column = table.columns[key];
+		if (!column) throw new TypeError(`seed ${table.key}: unknown column "${key}"`);
+		if (column.generated) throw new TypeError(`seed ${table.key}: "${key}" is a generated column`);
+		columns.push(key);
+	}
+	const values = entries.map(([name, row]) => {
+		return `  (${columns.map((key) => row[key] === void 0 ? "default" : literal(row[key], table.columns[key], `seed ${table.key}.${name}.${key}`)).join(", ")})`;
+	});
+	return `insert into ${`${ident(table.schema)}.${ident(table.name)}`} (${columns.map((key) => ident(table.columns[key].db)).join(", ")}) values\n${values.join(",\n")}\non conflict do nothing;`;
+}
+/**
+* Typed fixtures shared by `supabase/seeds` and your tests. Rows use app
+* casing and Insert types; `better-supabase seed` renders them to SQL.
+*
+* ```ts
+* export const seed = defineSeed(sb, {
+*   organizations: { acme: { id: ACME, name: 'Acme' } },
+*   customers: { first: { organizationId: ACME, name: 'First customer' } },
+* });
+* ```
+*/
+function defineSeed(sb, fixtures) {
+	const meta = sb.meta;
+	const statements = () => {
+		const keys = Object.keys(fixtures).filter((key) => fixtures[key] !== void 0);
+		for (const key of keys) {
+			const table = meta.tables[key];
+			if (!table) throw new TypeError(`seed: unknown table "${key}"`);
+			if (table.kind === "view") throw new TypeError(`seed: "${key}" is a view`);
+		}
+		return order(meta, keys).flatMap((key) => {
+			const sql = statement(meta.tables[key], fixtures[key]);
+			return sql ? [sql] : [];
+		});
+	};
+	return {
+		[SEED]: true,
+		rows: fixtures,
+		statements,
+		sql: () => statements().join("\n\n"),
+		async insert(sql) {
+			for (const text of statements()) await sql.queryRaw(text);
+		}
+	};
+}
+//#endregion
 export { ConformanceError, LOCAL_JWT_SECRET, asUser, createTestSigner, defineSeed, expectDbBudget, expectTenantIsolation, isSeed, localAuth, localSigningKey, signLocalJwt, signTestJwt, signTestJwtWithKey, testAuthResolver, testCacheAdapter, testEventSink, testExecutor, testGenerator, testPlugin };

package/dist/{types-C83v5SQz.d.ts → types-DONv9SHN.d.ts}

@@ -1,3 +1,4 @@
+/// <reference lib="esnext.temporal" />
 //#region src/schema/types.d.ts
 type Casing = "snake" | "camel";
 /** Runtime metadata for one column. Keyed by the app (cased) column name. */
@@ -27,10 +28,12 @@ interface ColumnMeta {
   readonly storage?: string;
 }
 /**
- * Runtime representation for a column: `date` decodes timestamps to `Date`,
- * `bigint` and `string` read the exact text of `int8`/`numeric` values.
+ * Runtime representation for a column: `instant` decodes `timestamptz` to
+ * `Temporal.Instant`, `plainDateTime` decodes `timestamp` to
+ * `Temporal.PlainDateTime`, and `bigint` and `string` read the exact text of
+ * `int8`/`numeric` values.
  */
-type Codec = "date" | "bigint" | "string";
+type Codec = "instant" | "plainDateTime" | "bigint" | "string";
 interface RelationMeta {
   /** App key of the target table. */
   readonly table: string;
@@ -165,19 +168,19 @@ interface BucketMeta {
   readonly fileSizeLimit?: string;
   readonly allowedMimeTypes?: readonly string[];
 }
-interface RelationShape {
+interface RelationTypes {
   readonly table: string;
   readonly kind: "one" | "many";
   readonly nullable: boolean;
 }
-interface FlagsShape {
+interface ModelFlags {
   readonly softDelete?: string;
   readonly timestamps?: true;
   readonly tenant?: string;
   readonly actor?: true;
   readonly version?: string;
 }
-interface ModelShape {
+interface ModelTypes {
   readonly Row: object;
   readonly Insert: object;
   readonly Update: object;
@@ -188,17 +191,17 @@ interface ModelShape {
   readonly Checks?: string;
   /** Foreign key constraint names on this table. */
   readonly ForeignKeys?: string;
-  readonly Flags: FlagsShape;
+  readonly Flags: ModelFlags;
 }
 type AnyModels = {
-  readonly [table: string]: ModelShape;
+  readonly [table: string]: ModelTypes;
 };
-type FunctionShape = {
+type FunctionTypes = {
   readonly Args: object;
   readonly Returns: unknown;
 };
 type AnyFunctions = {
-  readonly [name: string]: FunctionShape;
+  readonly [name: string]: FunctionTypes;
 };
 /**
  * Carries the model types next to the runtime metadata. Created by
@@ -245,4 +248,4 @@ type IsUnion<T, U = T> = T extends unknown ? [U] extends [T] ? false : true : ne
 type PrimaryKeyValue<M extends AnyModels, T extends keyof M> = true extends IsUnion<PrimaryKeyColumn<M, T>> ? { readonly [K in PrimaryKeyColumn<M, T>]: Row<M, T>[K]; } : Row<M, T>[PrimaryKeyColumn<M, T>];
 type Simplify<T> = { [K in keyof T]: T[K]; } & {};
 //#endregion
-export { SchemaMeta as A, PrimaryKeyValue as C, Relations as D, RelationShape as E, UniqueConstraint as F, UniqueKeyName as I, UniqueWhere as L, TableFlags as M, TableKey as N, Row as O, TableMeta as P, Update as R, PrimaryKeyColumn as S, RelationMeta as T, Insert as _, Casing as a, PermdockBucketPolicy as b, Codec as c, Flags as d, FlagsShape as f, FunctionsOf as g, FunctionShape as h, BucketPolicyName as i, Simplify as j, Schema as k, ColumnMeta as l, FunctionMeta as m, AnyModels as n, CheckConstraint as o, ForeignKeyConstraint as p, BucketMeta as r, ClaimsMeta as s, AnyFunctions as t, DatabaseOf as u, ModelShape as v, RealtimeTableMeta as w, PermdockTopicPolicy as x, ModelsOf as y };
+export { SchemaMeta as A, PrimaryKeyValue as C, Relations as D, RelationTypes as E, UniqueConstraint as F, UniqueKeyName as I, UniqueWhere as L, TableFlags as M, TableKey as N, Row as O, TableMeta as P, Update as R, PrimaryKeyColumn as S, RelationMeta as T, ModelFlags as _, Casing as a, PermdockBucketPolicy as b, Codec as c, Flags as d, ForeignKeyConstraint as f, Insert as g, FunctionsOf as h, BucketPolicyName as i, Simplify as j, Schema as k, ColumnMeta as l, FunctionTypes as m, AnyModels as n, CheckConstraint as o, FunctionMeta as p, BucketMeta as r, ClaimsMeta as s, AnyFunctions as t, DatabaseOf as u, ModelTypes as v, RealtimeTableMeta as w, PermdockTopicPolicy as x, ModelsOf as y };

package/dist/{version-Cqq1m3UY.js → version-BfpG2gks.js}

@@ -1,4 +1,4 @@
-//#region src/cli/version.ts
+//#region src/core/version.ts
 const VERSION = "0.0.0";
 //#endregion
 export { VERSION as t };

package/dist/{view-D1s0wa0T.d.ts → view-3Po_PVlr.d.ts}

@@ -1,7 +1,30 @@
-import { p as DbError } from "./result-CTkCZ6JA.js";
-import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-TVia554c.js";
-import { i as InvalidReason, r as AuthState } from "./resolve-CjHILk2w.js";
+import { p as DbError } from "./result-c2OYgCV2.js";
+import { n as AmrEntry, s as Impersonator, t as Aal } from "./mfa-x3V3vGh-.js";
+import { i as InvalidReason, r as AuthState } from "./resolve-BRciX2jK.js";
 import { JWTClaims, UserClaims } from "@supabase/server";
+//#region src/auth/actor.d.ts
+/** One level of an RFC 8693 `act` chain: who acts, and who acted before it. */
+interface ActClaim {
+  readonly sub: string;
+  readonly act?: ActClaim;
+  readonly [claim: string]: unknown;
+}
+/**
+ * The app acting for the user: the outermost `sub` of an RFC 8693 `act`
+ * chain (prior actors stay on `chain`), else the OAuth `client_id` of a
+ * Supabase OAuth server token.
+ */
+interface SessionActor {
+  readonly id: string;
+  readonly kind: "oauth-client";
+  readonly chain?: ActClaim;
+}
+/** What the user delegated to the actor: the token's OAuth `scope`. */
+interface SessionDelegation {
+  readonly scopes: readonly string[];
+  readonly chain?: ActClaim;
+}
+//#endregion
 //#region src/auth/view.d.ts
 /**
  * The verified caller as plain data: no token, no clients. Safe to return
@@ -29,6 +52,13 @@ type AuthSession<C = unknown, P = unknown> = {
   readonly amr: readonly AmrEntry[];
   /** Set when an admin acts as this user (the `act` claim), for a banner. */
   readonly impersonator?: Impersonator;
+  /**
+   * The OAuth client or agent acting for the user (`client_id`, or the
+   * outermost `sub` of the `act` chain), as PermDock's `actorOf` reads it.
+   */
+  readonly actor?: SessionActor;
+  /** The scopes the user granted `actor`, plus its `act` chain. Set only with `actor`. */
+  readonly delegation?: SessionDelegation;
 } | {
   readonly kind: "service";
   readonly keyName: string;
@@ -46,4 +76,4 @@ type AnonReason = Extract<AuthState, {
 /** Drops the token from an `AuthState`, leaving only serializable fields. */
 declare function toSession<C, P>(auth: AuthState<C, P>): AuthSession<C, P>;
 //#endregion
-export { toSession as n, AuthSession as t };
+export { SessionDelegation as a, SessionActor as i, toSession as n, ActClaim as r, AuthSession as t };

package/dist/{view-aOYizTeE.js → view-wZ-9qIUz.js}

@@ -1,10 +1,17 @@
-import { g as impersonatorOf, n as amrOf, t as aalOf } from "./mfa-CpLfJSde.js";
+import { g as delegationOf, h as actorOf, n as amrOf, t as aalOf, v as impersonatorOf } from "./mfa-BxoR1RkN.js";
 //#region src/auth/view.ts
 /** Drops the token from an `AuthState`, leaving only serializable fields. */
 function toSession(auth) {
 	switch (auth.kind) {
 		case "user": {
 			const impersonator = impersonatorOf(auth.claims);
+			const outcome = actorOf(auth.claims);
+			const actor = outcome.ok ? outcome.actor : void 0;
+			const scopes = actor ? delegationOf(auth.claims)?.scopes : void 0;
+			const delegation = actor && (scopes || actor.chain) ? {
+				scopes: scopes ?? [],
+				...actor.chain ? { chain: actor.chain } : {}
+			} : void 0;
 			return {
 				kind: "user",
 				user: auth.user,
@@ -13,7 +20,9 @@ function toSession(auth) {
 				...auth.profile === void 0 ? {} : { profile: auth.profile },
 				aal: aalOf(auth.claims),
 				amr: amrOf(auth.claims),
-				...impersonator ? { impersonator } : {}
+				...impersonator ? { impersonator } : {},
+				...actor ? { actor } : {},
+				...delegation ? { delegation } : {}
 			};
 		}
 		case "service": return {

package/dist/webhooks/index.d.ts

@@ -1,19 +1,20 @@
-import { N as TableKey, O as Row, n as AnyModels, t as AnyFunctions } from "../types-C83v5SQz.js";
-import { o as Result } from "../result-CTkCZ6JA.js";
-import { t as BetterSupabase } from "../define-e3zI4_4g.js";
-//#region src/webhooks/index.d.ts
-export interface VerifiedWebhook<T = unknown> {
+/// <reference lib="esnext.temporal" />
+import { N as TableKey, O as Row, n as AnyModels, t as AnyFunctions } from "../types-DONv9SHN.js";
+import { o as Result } from "../result-c2OYgCV2.js";
+import { t as BetterSupabase } from "../define-DUbydmJa.js";
+//#region src/webhooks/verify.d.ts
+interface VerifiedWebhook<T = unknown> {
   readonly id: string;
-  readonly timestamp: Date;
+  readonly timestamp: Temporal.Instant;
   readonly payload: T;
   readonly body: string;
 }
-export interface VerifyOptions {
+interface VerifyOptions {
   /** Allowed clock skew in seconds. Defaults to 300. */
   readonly tolerance?: number;
-  readonly now?: () => number;
+  readonly now?: () => Temporal.Instant;
 }
-export type WebhookInput = Request | {
+type WebhookInput = Request | {
   readonly headers: Headers | Readonly<Record<string, string>>;
   readonly body: string;
 };
@@ -23,7 +24,7 @@ export declare function timingSafeEqual(a: string, b: string): boolean;
 export declare function signWebhook(secret: string, message: {
   readonly id: string;
   readonly body: string;
-  readonly timestamp?: Date;
+  readonly timestamp?: Temporal.Instant;
 }): Promise<Record<string, string>>;
 /**
  * Verifies a Standard Webhooks signature (`webhook-id`, `webhook-timestamp`,
@@ -41,13 +42,13 @@ interface HookUser {
   readonly user_metadata?: Readonly<Record<string, unknown>>;
   readonly [key: string]: unknown;
 }
-export interface AuthHookError {
+interface AuthHookError {
   readonly error: {
     readonly http_code: number;
     readonly message: string;
   };
 }
-export interface AuthHooks {
+interface AuthHooks {
   custom_access_token: {
     input: {
       readonly user_id: string;
@@ -116,7 +117,7 @@ export interface AuthHooks {
     output: Record<never, never>;
   };
 }
-export type AuthHookKind = keyof AuthHooks;
+type AuthHookKind = keyof AuthHooks;
 /** Rejects a hook with a status and message Supabase Auth passes to the client. */
 export declare function hookError(status: number, message: string): AuthHookError;
 /**
@@ -130,14 +131,14 @@ export declare function hookError(status: number, message: string): AuthHookErro
  * ```
  */
 export declare function authHook<K extends AuthHookKind>(_kind: K, secret: string | readonly string[], handler: (payload: AuthHooks[K]["input"], webhook: VerifiedWebhook<AuthHooks[K]["input"]>) => AuthHooks[K]["output"] | AuthHookError | Promise<AuthHooks[K]["output"] | AuthHookError>, options?: VerifyOptions): (request: Request) => Promise<Response>;
-export interface DatabaseWebhookPayload {
+interface DatabaseWebhookPayload {
   readonly type: "INSERT" | "UPDATE" | "DELETE";
   readonly table: string;
   readonly schema: string;
   readonly record: Readonly<Record<string, unknown>> | null;
   readonly old_record: Readonly<Record<string, unknown>> | null;
 }
-export interface DatabaseChange<R> {
+interface DatabaseChange<R> {
   readonly type: "INSERT" | "UPDATE" | "DELETE";
   readonly table: string;
   readonly record: R | null;
@@ -149,4 +150,5 @@ export declare function isDatabaseWebhook(value: unknown): value is DatabaseWebh
  * Returns `null` for other tables or payloads that aren't database webhooks.
  */
 export declare function databaseChange<M extends AnyModels, D, F extends AnyFunctions, E, T extends TableKey<M>>(sb: BetterSupabase<M, D, F, E>, table: T, payload: unknown): DatabaseChange<Row<M, T>> | null;
-//#endregion
+//#endregion
+export type { AuthHookError, AuthHookKind, AuthHooks, DatabaseChange, DatabaseWebhookPayload, VerifiedWebhook, VerifyOptions, WebhookInput };

package/dist/webhooks/index.js

@@ -1,2 +1,2 @@
-import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../webhooks-DMipjhSP.js";
+import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../webhooks-CAIFQSTM.js";
 export { authHook, databaseChange, hookError, isDatabaseWebhook, signWebhook, timingSafeEqual, verifySharedSecret, verifyWebhook };

package/dist/{webhooks-DMipjhSP.js → webhooks-CAIFQSTM.js}

@@ -1,13 +1,16 @@
 import { n as dbError } from "./errors-Bl3rkOzo.js";
+import { n as nowInstant, r as optionalTemporal } from "./temporal-BwshQk0W.js";
+import { n as temporalMissing } from "./temporal-required-CMxeSVPo.js";
 import { i as ok, n as err } from "./result-DWXatkd6.js";
+import { i as toBase64, r as fromBase64 } from "./base64-CQeB1eSf.js";
 import { s as toApp } from "./shared-_6-uPL7E.js";
-//#region src/webhooks/index.ts
+//#region src/webhooks/verify.ts
 const encoder = new TextEncoder();
 /** Accepts `whsec_…`, `v1,whsec_…` (Supabase Auth hooks) or raw base64. */
 function secretBytes(secret) {
 	const raw = secret.replace(/^v1,/, "").replace(/^whsec_/, "");
 	try {
-		return Uint8Array.from(atob(raw), (char) => char.charCodeAt(0));
+		return fromBase64(raw);
 	} catch {
 		throw new TypeError("Webhook secret is not valid base64");
 	}
@@ -17,10 +20,7 @@ async function signature(secret, content) {
 		name: "HMAC",
 		hash: "SHA-256"
 	}, false, ["sign"]);
-	const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(content)));
-	let binary = "";
-	for (const byte of mac) binary += String.fromCharCode(byte);
-	return btoa(binary);
+	return toBase64(new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(content))));
 }
 /** Constant-time string comparison. */
 function timingSafeEqual(a, b) {
@@ -37,7 +37,7 @@ function header(headers, name) {
 const unauthorized = (code, message) => dbError("unauthorized", message, { code });
 /** Headers for a signed Standard Webhooks request. */
 async function signWebhook(secret, message) {
-	const timestamp = String(Math.floor((message.timestamp ?? /* @__PURE__ */ new Date()).getTime() / 1e3));
+	const timestamp = String(Math.floor((message.timestamp ?? nowInstant()).epochMilliseconds / 1e3));
 	return {
 		"webhook-id": message.id,
 		"webhook-timestamp": timestamp,
@@ -58,7 +58,9 @@ async function verifyWebhook(input, secrets, options = {}) {
 	if (!id || !timestamp || !signatures) return err(unauthorized("WEBHOOK_MISSING_HEADERS", "Missing webhook signature headers"));
 	const seconds = Number(timestamp);
 	if (!/^\d+$/.test(timestamp)) return err(unauthorized("WEBHOOK_INVALID_TIMESTAMP", "Invalid webhook timestamp"));
-	const now = (options.now?.() ?? Date.now()) / 1e3;
+	const namespace = optionalTemporal();
+	if (namespace === void 0) return err(temporalMissing());
+	const now = (options.now?.() ?? namespace.Now.instant()).epochMilliseconds / 1e3;
 	const tolerance = options.tolerance ?? 300;
 	if (seconds < now - tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_OLD", "Webhook timestamp is too old"));
 	if (seconds > now + tolerance) return err(unauthorized("WEBHOOK_TIMESTAMP_TOO_NEW", "Webhook timestamp is in the future"));
@@ -73,7 +75,7 @@ async function verifyWebhook(input, secrets, options = {}) {
 	try {
 		return ok({
 			id,
-			timestamp: /* @__PURE__ */ new Date(seconds * 1e3),
+			timestamp: namespace.Instant.fromEpochMilliseconds(seconds * 1e3),
 			payload: JSON.parse(body),
 			body
 		});