better-supabase 0.3.0 → 0.5.0

package/dist/webhooks/index.js

@@ -1,2 +1,588 @@
-import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../webhooks-CAIFQSTM.js";
-export { authHook, databaseChange, hookError, isDatabaseWebhook, signWebhook, timingSafeEqual, verifySharedSecret, verifyWebhook };
+import { c as mapDbError, n as dbError } from "../errors-DtwXa6b8.js";
+import { t as temporal } from "../temporal-required-CAt4Dc9Z.js";
+import { i as ok, n as err, o as toDbError, t as AsyncResult } from "../result-BKiliPY7.js";
+import { i as toBase64 } from "../base64-D2gsioCY.js";
+import { a as problemResponse } from "../problem-BW1KhzSG.js";
+import { n as emitKitEvent } from "../kit-events-CTFDfSwb.js";
+import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../verify-Ce49ETPz.js";
+import { n as rpcTransport, r as sqlTransport, t as rawError } from "../kit-transport-DJlHQUBU.js";
+//#region src/webhooks/http.ts
+/** A delivery that must not be retried, e.g. a URL `allowUrl` rejected. */
+var WebhookPolicyError = class extends Error {
+	name = "WebhookPolicyError";
+};
+const REDIRECTS = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/** `Retry-After` as seconds from now: delta-seconds or an HTTP date. */
+function parseRetryAfter(value, now = Date.now()) {
+	if (value === null) return void 0;
+	const text = value.trim();
+	if (/^\d+$/.test(text)) return Number(text);
+	const at = Date.parse(text);
+	if (Number.isNaN(at)) return void 0;
+	return Math.max(0, Math.ceil((at - now) / 1e3));
+}
+/** Reads at most `limit` bytes of the body, then cancels the stream. */
+async function readCapped(response, limit) {
+	if (!response.body) return "";
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let text = "";
+	let left = limit;
+	try {
+		while (left > 0) {
+			const { done, value } = await reader.read();
+			if (done) return text + decoder.decode();
+			const chunk = value.byteLength > left ? value.subarray(0, left) : value;
+			left -= chunk.byteLength;
+			text += decoder.decode(chunk, { stream: true });
+		}
+		return text + decoder.decode();
+	} finally {
+		await reader.cancel().catch(() => void 0);
+	}
+}
+async function allowed(allowUrl, url) {
+	try {
+		return await allowUrl(url);
+	} catch {
+		return false;
+	}
+}
+/** Sends webhooks with `fetch`, following redirects only to allowed URLs. */
+function fetchTransport(options = {}) {
+	const send = options.fetch ?? globalThis.fetch;
+	const maxRedirects = options.maxRedirects ?? 0;
+	const timeoutMs = options.timeoutMs ?? 1e4;
+	const maxResponseBytes = options.maxResponseBytes ?? 65536;
+	return {
+		apiVersion: 1,
+		name: "fetch",
+		async send(request) {
+			const timeout = AbortSignal.timeout(timeoutMs);
+			const signal = request.signal ? AbortSignal.any([request.signal, timeout]) : timeout;
+			let url = new URL(request.url);
+			for (let hop = 0;; hop++) {
+				if (options.allowUrl && !await allowed(options.allowUrl, url)) throw new WebhookPolicyError(`Endpoint URL is not allowed: ${url.host}`);
+				const response = await send(url, {
+					method: "POST",
+					headers: request.headers,
+					body: request.body,
+					redirect: "manual",
+					signal
+				});
+				if (!REDIRECTS.has(response.status)) {
+					const retryAfter = parseRetryAfter(response.headers.get("retry-after"));
+					return {
+						status: response.status,
+						body: await readCapped(response, maxResponseBytes),
+						...retryAfter === void 0 ? {} : { retryAfter }
+					};
+				}
+				await response.body?.cancel();
+				const location = response.headers.get("location");
+				if (!location) throw new WebhookPolicyError(`Redirect ${String(response.status)} without a location`);
+				if (hop >= maxRedirects) throw new WebhookPolicyError(maxRedirects === 0 ? `Redirect ${String(response.status)} not followed (maxRedirects is 0)` : `More than ${String(maxRedirects)} redirects`);
+				url = new URL(location, url);
+			}
+		}
+	};
+}
+//#endregion
+//#region src/webhooks/secrets.ts
+/** The kit's `webhook_secrets` and `rotate_webhook_secret` functions. */
+function sqlSecretStore(transport, options = {}) {
+	const schema = options.schema ?? "better_supabase";
+	return {
+		apiVersion: 1,
+		async secrets(endpointId) {
+			const value = await transport.call(schema, "webhook_secrets", { endpoint: endpointId });
+			return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
+		},
+		async rotate(endpointId, rotateOptions = {}) {
+			const value = await transport.call(schema, "rotate_webhook_secret", {
+				endpoint: endpointId,
+				overlap: rotateOptions.overlap,
+				secret: rotateOptions.secret
+			});
+			return String(value);
+		}
+	};
+}
+//#endregion
+//#region src/webhooks/signers.ts
+function needSecrets(secrets) {
+	if (secrets.length === 0) throw new TypeError("The endpoint has no signing secret");
+}
+/**
+* Signs with the [Standard Webhooks](https://www.standardwebhooks.com/)
+* scheme: `webhook-id`, `webhook-timestamp` and one `v1,` signature per
+* secret in `webhook-signature`. `verifyWebhook` checks it.
+*/
+function standardWebhooks(options = {}) {
+	const names = {
+		id: options.headers?.id ?? "webhook-id",
+		timestamp: options.headers?.timestamp ?? "webhook-timestamp",
+		signature: options.headers?.signature ?? "webhook-signature"
+	};
+	return {
+		apiVersion: 1,
+		name: "standard-webhooks",
+		async sign({ id, body, timestamp, secrets }) {
+			needSecrets(secrets);
+			const signed = await Promise.all(secrets.map((secret) => signWebhook(secret, {
+				id,
+				body,
+				timestamp
+			})));
+			return {
+				[names.id]: id,
+				[names.timestamp]: signed[0]["webhook-timestamp"],
+				[names.signature]: signed.map((headers) => headers["webhook-signature"]).join(" ")
+			};
+		}
+	};
+}
+const encoder = /* @__PURE__ */ new TextEncoder();
+const hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+/**
+* HMAC-SHA256 with the secret's UTF-8 bytes as the key, for receivers that
+* verify an existing format, e.g. `v1=<hex>` over `timestamp.body`.
+*/
+function hmacSigner(options) {
+	const content = options.content ?? ((input) => `${input.timestamp}.${input.body}`);
+	const encode = options.encoding === "base64" ? toBase64 : hex;
+	const prefix = options.prefix ?? "v1=";
+	return {
+		apiVersion: 1,
+		name: options.name ?? "hmac",
+		async sign({ id, body, timestamp, secrets }) {
+			needSecrets(secrets);
+			const seconds = String(Math.floor(timestamp.epochMilliseconds / 1e3));
+			const message = encoder.encode(content({
+				id,
+				timestamp: seconds,
+				body
+			}));
+			const signatures = await Promise.all(secrets.map(async (secret) => {
+				const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+					name: "HMAC",
+					hash: "SHA-256"
+				}, false, ["sign"]);
+				const mac = await crypto.subtle.sign("HMAC", key, message);
+				return `${prefix}${encode(new Uint8Array(mac))}`;
+			}));
+			return {
+				[options.signatureHeader]: signatures.join(options.separator ?? ","),
+				...options.timestampHeader ? { [options.timestampHeader]: seconds } : {},
+				...options.idHeader ? { [options.idHeader]: id } : {}
+			};
+		}
+	};
+}
+//#endregion
+//#region src/webhooks/url-policy.ts
+const PRIVATE_V4 = [
+	[0, 8],
+	[167772160, 8],
+	[1681915904, 10],
+	[2130706432, 8],
+	[2851995648, 16],
+	[2886729728, 12],
+	[3221225472, 24],
+	[3221225984, 24],
+	[3232235520, 16],
+	[3323068416, 15],
+	[3325256704, 24],
+	[3405803776, 24],
+	[3758096384, 4],
+	[4026531840, 4]
+];
+function v4(address) {
+	const parts = address.split(".");
+	if (parts.length !== 4) return void 0;
+	let value = 0;
+	for (const part of parts) {
+		if (!/^\d{1,3}$/.test(part)) return void 0;
+		const octet = Number(part);
+		if (octet > 255) return void 0;
+		value = value * 256 + octet;
+	}
+	return value;
+}
+const publicV4 = (value) => !PRIVATE_V4.some(([base, bits]) => Math.floor(value / 2 ** (32 - bits)) === Math.floor(base / 2 ** (32 - bits)));
+function v6(address) {
+	let text = address.toLowerCase();
+	const zone = text.indexOf("%");
+	if (zone !== -1) text = text.slice(0, zone);
+	if (text.includes(".")) {
+		const colon = text.lastIndexOf(":");
+		const embedded = v4(text.slice(colon + 1));
+		if (embedded === void 0) return void 0;
+		const high = Math.floor(embedded / 65536).toString(16);
+		const low = (embedded % 65536).toString(16);
+		text = `${text.slice(0, colon + 1)}${high}:${low}`;
+	}
+	const halves = text.split("::");
+	if (halves.length > 2) return void 0;
+	const groups = (part) => part === "" ? [] : part.split(":");
+	const head = groups(halves[0]);
+	const rest = halves.length === 2 ? groups(halves[1]) : [];
+	if (![...head, ...rest].every((group) => /^[0-9a-f]{1,4}$/.test(group))) return void 0;
+	const known = head.length + rest.length;
+	if (halves.length === 1 ? known !== 8 : known > 7) return void 0;
+	return [
+		...head,
+		...Array.from({ length: 8 - known }, () => "0"),
+		...rest
+	].map((group) => Number.parseInt(group, 16));
+}
+function publicV6(groups) {
+	const [first = 0] = groups;
+	const zeros = (from, to) => groups.slice(from, to).every((group) => group === 0);
+	const embedded = groups[6] * 65536 + groups[7];
+	if (zeros(0, 8)) return false;
+	if (zeros(0, 7) && groups[7] === 1) return false;
+	if (zeros(0, 5) && groups[5] === 65535) return publicV4(embedded);
+	if (first === 100 && groups[1] === 65435 && zeros(2, 6)) return publicV4(embedded);
+	if (zeros(0, 6)) return false;
+	if (first === 100 && groups[1] === 65435 && groups[2] === 1) return false;
+	if (first === 8194) return publicV4(groups[1] * 65536 + groups[2]);
+	if (first === 8193 && groups[1] === 0) return false;
+	if ((first & 65024) === 64512) return false;
+	if ((first & 65472) === 65152) return false;
+	if ((first & 65472) === 65216) return false;
+	if ((first & 65280) === 65280) return false;
+	if (first === 8193 && groups[1] === 3512) return false;
+	if (first === 256 && zeros(1, 4)) return false;
+	return true;
+}
+/**
+* Whether an IP address is reachable on the public internet: not loopback,
+* private, link-local (cloud metadata), carrier-grade NAT, multicast or
+* reserved. Returns `false` for anything that isn't an IP address.
+*/
+function isPublicAddress(address) {
+	const ipv4 = v4(address);
+	if (ipv4 !== void 0) return publicV4(ipv4);
+	const ipv6 = v6(address.replaceAll(/^\[|\]$/g, ""));
+	return ipv6 !== void 0 && publicV6(ipv6);
+}
+const isAddress = (host) => v4(host) !== void 0 || v6(host) !== void 0;
+const LOCAL_HOST = /(^|\.)(localhost|local|internal|home\.arpa)$/;
+/** `node:dns` without importing it, so this entry stays runtime-neutral. */
+function builtinResolver() {
+	const dns = globalThis.process?.getBuiltinModule?.("node:dns");
+	if (typeof dns !== "object" || dns === null || !("promises" in dns)) return void 0;
+	const { promises } = dns;
+	return async (hostname) => (await promises.lookup(hostname, {
+		all: true,
+		verbatim: true
+	})).map((entry) => entry.address);
+}
+/**
+* The default `allowUrl`: HTTPS only, no credentials in the URL, no local
+* host names, and every address the host resolves to must be public. The
+* delivery transport calls it again for each redirect.
+*
+* DNS can change between this check and the connection. Route webhooks
+* through an egress proxy when that matters.
+*/
+function publicUrl(options = {}) {
+	const resolve = options.resolve === false ? void 0 : options.resolve ?? builtinResolver();
+	if (options.resolve === void 0 && !resolve) throw new TypeError("publicUrl() needs a resolve option on runtimes without node:dns, or resolve: false to skip the DNS check");
+	const trusted = new Set(options.allowHosts?.map((host) => host.toLowerCase()));
+	return async (url) => {
+		const host = url.hostname.toLowerCase().replaceAll(/^\[|\]$/g, "");
+		if (trusted.has(host)) return true;
+		if (url.protocol !== "https:" && !(options.allowHttp && url.protocol === "http:")) return false;
+		if (url.username || url.password) return false;
+		if (isAddress(host)) return isPublicAddress(host);
+		if (LOCAL_HOST.test(host) || !host.includes(".")) return false;
+		if (!resolve) return true;
+		const addresses = await resolve(host);
+		return addresses.length > 0 && addresses.every(isPublicAddress);
+	};
+}
+//#endregion
+//#region src/webhooks/outgoing.ts
+const DEFAULT_SCHEMA = "better_supabase";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const textOf = (value) => value === null || value === void 0 ? null : String(value);
+function toDelivery(row) {
+	return {
+		id: String(row["id"]),
+		endpointId: String(row["endpoint_id"]),
+		url: String(row["url"]),
+		type: String(row["type"]),
+		payload: row["payload"] ?? {},
+		attempt: Number(row["attempt"] ?? 1),
+		tenant: textOf(row["tenant"]),
+		eventId: textOf(row["event_id"]),
+		runId: textOf(row["run_id"]),
+		createdAt: typeof row["created_at"] === "string" ? temporal().Instant.from(row["created_at"]) : temporal().Now.instant()
+	};
+}
+const SCHEDULE = [
+	5,
+	300,
+	1800,
+	7200,
+	18e3,
+	36e3
+];
+const defaultBackoff = (attempt) => Math.round(Math.random() * SCHEDULE[Math.min(Math.max(attempt, 1), SCHEDULE.length) - 1]);
+const MAX_RETRY_AFTER = 86400;
+const defaultRetryable = (status) => status === 408 || status === 429 || status >= 500;
+const errorText = (cause) => cause instanceof Error ? cause.message : String(cause);
+function createWebhooks(options) {
+	const { transport } = options;
+	const schema = options.schema ?? DEFAULT_SCHEMA;
+	const mappers = options.errorMappers ?? [];
+	const store = options.secrets ?? sqlSecretStore(transport, { schema });
+	const signer = options.signer ?? standardWebhooks();
+	const maxAttempts = options.retry?.maxAttempts ?? 8;
+	const backoff = options.retry?.backoff ?? defaultBackoff;
+	const retryable = options.retry?.retryable ?? defaultRetryable;
+	const bodyLimit = options.responseBodyLimit ?? 2e3;
+	let http = options.http;
+	const httpTransport = () => http ??= fetchTransport({ allowUrl: options.allowUrl ?? publicUrl() });
+	const call = (fn, args) => transport.call(schema, fn, args);
+	function run(fn, then) {
+		return AsyncResult.from(async () => {
+			try {
+				return ok(then(await fn()));
+			} catch (cause) {
+				const raw = rawError(cause);
+				return err(raw ? mapDbError(raw, mappers) : toDbError(cause));
+			}
+		});
+	}
+	function emit(type, delivery, extra = {}) {
+		if (!options.events) return;
+		emitKitEvent(options.events, type, {
+			endpointId: delivery.endpointId,
+			deliveryId: delivery.id,
+			eventType: delivery.type,
+			attempt: delivery.attempt,
+			...extra
+		}, {
+			subject: `webhooks/${delivery.endpointId}`,
+			...delivery.tenant ? { tenant: delivery.tenant } : {},
+			...options.context ? { context: options.context } : {}
+		});
+	}
+	async function complete(delivery, status, detail) {
+		const retryAfter = Math.min(detail.response?.retryAfter ?? 0, MAX_RETRY_AFTER);
+		const retryAt = status === "retrying" ? temporal().Now.instant().add({ seconds: Math.max(backoff(delivery.attempt), retryAfter) }).toString() : void 0;
+		return call("complete_webhook_delivery", {
+			delivery: delivery.id,
+			outcome: {
+				status,
+				attempt: delivery.attempt,
+				...retryAt ? { retry_at: retryAt } : {},
+				...detail.response ? {
+					response_status: detail.response.status,
+					response_body: detail.response.body.slice(0, bodyLimit)
+				} : {},
+				...detail.durationMs === void 0 ? {} : { duration_ms: detail.durationMs },
+				...detail.error === void 0 ? {} : { error: detail.error.slice(0, bodyLimit) }
+			}
+		});
+	}
+	const failure = (delivery) => delivery.attempt >= maxAttempts ? "dead" : "retrying";
+	async function attempt(delivery) {
+		if (options.shouldDeliver) {
+			let send;
+			try {
+				send = await options.shouldDeliver(delivery);
+			} catch (cause) {
+				return {
+					outcome: "canceled",
+					error: errorText(cause)
+				};
+			}
+			if (!send) return {
+				outcome: "canceled",
+				error: "Canceled by shouldDeliver"
+			};
+		}
+		let body;
+		let headers;
+		try {
+			const secrets = await store.secrets(delivery.endpointId);
+			if (secrets.length === 0) return {
+				outcome: "dead",
+				error: "The endpoint has no signing secret"
+			};
+			body = JSON.stringify(options.transform ? await options.transform(delivery) : {
+				type: delivery.type,
+				timestamp: delivery.createdAt.toString(),
+				data: delivery.payload
+			});
+			headers = {
+				"content-type": "application/json",
+				"user-agent": "better-supabase-webhooks",
+				...options.headers?.(delivery),
+				...await signer.sign({
+					id: delivery.id,
+					body,
+					timestamp: temporal().Now.instant(),
+					secrets
+				})
+			};
+		} catch (cause) {
+			return {
+				outcome: failure(delivery),
+				error: errorText(cause)
+			};
+		}
+		const started = Date.now();
+		try {
+			const response = await httpTransport().send({
+				url: delivery.url,
+				headers,
+				body
+			});
+			const durationMs = Date.now() - started;
+			if (response.status >= 200 && response.status < 300) return {
+				outcome: "succeeded",
+				response,
+				durationMs
+			};
+			return {
+				outcome: retryable(response.status) ? failure(delivery) : "dead",
+				response,
+				durationMs,
+				error: `HTTP ${String(response.status)}`
+			};
+		} catch (cause) {
+			return {
+				outcome: cause instanceof WebhookPolicyError ? "dead" : failure(delivery),
+				durationMs: Date.now() - started,
+				error: errorText(cause)
+			};
+		}
+	}
+	async function deliver(deliverOptions = {}) {
+		const counts = {
+			succeeded: 0,
+			retrying: 0,
+			dead: 0,
+			canceled: 0,
+			disabled: 0
+		};
+		const deadline = deliverOptions.budgetMs === void 0 ? Number.POSITIVE_INFINITY : Date.now() + deliverOptions.budgetMs;
+		const batch = deliverOptions.batch ?? 25;
+		const concurrency = Math.max(1, deliverOptions.concurrency ?? 10);
+		async function handle(delivery) {
+			const result = await attempt(delivery);
+			const state = await complete(delivery, result.outcome, result);
+			if (state === "stale") return;
+			switch (result.outcome) {
+				case "succeeded":
+					counts.succeeded += 1;
+					emit("webhook.delivered", delivery, { status: result.response?.status ?? 200 });
+					break;
+				case "retrying":
+				case "dead":
+					if (result.outcome === "retrying") counts.retrying += 1;
+					else counts.dead += 1;
+					emit("webhook.failed", delivery, {
+						...result.response ? { status: result.response.status } : {},
+						...result.error ? { error: result.error } : {}
+					});
+					break;
+				case "canceled":
+					counts.canceled += 1;
+					break;
+				default: {
+					const unknown = result.outcome;
+					throw new TypeError(`Unknown outcome ${String(unknown)}`);
+				}
+			}
+			if (state === "disabled") {
+				counts.disabled += 1;
+				emit("webhook.disabled", delivery);
+			}
+		}
+		while (Date.now() < deadline) {
+			const claimed = await call("claim_webhook_deliveries", {
+				max_items: batch,
+				lease: deliverOptions.lease ?? "2 minutes",
+				max_attempts: maxAttempts
+			});
+			const queue = (Array.isArray(claimed) ? claimed : []).filter(isRecord).map(toDelivery);
+			const size = queue.length;
+			await Promise.all(Array.from({ length: Math.min(concurrency, size) }, async () => {
+				for (let next = queue.shift(); next; next = queue.shift()) await handle(next);
+			}));
+			if (size < batch) break;
+		}
+		return counts;
+	}
+	return {
+		publish: (event) => run(() => call("publish_webhook_event", {
+			event_type: event.type,
+			payload: event.data ?? {},
+			tenant: event.tenant ?? null,
+			event_id: event.id ?? null
+		}), Number),
+		dispatch: (input) => run(() => call("dispatch_webhook", {
+			endpoint: input.endpointId,
+			event_type: input.type,
+			payload: input.data ?? {},
+			run_id: input.runId ?? null,
+			event_id: input.eventId ?? null
+		}), String),
+		redeliver: (deliveryId) => run(() => call("redeliver_webhook", { delivery: deliveryId }), String),
+		rotateSecret(endpointId, rotateOptions) {
+			if (!store.rotate) return AsyncResult.err(dbError("unexpected", "The secret store can't rotate secrets"));
+			const rotate = store.rotate.bind(store);
+			return run(() => rotate(endpointId, rotateOptions), String);
+		},
+		deliver,
+		deliverRoute(routeOptions) {
+			const secret = routeOptions.secret;
+			if (!secret) throw new TypeError("deliverRoute needs a secret, such as process.env.CRON_SECRET");
+			return async (request) => {
+				const instance = new URL(request.url).pathname;
+				if (request.method !== "GET" && request.method !== "POST") return new Response(null, {
+					status: 405,
+					headers: { allow: "GET, POST" }
+				});
+				if (!verifySharedSecret(request, secret)) return problemResponse(dbError("unauthorized", "The deliver route needs its bearer secret"), { instance });
+				try {
+					return Response.json(await deliver({
+						budgetMs: 5e4,
+						...routeOptions
+					}));
+				} catch (cause) {
+					routeOptions.onError?.(cause);
+					return problemResponse(toDbError(cause), { instance });
+				}
+			};
+		},
+		sink: (sinkOptions = {}) => {
+			const prefix = `${sinkOptions.typePrefix ?? "dev.better-supabase"}.`;
+			return { async send(events) {
+				for (const event of events) {
+					const tenant = event["partitionkey"];
+					await call("publish_webhook_event", {
+						event_type: event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type,
+						payload: event.data ?? {},
+						tenant: typeof tenant === "string" ? tenant : null,
+						event_id: event.id
+					});
+				}
+			} };
+		}
+	};
+}
+//#endregion
+export { WebhookPolicyError, authHook, createWebhooks, databaseChange, fetchTransport, hmacSigner, hookError, isDatabaseWebhook, isPublicAddress, publicUrl, rpcTransport, signWebhook, sqlSecretStore, sqlTransport, standardWebhooks, timingSafeEqual, verifySharedSecret, verifyWebhook };

package/dist/wire-D2dT86vi.js

@@ -0,0 +1,35 @@
+import { n as dbError, t as DbException } from "./errors-DtwXa6b8.js";
+import { i as temporalText } from "./temporal-CVlIV2DZ.js";
+import { t as temporal } from "./temporal-required-CAt4Dc9Z.js";
+//#region src/ir/wire.ts
+/** Wire form of an app value: Temporal values to ISO text, `bigint` to decimal text. */
+function encodeValue(value) {
+	if (typeof value !== "object" || value === null) return typeof value === "bigint" ? value.toString() : value;
+	const text = temporalText(value);
+	if (text !== void 0) return text;
+	if (Array.isArray(value)) return value.map(encodeValue);
+	return value;
+}
+/** Postgres timestamps can be `infinity`; Temporal has no such value. */
+function finite(value, type) {
+	const text = String(value);
+	if (text === "infinity" || text === "-infinity") throw new DbException(dbError("invalid_value", `${text} can't be held by a Temporal.${type}`));
+	return text;
+}
+/** App form of one wire scalar for a column with `codec`. */
+function decodeScalar(codec, value) {
+	if (value === null || value === void 0) return value;
+	switch (codec) {
+		case "instant": return temporal().Instant.from(finite(value, "Instant"));
+		case "plainDateTime": return temporal().PlainDateTime.from(finite(value, "PlainDateTime"));
+		case "bigint": return BigInt(value);
+		case "string": return String(value);
+		default: return codec;
+	}
+}
+/** App form of a wire value for a column with `codec`. */
+function decodeValue(codec, value) {
+	return Array.isArray(value) ? value.map((item) => decodeScalar(codec, item)) : decodeScalar(codec, value);
+}
+//#endregion
+export { decodeValue as n, encodeValue as r, decodeScalar as t };