better-supabase 0.5.0 → 0.6.0

package/dist/workflow-sdk/world/index.js

@@ -0,0 +1,702 @@
+import { n as dbError } from "../../errors-B11Duf73.js";
+import { a as problemResponse } from "../../problem-BreOl8b8.js";
+import { r as sqlIdent } from "../../template--jDkl3UP.js";
+import { Y as WORLD_POSTGRES_VERSION, r as WORKFLOW_VAULT_SECRETS } from "../../workflow-sdk-world-D-prir6O.js";
+import { Pool } from "pg";
+import { reenqueueActiveRuns } from "@workflow/world";
+import { createWorld as createWorld$1 } from "@workflow/world-postgres";
+//#region src/workflow-sdk/world/analytics.ts
+/** world-postgres stores UTC in `timestamp without time zone` columns. */
+const utc = (column) => `(${column} at time zone 'UTC')`;
+const RUN_COLUMNS = `
+  r.id as "runId", r.status::text as status, r.deployment_id as "deploymentId",
+  r.name as "workflowName", nullif(r.spec_version, '')::int as "specVersion",
+  coalesce(r.attributes, '{}'::jsonb) as attributes,
+  ${utc("r.created_at")} as "createdAt", ${utc("r.updated_at")} as "updatedAt",
+  ${utc("r.started_at")} as "startedAt", ${utc("r.completed_at")} as "completedAt",
+  r.error_code as "errorCode",
+  r.encryption_public_key is not null as "workflowEncryptionEnabled"`;
+const STEP_COLUMNS = `
+  s.run_id as "runId", s.step_id as "stepId", s.step_name as "stepName",
+  s.status::text as status, s.attempt,
+  ${utc("s.created_at")} as "createdAt", ${utc("s.updated_at")} as "updatedAt",
+  ${utc("s.started_at")} as "startedAt", ${utc("s.completed_at")} as "completedAt",
+  ${utc("s.retry_after")} as "retryAfter"`;
+const EVENT_COLUMNS = `
+  e.run_id as "runId", e.id as "eventId", e.type as "eventType",
+  e.correlation_id as "correlationId", e.correlation_id as "entityId",
+  (select s.step_name from workflow.workflow_steps s
+    where s.run_id = e.run_id and s.step_id = e.correlation_id) as "stepName",
+  r.name as "workflowName", r.deployment_id as "deploymentId",
+  e.spec_version as "specVersion", ${utc("r.created_at")} as "runCreatedAt",
+  ${utc("e.created_at")} as "createdAt",
+  case when e.payload ? 'resumeAt' then (e.payload ->> 'resumeAt')::timestamptz end as "resumeAt",
+  case when e.payload ? 'retryAfter' then (e.payload ->> 'retryAfter')::timestamptz end as "retryAfter",
+  e.payload ->> 'errorCode' as "errorCode"`;
+/** world-postgres keys waits `<runId>-<correlationId>`; analytics names them by the correlation id, as steps and hooks. */
+const WAIT_COLUMNS = `
+  w.run_id as "runId",
+  case when starts_with(w.wait_id, w.run_id || '-')
+    then substr(w.wait_id, length(w.run_id) + 2) else w.wait_id end as "waitId",
+  w.status::text as status,
+  ${utc("w.resume_at")} as "resumeAt", ${utc("w.created_at")} as "createdAt",
+  ${utc("w.updated_at")} as "updatedAt", ${utc("w.completed_at")} as "completedAt"`;
+/** Hooks keep their row only while active, so the status comes from the event log. */
+const HOOKS = `
+  select e.run_id as "runId", e.correlation_id as "hookId",
+    case
+      when bool_or(e.type = 'hook_conflict') then 'conflict'
+      when bool_or(e.type = 'hook_disposed') then 'disposed'
+      when bool_or(e.type = 'hook_received') then 'received'
+      else 'created'
+    end as status,
+    ${utc("min(e.created_at)")} as "createdAt",
+    ${utc("max(e.created_at)")} as "updatedAt",
+    ${utc("max(e.created_at) filter (where e.type = 'hook_received')")} as "receivedAt",
+    ${utc("max(e.created_at) filter (where e.type = 'hook_disposed')")} as "disposedAt",
+    bool_or(h.is_webhook) as "isWebhook", bool_or(h.is_system) as "isSystem"
+  from workflow.workflow_events e
+  left join workflow.workflow_hooks h on h.hook_id = e.correlation_id
+  where e.type like 'hook\\_%' and e.correlation_id is not null`;
+function page(pagination, max) {
+	const limit = Math.min(max, Math.max(1, pagination?.limit ?? max));
+	if (pagination?.limit !== void 0 && pagination.limit > max) throw new RangeError(`better-supabase: the analytics page limit is ${String(max)}, got ${String(pagination.limit)}`);
+	const offset = Number(pagination?.cursor ?? 0);
+	return {
+		limit,
+		offset: Number.isSafeInteger(offset) && offset > 0 ? offset : 0,
+		order: pagination?.sortOrder === "asc" ? "asc" : "desc"
+	};
+}
+function paged(rows, limit, offset) {
+	const hasMore = rows.length > limit;
+	return {
+		data: rows.slice(0, limit),
+		hasMore,
+		cursor: hasMore ? String(offset + limit) : null
+	};
+}
+/** Converts SQL nulls to the optional fields the analytics schemas allow. */
+function compact(row) {
+	const out = {};
+	for (const [key, value] of Object.entries(row)) if (value !== null) out[key] = value;
+	return out;
+}
+function notFound(what, id) {
+	return /* @__PURE__ */ new Error(`better-supabase: workflow ${what} "${id}" not found`);
+}
+const RUN_SCOPED_LIMIT = 1e3;
+const LIMIT = 100;
+const MAX_ATTRIBUTE_FILTERS = 8;
+/**
+* The World's `analytics` namespace over the world-postgres tables: the run
+* listing filters by status, name, window and latest attributes (the GIN
+* index on `workflow_runs.attributes` serves the filter).
+*/
+function createAnalytics(pool) {
+	const rows = async (sql, params) => {
+		return (await pool.query(sql, [...params])).rows.map((row) => compact(row));
+	};
+	const one = async (sql, params, what, id) => {
+		const [row] = await rows(sql, params);
+		if (row === void 0) throw notFound(what, id);
+		return row;
+	};
+	const window = (params, column, values) => {
+		if (params.startTime === void 0 !== (params.endTime === void 0)) throw new TypeError("better-supabase: analytics startTime and endTime go together");
+		if (params.startTime === void 0 || params.endTime === void 0) return "";
+		values.push(params.startTime, params.endTime);
+		return ` and ${utc(column)} between $${String(values.length - 1)}::timestamptz and $${String(values.length)}::timestamptz`;
+	};
+	const listEvents = async (params) => {
+		const { limit, offset, order } = page(params.pagination, RUN_SCOPED_LIMIT);
+		const values = [params.runId];
+		let where = "e.run_id = $1";
+		if (params.eventType !== void 0) {
+			values.push(params.eventType);
+			where += ` and e.type = $${String(values.length)}`;
+		}
+		if (params.correlationId !== void 0) {
+			values.push(params.correlationId);
+			where += ` and e.correlation_id = $${String(values.length)}`;
+		}
+		values.push(limit + 1, offset);
+		return paged(await rows(`select ${EVENT_COLUMNS} from workflow.workflow_events e
+       join workflow.workflow_runs r on r.id = e.run_id
+       where ${where} order by e.id ${order}
+       limit $${String(values.length - 1)} offset $${String(values.length)}`, values), limit, offset);
+	};
+	return {
+		runs: {
+			get: (runId) => one(`select ${RUN_COLUMNS} from workflow.workflow_runs r where r.id = $1`, [runId], "run", runId),
+			async list(params = {}) {
+				const { limit, offset, order } = page(params.pagination, LIMIT);
+				const values = [];
+				let where = "true";
+				if (params.workflowName !== void 0) {
+					values.push(params.workflowName);
+					where += ` and r.name = $${String(values.length)}`;
+				}
+				if (params.status !== void 0) {
+					values.push(params.status);
+					where += ` and r.status::text = $${String(values.length)}`;
+				}
+				if (params.attributes !== void 0) {
+					if (Object.keys(params.attributes).length > MAX_ATTRIBUTE_FILTERS) throw new RangeError(`better-supabase: analytics filters by at most ${String(MAX_ATTRIBUTE_FILTERS)} attributes`);
+					values.push(JSON.stringify(params.attributes));
+					where += ` and r.attributes @> $${String(values.length)}::jsonb`;
+				}
+				where += window(params, "r.updated_at", values);
+				values.push(limit + 1, offset);
+				return paged(await rows(`select ${RUN_COLUMNS} from workflow.workflow_runs r where ${where}
+           order by r.created_at ${order}, r.id ${order}
+           limit $${String(values.length - 1)} offset $${String(values.length)}`, values), limit, offset);
+			}
+		},
+		attributes: { async list(params = {}) {
+			const { limit, offset } = page(params.pagination, LIMIT);
+			const values = [];
+			let where = "true";
+			if (params.workflowName !== void 0) {
+				values.push(params.workflowName);
+				where += ` and r.name = $${String(values.length)}`;
+			}
+			where += window(params, "r.updated_at", values);
+			values.push(limit + 1, offset);
+			return paged(await rows(`select k.key, count(*)::int as "runCount",
+             ${utc("min(r.created_at)")} as "firstSeenAt",
+             ${utc("max(r.updated_at)")} as "lastSeenAt"
+           from workflow.workflow_runs r
+           cross join lateral jsonb_object_keys(coalesce(r.attributes, '{}'::jsonb)) as k(key)
+           where ${where}
+           group by k.key order by k.key
+           limit $${String(values.length - 1)} offset $${String(values.length)}`, values), limit, offset);
+		} },
+		steps: {
+			get: (runId, stepId) => one(`select ${STEP_COLUMNS} from workflow.workflow_steps s where s.run_id = $1 and s.step_id = $2`, [runId, stepId], "step", stepId),
+			async list(params) {
+				const { limit, offset, order } = page(params.pagination, RUN_SCOPED_LIMIT);
+				return paged(await rows(`select ${STEP_COLUMNS} from workflow.workflow_steps s where s.run_id = $1
+           order by s.created_at ${order}, s.step_id ${order} limit $2 offset $3`, [
+					params.runId,
+					limit + 1,
+					offset
+				]), limit, offset);
+			}
+		},
+		events: {
+			get: (runId, eventId) => one(`select ${EVENT_COLUMNS} from workflow.workflow_events e
+           join workflow.workflow_runs r on r.id = e.run_id
+           where e.run_id = $1 and e.id = $2`, [runId, eventId], "event", eventId),
+			getMany(runId, eventIds) {
+				if (eventIds.length > LIMIT) throw new RangeError(`better-supabase: analytics looks up at most ${String(LIMIT)} events at once`);
+				return rows(`select ${EVENT_COLUMNS} from workflow.workflow_events e
+           join workflow.workflow_runs r on r.id = e.run_id
+           where e.run_id = $1 and e.id = any($2::text[])`, [runId, [...new Set(eventIds)]]);
+			},
+			list: listEvents,
+			listByCorrelationId(params) {
+				return listEvents({
+					runId: params.runId,
+					correlationId: params.correlationId,
+					...params.pagination === void 0 ? {} : { pagination: params.pagination }
+				});
+			}
+		},
+		hooks: {
+			get: (hookId, params) => one(`${HOOKS} and e.correlation_id = $1 and ($2::text is null or e.run_id = $2)
+           group by e.run_id, e.correlation_id`, [hookId, params?.runId ?? null], "hook", hookId),
+			async list(params) {
+				const { limit, offset, order } = page(params.pagination, LIMIT);
+				return paged(await rows(`${HOOKS} and e.run_id = $1 group by e.run_id, e.correlation_id
+           order by "createdAt" ${order}, "hookId" ${order} limit $2 offset $3`, [
+					params.runId,
+					limit + 1,
+					offset
+				]), limit, offset);
+			}
+		},
+		waits: {
+			get: (runId, waitId) => one(`select ${WAIT_COLUMNS} from workflow.workflow_waits w
+           where w.run_id = $1 and w.wait_id in ($2::text, $1::text || '-' || $2::text)`, [runId, waitId], "wait", waitId),
+			async list(params) {
+				const { limit, offset, order } = page(params.pagination, RUN_SCOPED_LIMIT);
+				const values = [params.runId];
+				let where = "w.run_id = $1";
+				if (params.status !== void 0) {
+					values.push(params.status);
+					where += ` and w.status::text = $${String(values.length)}`;
+				}
+				values.push(limit + 1, offset);
+				return paged(await rows(`select ${WAIT_COLUMNS} from workflow.workflow_waits w where ${where}
+           order by w.created_at ${order}, w.wait_id ${order}
+           limit $${String(values.length - 1)} offset $${String(values.length)}`, values), limit, offset);
+			}
+		}
+	};
+}
+//#endregion
+//#region src/workflow-sdk/world/world.ts
+/**
+* The `@workflow/world` protocol this World speaks: the package version its
+* types and queue format come from. Its tables come from
+* `@workflow/world-postgres` at `WORLD_POSTGRES_VERSION`.
+*/
+const WORKFLOW_WORLD_PROTOCOL = "5.0.2";
+/** The deliveries one message may take; matches world-postgres (49 plus 24 retries of the terminal write). */
+const MAX_DELIVERIES = 73;
+const SIGNATURE_TOLERANCE_SECONDS = 300;
+const JOB_HEADER = "x-bs-job";
+const SIGNATURE_HEADER = "x-bs-signature";
+const FLOW_PATH = "/.well-known/workflow/v1/flow";
+const HKDF_SALT = "better-supabase/workflow";
+const encoder = new TextEncoder();
+/** JSON with Uint8Array values as `{ __type: "Uint8Array", data: <base64> }`, as world-postgres sends them. */
+function serialize(value) {
+	return Buffer.from(JSON.stringify(value, (_key, inner) => inner instanceof Uint8Array ? {
+		__type: "Uint8Array",
+		data: Buffer.from(inner).toString("base64")
+	} : inner));
+}
+function isStoredMessage(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = { ...value };
+	return typeof record["queueName"] === "string" && typeof record["messageId"] === "string" && typeof record["attempt"] === "number" && typeof record["body"] === "string";
+}
+function env(name) {
+	const value = process.env[name];
+	return value === void 0 || value === "" ? void 0 : value;
+}
+function positiveInt(value) {
+	const parsed = Math.trunc(Number(value ?? ""));
+	return Number.isFinite(parsed) && parsed > 0 ? parsed : void 0;
+}
+/** The flow route: `flowUrl`, `WORKFLOW_FLOW_URL`, or the local server. */
+function resolveFlowUrl(flowUrl) {
+	const explicit = flowUrl ?? env("WORKFLOW_FLOW_URL");
+	if (explicit !== void 0) return explicit;
+	const base = env("WORKFLOW_LOCAL_BASE_URL") ?? `http://localhost:${env("PORT") ?? "3000"}`;
+	const url = new URL(base);
+	url.pathname = `${url.pathname.replace(/\/+$/, "")}${FLOW_PATH}`;
+	url.search = "";
+	url.hash = "";
+	return url.toString();
+}
+/** A 32-byte key from base64 or hex. */
+function parseMasterKey(value) {
+	const text = value.trim();
+	const bytes = /^[0-9a-f]{64,}$/i.test(text) ? Buffer.from(text, "hex") : Buffer.from(text, "base64");
+	if (bytes.byteLength < 32) throw new TypeError("better-supabase: the workflow encryption key must be at least 32 bytes, base64 or hex");
+	return new Uint8Array(bytes);
+}
+/** The run's AES-256 key: HKDF-SHA256 of the master key with info `run:<runId>`. */
+async function deriveRunKey(master, runId) {
+	const key = await crypto.subtle.importKey("raw", Uint8Array.from(master), "HKDF", false, ["deriveBits"]);
+	const bits = await crypto.subtle.deriveBits({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: encoder.encode(HKDF_SALT),
+		info: encoder.encode(`run:${runId}`)
+	}, key, 256);
+	return new Uint8Array(bits);
+}
+async function hmacHex(secret, message) {
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
+	return Buffer.from(signature).toString("hex");
+}
+function constantTimeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	let diff = 0;
+	for (let index = 0; index < a.length; index += 1) diff |= (a.codePointAt(index) ?? 0) ^ (b.codePointAt(index) ?? 0);
+	return diff === 0;
+}
+/** `t=<unix>,v1=<hex>` over `<t>.<job>.<body>`. */
+async function signDelivery(secret, job, body, now = Date.now()) {
+	const t = String(Math.floor(now / 1e3));
+	return `t=${t},v1=${await hmacHex(secret, `${t}.${job}.${body}`)}`;
+}
+/** Whether `header` signs `job` and `body` with `secret` within five minutes of `now`. */
+async function verifyDelivery(secret, header, job, body, now = Date.now()) {
+	if (header === null) return false;
+	const parts = new Map(header.split(",").map((part) => {
+		const index = part.indexOf("=");
+		return [part.slice(0, index).trim(), part.slice(index + 1).trim()];
+	}));
+	const t = parts.get("t");
+	const v1 = parts.get("v1");
+	if (t === void 0 || v1 === void 0 || !/^\d+$/.test(t)) return false;
+	if (Math.abs(now / 1e3 - Number(t)) > SIGNATURE_TOLERANCE_SECONDS) return false;
+	return constantTimeEqual(await hmacHex(secret, `${t}.${job}.${body}`), v1);
+}
+/** `load` once; a rejection is not kept, so the next call reads again. */
+function memoized(load) {
+	let promise;
+	return () => promise ??= load().catch((cause) => {
+		promise = void 0;
+		throw cause;
+	});
+}
+/** Unsigned poll deliveries are accepted only when `NODE_ENV` is `development` or `test`. */
+function unsignedAllowed() {
+	const mode = env("NODE_ENV");
+	return mode === "development" || mode === "test";
+}
+function deliveryProblem(kind, detail) {
+	return problemResponse(dbError(kind, detail, { code: "WORKFLOW_DELIVERY_REJECTED" }), { expose: true });
+}
+/** Retry delay after a failed delivery, as world-postgres (exp(min(attempt, 10)) seconds). */
+const backoffSeconds = (attempt) => Math.ceil(Math.exp(Math.min(attempt, 10)));
+/**
+* A Workflow SDK World on Supabase Postgres: the run, step, event, hook and
+* stream tables of `@workflow/world-postgres` (installed by the
+* `workflow-sdk-world` SQL module), with messages in the jobs module's
+* queue instead of graphile-worker.
+*
+* ```ts
+* // workflow.config or WORKFLOW_TARGET_WORLD=better-supabase/workflow-sdk/world
+* export default createSupabaseWorld({ delivery: "pg_net" });
+* ```
+*/
+function createSupabaseWorld(options = {}) {
+	const delivery = options.delivery ?? "poll";
+	const queueName = options.queue ?? "workflow_deliveries";
+	const schema = sqlIdent(options.schema ?? "better_supabase");
+	const concurrency = Math.max(1, options.concurrency ?? 50);
+	const pollInterval = Math.max(10, options.pollInterval ?? 250);
+	const lease = Math.max(5, options.lease ?? 60);
+	const deliveryTimeout = Math.max(lease, options.deliveryTimeout ?? 300);
+	const pool = options.pool ?? new Pool({ connectionString: options.connectionString ?? env("WORKFLOW_POSTGRES_URL") ?? env("SUPABASE_DB_URL") ?? env("DATABASE_URL") });
+	const base = createWorld$1({
+		pool,
+		...options.namespace === void 0 ? {} : { namespace: options.namespace }
+	});
+	/** The Vault secret, `undefined` when no row has the name; a failed read rejects. */
+	const vault = async (name) => {
+		return (await pool.query("select decrypted_secret as secret from vault.decrypted_secrets where name = $1", [name])).rows[0]?.secret ?? void 0;
+	};
+	const deliverySecret = memoized(async () => options.deliverySecret ?? vault(WORKFLOW_VAULT_SECRETS.deliverySecret));
+	const masterKey = memoized(async () => {
+		const text = options.encryptionKey ?? await vault(WORKFLOW_VAULT_SECRETS.encryptionKey);
+		return text === void 0 ? void 0 : parseMasterKey(text);
+	});
+	const allowUnsigned = unsignedAllowed();
+	const call = async (fn, args) => {
+		const list = args.map((_, index) => `$${String(index + 1)}`).join(", ");
+		return (await pool.query(`select * from ${schema}.${sqlIdent(fn)}(${list})`, [...args])).rows;
+	};
+	const store = async (message, delaySeconds) => {
+		await call("enqueue_job", [
+			queueName,
+			JSON.stringify(message),
+			Math.max(0, Math.ceil(delaySeconds ?? 0)),
+			MAX_DELIVERIES,
+			message.idempotencyKey ?? message.messageId,
+			false
+		]);
+	};
+	const queue = async (name, message, opts) => {
+		const messageId = `msg_${crypto.randomUUID()}`;
+		await store({
+			queueName: name,
+			messageId,
+			attempt: 1,
+			body: serialize(message).toString("base64"),
+			...opts?.headers === void 0 ? {} : { headers: opts.headers },
+			...opts?.idempotencyKey === void 0 ? {} : { idempotencyKey: opts.idempotencyKey }
+		}, opts?.delaySeconds);
+		startPolling();
+		return { messageId };
+	};
+	const queueBatch = (name, messages) => Promise.all(messages.map(({ message, opts }) => queue(name, message, opts).then(({ messageId }) => ({ messageId }), (cause) => ({
+		messageId: null,
+		error: cause instanceof Error ? cause.message : String(cause),
+		retryable: true
+	}))));
+	const complete = (id, attempts) => call("complete_job", [
+		queueName,
+		id,
+		attempts
+	]);
+	const fail = (id, attempts, error, attempt) => call("fail_job", [
+		queueName,
+		id,
+		attempts,
+		error.slice(0, 2e3),
+		backoffSeconds(attempt)
+	]);
+	const heartbeat = (id, attempts) => {
+		const timer = setInterval(() => {
+			call("extend_job_lease", [
+				queueName,
+				id,
+				attempts,
+				lease
+			]).catch(() => void 0);
+		}, Math.max(1e3, lease * 1e3 / 2));
+		return () => {
+			clearInterval(timer);
+		};
+	};
+	/** Settles a delivered job from the flow route's response. */
+	const settle = async (job, message, attempt, status, text) => {
+		if (status < 200 || status >= 300) {
+			await fail(job.id, job.attempts, `Flow route answered ${String(status)}: ${text}`, attempt);
+			return;
+		}
+		let timeoutSeconds;
+		try {
+			const parsed = JSON.parse(text);
+			if (typeof parsed === "object" && parsed !== null && "timeoutSeconds" in parsed) {
+				const value = Number(parsed.timeoutSeconds);
+				if (Number.isFinite(value) && value >= 0) timeoutSeconds = value;
+			}
+		} catch {
+			timeoutSeconds = void 0;
+		}
+		if (timeoutSeconds !== void 0) await store({
+			...message,
+			attempt: attempt + 1
+		}, timeoutSeconds);
+		await complete(job.id, job.attempts);
+	};
+	const deliveryHeaders = (message, attempt) => {
+		const headers = new Headers(message.headers);
+		headers.set("content-type", "application/json");
+		headers.set("x-vqs-queue-name", message.queueName);
+		headers.set("x-vqs-message-id", message.messageId);
+		headers.set("x-vqs-message-attempt", String(attempt));
+		headers.delete(JOB_HEADER);
+		headers.delete(SIGNATURE_HEADER);
+		return headers;
+	};
+	const flowUrl = () => resolveFlowUrl(options.flowUrl);
+	const deliver = async (job) => {
+		const payload = job.message.payload;
+		if (!isStoredMessage(payload)) {
+			await fail(job.id, job.attempts, "Not a workflow message", 99);
+			return;
+		}
+		const attempt = payload.attempt + job.attempts - 1;
+		const body = Buffer.from(payload.body, "base64");
+		const headers = deliveryHeaders(payload, attempt);
+		const beat = heartbeat(job.id, job.attempts);
+		const controller = new AbortController();
+		const timer = setTimeout(() => {
+			controller.abort(/* @__PURE__ */ new Error(`The flow route did not answer within ${String(deliveryTimeout)} seconds`));
+		}, deliveryTimeout * 1e3);
+		const stop = () => {
+			clearTimeout(timer);
+			beat();
+		};
+		controller.signal.addEventListener("abort", stop, { once: true });
+		try {
+			const secret = await deliverySecret();
+			if (secret !== void 0) headers.set(SIGNATURE_HEADER, await signDelivery(secret, "", body.toString("utf8")));
+			const response = await fetch(flowUrl(), {
+				method: "POST",
+				headers,
+				body,
+				signal: controller.signal
+			});
+			const text = await response.text();
+			stop();
+			await settle(job, payload, attempt, response.status, text);
+		} catch (cause) {
+			stop();
+			await fail(job.id, job.attempts, cause instanceof Error ? cause.message : String(cause), attempt);
+		}
+	};
+	const claim = (batch) => call("claim_jobs", [
+		queueName,
+		lease,
+		batch
+	]).then((rows) => rows.map((row) => ({
+		...row,
+		id: String(row.id)
+	})));
+	let running = false;
+	let closed = false;
+	let loop;
+	const inflight = /* @__PURE__ */ new Set();
+	let wake;
+	const deliverOnce = async () => {
+		const jobs = await claim(concurrency);
+		await Promise.all(jobs.map((job) => deliver(job)));
+		return jobs.length;
+	};
+	const track = (job) => {
+		const task = deliver(job).catch(() => void 0).finally(() => {
+			inflight.delete(task);
+			wake?.();
+		});
+		inflight.add(task);
+	};
+	/** Waits `pollInterval`, or until a delivery finishes and frees a slot. */
+	const idle = () => new Promise((resolve) => {
+		const timer = setTimeout(done, pollInterval);
+		function done() {
+			clearTimeout(timer);
+			wake = void 0;
+			resolve();
+		}
+		wake = done;
+	});
+	const claimInto = async (room) => {
+		try {
+			const jobs = await claim(room);
+			jobs.forEach(track);
+			return jobs.length;
+		} catch {
+			return 0;
+		}
+	};
+	const isRunning = () => running;
+	const poll = async () => {
+		while (isRunning()) {
+			const room = concurrency - inflight.size;
+			const claimed = room > 0 ? await claimInto(room) : 0;
+			if (claimed === 0 || room <= claimed) await idle();
+		}
+	};
+	function startPolling() {
+		if (delivery !== "poll" || running || closed) return;
+		running = true;
+		loop = poll();
+	}
+	const createQueueHandler = (prefix, handler) => {
+		const inner = base.createQueueHandler(prefix, handler);
+		return async (req) => {
+			const job = req.headers.get(JOB_HEADER);
+			let secret;
+			try {
+				secret = await deliverySecret();
+			} catch {
+				return deliveryProblem("network", "The workflow delivery secret could not be read from Vault");
+			}
+			if (job === null) {
+				if (secret === void 0 && delivery === "poll") {
+					if (allowUnsigned) return inner(req);
+					return deliveryProblem("unauthorized", "Unsigned workflow delivery: set WORKFLOW_DELIVERY_SECRET or the Vault secret workflow_delivery_secret");
+				}
+				const text = await req.text();
+				if (secret === void 0 || !await verifyDelivery(secret, req.headers.get(SIGNATURE_HEADER), "", text)) return deliveryProblem("unauthorized", "Unsigned workflow delivery");
+				return inner(new Request(req.url, {
+					method: "POST",
+					headers: req.headers,
+					body: text
+				}));
+			}
+			const text = await req.text();
+			if (secret === void 0 || !await verifyDelivery(secret, req.headers.get(SIGNATURE_HEADER), job, text)) return deliveryProblem("unauthorized", "Bad workflow delivery signature");
+			const [jobQueue, id, readCount] = job.split(":");
+			const attempts = Number(readCount);
+			let payload;
+			try {
+				payload = JSON.parse(text);
+			} catch {
+				payload = void 0;
+			}
+			if (jobQueue !== queueName || id === void 0 || !/^\d+$/.test(id) || !Number.isInteger(attempts) || !isStoredMessage(payload)) return deliveryProblem("invalid_request", "Malformed workflow delivery");
+			const claimed = {
+				id,
+				attempts
+			};
+			const attempt = payload.attempt + attempts - 1;
+			const stop = heartbeat(id, attempts);
+			try {
+				const response = await inner(new Request(req.url, {
+					method: "POST",
+					headers: deliveryHeaders(payload, attempt),
+					body: Buffer.from(payload.body, "base64")
+				}));
+				const answer = await response.text();
+				await settle(claimed, payload, attempt, response.status, answer);
+				return new Response(answer, {
+					status: response.status,
+					headers: response.headers
+				});
+			} catch (cause) {
+				await fail(id, attempts, cause instanceof Error ? cause.message : String(cause), attempt).catch(() => void 0);
+				throw cause;
+			} finally {
+				stop();
+			}
+		};
+	};
+	async function getEncryptionKeyForRun(run) {
+		const master = await masterKey();
+		if (master === void 0) return void 0;
+		return deriveRunKey(master, typeof run === "string" ? run : run.runId);
+	}
+	return {
+		...base,
+		analytics: createAnalytics(pool),
+		queue,
+		queueBatch,
+		createQueueHandler,
+		getEncryptionKeyForRun,
+		deliverOnce,
+		async start() {
+			startPolling();
+			await reenqueueActiveRuns(base.runs, queue, "better-supabase", options.namespace);
+		},
+		async close() {
+			closed = true;
+			running = false;
+			wake?.();
+			await loop;
+			await Promise.all(inflight);
+			await base.close?.();
+			if (options.pool === void 0) await pool.end();
+		}
+	};
+}
+/** The options `createWorld()` reads from the environment. */
+function worldOptionsFromEnv(source = process.env) {
+	const read = (name) => {
+		const value = source[name];
+		return value === void 0 || value === "" ? void 0 : value;
+	};
+	const delivery = read("WORKFLOW_DELIVERY");
+	if (delivery !== void 0 && delivery !== "poll" && delivery !== "pg_net") throw new TypeError(`better-supabase: WORKFLOW_DELIVERY must be "poll" or "pg_net", got "${delivery}"`);
+	const connectionString = read("WORKFLOW_POSTGRES_URL") ?? read("SUPABASE_DB_URL") ?? read("DATABASE_URL");
+	const flowUrl = read("WORKFLOW_FLOW_URL");
+	const deliverySecret = read("WORKFLOW_DELIVERY_SECRET");
+	const encryptionKey = read("WORKFLOW_ENCRYPTION_KEY");
+	const queue = read("WORKFLOW_DELIVERY_QUEUE");
+	const namespace = read("WORKFLOW_QUEUE_NAMESPACE");
+	const concurrency = positiveInt(read("WORKFLOW_POSTGRES_WORKER_CONCURRENCY"));
+	const pollInterval = positiveInt(read("WORKFLOW_POSTGRES_POLL_INTERVAL_MS"));
+	return {
+		...connectionString === void 0 ? {} : { connectionString },
+		...delivery === void 0 ? {} : { delivery },
+		...flowUrl === void 0 ? {} : { flowUrl },
+		...deliverySecret === void 0 ? {} : { deliverySecret },
+		...encryptionKey === void 0 ? {} : { encryptionKey },
+		...queue === void 0 ? {} : { queue },
+		...namespace === void 0 ? {} : { namespace },
+		...concurrency === void 0 ? {} : { concurrency },
+		...pollInterval === void 0 ? {} : { pollInterval }
+	};
+}
+/**
+* The World from the environment, the factory the Workflow SDK calls for
+* `WORKFLOW_TARGET_WORLD=better-supabase/workflow-sdk/world`: the connection
+* from `WORKFLOW_POSTGRES_URL`, `SUPABASE_DB_URL` or `DATABASE_URL`, and
+* `WORKFLOW_DELIVERY`, `WORKFLOW_FLOW_URL`, `WORKFLOW_DELIVERY_SECRET`,
+* `WORKFLOW_ENCRYPTION_KEY`, `WORKFLOW_DELIVERY_QUEUE`,
+* `WORKFLOW_QUEUE_NAMESPACE`, `WORKFLOW_POSTGRES_WORKER_CONCURRENCY` and
+* `WORKFLOW_POSTGRES_POLL_INTERVAL_MS`.
+*/
+function createWorld() {
+	return createSupabaseWorld(worldOptionsFromEnv());
+}
+//#endregion
+//#region src/workflow-sdk/world/index.ts
+var world_default = createWorld;
+//#endregion
+export { WORKFLOW_WORLD_PROTOCOL, WORLD_POSTGRES_VERSION, createSupabaseWorld, createWorld, world_default as default, deriveRunKey, parseMasterKey, resolveFlowUrl, signDelivery, verifyDelivery, worldOptionsFromEnv };