better-supabase 0.5.0 → 0.6.0

package/dist/{webhooks → blocks/webhooks}/index.js

@@ -1,12 +1,448 @@
-import { c as mapDbError, n as dbError } from "../errors-DtwXa6b8.js";
-import { t as temporal } from "../temporal-required-CAt4Dc9Z.js";
-import { i as ok, n as err, o as toDbError, t as AsyncResult } from "../result-BKiliPY7.js";
-import { i as toBase64 } from "../base64-D2gsioCY.js";
-import { a as problemResponse } from "../problem-BW1KhzSG.js";
-import { n as emitKitEvent } from "../kit-events-CTFDfSwb.js";
-import { a as signWebhook, c as verifyWebhook, i as isDatabaseWebhook, n as databaseChange, o as timingSafeEqual, r as hookError, s as verifySharedSecret, t as authHook } from "../verify-Ce49ETPz.js";
-import { n as rpcTransport, r as sqlTransport, t as rawError } from "../kit-transport-DJlHQUBU.js";
-//#region src/webhooks/http.ts
+import { c as mapDbError, n as dbError } from "../../errors-B11Duf73.js";
+import { t as temporal } from "../../temporal-required-BVvW7SYJ.js";
+import { a as ok, r as err, s as toDbError, t as AsyncResult } from "../../result-DzUbqgdW.js";
+import { i as toBase64 } from "../../base64-D2gsioCY.js";
+import { a as problemResponse } from "../../problem-BreOl8b8.js";
+import { t as fromPgError } from "../../executor-De1Of3m3.js";
+import { i as emitBlockEvent } from "../../block-events-CrT8r7Fe.js";
+import { n as rpcTransport, r as sqlTransport, t as rawError } from "../../block-transport-BLr-ZgLc.js";
+import { c as errorText, d as isRecord, h as optionalText, k as toInstant, n as applyTemporal, v as readBodyCapped } from "../../block-helpers-DWHxHsEQ.js";
+import { a as signStripeWebhook, c as timingSafeEqual, d as verifyWebhook, i as isDatabaseWebhook, l as verifySharedSecret, n as databaseChange, o as signWebhook, r as hookError, s as stripeInboxVerify, t as authHook, u as verifyStripeWebhook } from "../../verify-DL41hbvY.js";
+//#region src/blocks/webhooks/incoming.ts
+/** The header that carries an endpoint's id on stored deliveries. */
+const INCOMING_ENDPOINT_HEADER = "x-bs-endpoint-id";
+const IDENT = /^[a-z_][a-z0-9_]*$/;
+const VERIFY_MODES = [
+	"none",
+	"standard-webhooks",
+	"hmac-sha256",
+	"shared-secret"
+];
+function verifyOf(value) {
+	const mode = VERIFY_MODES.find((entry) => entry === value);
+	if (mode === void 0) throw new TypeError(`Unknown verification mode ${String(value)}`);
+	return mode;
+}
+const encoder$1 = /* @__PURE__ */ new TextEncoder();
+async function hmacHex(secret, body) {
+	const key = await crypto.subtle.importKey("raw", encoder$1.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder$1.encode(body)));
+	return Array.from(mac, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function asDbError(cause) {
+	const raw = fromPgError(cause);
+	return raw ? mapDbError(raw) : toDbError(cause);
+}
+const attempt = (fn) => AsyncResult.from(async () => {
+	try {
+		return ok(await fn());
+	} catch (cause) {
+		return err(asDbError(cause));
+	}
+});
+/**
+* Tenant-owned trigger URLs over the `webhooks-in` SQL module: create
+* endpoints, then route `/hooks/<token>` to `receive`. Deliveries land in
+* the webhook inbox (`createWebhookInbox`), where a worker processes them.
+*/
+function createIncomingWebhooks(sql, options = {}) {
+	applyTemporal(options);
+	const schema = options.schema ?? "better_supabase";
+	if (!IDENT.test(schema)) throw new TypeError(`createIncomingWebhooks: "${schema}" is not a schema name`);
+	const source = options.source ?? "webhook-in";
+	const fn = (name) => `"${schema}"."${name}"`;
+	const value = async (text, params) => {
+		const [row] = await sql.queryRaw(text, params);
+		return row.value;
+	};
+	return {
+		async receive(request, token) {
+			const instance = new URL(request.url).pathname;
+			if (request.method !== "POST") return new Response(null, {
+				status: 405,
+				headers: { allow: "POST" }
+			});
+			const problem = (error, endpoint) => (endpoint === void 0 ? Promise.resolve() : sql.queryRaw(`select ${fn("record_incoming_webhook")}($1, $2)`, [endpoint, error.status]).then(() => void 0)).then(() => problemResponse(error, {
+				instance,
+				format: options.problem
+			}));
+			try {
+				const [endpoint] = await sql.queryRaw(`select * from ${fn("incoming_webhook_by_token")}($1)`, [token]);
+				if (!endpoint?.enabled) return await problem(dbError("not_found", "No such webhook endpoint"));
+				const body = await readBodyCapped(request, endpoint.max_body_bytes);
+				if (body === void 0) return await problem({
+					...dbError("invalid_input", "The body is too large", { code: "WEBHOOK_TOO_LARGE" }),
+					status: 413
+				}, endpoint.id);
+				if (options.rateLimit) {
+					const [hit] = await sql.queryRaw("select * from better_supabase.hit_rate_limit($1, $2, $3, $4::interval)", [
+						`${source}:endpoint`,
+						endpoint.id,
+						options.rateLimit.max,
+						typeof options.rateLimit.period === "number" ? `${String(options.rateLimit.period)} seconds` : options.rateLimit.period
+					]);
+					if (hit && !hit.allowed) return await problem(dbError("rate_limited", "Too many deliveries", { retryAfter: Math.max(1, hit.retry_after) }), endpoint.id);
+				}
+				let messageId = request.headers.get("webhook-id") ?? request.headers.get("svix-id") ?? crypto.randomUUID();
+				if (endpoint.verify === "standard-webhooks") {
+					let verified = await verifyWebhook({
+						headers: request.headers,
+						body
+					}, endpoint.secret ?? "");
+					if (!verified.ok && endpoint.previous_secret) {
+						const previous = await verifyWebhook({
+							headers: request.headers,
+							body
+						}, endpoint.previous_secret);
+						if (previous.ok) verified = previous;
+					}
+					if (!verified.ok) return await problem(verified.error, endpoint.id);
+					messageId = verified.data.id;
+				} else if (endpoint.verify === "shared-secret") {
+					const given = request.headers.get(endpoint.signature_header ?? "x-webhook-secret") ?? "";
+					const matches = endpoint.secret !== null && timingSafeEqual(given, endpoint.secret) || endpoint.previous_secret !== null && endpoint.previous_secret !== void 0 && timingSafeEqual(given, endpoint.previous_secret);
+					if (given === "" || !matches) return await problem(dbError("unauthorized", "Invalid webhook secret", { code: "WEBHOOK_INVALID_SIGNATURE" }), endpoint.id);
+				} else if (endpoint.verify === "hmac-sha256") {
+					const signature = (request.headers.get(endpoint.signature_header ?? "x-signature") ?? "").replace(/^sha256=/, "");
+					let expected = await hmacHex(endpoint.secret ?? "", body);
+					if (!timingSafeEqual(signature, expected) && endpoint.previous_secret) {
+						const previous = await hmacHex(endpoint.previous_secret, body);
+						if (timingSafeEqual(signature, previous)) expected = previous;
+					}
+					if (!timingSafeEqual(signature, expected)) return await problem(dbError("unauthorized", "Invalid webhook signature", { code: "WEBHOOK_INVALID_SIGNATURE" }), endpoint.id);
+					messageId = `hmac:${expected}`;
+				}
+				let payload = body;
+				try {
+					payload = body === "" ? {} : JSON.parse(body);
+				} catch {
+					payload = { body };
+				}
+				const secretHeader = endpoint.verify === "shared-secret" ? (endpoint.signature_header ?? "x-webhook-secret").toLowerCase() : void 0;
+				const kept = (options.keepHeaders ?? []).flatMap((name) => {
+					if (name.toLowerCase() === secretHeader) return [];
+					const header = request.headers.get(name);
+					return header === null ? [] : [[name.toLowerCase(), header]];
+				});
+				const headers = Object.fromEntries([...kept, [INCOMING_ENDPOINT_HEADER, endpoint.id]]);
+				const [stored] = await sql.queryRaw("select * from better_supabase.receive_webhook($1, $2, $3, $4, $5, $6)", [
+					source,
+					`${endpoint.id}:${messageId}`,
+					typeof payload === "object" && payload !== null && "type" in payload && typeof payload.type === "string" ? payload.type : null,
+					JSON.stringify(payload),
+					JSON.stringify(headers),
+					endpoint.tenant
+				]);
+				const status = stored?.duplicate ? 200 : 202;
+				await sql.queryRaw(`select ${fn("record_incoming_webhook")}($1, $2)`, [endpoint.id, status]);
+				return Response.json({
+					id: Number(stored?.id),
+					duplicate: stored?.duplicate ?? false
+				}, { status });
+			} catch (cause) {
+				return problemResponse(asDbError(cause), {
+					instance,
+					format: options.problem
+				});
+			}
+		},
+		create: (input) => attempt(async () => {
+			const created = await value(`select ${fn("create_incoming_webhook")}($1, $2, $3, $4, $5, $6, $7) as value`, [
+				input.tenant,
+				input.name,
+				input.verify ?? "none",
+				JSON.stringify(input.metadata ?? {}),
+				input.signatureHeader ?? null,
+				input.subject?.type ?? null,
+				input.subject?.id ?? null
+			]);
+			const { subjectType, subjectId, ...rest } = created;
+			return {
+				...rest,
+				tenant: String(created.tenant),
+				subject: subjectType && subjectId ? {
+					type: subjectType,
+					id: subjectId
+				} : null
+			};
+		}),
+		list: (tenant, subject) => attempt(async () => {
+			return (await value(`select ${fn("list_incoming_webhooks")}($1, $2, $3) as value`, [
+				tenant,
+				subject?.type ?? null,
+				subject?.id ?? null
+			])).map((row) => ({
+				id: String(row["id"]),
+				tenant: String(row["tenant"]),
+				name: String(row["name"]),
+				verify: row["verify"],
+				signatureHeader: optionalText(row["signature_header"]) ?? null,
+				enabled: row["enabled"] === true,
+				maxBodyBytes: Number(row["max_body_bytes"]),
+				receiveCount: Number(row["receive_count"]),
+				lastReceivedAt: optionalText(row["last_received_at"]) ?? null,
+				lastStatus: row["last_status"] === null ? null : Number(row["last_status"]),
+				metadata: isRecord(row["metadata"]) ? row["metadata"] : {},
+				subject: typeof row["subject_type"] === "string" && typeof row["subject_id"] === "string" ? {
+					type: row["subject_type"],
+					id: row["subject_id"]
+				} : null,
+				createdBy: optionalText(row["created_by"]) ?? null,
+				createdAt: String(row["created_at"])
+			}));
+		}),
+		rotate: (id, rotateOptions = {}) => attempt(async () => {
+			const rotated = await value(`select ${fn("rotate_incoming_webhook")}($1, $2) as value`, [id, rotateOptions.rotateSecret ?? false]);
+			return {
+				token: rotated.token,
+				secret: rotated.secret
+			};
+		}),
+		rotateSecret: (id, rotateOptions = {}) => attempt(async () => {
+			const rotated = await value(`select ${fn("rotate_incoming_webhook_secret")}($1, $2::interval) as value`, [id, rotateOptions.grace === void 0 ? null : String(rotateOptions.grace)]);
+			const expires = optionalText(rotated["previousSecretExpiresAt"]);
+			return {
+				secret: String(rotated["secret"]),
+				previousSecretExpiresAt: expires === void 0 ? null : toInstant(expires)
+			};
+		}),
+		update: (id, input) => attempt(async () => {
+			const updated = await value(`select ${fn("update_incoming_webhook")}($1, $2, $3, $4, $5) as value`, [
+				id,
+				input.name ?? null,
+				input.metadata === void 0 ? null : JSON.stringify(input.metadata),
+				input.verify ?? null,
+				input.signatureHeader ?? null
+			]);
+			return {
+				id: String(updated["id"]),
+				tenant: String(updated["tenant"]),
+				name: String(updated["name"]),
+				verify: verifyOf(updated["verify"]),
+				secret: optionalText(updated["secret"]) ?? null,
+				signatureHeader: optionalText(updated["signatureHeader"]) ?? null,
+				metadata: isRecord(updated["metadata"]) ? updated["metadata"] : {}
+			};
+		}),
+		setEnabled: (id, enabled) => attempt(() => value(`select ${fn("set_incoming_webhook_enabled")}($1, $2) as value`, [id, enabled])),
+		remove: (id) => attempt(() => value(`select ${fn("delete_incoming_webhook")}($1) as value`, [id]))
+	};
+}
+//#endregion
+//#region src/blocks/webhooks/url-policy.ts
+const PRIVATE_V4 = [
+	[0, 8],
+	[167772160, 8],
+	[1681915904, 10],
+	[2130706432, 8],
+	[2851995648, 16],
+	[2886729728, 12],
+	[3221225472, 24],
+	[3221225984, 24],
+	[3232235520, 16],
+	[3323068416, 15],
+	[3325256704, 24],
+	[3405803776, 24],
+	[3758096384, 4],
+	[4026531840, 4]
+];
+function v4(address) {
+	const parts = address.split(".");
+	if (parts.length !== 4) return void 0;
+	let value = 0;
+	for (const part of parts) {
+		if (!/^\d{1,3}$/.test(part)) return void 0;
+		const octet = Number(part);
+		if (octet > 255) return void 0;
+		value = value * 256 + octet;
+	}
+	return value;
+}
+const publicV4 = (value) => !PRIVATE_V4.some(([base, bits]) => Math.floor(value / 2 ** (32 - bits)) === Math.floor(base / 2 ** (32 - bits)));
+function v6(address) {
+	let text = address.toLowerCase();
+	const zone = text.indexOf("%");
+	if (zone !== -1) text = text.slice(0, zone);
+	if (text.includes(".")) {
+		const colon = text.lastIndexOf(":");
+		const embedded = v4(text.slice(colon + 1));
+		if (embedded === void 0) return void 0;
+		const high = Math.floor(embedded / 65536).toString(16);
+		const low = (embedded % 65536).toString(16);
+		text = `${text.slice(0, colon + 1)}${high}:${low}`;
+	}
+	const halves = text.split("::");
+	if (halves.length > 2) return void 0;
+	const groups = (part) => part === "" ? [] : part.split(":");
+	const head = groups(halves[0]);
+	const rest = halves.length === 2 ? groups(halves[1]) : [];
+	if (![...head, ...rest].every((group) => /^[0-9a-f]{1,4}$/.test(group))) return void 0;
+	const known = head.length + rest.length;
+	if (halves.length === 1 ? known !== 8 : known > 7) return void 0;
+	return [
+		...head,
+		...Array.from({ length: 8 - known }, () => "0"),
+		...rest
+	].map((group) => Number.parseInt(group, 16));
+}
+function publicV6(groups) {
+	const [first = 0] = groups;
+	const zeros = (from, to) => groups.slice(from, to).every((group) => group === 0);
+	const embedded = groups[6] * 65536 + groups[7];
+	if (zeros(0, 8)) return false;
+	if (zeros(0, 7) && groups[7] === 1) return false;
+	if (zeros(0, 5) && groups[5] === 65535) return publicV4(embedded);
+	if (first === 100 && groups[1] === 65435 && zeros(2, 6)) return publicV4(embedded);
+	if (zeros(0, 6)) return false;
+	if (first === 100 && groups[1] === 65435 && groups[2] === 1) return false;
+	if (first === 8194) return publicV4(groups[1] * 65536 + groups[2]);
+	if (first === 8193 && groups[1] === 0) return false;
+	if ((first & 65024) === 64512) return false;
+	if ((first & 65472) === 65152) return false;
+	if ((first & 65472) === 65216) return false;
+	if ((first & 65280) === 65280) return false;
+	if (first === 8193 && groups[1] === 3512) return false;
+	if (first === 256 && zeros(1, 4)) return false;
+	return true;
+}
+/**
+* Whether an IP address is reachable on the public internet: not loopback,
+* private, link-local (cloud metadata), carrier-grade NAT, multicast or
+* reserved. Returns `false` for anything that isn't an IP address.
+*/
+function isPublicAddress(address) {
+	const ipv4 = v4(address);
+	if (ipv4 !== void 0) return publicV4(ipv4);
+	const ipv6 = v6(address.replaceAll(/^\[|\]$/g, ""));
+	return ipv6 !== void 0 && publicV6(ipv6);
+}
+const isAddress = (host) => v4(host) !== void 0 || v6(host) !== void 0;
+const LOCAL_HOST = /(^|\.)(localhost|local|internal|home\.arpa)$/;
+/** `node:dns` without importing it, so this entry stays runtime-neutral. */
+function builtinResolver() {
+	const dns = globalThis.process?.getBuiltinModule?.("node:dns");
+	if (typeof dns !== "object" || dns === null || !("promises" in dns)) return void 0;
+	const { promises } = dns;
+	return async (hostname) => (await promises.lookup(hostname, {
+		all: true,
+		verbatim: true
+	})).map((entry) => entry.address);
+}
+/**
+* The default `allowUrl`: HTTPS only, no credentials in the URL, no local
+* host names, and every address the host resolves to must be public. The
+* delivery transport calls it again for each redirect.
+*
+* DNS can change between this check and the connection. Route webhooks
+* through an egress proxy when that matters.
+*/
+function publicUrl(options = {}) {
+	const resolve = options.resolve === false ? void 0 : options.resolve ?? builtinResolver();
+	if (options.resolve === void 0 && !resolve) throw new TypeError("publicUrl() needs a resolve option on runtimes without node:dns, or resolve: false to skip the DNS check");
+	const trusted = new Set(options.allowHosts?.map((host) => host.toLowerCase()));
+	return async (url) => {
+		const host = url.hostname.toLowerCase().replaceAll(/^\[|\]$/g, "");
+		if (trusted.has(host)) return true;
+		if (url.protocol !== "https:" && !(options.allowHttp && url.protocol === "http:")) return false;
+		if (url.username || url.password) return false;
+		if (isAddress(host)) return isPublicAddress(host);
+		if (LOCAL_HOST.test(host) || !host.includes(".")) return false;
+		if (!resolve) return true;
+		const addresses = await resolve(host);
+		return addresses.length > 0 && addresses.every(isPublicAddress);
+	};
+}
+//#endregion
+//#region src/blocks/webhooks/safe-fetch.ts
+/** A request `safeFetch` refused: a URL outside the policy or too many redirects. */
+var UnsafeUrlError = class extends Error {
+	name = "UnsafeUrlError";
+};
+var UrlCheckError = class extends Error {
+	name = "UrlCheckError";
+};
+const REDIRECTS$1 = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+/**
+* Whether a redirect keeps the method and body, as fetch does: 307 and 308
+* always, 301 and 302 except for POST, 303 only for HEAD.
+*/
+const keepsMethod = (status, method) => status === 307 || status === 308 || (status === 301 || status === 302) && method !== "POST" || status === 303 && method === "HEAD";
+/** Headers a redirect to another origin drops, as fetch does. */
+const CREDENTIALS = [
+	"authorization",
+	"cookie",
+	"proxy-authorization"
+];
+/**
+* A `fetch` for URLs that users or tenants supply (link previews, imports,
+* avatars by URL, callback URLs): it refuses private, loopback and
+* link-local addresses, non-HTTPS URLs and credentials in the URL, checks
+* every redirect against the same policy before following it, and stops
+* after `timeoutMs`. It throws `UnsafeUrlError` for a refused URL and
+* `UrlCheckError` when the check itself failed (a DNS lookup error). A redirect
+* to another origin drops the credential headers and `sensitiveHeaders`.
+*
+* DNS can change between the check and the connection; route the requests
+* through an egress proxy when that matters.
+*/
+function createSafeFetch(options = {}) {
+	const send = options.fetch ?? globalThis.fetch;
+	const allowUrl = options.allowUrl ?? publicUrl(options);
+	const maxRedirects = options.maxRedirects ?? 3;
+	const timeoutMs = options.timeoutMs ?? 1e4;
+	const sensitive = [...CREDENTIALS, ...options.sensitiveHeaders ?? []];
+	const check = async (url) => {
+		let ok;
+		try {
+			ok = await allowUrl(url);
+		} catch (error) {
+			throw new UrlCheckError(`Could not check URL: ${url.host}`, { cause: error });
+		}
+		if (!ok) throw new UnsafeUrlError(`URL is not allowed: ${url.host}`);
+	};
+	return async (input, init) => {
+		await check(new URL(input instanceof Request ? input.url : String(input)));
+		const request = new Request(input, init);
+		const timeout = AbortSignal.timeout(timeoutMs);
+		const signal = AbortSignal.any([request.signal, timeout]);
+		let url = new URL(request.url);
+		let method = request.method;
+		const headers = new Headers(request.headers);
+		let body = method === "GET" || method === "HEAD" ? void 0 : await request.arrayBuffer();
+		for (let hop = 0;; hop++) {
+			if (hop > 0) await check(url);
+			const response = await send(url, {
+				method,
+				headers,
+				...body === void 0 ? {} : { body },
+				redirect: "manual",
+				signal
+			});
+			if (!REDIRECTS$1.has(response.status)) return response;
+			await response.body?.cancel();
+			const location = response.headers.get("location");
+			if (!location || hop >= maxRedirects) throw new UnsafeUrlError(location ? `More than ${String(maxRedirects)} redirects` : `Redirect ${String(response.status)} without a location`);
+			if (!keepsMethod(response.status, method)) {
+				method = "GET";
+				body = void 0;
+			}
+			const next = new URL(location, url);
+			if (next.origin !== url.origin) for (const name of sensitive) headers.delete(name);
+			url = next;
+		}
+	};
+}
+//#endregion
+//#region src/blocks/webhooks/http.ts
 /** A delivery that must not be retried, e.g. a URL `allowUrl` rejected. */
 var WebhookPolicyError = class extends Error {
 	name = "WebhookPolicyError";
@@ -47,11 +483,15 @@ async function readCapped(response, limit) {
 		await reader.cancel().catch(() => void 0);
 	}
 }
+/**
+* A check that threw (a DNS lookup that timed out) is not a refusal: it
+* throws `UrlCheckError`, which the delivery retries.
+*/
 async function allowed(allowUrl, url) {
 	try {
 		return await allowUrl(url);
-	} catch {
-		return false;
+	} catch (cause) {
+		throw new UrlCheckError(`Could not check endpoint URL: ${url.host}`, { cause });
 	}
 }
 /** Sends webhooks with `fetch`, following redirects only to allowed URLs. */
@@ -94,8 +534,8 @@ function fetchTransport(options = {}) {
 	};
 }
 //#endregion
-//#region src/webhooks/secrets.ts
-/** The kit's `webhook_secrets` and `rotate_webhook_secret` functions. */
+//#region src/blocks/webhooks/secrets.ts
+/** The module's `webhook_secrets` and `rotate_webhook_secret` functions. */
 function sqlSecretStore(transport, options = {}) {
 	const schema = options.schema ?? "better_supabase";
 	return {
@@ -115,7 +555,7 @@ function sqlSecretStore(transport, options = {}) {
 	};
 }
 //#endregion
-//#region src/webhooks/signers.ts
+//#region src/blocks/webhooks/signers.ts
 function needSecrets(secrets) {
 	if (secrets.length === 0) throw new TypeError("The endpoint has no signing secret");
 }
@@ -186,133 +626,7 @@ function hmacSigner(options) {
 	};
 }
 //#endregion
-//#region src/webhooks/url-policy.ts
-const PRIVATE_V4 = [
-	[0, 8],
-	[167772160, 8],
-	[1681915904, 10],
-	[2130706432, 8],
-	[2851995648, 16],
-	[2886729728, 12],
-	[3221225472, 24],
-	[3221225984, 24],
-	[3232235520, 16],
-	[3323068416, 15],
-	[3325256704, 24],
-	[3405803776, 24],
-	[3758096384, 4],
-	[4026531840, 4]
-];
-function v4(address) {
-	const parts = address.split(".");
-	if (parts.length !== 4) return void 0;
-	let value = 0;
-	for (const part of parts) {
-		if (!/^\d{1,3}$/.test(part)) return void 0;
-		const octet = Number(part);
-		if (octet > 255) return void 0;
-		value = value * 256 + octet;
-	}
-	return value;
-}
-const publicV4 = (value) => !PRIVATE_V4.some(([base, bits]) => Math.floor(value / 2 ** (32 - bits)) === Math.floor(base / 2 ** (32 - bits)));
-function v6(address) {
-	let text = address.toLowerCase();
-	const zone = text.indexOf("%");
-	if (zone !== -1) text = text.slice(0, zone);
-	if (text.includes(".")) {
-		const colon = text.lastIndexOf(":");
-		const embedded = v4(text.slice(colon + 1));
-		if (embedded === void 0) return void 0;
-		const high = Math.floor(embedded / 65536).toString(16);
-		const low = (embedded % 65536).toString(16);
-		text = `${text.slice(0, colon + 1)}${high}:${low}`;
-	}
-	const halves = text.split("::");
-	if (halves.length > 2) return void 0;
-	const groups = (part) => part === "" ? [] : part.split(":");
-	const head = groups(halves[0]);
-	const rest = halves.length === 2 ? groups(halves[1]) : [];
-	if (![...head, ...rest].every((group) => /^[0-9a-f]{1,4}$/.test(group))) return void 0;
-	const known = head.length + rest.length;
-	if (halves.length === 1 ? known !== 8 : known > 7) return void 0;
-	return [
-		...head,
-		...Array.from({ length: 8 - known }, () => "0"),
-		...rest
-	].map((group) => Number.parseInt(group, 16));
-}
-function publicV6(groups) {
-	const [first = 0] = groups;
-	const zeros = (from, to) => groups.slice(from, to).every((group) => group === 0);
-	const embedded = groups[6] * 65536 + groups[7];
-	if (zeros(0, 8)) return false;
-	if (zeros(0, 7) && groups[7] === 1) return false;
-	if (zeros(0, 5) && groups[5] === 65535) return publicV4(embedded);
-	if (first === 100 && groups[1] === 65435 && zeros(2, 6)) return publicV4(embedded);
-	if (zeros(0, 6)) return false;
-	if (first === 100 && groups[1] === 65435 && groups[2] === 1) return false;
-	if (first === 8194) return publicV4(groups[1] * 65536 + groups[2]);
-	if (first === 8193 && groups[1] === 0) return false;
-	if ((first & 65024) === 64512) return false;
-	if ((first & 65472) === 65152) return false;
-	if ((first & 65472) === 65216) return false;
-	if ((first & 65280) === 65280) return false;
-	if (first === 8193 && groups[1] === 3512) return false;
-	if (first === 256 && zeros(1, 4)) return false;
-	return true;
-}
-/**
-* Whether an IP address is reachable on the public internet: not loopback,
-* private, link-local (cloud metadata), carrier-grade NAT, multicast or
-* reserved. Returns `false` for anything that isn't an IP address.
-*/
-function isPublicAddress(address) {
-	const ipv4 = v4(address);
-	if (ipv4 !== void 0) return publicV4(ipv4);
-	const ipv6 = v6(address.replaceAll(/^\[|\]$/g, ""));
-	return ipv6 !== void 0 && publicV6(ipv6);
-}
-const isAddress = (host) => v4(host) !== void 0 || v6(host) !== void 0;
-const LOCAL_HOST = /(^|\.)(localhost|local|internal|home\.arpa)$/;
-/** `node:dns` without importing it, so this entry stays runtime-neutral. */
-function builtinResolver() {
-	const dns = globalThis.process?.getBuiltinModule?.("node:dns");
-	if (typeof dns !== "object" || dns === null || !("promises" in dns)) return void 0;
-	const { promises } = dns;
-	return async (hostname) => (await promises.lookup(hostname, {
-		all: true,
-		verbatim: true
-	})).map((entry) => entry.address);
-}
-/**
-* The default `allowUrl`: HTTPS only, no credentials in the URL, no local
-* host names, and every address the host resolves to must be public. The
-* delivery transport calls it again for each redirect.
-*
-* DNS can change between this check and the connection. Route webhooks
-* through an egress proxy when that matters.
-*/
-function publicUrl(options = {}) {
-	const resolve = options.resolve === false ? void 0 : options.resolve ?? builtinResolver();
-	if (options.resolve === void 0 && !resolve) throw new TypeError("publicUrl() needs a resolve option on runtimes without node:dns, or resolve: false to skip the DNS check");
-	const trusted = new Set(options.allowHosts?.map((host) => host.toLowerCase()));
-	return async (url) => {
-		const host = url.hostname.toLowerCase().replaceAll(/^\[|\]$/g, "");
-		if (trusted.has(host)) return true;
-		if (url.protocol !== "https:" && !(options.allowHttp && url.protocol === "http:")) return false;
-		if (url.username || url.password) return false;
-		if (isAddress(host)) return isPublicAddress(host);
-		if (LOCAL_HOST.test(host) || !host.includes(".")) return false;
-		if (!resolve) return true;
-		const addresses = await resolve(host);
-		return addresses.length > 0 && addresses.every(isPublicAddress);
-	};
-}
-//#endregion
-//#region src/webhooks/outgoing.ts
-const DEFAULT_SCHEMA = "better_supabase";
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+//#region src/blocks/webhooks/outgoing.ts
 const textOf = (value) => value === null || value === void 0 ? null : String(value);
 function toDelivery(row) {
 	return {
@@ -339,11 +653,11 @@ const SCHEDULE = [
 const defaultBackoff = (attempt) => Math.round(Math.random() * SCHEDULE[Math.min(Math.max(attempt, 1), SCHEDULE.length) - 1]);
 const MAX_RETRY_AFTER = 86400;
 const defaultRetryable = (status) => status === 408 || status === 429 || status >= 500;
-const errorText = (cause) => cause instanceof Error ? cause.message : String(cause);
 function createWebhooks(options) {
+	applyTemporal(options);
 	const { transport } = options;
-	const schema = options.schema ?? DEFAULT_SCHEMA;
-	const mappers = options.errorMappers ?? [];
+	const schema = options.schema ?? "better_supabase";
+	const mappers = options.mappers ?? [];
 	const store = options.secrets ?? sqlSecretStore(transport, { schema });
 	const signer = options.signer ?? standardWebhooks();
 	const maxAttempts = options.retry?.maxAttempts ?? 8;
@@ -365,7 +679,7 @@ function createWebhooks(options) {
 	}
 	function emit(type, delivery, extra = {}) {
 		if (!options.events) return;
-		emitKitEvent(options.events, type, {
+		emitBlockEvent(options.events, type, {
 			endpointId: delivery.endpointId,
 			deliveryId: delivery.id,
 			eventType: delivery.type,
@@ -556,7 +870,10 @@ function createWebhooks(options) {
 					status: 405,
 					headers: { allow: "GET, POST" }
 				});
-				if (!verifySharedSecret(request, secret)) return problemResponse(dbError("unauthorized", "The deliver route needs its bearer secret"), { instance });
+				if (!verifySharedSecret(request, secret)) return problemResponse(dbError("unauthorized", "The deliver route needs its bearer secret"), {
+					instance,
+					format: routeOptions.problem
+				});
 				try {
 					return Response.json(await deliver({
 						budgetMs: 5e4,
@@ -564,7 +881,10 @@ function createWebhooks(options) {
 					}));
 				} catch (cause) {
 					routeOptions.onError?.(cause);
-					return problemResponse(toDbError(cause), { instance });
+					return problemResponse(toDbError(cause), {
+						instance,
+						format: routeOptions.problem
+					});
 				}
 			};
 		},
@@ -585,4 +905,4 @@ function createWebhooks(options) {
 	};
 }
 //#endregion
-export { WebhookPolicyError, authHook, createWebhooks, databaseChange, fetchTransport, hmacSigner, hookError, isDatabaseWebhook, isPublicAddress, publicUrl, rpcTransport, signWebhook, sqlSecretStore, sqlTransport, standardWebhooks, timingSafeEqual, verifySharedSecret, verifyWebhook };
+export { INCOMING_ENDPOINT_HEADER, UnsafeUrlError, UrlCheckError, WebhookPolicyError, authHook, createIncomingWebhooks, createSafeFetch, createWebhooks, databaseChange, fetchTransport, hmacSigner, hookError, isDatabaseWebhook, isPublicAddress, publicUrl, rpcTransport, signStripeWebhook, signWebhook, sqlSecretStore, sqlTransport, standardWebhooks, stripeInboxVerify, timingSafeEqual, verifySharedSecret, verifyStripeWebhook, verifyWebhook };