better-supabase 0.5.0 → 0.6.0

package/dist/credentials/index.js

@@ -0,0 +1,168 @@
+import { n as dbError } from "../errors-B11Duf73.js";
+import { a as ok, r as err, t as AsyncResult } from "../result-DzUbqgdW.js";
+import { a as tenantCredentialRef, i as subjectFor, n as credentialRefInTenant, r as foreignCredentialRef } from "../provider-Di3sRutW.js";
+import { n as rpcTransport, r as sqlTransport } from "../block-transport-BLr-ZgLc.js";
+import { i as blockCall } from "../block-helpers-DWHxHsEQ.js";
+import { c as timingSafeEqual, d as verifyWebhook, l as verifySharedSecret } from "../verify-DL41hbvY.js";
+import { n as revokeIfConfigured, t as credentialRouter } from "../compose-BIBNgAnq.js";
+//#region src/credentials/vault.ts
+const MAX_CACHED = 256;
+const invalidRef = (message) => err(dbError("invalid_input", message, { hint: "CREDENTIAL_REF_INVALID" }));
+const TENANT = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,99}$/;
+const TENANT_PREFIX = "tenant/";
+function vaultRef(ref) {
+	if (ref.provider !== "vault") return invalidRef(`vault does not resolve "${ref.provider}" credentials`);
+	const { secret, tenant, scope, header, scheme, inbound, signatureHeader } = ref;
+	if (typeof secret !== "string" || secret.length === 0) return invalidRef("a vault credential ref needs a secret name");
+	if (tenant !== void 0) {
+		if (typeof tenant !== "string" || !TENANT.test(tenant)) return invalidRef("tenant is an id of letters, digits and ._:@- without a slash");
+		if (secret.includes("/")) return invalidRef("a tenant's secret name has no slash");
+	} else if (secret.startsWith(TENANT_PREFIX)) return invalidRef(`a secret name starting with "${TENANT_PREFIX}" needs its tenant set`);
+	if (scope !== void 0 && scope !== "app" && scope !== "user") return invalidRef("scope is \"app\" or \"user\"");
+	if (header !== void 0 && typeof header !== "string") return invalidRef("header is a header name");
+	if (scheme !== void 0 && scheme !== null && typeof scheme !== "string") return invalidRef("scheme is a string or null");
+	if (inbound !== void 0 && inbound !== "standard-webhooks" && inbound !== "hmac-sha256" && inbound !== "shared-secret") return invalidRef("inbound is \"standard-webhooks\", \"hmac-sha256\" or \"shared-secret\"");
+	if (signatureHeader !== void 0 && typeof signatureHeader !== "string") return invalidRef("signatureHeader is a header name");
+	return ok({
+		provider: "vault",
+		secret,
+		...tenant === void 0 ? {} : { tenant },
+		...scope === void 0 ? {} : { scope },
+		...header === void 0 ? {} : { header },
+		...scheme === void 0 ? {} : { scheme },
+		...inbound === void 0 ? {} : { inbound },
+		...signatureHeader === void 0 ? {} : { signatureHeader }
+	});
+}
+/**
+* The Vault name under `bs:cred:vault:`: `tenant/<tenant>/<secret>` for a
+* tenant's ref; per-user secrets end in `@<user id>`.
+*/
+function storageName(ref, subject) {
+	const base = ref.tenant === void 0 ? ref.secret : `${TENANT_PREFIX}${ref.tenant}/${ref.secret}`;
+	if (ref.scope !== "user") return ok(base);
+	if (subject?.type !== "user") return err(dbError("forbidden", `"${ref.secret}" is stored per user`, { hint: "CREDENTIAL_SUBJECT_REQUIRED" }));
+	return ok(`${base}@${subject.id}`);
+}
+function headersFor(ref, token) {
+	const scheme = ref.scheme === void 0 ? "Bearer" : ref.scheme;
+	return { [(ref.header ?? "authorization").toLowerCase()]: scheme === null ? token : `${scheme} ${token}` };
+}
+const encoder = /* @__PURE__ */ new TextEncoder();
+async function hmacHex(secret, body) {
+	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	const signature = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(body)));
+	return Array.from(signature, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+async function verifyWith(ref, scheme, request, secret) {
+	switch (scheme) {
+		case "standard-webhooks": {
+			const verified = await verifyWebhook({
+				headers: request.headers,
+				body: await request.text()
+			}, secret);
+			return verified.ok || verified.error.kind === "invalid_request";
+		}
+		case "hmac-sha256": {
+			const offered = (request.headers.get(ref.signatureHeader ?? "x-hub-signature-256") ?? "").replace(/^sha256=/i, "");
+			return timingSafeEqual(offered.toLowerCase(), await hmacHex(secret, await request.text()));
+		}
+		case "shared-secret": return verifySharedSecret(request, secret, ref.signatureHeader ?? "authorization");
+		default: return scheme;
+	}
+}
+/**
+* A `CredentialProvider` over the `credentials` SQL module: tokens and API
+* keys in Supabase Vault, read through security definer functions only the
+* service role may call. Static secrets only; OAuth connections come from
+* a provider such as `better-supabase/vercel-connect`.
+*/
+function vaultCredentials(options) {
+	const call = blockCall(options.transport, options.schema ?? "better_supabase", options.mappers);
+	const cacheMs = options.cacheMs ?? 6e4;
+	const cache = /* @__PURE__ */ new Map();
+	const read = (name) => {
+		const cached = cache.get(name);
+		if (cached !== void 0 && cached.until > Date.now()) return AsyncResult.ok(cached.value);
+		return call("credential_get", {
+			provider: "vault",
+			name
+		}, (value) => value).andThen((value) => {
+			if (typeof value !== "string") return Promise.resolve(err(dbError("not_found", `No credential is stored as "${name}"`, { hint: "CREDENTIAL_NOT_FOUND" })));
+			if (cacheMs > 0) {
+				if (cache.size >= MAX_CACHED) cache.clear();
+				cache.set(name, {
+					value,
+					until: Date.now() + cacheMs
+				});
+			}
+			return Promise.resolve(ok(value));
+		});
+	};
+	const resolve = (ref, subject) => {
+		const parsed = vaultRef(ref);
+		if (!parsed.ok) return parsed;
+		const name = storageName(parsed.data, subject);
+		return name.ok ? ok({
+			ref: parsed.data,
+			name: name.data
+		}) : name;
+	};
+	return {
+		apiVersion: 1,
+		name: "vault",
+		getToken(ref, getOptions) {
+			const resolved = resolve(ref, getOptions.subject);
+			if (!resolved.ok) return AsyncResult.err(resolved.error);
+			return read(resolved.data.name).map((token) => ({
+				token,
+				headers: headersFor(resolved.data.ref, token)
+			}));
+		},
+		capabilities(ref) {
+			const parsed = vaultRef(ref);
+			return {
+				userSubjects: parsed.ok && parsed.data.scope === "user",
+				authorization: false,
+				revoke: true,
+				inbound: parsed.ok && parsed.data.inbound !== void 0
+			};
+		},
+		revoke(ref, revokeOptions) {
+			const resolved = resolve(ref, revokeOptions.subject);
+			if (!resolved.ok) return AsyncResult.err(resolved.error);
+			const { name } = resolved.data;
+			cache.delete(name);
+			return call("credential_delete", {
+				provider: "vault",
+				name
+			}, (value) => value === true);
+		},
+		set(ref, value, setOptions = {}) {
+			const resolved = resolve(ref, setOptions.subject);
+			if (!resolved.ok) return AsyncResult.err(resolved.error);
+			const { name } = resolved.data;
+			cache.delete(name);
+			return call("credential_set", {
+				provider: "vault",
+				name,
+				secret: value,
+				description: setOptions.description ?? null
+			}, () => {});
+		},
+		verifyInbound(request, ref) {
+			const parsed = vaultRef(ref);
+			if (!parsed.ok) return AsyncResult.err(parsed.error);
+			const { inbound } = parsed.data;
+			if (inbound === void 0) return AsyncResult.err(dbError("invalid_input", `"${parsed.data.secret}" has no inbound scheme`, { hint: "CREDENTIAL_REF_INVALID" }));
+			const name = storageName(parsed.data, { type: "app" });
+			if (!name.ok) return AsyncResult.err(name.error);
+			return read(name.data).andThen(async (secret) => ok(await verifyWith(parsed.data, inbound, request.clone(), secret)));
+		}
+	};
+}
+//#endregion
+export { credentialRefInTenant, credentialRouter, foreignCredentialRef, revokeIfConfigured, rpcTransport, sqlTransport, subjectFor, tenantCredentialRef, vaultCredentials };

package/dist/cron-DVPUg5k3.js

@@ -0,0 +1,145 @@
+import { t as temporal } from "./temporal-required-BVvW7SYJ.js";
+//#region src/blocks/jobs/cron.ts
+const MACROS = {
+	"@yearly": "0 0 1 1 *",
+	"@annually": "0 0 1 1 *",
+	"@monthly": "0 0 1 * *",
+	"@weekly": "0 0 * * 0",
+	"@daily": "0 0 * * *",
+	"@midnight": "0 0 * * *",
+	"@hourly": "0 * * * *"
+};
+const MONTHS = [
+	"jan",
+	"feb",
+	"mar",
+	"apr",
+	"may",
+	"jun",
+	"jul",
+	"aug",
+	"sep",
+	"oct",
+	"nov",
+	"dec"
+];
+const WEEKDAYS = [
+	"sun",
+	"mon",
+	"tue",
+	"wed",
+	"thu",
+	"fri",
+	"sat"
+];
+/** Replaces `JAN` or `MON` style names with their numbers. */
+function named(text, names, first) {
+	return text.replaceAll(/[a-z]{3}/gi, (name) => {
+		const index = names.indexOf(name.toLowerCase());
+		return index === -1 ? name : String(index + first);
+	});
+}
+const INTERVAL = /^(\d+)\s+(second|minute|hour)s?$/i;
+/** Gives up when no minute matches within this many days (`0 0 30 2 *`). */
+const SEARCH_DAYS = 1830;
+function invalid(expression, reason) {
+	return /* @__PURE__ */ new TypeError(`Invalid cron "${expression}": ${reason}`);
+}
+function field(expression, text, min, max) {
+	const values = /* @__PURE__ */ new Set();
+	for (const part of text.split(",")) {
+		const match = /^(\*|\d+(?:-\d+)?)(?:\/(\d+))?$/.exec(part);
+		if (!match) throw invalid(expression, `"${part}" is not a cron field`);
+		const [, range = "", stepText] = match;
+		const step = stepText === void 0 ? 1 : Number(stepText);
+		let from = min;
+		let to = max;
+		if (range !== "*") {
+			const [start = "", end] = range.split("-");
+			from = Number(start);
+			to = end === void 0 ? stepText === void 0 ? from : max : Number(end);
+		}
+		if (step < 1 || from < min || to > max || from > to) throw invalid(expression, `"${part}" is outside ${String(min)}-${String(max)}`);
+		for (let value = from; value <= to; value += step) values.add(value);
+	}
+	return [...values].toSorted((a, b) => a - b);
+}
+function parse(expression) {
+	const parts = (MACROS[expression.trim().toLowerCase()] ?? expression).trim().split(/\s+/);
+	if (parts.length !== 5) throw invalid(expression, "expected 5 fields (minute hour day month weekday)");
+	const [minute = "", hour = "", day = "", monthText = "", weekdayText = ""] = parts;
+	const month = named(monthText, MONTHS, 1);
+	const weekday = named(weekdayText, WEEKDAYS, 0);
+	return {
+		minutes: field(expression, minute, 0, 59),
+		hours: field(expression, hour, 0, 23),
+		days: new Set(field(expression, day, 1, 31)),
+		months: new Set(field(expression, month, 1, 12)),
+		weekdays: new Set(field(expression, weekday, 0, 7).map((value) => value === 0 ? 7 : value)),
+		daysRestricted: day !== "*",
+		weekdaysRestricted: weekday !== "*"
+	};
+}
+function dayMatches(fields, date) {
+	if (!fields.months.has(date.month)) return false;
+	const day = fields.days.has(date.day);
+	const weekday = fields.weekdays.has(date.dayOfWeek);
+	if (fields.daysRestricted && fields.weekdaysRestricted) return day || weekday;
+	if (fields.daysRestricted) return day;
+	if (fields.weekdaysRestricted) return weekday;
+	return true;
+}
+/** The first matching minute of `date` after `after`, from `start` on its first day. */
+function firstRunOn(fields, date, start, timeZone, after) {
+	for (const hour of fields.hours) {
+		if (start && hour < start.hour) continue;
+		for (const minute of fields.minutes) {
+			if (hour === start?.hour && minute < start.minute) continue;
+			const instant = date.toPlainDateTime({
+				hour,
+				minute
+			}).toZonedDateTime(timeZone, { disambiguation: "compatible" }).toInstant();
+			if (temporal().Instant.compare(instant, after) > 0) return instant;
+		}
+	}
+}
+/**
+* Throws a `TypeError` unless `expression` is a schedule `nextCronRun`
+* understands: five cron fields, a macro such as `@daily`, or an interval
+* such as `30 seconds`.
+*/
+function assertCron(expression) {
+	if (!INTERVAL.test(expression.trim())) parse(expression);
+}
+/**
+* The first run of `expression` after `after`, in `timeZone`.
+*
+* Accepts five cron fields (lists, ranges and steps; a restricted day of
+* month and day of week match either, as in cron), the macros `@hourly`,
+* `@daily`, `@weekly`, `@monthly` and `@yearly`, and intervals such as
+* `30 seconds`, `5 minutes` or `2 hours`, counted from `after`. A local time
+* that a DST change skips runs at the same offset after the gap.
+*/
+function nextCronRun(expression, timeZone, after) {
+	const interval = INTERVAL.exec(expression.trim());
+	if (interval) {
+		const amount = Number(interval[1]);
+		if (amount < 1) throw invalid(expression, "the interval must be positive");
+		const unit = interval[2].toLowerCase();
+		return after.add(unit === "second" ? { seconds: amount } : unit === "minute" ? { minutes: amount } : { hours: amount });
+	}
+	const fields = parse(expression);
+	const start = after.toZonedDateTimeISO(timeZone).toPlainDateTime().round({
+		smallestUnit: "minute",
+		roundingMode: "floor"
+	}).add({ minutes: 1 });
+	let date = start.toPlainDate();
+	for (let offset = 0; offset < SEARCH_DAYS; offset += 1) {
+		const found = dayMatches(fields, date) && firstRunOn(fields, date, offset === 0 ? start : void 0, timeZone, after);
+		if (found) return found;
+		date = date.add({ days: 1 });
+	}
+	throw invalid(expression, "it never matches a date");
+}
+//#endregion
+export { nextCronRun as n, assertCron as t };

package/dist/csv-CPAzEmB6.js

@@ -0,0 +1,25 @@
+//#region src/blocks/csv.ts
+const FORMULA = /^[=+\-@\t\r]/;
+function cell(value, escapeFormulas) {
+	if (value === null || value === void 0) return "";
+	let text = typeof value === "string" ? value : typeof value === "number" || typeof value === "boolean" || typeof value === "bigint" ? String(value) : JSON.stringify(value);
+	if (escapeFormulas && typeof value === "string" && FORMULA.test(text)) text = `'${text}`;
+	return /[",\r\n]/.test(text) ? `"${text.replaceAll("\"", "\"\"")}"` : text;
+}
+/** The columns of `rows`: every key, in the order it first appears. */
+function csvColumns(rows) {
+	const columns = /* @__PURE__ */ new Set();
+	for (const row of rows) for (const key of Object.keys(row)) columns.add(key);
+	return [...columns];
+}
+/**
+* RFC 4180 CSV with a header row and CRLF line ends. Objects and arrays are
+* written as JSON, null and undefined as empty cells.
+*/
+function toCsv(rows, options = {}) {
+	const columns = options.columns ?? csvColumns(rows);
+	const escape = options.escapeFormulas ?? true;
+	return `${[columns.map((column) => cell(column, false)).join(","), ...rows.map((row) => columns.map((column) => cell(row[column], escape)).join(","))].join("\r\n")}\r\n`;
+}
+//#endregion
+export { toCsv as t };

package/dist/db-exception-CnWcYPxL.js

@@ -0,0 +1,15 @@
+//#region src/core/db-exception.ts
+/** Thrown by `.orThrow()`. Carries the plain `DbError` as `error`. */
+var DbException = class extends Error {
+	name = "DbException";
+	error;
+	constructor(error) {
+		super(error.message);
+		this.error = error;
+	}
+	get kind() {
+		return this.error.kind;
+	}
+};
+//#endregion
+export { DbException as t };