better-supabase 0.7.0 → 0.8.0

package/dist/workflow-sdk/world/index.d.ts

@@ -1,14 +1,10 @@
 import { Pool } from "pg";
 import { World } from "@workflow/world";
-//#region src/sql/modules/workflow-sdk-world-ddl.generated.d.ts
-/** The `@workflow/world-postgres` version the DDL below was generated from. */
-export declare const WORLD_POSTGRES_VERSION = "5.0.2";
-//#endregion
 //#region src/sql/modules/workflow-sdk-world.d.ts
 declare const WORKFLOW_DELIVERY_MODES: readonly ["poll", "pg_net"];
 type WorkflowDeliveryMode = (typeof WORKFLOW_DELIVERY_MODES)[number];
 //#endregion
-//#region src/workflow-sdk/world/world.d.ts
+//#region src/workflow-sdk/world/types.d.ts
 /**
  * The `@workflow/world` protocol this World speaks: the package version its
  * types and queue format come from. Its tables come from
@@ -62,16 +58,8 @@ interface SupabaseWorldOptions {
   /** The queue namespace, as `WORKFLOW_QUEUE_NAMESPACE`. */
   readonly namespace?: string;
 }
-/** The flow route: `flowUrl`, `WORKFLOW_FLOW_URL`, or the local server. */
-export declare function resolveFlowUrl(flowUrl?: string): string;
-/** A 32-byte key from base64 or hex. */
-export declare function parseMasterKey(value: string): Uint8Array;
-/** The run's AES-256 key: HKDF-SHA256 of the master key with info `run:<runId>`. */
-export declare function deriveRunKey(master: Uint8Array, runId: string): Promise<Uint8Array>;
-/** `t=<unix>,v1=<hex>` over `<t>.<job>.<body>`. */
-export declare function signDelivery(secret: string, job: string, body: string, now?: number): Promise<string>;
-/** Whether `header` signs `job` and `body` with `secret` within five minutes of `now`. */
-export declare function verifyDelivery(secret: string, header: string | null, job: string, body: string, now?: number): Promise<boolean>;
+//#endregion
+//#region src/workflow-sdk/world/world.d.ts
 /** The World plus the delivery helpers the tests and routes use. */
 type SupabaseWorld = World & {
   start(): Promise<void>;
@@ -91,8 +79,6 @@ type SupabaseWorld = World & {
  * ```
  */
 export declare function createSupabaseWorld(options?: SupabaseWorldOptions): SupabaseWorld;
-/** The options `createWorld()` reads from the environment. */
-export declare function worldOptionsFromEnv(source?: Readonly<Record<string, string | undefined>>): SupabaseWorldOptions;
 /**
  * The World from the environment, the factory the Workflow SDK calls for
  * `WORKFLOW_TARGET_WORLD=better-supabase/workflow-sdk/world`: the connection
@@ -104,4 +90,24 @@ export declare function worldOptionsFromEnv(source?: Readonly<Record<string, str
  */
 export declare function createWorld(): SupabaseWorld;
 //#endregion
+//#region src/sql/modules/workflow-sdk-world-ddl.generated.d.ts
+/** The `@workflow/world-postgres` version the DDL below was generated from. */
+export declare const WORLD_POSTGRES_VERSION = "5.0.2";
+//#endregion
+//#region src/workflow-sdk/world/crypto.d.ts
+/** A 32-byte key from base64 or hex. */
+export declare function parseMasterKey(value: string): Uint8Array;
+/** The run's AES-256 key: HKDF-SHA256 of the master key with info `run:<runId>`. */
+export declare function deriveRunKey(master: Uint8Array, runId: string): Promise<Uint8Array>;
+/** `t=<unix>,v1=<hex>` over `<t>.<job>.<body>`. */
+export declare function signDelivery(secret: string, job: string, body: string, now?: number): Promise<string>;
+/** Whether `header` signs `job` and `body` with `secret` within five minutes of `now`. */
+export declare function verifyDelivery(secret: string, header: string | null, job: string, body: string, now?: number): Promise<boolean>;
+//#endregion
+//#region src/workflow-sdk/world/env.d.ts
+/** The flow route: `flowUrl`, `WORKFLOW_FLOW_URL`, or the local server. */
+export declare function resolveFlowUrl(flowUrl?: string): string;
+/** The options `createWorld()` reads from the environment. */
+export declare function worldOptionsFromEnv(source?: Readonly<Record<string, string | undefined>>): SupabaseWorldOptions;
+//#endregion
 export { type SupabaseWorld, type SupabaseWorldOptions, type WorkflowDeliveryMode, createWorld as default };

package/dist/workflow-sdk/world/index.js

@@ -1,7 +1,9 @@
-import { n as dbError } from "../../errors-B11Duf73.js";
-import { a as problemResponse } from "../../problem-BreOl8b8.js";
-import { r as sqlIdent } from "../../template--jDkl3UP.js";
-import { Y as WORLD_POSTGRES_VERSION, r as WORKFLOW_VAULT_SECRETS } from "../../workflow-sdk-world-D-prir6O.js";
+import { n as dbError } from "../../errors-2M6CKMP4.js";
+import { o as problemResponse } from "../../problem-CJvFeGu7.js";
+import { i as sqlIdent } from "../../template-lPVh-EwW.js";
+import { n as hmacHex, r as timingSafeEqual } from "../../hmac-DCud0myt.js";
+import { n as memoized } from "../../optional-peer-D1pi-skw.js";
+import { i as WORLD_POSTGRES_VERSION, r as WORKFLOW_VAULT_SECRETS } from "../../workflow-sdk-world-CMV1ahFW.js";
 import { Pool } from "pg";
 import { reenqueueActiveRuns } from "@workflow/world";
 import { createWorld as createWorld$1 } from "@workflow/world-postgres";
@@ -236,33 +238,19 @@ function createAnalytics(pool) {
 	};
 }
 //#endregion
-//#region src/workflow-sdk/world/world.ts
+//#region src/workflow-sdk/world/types.ts
 /**
 * The `@workflow/world` protocol this World speaks: the package version its
 * types and queue format come from. Its tables come from
 * `@workflow/world-postgres` at `WORLD_POSTGRES_VERSION`.
 */
 const WORKFLOW_WORLD_PROTOCOL = "5.0.2";
-/** The deliveries one message may take; matches world-postgres (49 plus 24 retries of the terminal write). */
-const MAX_DELIVERIES = 73;
-const SIGNATURE_TOLERANCE_SECONDS = 300;
 const JOB_HEADER = "x-bs-job";
 const SIGNATURE_HEADER = "x-bs-signature";
 const FLOW_PATH = "/.well-known/workflow/v1/flow";
 const HKDF_SALT = "better-supabase/workflow";
-const encoder = new TextEncoder();
-/** JSON with Uint8Array values as `{ __type: "Uint8Array", data: <base64> }`, as world-postgres sends them. */
-function serialize(value) {
-	return Buffer.from(JSON.stringify(value, (_key, inner) => inner instanceof Uint8Array ? {
-		__type: "Uint8Array",
-		data: Buffer.from(inner).toString("base64")
-	} : inner));
-}
-function isStoredMessage(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const record = { ...value };
-	return typeof record["queueName"] === "string" && typeof record["messageId"] === "string" && typeof record["attempt"] === "number" && typeof record["body"] === "string";
-}
+//#endregion
+//#region src/workflow-sdk/world/env.ts
 function env(name) {
 	const value = process.env[name];
 	return value === void 0 || value === "" ? void 0 : value;
@@ -282,6 +270,37 @@ function resolveFlowUrl(flowUrl) {
 	url.hash = "";
 	return url.toString();
 }
+/** The options `createWorld()` reads from the environment. */
+function worldOptionsFromEnv(source = process.env) {
+	const read = (name) => {
+		const value = source[name];
+		return value === void 0 || value === "" ? void 0 : value;
+	};
+	const delivery = read("WORKFLOW_DELIVERY");
+	if (delivery !== void 0 && delivery !== "poll" && delivery !== "pg_net") throw new TypeError(`better-supabase: WORKFLOW_DELIVERY must be "poll" or "pg_net", got "${delivery}"`);
+	const connectionString = read("WORKFLOW_POSTGRES_URL") ?? read("SUPABASE_DB_URL") ?? read("DATABASE_URL");
+	const flowUrl = read("WORKFLOW_FLOW_URL");
+	const deliverySecret = read("WORKFLOW_DELIVERY_SECRET");
+	const encryptionKey = read("WORKFLOW_ENCRYPTION_KEY");
+	const queue = read("WORKFLOW_DELIVERY_QUEUE");
+	const namespace = read("WORKFLOW_QUEUE_NAMESPACE");
+	const concurrency = positiveInt(read("WORKFLOW_POSTGRES_WORKER_CONCURRENCY"));
+	const pollInterval = positiveInt(read("WORKFLOW_POSTGRES_POLL_INTERVAL_MS"));
+	return {
+		...connectionString === void 0 ? {} : { connectionString },
+		...delivery === void 0 ? {} : { delivery },
+		...flowUrl === void 0 ? {} : { flowUrl },
+		...deliverySecret === void 0 ? {} : { deliverySecret },
+		...encryptionKey === void 0 ? {} : { encryptionKey },
+		...queue === void 0 ? {} : { queue },
+		...namespace === void 0 ? {} : { namespace },
+		...concurrency === void 0 ? {} : { concurrency },
+		...pollInterval === void 0 ? {} : { pollInterval }
+	};
+}
+//#endregion
+//#region src/workflow-sdk/world/crypto.ts
+const encoder = new TextEncoder();
 /** A 32-byte key from base64 or hex. */
 function parseMasterKey(value) {
 	const text = value.trim();
@@ -300,20 +319,6 @@ async function deriveRunKey(master, runId) {
 	}, key, 256);
 	return new Uint8Array(bits);
 }
-async function hmacHex(secret, message) {
-	const key = await crypto.subtle.importKey("raw", encoder.encode(secret), {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	const signature = await crypto.subtle.sign("HMAC", key, encoder.encode(message));
-	return Buffer.from(signature).toString("hex");
-}
-function constantTimeEqual(a, b) {
-	if (a.length !== b.length) return false;
-	let diff = 0;
-	for (let index = 0; index < a.length; index += 1) diff |= (a.codePointAt(index) ?? 0) ^ (b.codePointAt(index) ?? 0);
-	return diff === 0;
-}
 /** `t=<unix>,v1=<hex>` over `<t>.<job>.<body>`. */
 async function signDelivery(secret, job, body, now = Date.now()) {
 	const t = String(Math.floor(now / 1e3));
@@ -329,22 +334,28 @@ async function verifyDelivery(secret, header, job, body, now = Date.now()) {
 	const t = parts.get("t");
 	const v1 = parts.get("v1");
 	if (t === void 0 || v1 === void 0 || !/^\d+$/.test(t)) return false;
-	if (Math.abs(now / 1e3 - Number(t)) > SIGNATURE_TOLERANCE_SECONDS) return false;
-	return constantTimeEqual(await hmacHex(secret, `${t}.${job}.${body}`), v1);
-}
-/** `load` once; a rejection is not kept, so the next call reads again. */
-function memoized(load) {
-	let promise;
-	return () => promise ??= load().catch((cause) => {
-		promise = void 0;
-		throw cause;
-	});
+	if (Math.abs(now / 1e3 - Number(t)) > 300) return false;
+	return timingSafeEqual(await hmacHex(secret, `${t}.${job}.${body}`), v1);
 }
 /** Unsigned poll deliveries are accepted only when `NODE_ENV` is `development` or `test`. */
 function unsignedAllowed() {
 	const mode = env("NODE_ENV");
 	return mode === "development" || mode === "test";
 }
+//#endregion
+//#region src/workflow-sdk/world/world.ts
+/** JSON with Uint8Array values as `{ __type: "Uint8Array", data: <base64> }`, as world-postgres sends them. */
+function serialize(value) {
+	return Buffer.from(JSON.stringify(value, (_key, inner) => inner instanceof Uint8Array ? {
+		__type: "Uint8Array",
+		data: Buffer.from(inner).toString("base64")
+	} : inner));
+}
+function isStoredMessage(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const record = { ...value };
+	return typeof record["queueName"] === "string" && typeof record["messageId"] === "string" && typeof record["attempt"] === "number" && typeof record["body"] === "string";
+}
 function deliveryProblem(kind, detail) {
 	return problemResponse(dbError(kind, detail, { code: "WORKFLOW_DELIVERY_REJECTED" }), { expose: true });
 }
@@ -393,7 +404,7 @@ function createSupabaseWorld(options = {}) {
 			queueName,
 			JSON.stringify(message),
 			Math.max(0, Math.ceil(delaySeconds ?? 0)),
-			MAX_DELIVERIES,
+			73,
 			message.idempotencyKey ?? message.messageId,
 			false
 		]);
@@ -583,7 +594,7 @@ function createSupabaseWorld(options = {}) {
 					return deliveryProblem("unauthorized", "Unsigned workflow delivery: set WORKFLOW_DELIVERY_SECRET or the Vault secret workflow_delivery_secret");
 				}
 				const text = await req.text();
-				if (secret === void 0 || !await verifyDelivery(secret, req.headers.get(SIGNATURE_HEADER), "", text)) return deliveryProblem("unauthorized", "Unsigned workflow delivery");
+				if (secret === void 0 || !await verifyDelivery(secret, req.headers.get("x-bs-signature"), "", text)) return deliveryProblem("unauthorized", "Unsigned workflow delivery");
 				return inner(new Request(req.url, {
 					method: "POST",
 					headers: req.headers,
@@ -591,7 +602,7 @@ function createSupabaseWorld(options = {}) {
 				}));
 			}
 			const text = await req.text();
-			if (secret === void 0 || !await verifyDelivery(secret, req.headers.get(SIGNATURE_HEADER), job, text)) return deliveryProblem("unauthorized", "Bad workflow delivery signature");
+			if (secret === void 0 || !await verifyDelivery(secret, req.headers.get("x-bs-signature"), job, text)) return deliveryProblem("unauthorized", "Bad workflow delivery signature");
 			const [jobQueue, id, readCount] = job.split(":");
 			const attempts = Number(readCount);
 			let payload;
@@ -655,34 +666,6 @@ function createSupabaseWorld(options = {}) {
 		}
 	};
 }
-/** The options `createWorld()` reads from the environment. */
-function worldOptionsFromEnv(source = process.env) {
-	const read = (name) => {
-		const value = source[name];
-		return value === void 0 || value === "" ? void 0 : value;
-	};
-	const delivery = read("WORKFLOW_DELIVERY");
-	if (delivery !== void 0 && delivery !== "poll" && delivery !== "pg_net") throw new TypeError(`better-supabase: WORKFLOW_DELIVERY must be "poll" or "pg_net", got "${delivery}"`);
-	const connectionString = read("WORKFLOW_POSTGRES_URL") ?? read("SUPABASE_DB_URL") ?? read("DATABASE_URL");
-	const flowUrl = read("WORKFLOW_FLOW_URL");
-	const deliverySecret = read("WORKFLOW_DELIVERY_SECRET");
-	const encryptionKey = read("WORKFLOW_ENCRYPTION_KEY");
-	const queue = read("WORKFLOW_DELIVERY_QUEUE");
-	const namespace = read("WORKFLOW_QUEUE_NAMESPACE");
-	const concurrency = positiveInt(read("WORKFLOW_POSTGRES_WORKER_CONCURRENCY"));
-	const pollInterval = positiveInt(read("WORKFLOW_POSTGRES_POLL_INTERVAL_MS"));
-	return {
-		...connectionString === void 0 ? {} : { connectionString },
-		...delivery === void 0 ? {} : { delivery },
-		...flowUrl === void 0 ? {} : { flowUrl },
-		...deliverySecret === void 0 ? {} : { deliverySecret },
-		...encryptionKey === void 0 ? {} : { encryptionKey },
-		...queue === void 0 ? {} : { queue },
-		...namespace === void 0 ? {} : { namespace },
-		...concurrency === void 0 ? {} : { concurrency },
-		...pollInterval === void 0 ? {} : { pollInterval }
-	};
-}
 /**
 * The World from the environment, the factory the Workflow SDK calls for
 * `WORKFLOW_TARGET_WORLD=better-supabase/workflow-sdk/world`: the connection

package/dist/{workflow-sdk-B3yLD6Br.d.ts → workflow-sdk-DTZyrvNo.d.ts}

@@ -1,6 +1,6 @@
-import { m as RequestContext } from "./plugin-FGY8UhYm.js";
-import { a as OutboxEvent, o as OutboxHandler } from "./outbox-Cq7pPYvl.js";
-import { u as WorkflowStarter } from "./workflows-B0j9WKPu.js";
+import { m as RequestContext } from "./plugin-CPK2HsbY.js";
+import { a as OutboxEvent, o as OutboxHandler } from "./outbox-DZfAvfzC.js";
+import { u as WorkflowStarter } from "./workflows-CcpCBfIe.js";
 import { Hook, Run } from "workflow/api";
 import { World } from "@workflow/world";
 //#region src/workflow-sdk/workflow-sdk.d.ts