better-supabase 0.7.1 → 0.9.0

package/dist/workflow-builder-DJ1oHn8g.js

@@ -1,398 +0,0 @@
-import { n as dbError } from "./errors-B11Duf73.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-DzUbqgdW.js";
-import { n as credentialRefInTenant, r as foreignCredentialRef } from "./provider-Di3sRutW.js";
-import { D as stringsOf, O as textOf, S as requiredInstant, _ as randomToken, b as recordOrEmpty, d as isRecord, h as optionalText, i as blockCall, l as injectableOf, m as optionalInstant, n as applyTemporal, s as enumOrThrow, w as seconds, x as recordsOf, y as recordOf } from "./block-helpers-DWHxHsEQ.js";
-import { t as createWorkflows } from "./workflows-wu1WWBn7.js";
-import { o as graphOf, r as diffGraphs } from "./graph-BGyLLFLX.js";
-//#region src/blocks/workflow-builder/rows.ts
-const VERSION_STATUSES = [
-	"draft",
-	"published",
-	"archived"
-];
-const TRIGGER_KINDS = [
-	"manual",
-	"webhook",
-	"schedule",
-	"event",
-	"form",
-	"chat"
-];
-const NODE_RUN_STATUSES = [
-	"running",
-	"waiting",
-	"completed",
-	"failed",
-	"skipped"
-];
-function definitionOf(row) {
-	const published = row["published"];
-	return {
-		id: textOf(row["id"]),
-		tenant: optionalText(row["tenant"]),
-		slug: textOf(row["slug"]),
-		name: textOf(row["name"]),
-		description: optionalText(row["description"]),
-		createdBy: optionalText(row["createdBy"]),
-		createdAt: requiredInstant(row["createdAt"], "createdAt"),
-		updatedAt: requiredInstant(row["updatedAt"], "updatedAt"),
-		..."published" in row ? { published: typeof published === "number" ? published : void 0 } : {},
-		..."draft" in row ? { draft: row["draft"] === true } : {}
-	};
-}
-function versionOf(row) {
-	return {
-		id: textOf(row["id"]),
-		definition: textOf(row["definition"]),
-		version: Number(row["version"]),
-		status: enumOrThrow(row["status"], VERSION_STATUSES, "version status"),
-		createdBy: optionalText(row["createdBy"]),
-		createdAt: requiredInstant(row["createdAt"], "createdAt"),
-		publishedAt: optionalInstant(row["publishedAt"]),
-		..."graph" in row ? { graph: graphOf(row["graph"]) } : {},
-		..."compiled" in row && row["compiled"] !== null ? { compiled: row["compiled"] } : {}
-	};
-}
-function triggerOf(row) {
-	return {
-		id: textOf(row["id"]),
-		definition: textOf(row["definition"]),
-		kind: enumOrThrow(row["kind"], TRIGGER_KINDS, "trigger kind"),
-		config: recordOrEmpty(row["config"]),
-		enabled: row["enabled"] !== false,
-		createdAt: requiredInstant(row["createdAt"], "createdAt"),
-		updatedAt: requiredInstant(row["updatedAt"], "updatedAt")
-	};
-}
-function refOf(value) {
-	if (!isRecord(value) || typeof value["provider"] !== "string") throw new TypeError("workflow-builder: a credential_ref has no provider");
-	return {
-		...value,
-		provider: value["provider"]
-	};
-}
-function credentialOf(row) {
-	return {
-		id: textOf(row["id"]),
-		tenant: optionalText(row["tenant"]),
-		kind: textOf(row["kind"]),
-		name: textOf(row["name"]),
-		ref: refOf(row["ref"]),
-		scopes: Array.isArray(row["scopes"]) ? stringsOf(row["scopes"]) : [],
-		createdBy: optionalText(row["createdBy"]),
-		createdAt: requiredInstant(row["createdAt"], "createdAt")
-	};
-}
-function stepOf(row) {
-	return {
-		name: textOf(row["name"]),
-		title: textOf(row["title"]),
-		description: optionalText(row["description"]),
-		inputSchema: recordOrEmpty(row["inputSchema"]),
-		outputSchema: recordOrEmpty(row["outputSchema"]),
-		credentialKind: optionalText(row["credentialKind"])
-	};
-}
-function nodeRunOf(row) {
-	return {
-		run: textOf(row["run"]),
-		node: textOf(row["node"]),
-		status: enumOrThrow(row["status"], NODE_RUN_STATUSES, "node status"),
-		attempts: Number(row["attempts"] ?? 0),
-		output: row["output"] ?? void 0,
-		error: optionalText(row["error"]),
-		startedAt: optionalInstant(row["startedAt"]),
-		endedAt: optionalInstant(row["endedAt"])
-	};
-}
-function alertOf(row) {
-	const threshold = row["threshold"];
-	return {
-		id: textOf(row["id"]),
-		definition: textOf(row["definition"]),
-		onEvent: row["onEvent"] === "slow" ? "slow" : "failed",
-		threshold: threshold === null || threshold === void 0 ? void 0 : Number(threshold),
-		channel: recordOrEmpty(row["channel"]),
-		createdBy: optionalText(row["createdBy"]),
-		createdAt: requiredInstant(row["createdAt"], "createdAt")
-	};
-}
-/** `map` over an object result, or `undefined` for anything else. */
-function optionalOf(map) {
-	return (value) => isRecord(value) ? map(value) : void 0;
-}
-//#endregion
-//#region src/blocks/workflow-builder/workflow-builder.ts
-const BUILDER_PREFIX = "builder:";
-/**
-* The `workflow-builder` module's definitions, versions, triggers,
-* credentials, step library, node runs and alerts. The engine plugs in
-* through `compile` and `start`; credential rows resolve through the
-* `credentials` providers.
-*
-* ```ts
-* const builder = createBuilder({
-*   transport: rpcTransport(supabase),
-*   compile: compileGraph,
-*   start: graphStarter({ executor: builderWorkflow, steps: { runNode } }),
-* });
-* ```
-*/
-function createBuilder(options) {
-	applyTemporal(options);
-	injectableOf("workflow-builder compiler", options.compile);
-	injectableOf("workflow-builder starter", options.start);
-	const call = blockCall(options.transport, options.schema, options.mappers);
-	const serviceCall = blockCall(options.service ?? options.transport, options.schema, options.mappers);
-	const providers = options.credentials === void 0 ? [] : Array.isArray(options.credentials) ? options.credentials : [options.credentials];
-	const providerFor = (ref) => providers.find((provider) => provider.name === ref.provider);
-	const noProvider = (ref) => dbError("invalid_request", `No credential provider named "${ref.provider}" was passed to createBuilder`);
-	const getVersion = (version) => call("workflow_version_get", { version }, optionalOf(versionOf));
-	const startTarget = (caller, definition, start) => caller("workflow_start_target", { definition }, (value) => recordOf(value, "workflow_start_target")).andThen(async (row) => {
-		const target = {
-			definition: definitionOf(recordOf(row["definition"], "definition")),
-			version: versionOf(recordOf(row["version"], "version"))
-		};
-		return ok(await start(target));
-	});
-	const starterOf = () => options.start;
-	const missingStarter = () => dbError("invalid_request", "Pass `start` to createBuilder to run workflows");
-	const runWith = (caller, input) => {
-		const start = starterOf();
-		if (start === void 0) return AsyncResult.err(missingStarter());
-		return startTarget(caller, input.definition, (target) => start({
-			definition: target.definition,
-			version: target.version,
-			input: input.input ?? {},
-			tenant: target.definition.tenant,
-			actor: input.actor,
-			idempotencyKey: input.idempotencyKey ?? `run:${randomToken(16)}`,
-			...input.trigger === void 0 ? {} : { trigger: input.trigger }
-		}));
-	};
-	const credentialRow = (id) => serviceCall("workflow_credential_get", { credential: id }, (value) => isRecord(value) ? credentialOf(value) : void 0);
-	return {
-		definitions: {
-			save: (input) => call("save_workflow_definition", {
-				tenant: input.tenant,
-				slug: input.slug,
-				name: input.name,
-				description: input.description
-			}, (value) => definitionOf(recordOf(value, "save_workflow_definition"))),
-			list: (tenant) => call("workflow_definitions_list", { tenant }, (value) => recordsOf(value, "workflow_definitions_list").map(definitionOf)),
-			get: (id) => call("workflow_definition_get", { definition: id }, optionalOf(definitionOf)),
-			remove: (id) => call("remove_workflow_definition", { definition: id }, (value) => value === true)
-		},
-		versions: {
-			save: (definition, graph) => call("save_workflow_draft", {
-				definition,
-				graph
-			}, (value) => versionOf(recordOf(value, "save_workflow_draft"))),
-			publish: (version) => getVersion(version).andThen(async (found) => {
-				if (found === void 0) return err(dbError("not_found", "No such workflow version"));
-				let compiled = null;
-				if (options.compile !== void 0 && found.status !== "published") try {
-					compiled = await options.compile(found.graph ?? graphOf(void 0)) ?? null;
-				} catch (cause) {
-					return err(dbError("invalid_input", cause instanceof Error ? cause.message : String(cause)));
-				}
-				const publish = (caller, stored) => caller("publish_workflow_version", {
-					version,
-					compiled: stored
-				}, (value) => versionOf(recordOf(value, "publish_workflow_version")));
-				const result = await publish(call, null);
-				if (!result.ok || compiled === null || options.service === void 0) return result;
-				return publish(serviceCall, compiled);
-			}),
-			list: (definition) => call("workflow_versions_list", { definition }, (value) => recordsOf(value, "workflow_versions_list").map(versionOf)),
-			get: getVersion,
-			diff: (from, to) => getVersion(from).andThen(async (before) => {
-				const after = await getVersion(to);
-				if (!after.ok) return after;
-				if (before === void 0 || after.data === void 0) return err(dbError("not_found", "No such workflow version"));
-				return ok(diffGraphs(before.graph ?? graphOf(void 0), after.data.graph ?? graphOf(void 0)));
-			})
-		},
-		run: (input) => runWith(call, input),
-		triggers: {
-			save: (input) => call("save_workflow_trigger", {
-				definition: input.definition,
-				kind: input.kind,
-				config: input.config ?? {},
-				enabled: input.enabled ?? true,
-				trigger: input.id
-			}, (value) => triggerOf(recordOf(value, "save_workflow_trigger"))),
-			list: (definition) => call("workflow_triggers_list", { definition }, (value) => recordsOf(value, "workflow_triggers_list").map(triggerOf)),
-			remove: (id) => call("remove_workflow_trigger", { trigger: id }, (value) => value === true),
-			rotateToken: (id) => call("rotate_workflow_webhook_token", { trigger: id }, textOf),
-			webhook: async (request) => {
-				if (request.method !== "POST") return Response.json({ error: "Method not allowed" }, {
-					status: 405,
-					headers: { allow: "POST" }
-				});
-				const token = webhookToken(request);
-				if (token === void 0) return Response.json({ error: "Not found" }, { status: 404 });
-				const target = await serviceCall("workflow_webhook_target", { token }, (value) => isRecord(value) ? value : void 0);
-				if (!target.ok) return Response.json({ error: target.error.message }, { status: 500 });
-				if (target.data === void 0) return Response.json({ error: "Not found" }, { status: 404 });
-				const trigger = triggerOf(recordOf(target.data["trigger"], "trigger"));
-				const key = request.headers.get("idempotency-key");
-				const started = await runWith(serviceCall, {
-					definition: trigger.definition,
-					input: await bodyOf(request),
-					idempotencyKey: key === null || key.length === 0 ? `webhook:${trigger.id}:${randomToken(16)}` : `webhook:${trigger.id}:${key}`,
-					trigger
-				});
-				return started.ok ? Response.json({ runId: started.data }, { status: 202 }) : Response.json({ error: started.error.message }, { status: started.error.status });
-			},
-			onEvent: (event) => serviceCall("workflow_event_targets", {
-				type: event.type,
-				tenant: event.tenant
-			}, (value) => recordsOf(value, "workflow_event_targets")).andThen(async (rows) => {
-				const runs = [];
-				for (const row of rows) {
-					const trigger = triggerOf(recordOf(row["trigger"], "trigger"));
-					const started = await runWith(serviceCall, {
-						definition: trigger.definition,
-						input: event.payload ?? {},
-						idempotencyKey: `event:${trigger.id}:${event.id}`,
-						trigger
-					});
-					if (!started.ok) return started;
-					runs.push(started.data);
-				}
-				return ok(runs);
-			}),
-			syncSchedule: (trigger, tenant) => {
-				const cron = trigger.config["cron"];
-				if (trigger.kind !== "schedule" || typeof cron !== "string") return AsyncResult.err(dbError("invalid_input", "Only a schedule trigger with config.cron has a schedule"));
-				const timezone = trigger.config["timezone"];
-				return createWorkflows({
-					transport: options.service ?? options.transport,
-					...options.mappers === void 0 ? {} : { mappers: options.mappers }
-				}).schedules.create({
-					name: `builder-trigger:${trigger.id}`,
-					workflow: `${BUILDER_PREFIX}${trigger.definition}`,
-					cron,
-					...typeof timezone === "string" ? { timezone } : {},
-					input: trigger.config["input"] ?? {},
-					...tenant === void 0 ? {} : { tenant }
-				});
-			},
-			starter: (fallback) => async (scheduled) => {
-				if (!scheduled.workflow.startsWith(BUILDER_PREFIX)) {
-					if (fallback === void 0) throw new Error(`better-supabase: no starter for workflow "${scheduled.workflow}"`);
-					return fallback(scheduled);
-				}
-				return runWith(serviceCall, {
-					definition: scheduled.workflow.slice(8),
-					input: scheduled.input,
-					idempotencyKey: scheduled.idempotencyKey,
-					...scheduled.actor === void 0 ? {} : { actor: scheduled.actor }
-				}).orThrow();
-			}
-		},
-		credentials: {
-			list: (tenant) => call("workflow_credentials_list", { tenant }, (value) => recordsOf(value, "workflow_credentials_list").map(credentialOf)),
-			create: (input) => {
-				const save = () => call("save_workflow_credential", {
-					tenant: input.tenant,
-					kind: input.kind,
-					name: input.name,
-					ref: input.ref,
-					scopes: input.scopes ?? []
-				}, (value) => credentialOf(recordOf(value, "save_workflow_credential")));
-				if (input.secret === void 0) return save();
-				if (!credentialRefInTenant(input.ref, input.tenant)) return AsyncResult.err(foreignCredentialRef(input.tenant));
-				const provider = providerFor(input.ref);
-				if (provider === void 0) return AsyncResult.err(noProvider(input.ref));
-				if (provider.set === void 0) return AsyncResult.err(dbError("unsupported", `The credential provider "${provider.name}" can't store secrets`));
-				return provider.set(input.ref, input.secret, { subject: { type: "app" } }).andThen(() => save());
-			},
-			authorize: (id, authorize) => credentialRow(id).andThen(async (row) => {
-				if (row === void 0) return err(dbError("not_found", "No such credential"));
-				const provider = providerFor(row.ref);
-				if (provider === void 0) return err(noProvider(row.ref));
-				if (provider.startAuthorization === void 0 || !provider.capabilities(row.ref).authorization) return err(dbError("unsupported", `The credential provider "${provider.name}" doesn't authorize accounts`));
-				return provider.startAuthorization(row.ref, {
-					subject: { type: "app" },
-					redirectUri: authorize.redirectUri,
-					scopes: row.scopes,
-					...authorize.state === void 0 ? {} : { state: authorize.state }
-				}).map((started) => started.url);
-			}),
-			revoke: (id) => call("remove_workflow_credential", { credential: id }, (value) => isRecord(value) ? credentialOf(value) : void 0).andThen(async (row) => {
-				if (row === void 0) return ok(false);
-				if (!credentialRefInTenant(row.ref, row.tenant)) return ok(true);
-				const provider = providerFor(row.ref);
-				if (provider === void 0) return err(noProvider(row.ref));
-				if (!provider.capabilities(row.ref).revoke) return ok(true);
-				const revoked = await provider.revoke(row.ref, { subject: { type: "app" } });
-				return revoked.ok ? ok(true) : revoked;
-			}),
-			resolve: (id) => credentialRow(id).andThen(async (row) => {
-				if (row === void 0) return err(dbError("not_found", "No such credential"));
-				if (!credentialRefInTenant(row.ref, row.tenant)) return err(foreignCredentialRef(row.tenant));
-				const provider = providerFor(row.ref);
-				if (provider === void 0) return err(noProvider(row.ref));
-				return provider.getToken(row.ref, {
-					subject: { type: "app" },
-					scopes: row.scopes
-				});
-			})
-		},
-		steps: {
-			sync: (steps = options.steps ?? []) => serviceCall("sync_workflow_steps", { steps: Object.fromEntries(steps.map((step) => [step.name, {
-				title: step.title,
-				description: step.description,
-				inputSchema: step.inputSchema ?? {},
-				outputSchema: step.outputSchema ?? {},
-				credentialKind: step.credentialKind
-			}])) }, Number),
-			list: () => call("workflow_steps_list", {}, (value) => recordsOf(value, "workflow_steps_list").map(stepOf))
-		},
-		nodeRuns: {
-			record: (input) => serviceCall("record_workflow_node_run", {
-				run: input.run,
-				node: input.node,
-				status: input.status,
-				attempt: input.attempt,
-				output: input.output,
-				error: input.error
-			}, (value) => value === true),
-			list: (run) => call("workflow_node_runs_list", { run }, (value) => recordsOf(value, "workflow_node_runs_list").map(nodeRunOf))
-		},
-		alerts: {
-			save: (input) => call("save_workflow_alert", {
-				definition: input.definition,
-				on_event: input.onEvent,
-				channel: input.channel ?? {},
-				threshold: input.threshold === void 0 ? void 0 : seconds(input.threshold),
-				alert: input.id
-			}, (value) => alertOf(recordOf(value, "save_workflow_alert"))),
-			list: (definition) => call("workflow_alerts_list", { definition }, (value) => recordsOf(value, "workflow_alerts_list").map(alertOf)),
-			remove: (id) => call("remove_workflow_alert", { alert: id }, (value) => value === true),
-			check: (check = {}) => serviceCall("check_workflow_alerts", { batch: check.batch }, Number)
-		}
-	};
-}
-function webhookToken(request) {
-	const header = request.headers.get("authorization");
-	if (header !== null && /^bearer\s+/i.test(header)) {
-		const token = header.replace(/^bearer\s+/i, "").trim();
-		return token.length > 0 ? token : void 0;
-	}
-	const segment = new URL(request.url).pathname.split("/").findLast(Boolean);
-	return segment?.startsWith("wfh_") === true ? decodeURIComponent(segment) : void 0;
-}
-async function bodyOf(request) {
-	const text = await request.text();
-	if (text.length === 0) return {};
-	try {
-		return JSON.parse(text);
-	} catch {
-		return { body: text };
-	}
-}
-//#endregion
-export { createBuilder as t };

package/dist/workflow-sdk-B3yLD6Br.d.ts

@@ -1,98 +0,0 @@
-import { m as RequestContext } from "./plugin-FGY8UhYm.js";
-import { a as OutboxEvent, o as OutboxHandler } from "./outbox-Cq7pPYvl.js";
-import { u as WorkflowStarter } from "./workflows-B0j9WKPu.js";
-import { Hook, Run } from "workflow/api";
-import { World } from "@workflow/world";
-//#region src/workflow-sdk/workflow-sdk.d.ts
-/** A workflow function (a `"use workflow"` export), typed structurally. */
-type WorkflowFn<TArgs extends unknown[] = unknown[], TResult = unknown> = (...args: TArgs) => Promise<TResult>;
-/**
- * The actor and tenant of `context` as plain data, to pass into a workflow
- * as an argument; inside a step, `bs.forContext(context)` runs as that user
- * with RLS. Claims and anything else in `context` stay out of the run's
- * serialized state.
- */
-declare function workflowContext(context: RequestContext): RequestContext;
-/** The `bs.tenant` and `bs.actor` attributes for `context`. */
-declare function contextAttributes(context: RequestContext): Record<string, string>;
-interface StartForOptions {
-  /**
-   * Starting again with the same key returns the run the first start
-   * created, while that run is in the World. Schedules and admission pass
-   * `schedule:{id}:{fireAt}` and `admission:{id}`.
-   */
-  readonly idempotencyKey?: string;
-  /** More attributes for the run; `bs.*` keys are set from the context. */
-  readonly attributes?: Readonly<Record<string, string>>;
-  /** The World to look the key up in. Defaults to the configured one. */
-  readonly world?: World;
-}
-/**
- * `start(workflow, args)` for the caller in `context`: the run carries
- * `bs.tenant` and `bs.actor`, so `workflow_runs` lists it to the tenant and
- * the actor under RLS. With `idempotencyKey`, a run that already has the key
- * is returned instead of starting another (the key lookup needs a World with
- * `analytics`, as the Supabase World has).
- */
-declare function startFor<TArgs extends unknown[], TResult>(context: RequestContext, workflow: WorkflowFn<TArgs, TResult>, args: TArgs, options?: StartForOptions): Promise<Run<TResult>>;
-/**
- * The `start` callback for `schedules.tick` and `admission.tick` of
- * `better-supabase/blocks/workflows`: looks the workflow up by the name the
- * schedule or request stored and starts it with `startFor`, keyed by the
- * tick's idempotency key.
- */
-declare function workflowStarter(workflows: Readonly<Record<string, WorkflowFn<never[]>>>, options?: Pick<StartForOptions, "world">): WorkflowStarter;
-/**
- * Hook metadata that `authorizeHook` checks: the actor and tenant of
- * `context`, and the permission a tenant member needs to resume it instead.
- */
-declare function hookMetadata(context: RequestContext, permission?: string): Record<string, string>;
-/** `authorizeHook` refused the caller. */
-declare class HookForbiddenError extends Error {
-  readonly status = 403;
-  constructor(message: string);
-}
-interface AuthorizeHookOptions {
-  /**
-   * Whether the caller holds `permission` in `tenant`, for hooks created
-   * with `hookMetadata(context, permission)`, such as an approval any admin
-   * of the tenant may give.
-   */
-  readonly can?: (tenant: string, permission: string) => boolean | Promise<boolean>;
-}
-/**
- * The hook for `token` when the caller in `context` may resume it: the
- * actor in its `hookMetadata`, or a member of its tenant whom `can` grants
- * its permission. Throws `HookForbiddenError` otherwise, so a leaked token
- * alone never resumes a run.
- */
-declare function authorizeHook(token: string, context: RequestContext, options?: AuthorizeHookOptions): Promise<Hook>;
-interface StartOnEventOptions<TArgs extends unknown[]> {
-  /** Type patterns such as `invoice.paid` or `organization.*`. */
-  readonly types: readonly string[];
-  /** The workflow's arguments for an event. Defaults to `[event.payload]`. */
-  readonly args?: (event: OutboxEvent) => TArgs;
-  readonly world?: World;
-}
-/**
- * An outbox handler (`outbox.consume(name, handler)`) that starts
- * `workflow` for each matching event, as the event's actor in its tenant,
- * keyed by `event:{id}` so a redelivered batch starts nothing twice.
- */
-declare function startOnEvent<TArgs extends unknown[]>(workflow: WorkflowFn<TArgs>, options: StartOnEventOptions<TArgs>): OutboxHandler;
-interface ProtectWebHandlerOptions {
-  /**
-   * Whether the request's caller holds `permission`: resolve the session
-   * (`server.context(request)`) and check it, e.g. with `member_can`.
-   * Return `undefined` when there is no session (401).
-   */
-  readonly can: (request: Request, permission: string) => boolean | undefined | Promise<boolean | undefined>;
-}
-/**
- * Puts a route of the workflow web UI or a run's stream behind
- * `permission`: answers 401 without a session and 403 without the
- * permission, as `application/problem+json`.
- */
-declare function protectWebHandler(handler: (request: Request) => Response | Promise<Response>, permission: string, options: ProtectWebHandlerOptions): (request: Request) => Promise<Response>;
-//#endregion
-export { StartOnEventOptions as a, contextAttributes as c, startFor as d, startOnEvent as f, StartForOptions as i, hookMetadata as l, workflowStarter as m, HookForbiddenError as n, WorkflowFn as o, workflowContext as p, ProtectWebHandlerOptions as r, authorizeHook as s, AuthorizeHookOptions as t, protectWebHandler as u };

package/dist/workflow-sdk-C2WJ_G2O.js

@@ -1,173 +0,0 @@
-import { n as withContext, t as unwrap } from "./envelope-DqnYGRw7.js";
-import { t as WORKFLOW_ATTRIBUTES } from "./attributes-5dYul0u0.js";
-import { getHookByToken, getRun, start } from "workflow/api";
-import { getWorld } from "workflow/runtime";
-//#region src/workflow-sdk/workflow-sdk.ts
-/**
-* The actor and tenant of `context` as plain data, to pass into a workflow
-* as an argument; inside a step, `bs.forContext(context)` runs as that user
-* with RLS. Claims and anything else in `context` stay out of the run's
-* serialized state.
-*/
-function workflowContext(context) {
-	return unwrap(withContext(null, context)).context;
-}
-/** The `bs.tenant` and `bs.actor` attributes for `context`. */
-function contextAttributes(context) {
-	const recorded = workflowContext(context);
-	return {
-		...recorded.tenant === void 0 ? {} : { [WORKFLOW_ATTRIBUTES.tenant]: recorded.tenant },
-		...recorded.actor?.kind === "user" ? { [WORKFLOW_ATTRIBUTES.actor]: recorded.actor.id } : {}
-	};
-}
-/** The run a start with idempotency `key` created, while it is in the World. */
-async function runForKey(key, world) {
-	const target = world ?? await getWorld();
-	if (target.analytics === void 0) return void 0;
-	return (await target.analytics.runs.list({
-		attributes: { [WORKFLOW_ATTRIBUTES.key]: key },
-		pagination: { limit: 1 }
-	})).data[0]?.runId;
-}
-/**
-* `start(workflow, args)` for the caller in `context`: the run carries
-* `bs.tenant` and `bs.actor`, so `workflow_runs` lists it to the tenant and
-* the actor under RLS. With `idempotencyKey`, a run that already has the key
-* is returned instead of starting another (the key lookup needs a World with
-* `analytics`, as the Supabase World has).
-*/
-async function startFor(context, workflow, args, options = {}) {
-	const key = options.idempotencyKey;
-	if (key !== void 0) {
-		const existing = await runForKey(key, options.world);
-		if (existing !== void 0) return getRun(existing);
-	}
-	return start(workflow, args, {
-		attributes: {
-			...options.attributes,
-			...contextAttributes(context),
-			...key === void 0 ? {} : { [WORKFLOW_ATTRIBUTES.key]: key }
-		},
-		...options.world === void 0 ? {} : { world: options.world }
-	});
-}
-function userContext(call) {
-	const actor = call.actor === void 0 ? void 0 : {
-		id: call.actor,
-		kind: "user"
-	};
-	return {
-		...actor === void 0 ? {} : { actor },
-		...call.tenant === void 0 ? {} : { tenant: call.tenant }
-	};
-}
-/**
-* The `start` callback for `schedules.tick` and `admission.tick` of
-* `better-supabase/blocks/workflows`: looks the workflow up by the name the
-* schedule or request stored and starts it with `startFor`, keyed by the
-* tick's idempotency key.
-*/
-function workflowStarter(workflows, options = {}) {
-	return async (call) => {
-		const workflow = workflows[call.workflow];
-		if (workflow === void 0) throw new Error(`better-supabase: no workflow named "${call.workflow}" was passed to workflowStarter`);
-		const args = Array.isArray(call.input) ? call.input : [call.input];
-		return (await startFor(userContext(call), workflow, args, {
-			idempotencyKey: call.idempotencyKey,
-			...options
-		})).runId;
-	};
-}
-/**
-* Hook metadata that `authorizeHook` checks: the actor and tenant of
-* `context`, and the permission a tenant member needs to resume it instead.
-*/
-function hookMetadata(context, permission) {
-	return {
-		...contextAttributes(context),
-		...permission === void 0 ? {} : { "bs.permission": permission }
-	};
-}
-/** `authorizeHook` refused the caller. */
-var HookForbiddenError = class extends Error {
-	status = 403;
-	constructor(message) {
-		super(message);
-		this.name = "HookForbiddenError";
-	}
-};
-function stringField(value, key) {
-	if (typeof value !== "object" || value === null) return void 0;
-	const field = { ...value }[key];
-	return typeof field === "string" ? field : void 0;
-}
-/**
-* The hook for `token` when the caller in `context` may resume it: the
-* actor in its `hookMetadata`, or a member of its tenant whom `can` grants
-* its permission. Throws `HookForbiddenError` otherwise, so a leaked token
-* alone never resumes a run.
-*/
-async function authorizeHook(token, context, options = {}) {
-	const hook = await getHookByToken(token);
-	const metadata = await hook.metadata;
-	const actor = context.actor?.kind === "user" ? context.actor.id : void 0;
-	const owner = stringField(metadata, WORKFLOW_ATTRIBUTES.actor);
-	if (actor !== void 0 && owner === actor) return hook;
-	const tenant = stringField(metadata, WORKFLOW_ATTRIBUTES.tenant);
-	const permission = stringField(metadata, "bs.permission");
-	if (actor !== void 0 && tenant !== void 0 && permission !== void 0 && options.can !== void 0 && await options.can(tenant, permission)) return hook;
-	throw new HookForbiddenError("better-supabase: the caller may not resume this workflow hook");
-}
-/** Whether `type` matches `pattern` (`invoice.paid`, `organization.*` or `*`). */
-function matches(pattern, type) {
-	if (pattern === "*" || pattern === type) return true;
-	return pattern.endsWith(".*") && type.startsWith(pattern.slice(0, -1));
-}
-/**
-* An outbox handler (`outbox.consume(name, handler)`) that starts
-* `workflow` for each matching event, as the event's actor in its tenant,
-* keyed by `event:{id}` so a redelivered batch starts nothing twice.
-*/
-function startOnEvent(workflow, options) {
-	return async (events) => {
-		for (const event of events) {
-			if (!options.types.some((pattern) => matches(pattern, event.type))) continue;
-			const args = options.args?.(event) ?? [event.payload];
-			await startFor({
-				...event.actorId === null ? {} : { actor: {
-					id: event.actorId,
-					kind: "user"
-				} },
-				...event.tenant === null ? {} : { tenant: event.tenant }
-			}, workflow, args, {
-				idempotencyKey: `event:${event.id}`,
-				...options.world === void 0 ? {} : { world: options.world }
-			});
-		}
-	};
-}
-function problem(status) {
-	return new Response(JSON.stringify({
-		type: "about:blank",
-		title: status === 401 ? "Unauthorized" : "Forbidden",
-		status
-	}), {
-		status,
-		headers: { "content-type": "application/problem+json" }
-	});
-}
-/**
-* Puts a route of the workflow web UI or a run's stream behind
-* `permission`: answers 401 without a session and 403 without the
-* permission, as `application/problem+json`.
-*/
-function protectWebHandler(handler, permission, options) {
-	return async (request) => {
-		const allowed = await options.can(request, permission);
-		if (allowed === void 0) return problem(401);
-		if (!allowed) return problem(403);
-		return handler(request);
-	};
-}
-//#endregion
-export { protectWebHandler as a, startOnEvent as c, hookMetadata as i, workflowContext as l, authorizeHook as n, runForKey as o, contextAttributes as r, startFor as s, HookForbiddenError as t, workflowStarter as u };