better-supabase 0.7.1 → 0.9.0

package/dist/blocks/webhooks/index.js

@@ -1,13 +1,66 @@
-import { c as mapDbError, n as dbError } from "../../errors-B11Duf73.js";
-import { t as temporal } from "../../temporal-required-BVvW7SYJ.js";
-import { a as ok, r as err, s as toDbError, t as AsyncResult } from "../../result-DzUbqgdW.js";
-import { i as toBase64 } from "../../base64-D2gsioCY.js";
-import { a as problemResponse } from "../../problem-BreOl8b8.js";
-import { t as fromPgError } from "../../executor-De1Of3m3.js";
-import { i as emitBlockEvent } from "../../block-events-CrT8r7Fe.js";
-import { n as rpcTransport, r as sqlTransport, t as rawError } from "../../block-transport-BLr-ZgLc.js";
-import { c as errorText, d as isRecord, h as optionalText, k as toInstant, n as applyTemporal, v as readBodyCapped } from "../../block-helpers-DWHxHsEQ.js";
-import { a as signStripeWebhook, c as timingSafeEqual, d as verifyWebhook, i as isDatabaseWebhook, l as verifySharedSecret, n as databaseChange, o as signWebhook, r as hookError, s as stripeInboxVerify, t as authHook, u as verifyStripeWebhook } from "../../verify-DL41hbvY.js";
+import { t as DbException } from "../../db-exception-CnWcYPxL.js";
+import { n as dbError } from "../../errors-8i6tSICm.js";
+import { t as temporal } from "../../temporal-required-DqRzr7i0.js";
+import { a as ok, r as err, s as toDbError, t as AsyncResult } from "../../result-BlgnMB0H.js";
+import { n as isRecord } from "../../guards-6F2bCtQR.js";
+import { i as toBase64, r as fromBase64 } from "../../base64-BmeCBgGo.js";
+import { a as methodNotAllowed, o as problemResponse } from "../../problem-pIiL3WbE.js";
+import { a as stripTypePrefix } from "../../cloud-event-CTh9Sr5w.js";
+import { n as credentialRefInTenant, r as foreignCredentialRef } from "../../provider-DKh2xFZb.js";
+import { n as event, t as defineEvents } from "../../event-map-Dy2vKHai.js";
+import { r as blockEmitter } from "../../block-events-DD9Q_NUz.js";
+import { n as hmacHex, r as timingSafeEqual } from "../../hmac-DCud0myt.js";
+import { i as signWebhook, o as verifySharedSecret, s as verifyWebhook, t as PUBLIC_KEY_PREFIX } from "../../signatures-B41ApWXA.js";
+import { t as cronRoute } from "../../cron-route-CoL-By8Z.js";
+import { i as sqlTransport, r as rpcTransport, t as dbTransport } from "../../block-transport-G4t1umrR.js";
+import { C as optionalText, D as recordOf, E as readBodyCapped, L as toBlockError, M as seconds, R as toInstant, c as chunksOf, f as errorText, i as batchResultsOf, k as recordsOf, n as applyTemporal, o as blockCall, r as asDbError, s as budget } from "../../block-helpers-CfG_MvDR.js";
+import { t as subjectReaders } from "../../subject-readers-DiePmaYP.js";
+import { r as withBlockHooks } from "../../block-hooks-BsXncUlZ.js";
+import { n as hitRateLimit, o as receiveWebhook } from "../../rate-limit--QSiFA6D.js";
+import { n as defineBlock } from "../../define-block-B6Gjs57G.js";
+import { t as MAX_BATCH } from "../../batch-limit-DKVQDz4o.js";
+import { a as signStripeWebhook, i as isDatabaseWebhook, n as databaseChange, o as stripeInboxVerify, r as hookError, s as verifyStripeWebhook, t as authHook } from "../../verify-EQcC3Khp.js";
+import { toHttp } from "../../events/index.js";
+import { n as webhooksOutSqlOptions, t as webhooksInSqlOptions } from "../../options-D7f2VKzj.js";
+//#region src/blocks/webhooks/destinations.ts
+/**
+* Stores deliveries in the webhook inbox under `source` (the delivery's
+* source when unset), with the endpoint's tenant and the id
+* `<endpoint id>:<message id>`. The default destination of
+* `createIncomingWebhooks`.
+*/
+function inboxDestination(sql, options = {}) {
+	return {
+		apiVersion: 1,
+		name: "inbox",
+		deliver: (delivery) => receiveWebhook(sql, {
+			source: options.source ?? delivery.source,
+			id: `${delivery.endpoint.id}:${delivery.messageId}`,
+			type: delivery.type,
+			payload: delivery.payload,
+			headers: delivery.headers,
+			tenant: delivery.endpoint.tenant
+		})
+	};
+}
+/**
+* Enqueues each delivery once on a jobs queue (`jobs.enqueueOnce`) with the
+* dedupe key `<endpoint id>:<message id>` and the endpoint's tenant as the
+* job's tenant. A repeat is a duplicate while the job waits, runs or stays
+* archived; `jobs.purge` ends that window.
+*/
+function jobsDestination(jobs, options) {
+	return {
+		apiVersion: 1,
+		name: "jobs",
+		deliver: (delivery) => jobs.enqueueOnce(options.queue, options.payload?.(delivery) ?? delivery, {
+			dedupeKey: `${delivery.endpoint.id}:${delivery.messageId}`,
+			context: { tenant: delivery.endpoint.tenant },
+			...options.maxAttempts === void 0 ? {} : { maxAttempts: options.maxAttempts }
+		}).orThrow()
+	};
+}
+//#endregion
 //#region src/blocks/webhooks/incoming.ts
 /** The header that carries an endpoint's id on stored deliveries. */
 const INCOMING_ENDPOINT_HEADER = "x-bs-endpoint-id";
@@ -23,48 +76,25 @@ function verifyOf(value) {
 	if (mode === void 0) throw new TypeError(`Unknown verification mode ${String(value)}`);
 	return mode;
 }
-const encoder$1 = /* @__PURE__ */ new TextEncoder();
-async function hmacHex(secret, body) {
-	const key = await crypto.subtle.importKey("raw", encoder$1.encode(secret), {
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	const mac = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder$1.encode(body)));
-	return Array.from(mac, (byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function asDbError(cause) {
-	const raw = fromPgError(cause);
-	return raw ? mapDbError(raw) : toDbError(cause);
-}
-const attempt = (fn) => AsyncResult.from(async () => {
-	try {
-		return ok(await fn());
-	} catch (cause) {
-		return err(asDbError(cause));
-	}
-});
 /**
 * Tenant-owned trigger URLs over the `webhooks-in` SQL module: create
 * endpoints, then route `/hooks/<token>` to `receive`. Deliveries land in
-* the webhook inbox (`createWebhookInbox`), where a worker processes them.
+* the webhook inbox (`createWebhookInbox`), where a worker processes them,
+* or in `options.destination`.
 */
-function createIncomingWebhooks(sql, options = {}) {
+function createIncomingWebhooks(options) {
 	applyTemporal(options);
+	const { sql } = options;
 	const schema = options.schema ?? "better_supabase";
 	if (!IDENT.test(schema)) throw new TypeError(`createIncomingWebhooks: "${schema}" is not a schema name`);
 	const source = options.source ?? "webhook-in";
+	const destination = options.destination ?? inboxDestination(sql);
 	const fn = (name) => `"${schema}"."${name}"`;
-	const value = async (text, params) => {
-		const [row] = await sql.queryRaw(text, params);
-		return row.value;
-	};
-	return {
+	const call = blockCall(options.transport ?? sqlTransport(sql), schema, options.mappers);
+	return withBlockHooks({
 		async receive(request, token) {
 			const instance = new URL(request.url).pathname;
-			if (request.method !== "POST") return new Response(null, {
-				status: 405,
-				headers: { allow: "POST" }
-			});
+			if (request.method !== "POST") return methodNotAllowed(["POST"]);
 			const problem = (error, endpoint) => (endpoint === void 0 ? Promise.resolve() : sql.queryRaw(`select ${fn("record_incoming_webhook")}($1, $2)`, [endpoint, error.status]).then(() => void 0)).then(() => problemResponse(error, {
 				instance,
 				format: options.problem
@@ -78,13 +108,8 @@ function createIncomingWebhooks(sql, options = {}) {
 					status: 413
 				}, endpoint.id);
 				if (options.rateLimit) {
-					const [hit] = await sql.queryRaw("select * from better_supabase.hit_rate_limit($1, $2, $3, $4::interval)", [
-						`${source}:endpoint`,
-						endpoint.id,
-						options.rateLimit.max,
-						typeof options.rateLimit.period === "number" ? `${String(options.rateLimit.period)} seconds` : options.rateLimit.period
-					]);
-					if (hit && !hit.allowed) return await problem(dbError("rate_limited", "Too many deliveries", { retryAfter: Math.max(1, hit.retry_after) }), endpoint.id);
+					const hit = await hitRateLimit(sql, `${source}:endpoint`, endpoint.id, options.rateLimit.max, typeof options.rateLimit.period === "number" ? `${String(options.rateLimit.period)} seconds` : options.rateLimit.period);
+					if (!hit.allowed) return await problem(dbError("rate_limited", "Too many deliveries", { retryAfter: Math.max(1, hit.retryAfter) }), endpoint.id);
 				}
 				let messageId = request.headers.get("webhook-id") ?? request.headers.get("svix-id") ?? crypto.randomUUID();
 				if (endpoint.verify === "standard-webhooks") {
@@ -128,19 +153,23 @@ function createIncomingWebhooks(sql, options = {}) {
 					return header === null ? [] : [[name.toLowerCase(), header]];
 				});
 				const headers = Object.fromEntries([...kept, [INCOMING_ENDPOINT_HEADER, endpoint.id]]);
-				const [stored] = await sql.queryRaw("select * from better_supabase.receive_webhook($1, $2, $3, $4, $5, $6)", [
+				const stored = await destination.deliver({
+					endpoint: {
+						id: endpoint.id,
+						tenant: endpoint.tenant,
+						metadata: isRecord(endpoint.metadata) ? endpoint.metadata : {}
+					},
 					source,
-					`${endpoint.id}:${messageId}`,
-					typeof payload === "object" && payload !== null && "type" in payload && typeof payload.type === "string" ? payload.type : null,
-					JSON.stringify(payload),
-					JSON.stringify(headers),
-					endpoint.tenant
-				]);
-				const status = stored?.duplicate ? 200 : 202;
+					messageId,
+					type: typeof payload === "object" && payload !== null && "type" in payload && typeof payload.type === "string" ? payload.type : null,
+					payload,
+					headers
+				});
+				const status = stored.duplicate ? 200 : 202;
 				await sql.queryRaw(`select ${fn("record_incoming_webhook")}($1, $2)`, [endpoint.id, status]);
 				return Response.json({
-					id: Number(stored?.id),
-					duplicate: stored?.duplicate ?? false
+					id: stored.id,
+					duplicate: stored.duplicate
 				}, { status });
 			} catch (cause) {
 				return problemResponse(asDbError(cause), {
@@ -149,74 +178,84 @@ function createIncomingWebhooks(sql, options = {}) {
 				});
 			}
 		},
-		create: (input) => attempt(async () => {
-			const created = await value(`select ${fn("create_incoming_webhook")}($1, $2, $3, $4, $5, $6, $7) as value`, [
-				input.tenant,
-				input.name,
-				input.verify ?? "none",
-				JSON.stringify(input.metadata ?? {}),
-				input.signatureHeader ?? null,
-				input.subject?.type ?? null,
-				input.subject?.id ?? null
-			]);
-			const { subjectType, subjectId, ...rest } = created;
+		create: (input) => call("create_incoming_webhook", {
+			tenant: input.tenant,
+			name: input.name,
+			verify: input.verify ?? "none",
+			metadata: input.metadata ?? {},
+			signature_header: input.signatureHeader ?? null,
+			subject_type: input.subject?.type ?? null,
+			subject_id: input.subject?.id ?? null
+		}, (value) => {
+			const created = recordOf(value, "create_incoming_webhook");
+			const subjectType = optionalText(created["subjectType"]);
+			const subjectId = optionalText(created["subjectId"]);
 			return {
-				...rest,
-				tenant: String(created.tenant),
+				id: String(created["id"]),
+				tenant: String(created["tenant"]),
+				name: String(created["name"]),
+				verify: verifyOf(created["verify"]),
+				token: String(created["token"]),
+				secret: optionalText(created["secret"]) ?? null,
+				signatureHeader: optionalText(created["signatureHeader"]) ?? null,
 				subject: subjectType && subjectId ? {
 					type: subjectType,
 					id: subjectId
 				} : null
 			};
 		}),
-		list: (tenant, subject) => attempt(async () => {
-			return (await value(`select ${fn("list_incoming_webhooks")}($1, $2, $3) as value`, [
-				tenant,
-				subject?.type ?? null,
-				subject?.id ?? null
-			])).map((row) => ({
-				id: String(row["id"]),
-				tenant: String(row["tenant"]),
-				name: String(row["name"]),
-				verify: row["verify"],
-				signatureHeader: optionalText(row["signature_header"]) ?? null,
-				enabled: row["enabled"] === true,
-				maxBodyBytes: Number(row["max_body_bytes"]),
-				receiveCount: Number(row["receive_count"]),
-				lastReceivedAt: optionalText(row["last_received_at"]) ?? null,
-				lastStatus: row["last_status"] === null ? null : Number(row["last_status"]),
-				metadata: isRecord(row["metadata"]) ? row["metadata"] : {},
-				subject: typeof row["subject_type"] === "string" && typeof row["subject_id"] === "string" ? {
-					type: row["subject_type"],
-					id: row["subject_id"]
-				} : null,
-				createdBy: optionalText(row["created_by"]) ?? null,
-				createdAt: String(row["created_at"])
-			}));
-		}),
-		rotate: (id, rotateOptions = {}) => attempt(async () => {
-			const rotated = await value(`select ${fn("rotate_incoming_webhook")}($1, $2) as value`, [id, rotateOptions.rotateSecret ?? false]);
+		list: (tenant, subject) => call("list_incoming_webhooks", {
+			tenant,
+			subject_type: subject?.type ?? null,
+			subject_id: subject?.id ?? null
+		}, (value) => recordsOf(value, "list_incoming_webhooks").map((row) => ({
+			id: String(row["id"]),
+			tenant: String(row["tenant"]),
+			name: String(row["name"]),
+			verify: row["verify"],
+			signatureHeader: optionalText(row["signature_header"]) ?? null,
+			enabled: row["enabled"] === true,
+			maxBodyBytes: Number(row["max_body_bytes"]),
+			receiveCount: Number(row["receive_count"]),
+			lastReceivedAt: optionalText(row["last_received_at"]) ?? null,
+			lastStatus: row["last_status"] === null ? null : Number(row["last_status"]),
+			metadata: isRecord(row["metadata"]) ? row["metadata"] : {},
+			subject: typeof row["subject_type"] === "string" && typeof row["subject_id"] === "string" ? {
+				type: row["subject_type"],
+				id: row["subject_id"]
+			} : null,
+			createdBy: optionalText(row["created_by"]) ?? null,
+			createdAt: String(row["created_at"])
+		}))),
+		rotate: (id, rotateOptions = {}) => call("rotate_incoming_webhook", {
+			endpoint: id,
+			rotate_secret: rotateOptions.rotateSecret ?? false
+		}, (value) => {
+			const rotated = recordOf(value, "rotate_incoming_webhook");
 			return {
-				token: rotated.token,
-				secret: rotated.secret
+				token: String(rotated["token"]),
+				secret: optionalText(rotated["secret"]) ?? null
 			};
 		}),
-		rotateSecret: (id, rotateOptions = {}) => attempt(async () => {
-			const rotated = await value(`select ${fn("rotate_incoming_webhook_secret")}($1, $2::interval) as value`, [id, rotateOptions.grace === void 0 ? null : String(rotateOptions.grace)]);
+		rotateSecret: (id, rotateOptions = {}) => call("rotate_incoming_webhook_secret", {
+			endpoint: id,
+			grace: rotateOptions.grace === void 0 ? null : String(rotateOptions.grace)
+		}, (value) => {
+			const rotated = recordOf(value, "rotate_incoming_webhook_secret");
 			const expires = optionalText(rotated["previousSecretExpiresAt"]);
 			return {
 				secret: String(rotated["secret"]),
 				previousSecretExpiresAt: expires === void 0 ? null : toInstant(expires)
 			};
 		}),
-		update: (id, input) => attempt(async () => {
-			const updated = await value(`select ${fn("update_incoming_webhook")}($1, $2, $3, $4, $5) as value`, [
-				id,
-				input.name ?? null,
-				input.metadata === void 0 ? null : JSON.stringify(input.metadata),
-				input.verify ?? null,
-				input.signatureHeader ?? null
-			]);
+		update: (id, input) => call("update_incoming_webhook", {
+			endpoint: id,
+			name: input.name ?? null,
+			metadata: input.metadata ?? null,
+			verify: input.verify ?? null,
+			signature_header: input.signatureHeader ?? null
+		}, (value) => {
+			const updated = recordOf(value, "update_incoming_webhook");
 			return {
 				id: String(updated["id"]),
 				tenant: String(updated["tenant"]),
@@ -227,10 +266,252 @@ function createIncomingWebhooks(sql, options = {}) {
 				metadata: isRecord(updated["metadata"]) ? updated["metadata"] : {}
 			};
 		}),
-		setEnabled: (id, enabled) => attempt(() => value(`select ${fn("set_incoming_webhook_enabled")}($1, $2) as value`, [id, enabled])),
-		remove: (id) => attempt(() => value(`select ${fn("delete_incoming_webhook")}($1) as value`, [id]))
+		setEnabled: (id, enabled) => call("set_incoming_webhook_enabled", {
+			endpoint: id,
+			enabled
+		}, (value) => value === true),
+		remove: (id) => call("delete_incoming_webhook", { endpoint: id }, (value) => value === true)
+	}, options.hooks, {
+		block: "incoming-webhooks",
+		...options.logger ? { logger: options.logger } : {}
+	});
+}
+//#endregion
+//#region src/blocks/webhooks/encoders.ts
+/** The default format: CloudEvents over HTTP, structured or batched per endpoint. */
+function cloudEvents() {
+	return {
+		apiVersion: 1,
+		name: "cloudevents",
+		signed: true,
+		encode(events, target) {
+			const [message] = target.batch ? toHttp(events, "batch") : toHttp(events[0]);
+			return message;
+		}
 	};
 }
+/**
+* The 0.8 body, `{ type, timestamp, data }`, with `data` from `transform`;
+* a batch is a JSON array of them. Signed with Standard Webhooks like
+* `cloudevents`.
+*/
+function standardEnvelope() {
+	return {
+		apiVersion: 1,
+		name: "standard",
+		signed: true,
+		encode(events, target) {
+			const envelopes = events.map((event) => ({
+				type: event.type,
+				timestamp: event.time,
+				data: event.data
+			}));
+			return {
+				body: JSON.stringify(target.batch ? envelopes : envelopes[0]),
+				headers: { "content-type": "application/json" }
+			};
+		}
+	};
+}
+/** A JSON value as an OTLP `AnyValue`; 64-bit integers are strings in OTLP/JSON. */
+function anyValue(value) {
+	if (value === null || value === void 0) return {};
+	if (typeof value === "string") return { stringValue: value };
+	if (typeof value === "boolean") return { boolValue: value };
+	if (typeof value === "bigint") return { intValue: value.toString() };
+	if (typeof value === "number") return Number.isSafeInteger(value) ? { intValue: String(value) } : { doubleValue: value };
+	if (Array.isArray(value)) return { arrayValue: { values: value.map(anyValue) } };
+	if (isRecord(value)) return { kvlistValue: { values: attributes(value) } };
+	return { stringValue: String(value) };
+}
+function attributes(record) {
+	return Object.entries(record).flatMap(([key, value]) => value === void 0 ? [] : [{
+		key,
+		value: anyValue(value)
+	}]);
+}
+const nanos = (time) => (time === void 0 ? temporal().Now.instant() : temporal().Instant.from(time)).epochNanoseconds.toString();
+const SEVERITY_TEXT = [
+	"TRACE",
+	"DEBUG",
+	"INFO",
+	"WARN",
+	"ERROR",
+	"FATAL"
+];
+/** OTLP/HTTP retries 429, 502, 503 and 504 only. */
+const OTLP_RETRYABLE = /* @__PURE__ */ new Set([
+	429,
+	502,
+	503,
+	504
+]);
+/**
+* OTLP/HTTP logs in the JSON encoding: one `ExportLogsServiceRequest` per
+* request, a log record per event with the CloudEvents attributes. Point
+* the endpoint at a collector's `/v1/logs`.
+*/
+function otlpLogs(options = {}) {
+	const resource = attributes({
+		"service.name": options.serviceName ?? "better-supabase",
+		...options.resource
+	});
+	return {
+		apiVersion: 1,
+		name: "otlp-logs",
+		signed: false,
+		encode(events) {
+			const observed = nanos(void 0);
+			const logRecords = events.map((event) => {
+				const severity = options.severity?.(event) ?? 9;
+				return {
+					timeUnixNano: nanos(event.time),
+					observedTimeUnixNano: observed,
+					severityNumber: severity,
+					severityText: SEVERITY_TEXT[Math.min(Math.max(Math.ceil(severity / 4), 1), 6) - 1],
+					eventName: event.type,
+					body: anyValue(event.data),
+					attributes: attributes({
+						"cloudevents.event_id": event.id,
+						"cloudevents.event_source": event.source,
+						"cloudevents.event_spec_version": event.specversion,
+						"cloudevents.event_type": event.type,
+						"cloudevents.event_subject": event.subject
+					})
+				};
+			});
+			return {
+				body: JSON.stringify({ resourceLogs: [{
+					resource: { attributes: resource },
+					scopeLogs: [{
+						scope: { name: "better-supabase/webhooks" },
+						logRecords
+					}]
+				}] }),
+				headers: { "content-type": "application/json" }
+			};
+		},
+		classify(response) {
+			if (response.status < 200 || response.status >= 300) return OTLP_RETRYABLE.has(response.status) ? {
+				outcome: "retry",
+				error: `HTTP ${String(response.status)}`
+			} : {
+				outcome: "dead",
+				error: `HTTP ${String(response.status)}`
+			};
+			const partial = jsonOf(response.body)?.["partialSuccess"];
+			if (!isRecord(partial)) return;
+			const rejected = Number(partial["rejectedLogRecords"] ?? 0);
+			if (!(rejected > 0)) return;
+			const message = partial["errorMessage"];
+			return {
+				outcome: "succeeded",
+				error: `The collector rejected ${String(rejected)} log records${typeof message === "string" && message !== "" ? `: ${message}` : ""}`
+			};
+		}
+	};
+}
+function jsonOf(body) {
+	try {
+		const value = JSON.parse(body);
+		return isRecord(value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+/** HEC codes worth a retry: internal error and server busy. */
+const HEC_RETRYABLE = /* @__PURE__ */ new Set([8, 9]);
+/**
+* The Splunk HTTP Event Collector's event format: one JSON object per
+* event, the CloudEvent as `event`. Point the endpoint at
+* `/services/collector/event` and set `credential_ref` to the HEC token.
+*/
+function splunkHec(options = {}) {
+	return {
+		apiVersion: 1,
+		name: "splunk-hec",
+		signed: false,
+		encode(events) {
+			return {
+				body: events.map((event) => JSON.stringify({
+					time: (event.time === void 0 ? temporal().Now.instant() : temporal().Instant.from(event.time)).epochMilliseconds / 1e3,
+					...options.host === void 0 ? {} : { host: options.host },
+					source: options.source ?? event.source,
+					sourcetype: options.sourcetype ?? "_json",
+					...options.index === void 0 ? {} : { index: options.index },
+					event
+				})).join("\n"),
+				headers: { "content-type": "application/json" }
+			};
+		},
+		authorize: (token) => ({ authorization: `Splunk ${token.token}` }),
+		classify(response) {
+			const reply = jsonOf(response.body);
+			const code = reply?.["code"];
+			if (typeof code !== "number") return;
+			if (code === 0) return response.status >= 200 && response.status < 300 ? { outcome: "succeeded" } : void 0;
+			const text = reply?.["text"];
+			return {
+				outcome: HEC_RETRYABLE.has(code) ? "retry" : "dead",
+				error: `HEC ${String(code)}${typeof text === "string" ? `: ${text}` : ""}`
+			};
+		}
+	};
+}
+/** RFC 8935 error codes a transmitter can't fix by sending the SET again. */
+const SET_RETRYABLE = /* @__PURE__ */ new Set(["invalid_key"]);
+/**
+* RFC 8935 push delivery of Security Event Tokens: the body is the compact
+* SET from the delivery's `data.set`, one per request. The shared-signals
+* block creates these endpoints (`format: 'set'`) and dispatches to them.
+*/
+function securityEvents() {
+	return {
+		apiVersion: 1,
+		name: "set",
+		signed: false,
+		encode(events) {
+			const data = events[0]?.data;
+			const set = isRecord(data) ? data["set"] : void 0;
+			if (typeof set !== "string" || set.split(".").length !== 3) throw new TypeError("A set delivery carries a compact SET in data.set");
+			return {
+				body: set,
+				headers: {
+					"content-type": "application/secevent+jwt",
+					accept: "application/json"
+				}
+			};
+		},
+		classify(response) {
+			if (response.status === 202 || response.status === 200) return { outcome: "succeeded" };
+			if (response.status !== 400) return;
+			const reply = jsonOf(response.body);
+			const code = typeof reply?.["err"] === "string" ? reply["err"] : "";
+			const description = typeof reply?.["description"] === "string" ? `: ${reply["description"]}` : "";
+			return {
+				outcome: SET_RETRYABLE.has(code) ? "retry" : "dead",
+				error: `SET rejected (${code || "HTTP 400"})${description}`
+			};
+		}
+	};
+}
+/** An endpoint `format`: what the `format` column's check allows. */
+const WEBHOOK_FORMAT = /^[a-z][a-z0-9-]{0,39}$/;
+/** The built-in encoders by format, with `encoders` replacing any by name. */
+function encoderRegistry(encoders = []) {
+	const registry = new Map([
+		cloudEvents(),
+		standardEnvelope(),
+		otlpLogs(),
+		splunkHec(),
+		securityEvents()
+	].map((encoder) => [encoder.name, encoder]));
+	for (const encoder of encoders) {
+		if (!WEBHOOK_FORMAT.test(encoder.name)) throw new TypeError(`createWebhooks: encoder name "${encoder.name}" must match ${String(WEBHOOK_FORMAT)}`);
+		registry.set(encoder.name, encoder);
+	}
+	return registry;
+}
 //#endregion
 //#region src/blocks/webhooks/url-policy.ts
 const PRIVATE_V4 = [
@@ -251,12 +532,12 @@ const PRIVATE_V4 = [
 ];
 function v4(address) {
 	const parts = address.split(".");
-	if (parts.length !== 4) return void 0;
+	if (parts.length !== 4) return;
 	let value = 0;
 	for (const part of parts) {
-		if (!/^\d{1,3}$/.test(part)) return void 0;
+		if (!/^\d{1,3}$/.test(part)) return;
 		const octet = Number(part);
-		if (octet > 255) return void 0;
+		if (octet > 255) return;
 		value = value * 256 + octet;
 	}
 	return value;
@@ -269,19 +550,19 @@ function v6(address) {
 	if (text.includes(".")) {
 		const colon = text.lastIndexOf(":");
 		const embedded = v4(text.slice(colon + 1));
-		if (embedded === void 0) return void 0;
+		if (embedded === void 0) return;
 		const high = Math.floor(embedded / 65536).toString(16);
 		const low = (embedded % 65536).toString(16);
 		text = `${text.slice(0, colon + 1)}${high}:${low}`;
 	}
 	const halves = text.split("::");
-	if (halves.length > 2) return void 0;
+	if (halves.length > 2) return;
 	const groups = (part) => part === "" ? [] : part.split(":");
 	const head = groups(halves[0]);
 	const rest = halves.length === 2 ? groups(halves[1]) : [];
-	if (![...head, ...rest].every((group) => /^[0-9a-f]{1,4}$/.test(group))) return void 0;
+	if (![...head, ...rest].every((group) => /^[0-9a-f]{1,4}$/.test(group))) return;
 	const known = head.length + rest.length;
-	if (halves.length === 1 ? known !== 8 : known > 7) return void 0;
+	if (halves.length === 1 ? known !== 8 : known > 7) return;
 	return [
 		...head,
 		...Array.from({ length: 8 - known }, () => "0"),
@@ -324,7 +605,7 @@ const LOCAL_HOST = /(^|\.)(localhost|local|internal|home\.arpa)$/;
 /** `node:dns` without importing it, so this entry stays runtime-neutral. */
 function builtinResolver() {
 	const dns = globalThis.process?.getBuiltinModule?.("node:dns");
-	if (typeof dns !== "object" || dns === null || !("promises" in dns)) return void 0;
+	if (typeof dns !== "object" || dns === null || !("promises" in dns)) return;
 	const { promises } = dns;
 	return async (hostname) => (await promises.lookup(hostname, {
 		all: true,
@@ -456,11 +737,11 @@ const REDIRECTS = /* @__PURE__ */ new Set([
 ]);
 /** `Retry-After` as seconds from now: delta-seconds or an HTTP date. */
 function parseRetryAfter(value, now = Date.now()) {
-	if (value === null) return void 0;
+	if (value === null) return;
 	const text = value.trim();
 	if (/^\d+$/.test(text)) return Number(text);
 	const at = Date.parse(text);
-	if (Number.isNaN(at)) return void 0;
+	if (Number.isNaN(at)) return;
 	return Math.max(0, Math.ceil((at - now) / 1e3));
 }
 /** Reads at most `limit` bytes of the body, then cancels the stream. */
@@ -588,6 +869,44 @@ function standardWebhooks(options = {}) {
 		}
 	};
 }
+/**
+* Signs with the Standard Webhooks asymmetric scheme: one `v1a,` Ed25519
+* signature over `id.timestamp.body` in `webhook-signature`. Receivers
+* verify it with the `whpk_` key `webhookPublicKey` returns, through
+* `verifyWebhook`. Endpoints opt in with `signing = 'v1a'`.
+*/
+function standardWebhooksAsymmetric(options) {
+	const names = {
+		id: options.headers?.id ?? "webhook-id",
+		timestamp: options.headers?.timestamp ?? "webhook-timestamp",
+		signature: options.headers?.signature ?? "webhook-signature"
+	};
+	return {
+		apiVersion: 1,
+		name: "standard-webhooks-v1a",
+		async sign({ id, body, timestamp, secrets }) {
+			const seconds = String(Math.floor(timestamp.epochMilliseconds / 1e3));
+			const result = await options.signer.sign(encoder.encode(`${id}.${seconds}.${body}`));
+			if (!result.ok) throw new Error(result.error.message);
+			if (result.data.alg !== "EdDSA" && result.data.alg !== "Ed25519") throw new TypeError(`v1a signatures need an Ed25519 key, not ${result.data.alg}`);
+			const symmetric = options.hmac ? await Promise.all(secrets.map(async (secret) => (await signWebhook(secret, {
+				id,
+				body,
+				timestamp
+			}))["webhook-signature"])) : [];
+			return {
+				[names.id]: id,
+				[names.timestamp]: seconds,
+				[names.signature]: [`v1a,${toBase64(result.data.signature)}`, ...symmetric].join(" ")
+			};
+		}
+	};
+}
+/** The `whpk_` public key of an Ed25519 JWK, for receivers of `v1a` signatures. */
+function webhookPublicKey(jwk) {
+	if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || jwk.x === void 0) throw new TypeError("A v1a public key is an Ed25519 JWK");
+	return `${PUBLIC_KEY_PREFIX}${toBase64(fromBase64(jwk.x))}`;
+}
 const encoder = /* @__PURE__ */ new TextEncoder();
 const hex = (bytes) => Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
 /**
@@ -627,8 +946,24 @@ function hmacSigner(options) {
 }
 //#endregion
 //#region src/blocks/webhooks/outgoing.ts
+/** `publish_webhook_event`'s named arguments for one event. */
+function publishArgs(event) {
+	return {
+		event_type: event.type,
+		payload: event.data ?? {},
+		tenant: event.tenant ?? null,
+		event_id: event.id ?? null,
+		...event.subject === void 0 ? {} : { subject: event.subject },
+		...event.readPermission === void 0 ? {} : { read_permission: event.readPermission }
+	};
+}
 const textOf = (value) => value === null || value === void 0 ? null : String(value);
-function toDelivery(row) {
+const textsOf = (value) => Array.isArray(value) ? value.map(String) : null;
+const credentialRefOf = (value) => isRecord(value) && typeof value["provider"] === "string" ? {
+	...value,
+	provider: value["provider"]
+} : null;
+function toDelivery(row, defaultFormat) {
 	return {
 		id: String(row["id"]),
 		endpointId: String(row["endpoint_id"]),
@@ -639,6 +974,14 @@ function toDelivery(row) {
 		tenant: textOf(row["tenant"]),
 		eventId: textOf(row["event_id"]),
 		runId: textOf(row["run_id"]),
+		subject: textOf(row["subject"]),
+		owner: textOf(row["owner"]),
+		principal: textOf(row["principal"]),
+		permissions: textsOf(row["permissions"]),
+		batch: row["batch"] === true,
+		signing: row["signing"] === "v1a" ? "v1a" : "v1",
+		format: typeof row["format"] === "string" ? row["format"] : defaultFormat,
+		credentialRef: credentialRefOf(row["credential_ref"]),
 		createdAt: typeof row["created_at"] === "string" ? temporal().Instant.from(row["created_at"]) : temporal().Now.instant()
 	};
 }
@@ -650,9 +993,44 @@ const SCHEDULE = [
 	18e3,
 	36e3
 ];
-const defaultBackoff = (attempt) => Math.round(Math.random() * SCHEDULE[Math.min(Math.max(attempt, 1), SCHEDULE.length) - 1]);
+/** Equal jitter: at least half the step, and never under a second. */
+const defaultBackoff = (attempt) => {
+	const step = SCHEDULE[Math.min(Math.max(attempt, 1), SCHEDULE.length) - 1];
+	return Math.max(1, Math.round(step / 2 + Math.random() * step / 2));
+};
 const MAX_RETRY_AFTER = 86400;
+/** Token errors a retry can't fix. */
+const PERMANENT_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
+	"invalid_input",
+	"not_found",
+	"forbidden",
+	"unauthorized"
+]);
 const defaultRetryable = (status) => status === 408 || status === 429 || status >= 500;
+/** W3C Trace Context, version 00 and the forward-compatible later versions. */
+const TRACEPARENT = /^(?!ff)[0-9a-f]{2}-(?!0{32})[0-9a-f]{32}-(?!0{16})[0-9a-f]{16}-[0-9a-f]{2}$/;
+function absoluteUri(where, value) {
+	if (!URL.canParse(value)) throw new TypeError(`${where} must be an absolute URI, not "${value}"`);
+	return value;
+}
+/** The CloudEvents `source`: the `source` option, else `/webhooks` on `appUrl`. */
+function sourceOf(options) {
+	if (options.source !== void 0) return absoluteUri("createWebhooks: source", options.source);
+	if (options.appUrl !== void 0) return new URL("/webhooks", absoluteUri("createWebhooks: appUrl", options.appUrl)).href;
+	return "urn:better-supabase:webhooks";
+}
+/** The `actorId` a block event or the outbox put in the payload, if any. */
+function actorOf(payload) {
+	if (!isRecord(payload)) return null;
+	const actor = payload["actorId"];
+	return typeof actor === "string" ? actor : null;
+}
+/** A stable `webhook-id` for a batch: the same deliveries give the same id. */
+async function batchId(deliveries) {
+	const ids = deliveries.map((delivery) => delivery.id).toSorted();
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(ids.join("\n")));
+	return `batch_${Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("").slice(0, 32)}`;
+}
 function createWebhooks(options) {
 	applyTemporal(options);
 	const { transport } = options;
@@ -660,36 +1038,30 @@ function createWebhooks(options) {
 	const mappers = options.mappers ?? [];
 	const store = options.secrets ?? sqlSecretStore(transport, { schema });
 	const signer = options.signer ?? standardWebhooks();
+	const encoders = encoderRegistry(options.encoders);
+	const defaultFormat = options.defaultFormat ?? "cloudevents";
+	if (!WEBHOOK_FORMAT.test(defaultFormat)) throw new TypeError(`createWebhooks: defaultFormat "${defaultFormat}" must match ${String(WEBHOOK_FORMAT)}`);
 	const maxAttempts = options.retry?.maxAttempts ?? 8;
 	const backoff = options.retry?.backoff ?? defaultBackoff;
 	const retryable = options.retry?.retryable ?? defaultRetryable;
 	const bodyLimit = options.responseBodyLimit ?? 2e3;
+	const source = sourceOf(options);
+	const dataschema = typeof options.dataschema === "string" ? absoluteUri("createWebhooks: dataschema", options.dataschema) : options.dataschema;
+	const subscribers = options.subscribers ?? options.authorization?.delivery?.subscribers ?? (options.authorization === void 0 ? void 0 : subjectReaders(transport, { schema }));
 	let http = options.http;
 	const httpTransport = () => http ??= fetchTransport({ allowUrl: options.allowUrl ?? publicUrl() });
-	const call = (fn, args) => transport.call(schema, fn, args);
-	function run(fn, then) {
-		return AsyncResult.from(async () => {
-			try {
-				return ok(then(await fn()));
-			} catch (cause) {
-				const raw = rawError(cause);
-				return err(raw ? mapDbError(raw, mappers) : toDbError(cause));
-			}
-		});
-	}
+	const db = blockCall(transport, schema, mappers);
+	/** A call the worker needs to go on: it throws the mapped `DbError`. */
+	const call = (fn, args) => db(fn, args, (value) => value).orThrow();
+	const emitEvent = blockEmitter(options);
 	function emit(type, delivery, extra = {}) {
-		if (!options.events) return;
-		emitBlockEvent(options.events, type, {
+		emitEvent(type, {
 			endpointId: delivery.endpointId,
 			deliveryId: delivery.id,
 			eventType: delivery.type,
 			attempt: delivery.attempt,
 			...extra
-		}, {
-			subject: `webhooks/${delivery.endpointId}`,
-			...delivery.tenant ? { tenant: delivery.tenant } : {},
-			...options.context ? { context: options.context } : {}
-		});
+		}, `webhooks/${delivery.endpointId}`, delivery.tenant);
 	}
 	async function complete(delivery, status, detail) {
 		const retryAfter = Math.min(detail.response?.retryAfter ?? 0, MAX_RETRY_AFTER);
@@ -710,79 +1082,186 @@ function createWebhooks(options) {
 		});
 	}
 	const failure = (delivery) => delivery.attempt >= maxAttempts ? "dead" : "retrying";
-	async function attempt(delivery) {
-		if (options.shouldDeliver) {
-			let send;
-			try {
-				send = await options.shouldDeliver(delivery);
-			} catch (cause) {
-				return {
-					outcome: "canceled",
-					error: errorText(cause)
-				};
-			}
-			if (!send) return {
-				outcome: "canceled",
-				error: "Canceled by shouldDeliver"
-			};
-		}
+	async function cloudEvent(delivery) {
+		const schema = typeof dataschema === "function" ? dataschema(delivery) : dataschema;
+		const traceparent = options.traceparent?.(delivery);
+		return {
+			specversion: "1.0",
+			id: delivery.id,
+			source,
+			type: options.typePrefix ? `${options.typePrefix.replace(/\.$/, "")}.${delivery.type}` : delivery.type,
+			...delivery.subject ? { subject: delivery.subject } : {},
+			time: delivery.createdAt.toString(),
+			datacontenttype: "application/json",
+			...schema === void 0 ? {} : { dataschema: absoluteUri("createWebhooks: dataschema", schema) },
+			data: options.transform ? await options.transform(delivery) : delivery.payload,
+			...traceparent !== void 0 && TRACEPARENT.test(traceparent) ? { traceparent } : {}
+		};
+	}
+	/** The headers the endpoint's `credential_ref` token becomes. */
+	async function authorization(delivery, encoder) {
+		const ref = delivery.credentialRef;
+		if (ref === null) return ok({});
+		if (!credentialRefInTenant(ref, delivery.tenant ?? void 0)) return err({
+			outcome: "dead",
+			error: foreignCredentialRef(delivery.tenant ?? void 0).message
+		});
+		if (options.credentials === void 0) return err({
+			outcome: "dead",
+			error: "The endpoint has a credential_ref, but no credentials provider is set"
+		});
+		const token = await options.credentials.getToken(ref, { subject: { type: "app" } });
+		if (!token.ok) return err({
+			outcome: PERMANENT_CREDENTIAL_ERRORS.has(token.error.kind) ? "dead" : "failed",
+			error: token.error.message
+		});
+		return ok(encoder.authorize?.(token.data) ?? token.data.headers);
+	}
+	/** The Standard Webhooks headers, from the endpoint's secrets or `asymmetricSigner`. */
+	async function signatureHeaders(deliveries, body) {
+		const first = deliveries[0];
+		const sign = first.signing === "v1a" ? options.asymmetricSigner : signer;
+		if (sign === void 0) return err({
+			outcome: "dead",
+			error: "The endpoint signs with v1a, but no asymmetricSigner is set"
+		});
+		const secrets = await store.secrets(first.endpointId);
+		if (secrets.length === 0 && first.signing === "v1") return err({
+			outcome: "dead",
+			error: "The endpoint has no signing secret"
+		});
+		return ok(await sign.sign({
+			id: first.batch ? await batchId(deliveries) : first.id,
+			body,
+			timestamp: temporal().Now.instant(),
+			secrets
+		}));
+	}
+	/** Sends one delivery, or one batch for an endpoint that takes batches. */
+	async function attempt(deliveries) {
+		const first = deliveries[0];
+		const encoder = encoders.get(first.format);
+		if (encoder === void 0) return {
+			outcome: "dead",
+			error: `No encoder for the endpoint format "${first.format}"`
+		};
 		let body;
 		let headers;
 		try {
-			const secrets = await store.secrets(delivery.endpointId);
-			if (secrets.length === 0) return {
-				outcome: "dead",
-				error: "The endpoint has no signing secret"
-			};
-			body = JSON.stringify(options.transform ? await options.transform(delivery) : {
-				type: delivery.type,
-				timestamp: delivery.createdAt.toString(),
-				data: delivery.payload
+			const auth = await authorization(first, encoder);
+			if (!auth.ok) return auth.error;
+			const events = await Promise.all(deliveries.map(cloudEvent));
+			const message = await encoder.encode(events, {
+				url: first.url,
+				batch: first.batch,
+				tenant: first.tenant
 			});
+			body = message.body;
+			const signature = encoder.signed ? await signatureHeaders(deliveries, body) : ok({});
+			if (!signature.ok) return signature.error;
 			headers = {
-				"content-type": "application/json",
+				...message.headers,
 				"user-agent": "better-supabase-webhooks",
-				...options.headers?.(delivery),
-				...await signer.sign({
-					id: delivery.id,
-					body,
-					timestamp: temporal().Now.instant(),
-					secrets
-				})
+				...options.headers?.(first),
+				...auth.data,
+				...signature.data
 			};
 		} catch (cause) {
 			return {
-				outcome: failure(delivery),
+				outcome: "failed",
 				error: errorText(cause)
 			};
 		}
 		const started = Date.now();
 		try {
 			const response = await httpTransport().send({
-				url: delivery.url,
+				url: first.url,
 				headers,
 				body
 			});
 			const durationMs = Date.now() - started;
+			const verdict = encoder.classify?.(response);
+			if (verdict !== void 0) return {
+				outcome: verdict.outcome === "retry" ? "failed" : verdict.outcome,
+				response,
+				durationMs,
+				...verdict.error === void 0 ? {} : { error: verdict.error }
+			};
 			if (response.status >= 200 && response.status < 300) return {
 				outcome: "succeeded",
 				response,
 				durationMs
 			};
 			return {
-				outcome: retryable(response.status) ? failure(delivery) : "dead",
+				outcome: retryable(response.status) ? "failed" : "dead",
 				response,
 				durationMs,
 				error: `HTTP ${String(response.status)}`
 			};
 		} catch (cause) {
 			return {
-				outcome: cause instanceof WebhookPolicyError ? "dead" : failure(delivery),
+				outcome: cause instanceof WebhookPolicyError ? "dead" : "failed",
 				durationMs: Date.now() - started,
 				error: errorText(cause)
 			};
 		}
 	}
+	/** `false` (or a throw) from `shouldDeliver` cancels the delivery. */
+	async function vetoed(delivery) {
+		if (!options.shouldDeliver) return;
+		try {
+			if (await options.shouldDeliver(delivery)) return;
+		} catch (cause) {
+			return {
+				outcome: "canceled",
+				error: errorText(cause)
+			};
+		}
+		return {
+			outcome: "canceled",
+			error: "Canceled by shouldDeliver"
+		};
+	}
+	/**
+	* Runs `subscribers` once per event and stored subject over its claimed
+	* deliveries. A delivery it leaves out is canceled; a throw fails every
+	* delivery of the event, which then retries.
+	*/
+	async function screen(queue) {
+		const refused = /* @__PURE__ */ new Map();
+		if (!subscribers) return refused;
+		const byEvent = Map.groupBy(queue, (delivery) => `${delivery.eventId ?? `delivery:${delivery.id}`}\u0000${delivery.subject ?? ""}`);
+		await Promise.all([...byEvent.values()].map(async (deliveries) => {
+			const first = deliveries[0];
+			const event = {
+				type: first.type,
+				tenant: first.tenant,
+				actorId: actorOf(first.payload),
+				payload: first.payload,
+				subject: first.subject
+			};
+			const candidates = deliveries.map((delivery) => ({
+				principal: delivery.owner ?? delivery.principal ?? delivery.endpointId,
+				kind: delivery.owner ? "user" : "service",
+				delivery
+			}));
+			let kept;
+			try {
+				kept = new Set(await subscribers(event, candidates));
+			} catch (cause) {
+				for (const delivery of deliveries) refused.set(delivery, {
+					outcome: "failed",
+					error: `Subscriber policy failed: ${errorText(cause)}`
+				});
+				return;
+			}
+			for (const candidate of candidates) if (!kept.has(candidate)) refused.set(candidate.delivery, {
+				outcome: "canceled",
+				error: "Refused by the subscriber policy"
+			});
+		}));
+		return refused;
+	}
 	async function deliver(deliverOptions = {}) {
 		const counts = {
 			succeeded: 0,
@@ -791,21 +1270,21 @@ function createWebhooks(options) {
 			canceled: 0,
 			disabled: 0
 		};
-		const deadline = deliverOptions.budgetMs === void 0 ? Number.POSITIVE_INFINITY : Date.now() + deliverOptions.budgetMs;
+		const spent = budget(deliverOptions.budgetMs);
 		const batch = deliverOptions.batch ?? 25;
 		const concurrency = Math.max(1, deliverOptions.concurrency ?? 10);
-		async function handle(delivery) {
-			const result = await attempt(delivery);
-			const state = await complete(delivery, result.outcome, result);
+		async function finish(delivery, result) {
+			const outcome = result.outcome === "failed" ? failure(delivery) : result.outcome;
+			const state = await complete(delivery, outcome, result);
 			if (state === "stale") return;
-			switch (result.outcome) {
+			switch (outcome) {
 				case "succeeded":
 					counts.succeeded += 1;
 					emit("webhook.delivered", delivery, { status: result.response?.status ?? 200 });
 					break;
 				case "retrying":
 				case "dead":
-					if (result.outcome === "retrying") counts.retrying += 1;
+					if (outcome === "retrying") counts.retrying += 1;
 					else counts.dead += 1;
 					emit("webhook.failed", delivery, {
 						...result.response ? { status: result.response.status } : {},
@@ -815,65 +1294,81 @@ function createWebhooks(options) {
 				case "canceled":
 					counts.canceled += 1;
 					break;
-				default: {
-					const unknown = result.outcome;
-					throw new TypeError(`Unknown outcome ${String(unknown)}`);
-				}
+				default: throw new TypeError(`Unknown outcome ${String(outcome)}`);
 			}
 			if (state === "disabled") {
 				counts.disabled += 1;
 				emit("webhook.disabled", delivery);
 			}
 		}
-		while (Date.now() < deadline) {
+		async function handle(deliveries) {
+			const send = [];
+			for (const delivery of deliveries) {
+				const veto = await vetoed(delivery);
+				if (veto) await finish(delivery, veto);
+				else send.push(delivery);
+			}
+			if (send.length === 0) return;
+			const result = await attempt(send);
+			for (const delivery of send) await finish(delivery, result);
+		}
+		while (!spent.expired()) {
 			const claimed = await call("claim_webhook_deliveries", {
 				max_items: batch,
 				lease: deliverOptions.lease ?? "2 minutes",
 				max_attempts: maxAttempts
 			});
-			const queue = (Array.isArray(claimed) ? claimed : []).filter(isRecord).map(toDelivery);
-			const size = queue.length;
-			await Promise.all(Array.from({ length: Math.min(concurrency, size) }, async () => {
+			const deliveries = (Array.isArray(claimed) ? claimed : []).filter(isRecord).map((row) => toDelivery(row, defaultFormat));
+			const size = deliveries.length;
+			const refused = await screen(deliveries);
+			for (const [delivery, result] of refused) await finish(delivery, result);
+			const allowed = deliveries.filter((delivery) => !refused.has(delivery));
+			const batched = Map.groupBy(allowed.filter((delivery) => delivery.batch), (delivery) => delivery.endpointId);
+			const queue = [...allowed.filter((delivery) => !delivery.batch).map((delivery) => [delivery]), ...batched.values()];
+			await Promise.all(Array.from({ length: Math.min(concurrency, queue.length) }, async () => {
 				for (let next = queue.shift(); next; next = queue.shift()) await handle(next);
 			}));
 			if (size < batch) break;
 		}
 		return counts;
 	}
-	return {
-		publish: (event) => run(() => call("publish_webhook_event", {
-			event_type: event.type,
-			payload: event.data ?? {},
-			tenant: event.tenant ?? null,
-			event_id: event.id ?? null
-		}), Number),
-		dispatch: (input) => run(() => call("dispatch_webhook", {
+	const purge = (purgeOptions = {}) => db("purge_webhook_deliveries", {
+		older_than: purgeOptions.olderThan === void 0 ? void 0 : seconds(purgeOptions.olderThan),
+		include_dead: purgeOptions.includeDead,
+		batch: purgeOptions.batch
+	}, (value) => Number(value ?? 0));
+	const publishMany = (events) => events.length === 0 ? AsyncResult.ok([]) : db("publish_webhook_events", { events: events.map(publishArgs) }, (value) => batchResultsOf(value, events.length, "count", Number, mappers));
+	return withBlockHooks({
+		purge,
+		purgeJob: (jobOptions) => async () => purge(jobOptions).orThrow(),
+		publish: (event) => db("publish_webhook_event", publishArgs(event), Number),
+		publishMany,
+		dispatch: (input) => db("dispatch_webhook", {
 			endpoint: input.endpointId,
 			event_type: input.type,
 			payload: input.data ?? {},
 			run_id: input.runId ?? null,
 			event_id: input.eventId ?? null
-		}), String),
-		redeliver: (deliveryId) => run(() => call("redeliver_webhook", { delivery: deliveryId }), String),
+		}, String),
+		redeliver: (deliveryId) => db("redeliver_webhook", { delivery: deliveryId }, String),
 		rotateSecret(endpointId, rotateOptions) {
 			if (!store.rotate) return AsyncResult.err(dbError("unexpected", "The secret store can't rotate secrets"));
 			const rotate = store.rotate.bind(store);
-			return run(() => rotate(endpointId, rotateOptions), String);
+			return AsyncResult.from(async () => {
+				try {
+					return ok(await rotate(endpointId, rotateOptions));
+				} catch (cause) {
+					return err(toBlockError(cause, mappers));
+				}
+			});
 		},
 		deliver,
 		deliverRoute(routeOptions) {
-			const secret = routeOptions.secret;
-			if (!secret) throw new TypeError("deliverRoute needs a secret, such as process.env.CRON_SECRET");
-			return async (request) => {
-				const instance = new URL(request.url).pathname;
-				if (request.method !== "GET" && request.method !== "POST") return new Response(null, {
-					status: 405,
-					headers: { allow: "GET, POST" }
-				});
-				if (!verifySharedSecret(request, secret)) return problemResponse(dbError("unauthorized", "The deliver route needs its bearer secret"), {
-					instance,
-					format: routeOptions.problem
-				});
+			return cronRoute({
+				name: "deliver",
+				secret: routeOptions.secret,
+				problem: routeOptions.problem
+			}, async (_request, instance) => {
 				try {
 					return Response.json(await deliver({
 						budgetMs: 5e4,
@@ -886,23 +1381,72 @@ function createWebhooks(options) {
 						format: routeOptions.problem
 					});
 				}
-			};
+			});
 		},
-		sink: (sinkOptions = {}) => {
-			const prefix = `${sinkOptions.typePrefix ?? "dev.better-supabase"}.`;
-			return { async send(events) {
-				for (const event of events) {
+		sink: (sinkOptions = {}) => ({ async send(events) {
+			let failure;
+			for (const chunk of chunksOf(events, MAX_BATCH)) {
+				const results = await publishMany(chunk.map((event) => {
 					const tenant = event["partitionkey"];
-					await call("publish_webhook_event", {
-						event_type: event.type.startsWith(prefix) ? event.type.slice(prefix.length) : event.type,
-						payload: event.data ?? {},
-						tenant: typeof tenant === "string" ? tenant : null,
-						event_id: event.id
-					});
+					return {
+						type: stripTypePrefix(event.type, sinkOptions.typePrefix),
+						data: event.data ?? {},
+						...typeof tenant === "string" ? { tenant } : {},
+						id: event.id,
+						...event.subject === void 0 ? {} : { subject: event.subject }
+					};
+				}));
+				if (!results.ok) {
+					failure ??= new DbException(results.error);
+					continue;
 				}
-			} };
-		}
-	};
+				for (const result of results.data) if (!result.ok) failure ??= new DbException(result.error);
+			}
+			if (failure !== void 0) throw failure;
+		} })
+	}, options.hooks, {
+		block: "webhooks",
+		...options.events ? { logger: options.events.logger } : {}
+	});
 }
 //#endregion
-export { INCOMING_ENDPOINT_HEADER, UnsafeUrlError, UrlCheckError, WebhookPolicyError, authHook, createIncomingWebhooks, createSafeFetch, createWebhooks, databaseChange, fetchTransport, hmacSigner, hookError, isDatabaseWebhook, isPublicAddress, publicUrl, rpcTransport, signStripeWebhook, signWebhook, sqlSecretStore, sqlTransport, standardWebhooks, stripeInboxVerify, timingSafeEqual, verifySharedSecret, verifyStripeWebhook, verifyWebhook };
+//#region src/blocks/webhooks/events.ts
+/** The `webhooks` block's event types, for its manifest and `onBlockEvent`. */
+const webhooksEvents = defineEvents({
+	"webhook.delivered": event(),
+	"webhook.failed": event(),
+	"webhook.disabled": event(),
+	"webhook.secret_rotated": event()
+});
+/** The `incoming-webhooks` block's event types, for its manifest and `onBlockEvent`. */
+const incomingWebhooksEvents = defineEvents({
+	"incoming_webhook.created": event(),
+	"incoming_webhook.updated": event(),
+	"incoming_webhook.enabled_set": event(),
+	"incoming_webhook.token_rotated": event(),
+	"incoming_webhook.secret_rotated": event(),
+	"incoming_webhook.deleted": event()
+});
+//#endregion
+//#region src/blocks/webhooks/manifest.ts
+/** The `webhooks` block's manifest (ADR 0029). */
+const webhooksBlock = defineBlock({
+	name: "webhooks",
+	sql: ["webhooks-out"],
+	options: { "webhooks-out": webhooksOutSqlOptions },
+	events: webhooksEvents,
+	create: createWebhooks,
+	category: "developer",
+	recipes: ["webhook-endpoints"]
+});
+/** The `incoming-webhooks` block's manifest (ADR 0029). */
+const incomingWebhooksBlock = defineBlock({
+	name: "incoming-webhooks",
+	sql: ["webhooks-in"],
+	options: { "webhooks-in": webhooksInSqlOptions },
+	events: incomingWebhooksEvents,
+	create: createIncomingWebhooks,
+	category: "developer"
+});
+//#endregion
+export { INCOMING_ENDPOINT_HEADER, UnsafeUrlError, UrlCheckError, WebhookPolicyError, authHook, cloudEvents, createIncomingWebhooks, createSafeFetch, createWebhooks, databaseChange, dbTransport, fetchTransport, hmacSigner, hookError, inboxDestination, incomingWebhooksBlock, incomingWebhooksEvents, isDatabaseWebhook, isPublicAddress, jobsDestination, otlpLogs, publicUrl, rpcTransport, securityEvents, signStripeWebhook, signWebhook, splunkHec, sqlSecretStore, sqlTransport, standardEnvelope, standardWebhooks, standardWebhooksAsymmetric, stripeInboxVerify, timingSafeEqual, verifySharedSecret, verifyStripeWebhook, verifyWebhook, webhookPublicKey, webhooksBlock, webhooksEvents };