better-supabase 0.8.0 → 0.9.0

package/dist/wire-Df3EWkG8.js

@@ -1,45 +0,0 @@
-import { t as DbException } from "./db-exception-CnWcYPxL.js";
-import { n as dbError } from "./errors-2M6CKMP4.js";
-import { d as temporalText } from "./temporal-BJGitm-h.js";
-import { t as temporal } from "./temporal-required-BtynQtM-.js";
-//#region src/ir/wire.ts
-/** ISO text of a `Date`; an invalid date has none. */
-function dateText(value) {
-	if (Number.isNaN(value.getTime())) throw new DbException(dbError("invalid_value", "The Date is invalid"));
-	return value.toISOString();
-}
-/**
-* Wire form of an app value: Temporal values and `Date` to ISO text, `bigint`
-* to decimal text.
-*/
-function encodeValue(value) {
-	if (typeof value !== "object" || value === null) return typeof value === "bigint" ? value.toString() : value;
-	if (value instanceof Date) return dateText(value);
-	const text = temporalText(value);
-	if (text !== void 0) return text;
-	if (Array.isArray(value)) return value.map(encodeValue);
-	return value;
-}
-/** Postgres timestamps can be `infinity`; Temporal has no such value. */
-function finite(value, type) {
-	const text = String(value);
-	if (text === "infinity" || text === "-infinity") throw new DbException(dbError("invalid_value", `${text} can't be held by a Temporal.${type}`));
-	return text;
-}
-/** App form of one wire scalar for a column with `codec`. */
-function decodeScalar(codec, value) {
-	if (value === null || value === void 0) return value;
-	switch (codec) {
-		case "instant": return temporal().Instant.from(finite(value, "Instant"));
-		case "plainDateTime": return temporal().PlainDateTime.from(finite(value, "PlainDateTime"));
-		case "bigint": return BigInt(value);
-		case "string": return String(value);
-		default: return codec;
-	}
-}
-/** App form of a wire value for a column with `codec`. */
-function decodeValue(codec, value) {
-	return Array.isArray(value) ? value.map((item) => decodeScalar(codec, item)) : decodeScalar(codec, value);
-}
-//#endregion
-export { encodeValue as i, decodeScalar as n, decodeValue as r, dateText as t };

package/dist/workflow-builder-CHqHpAVt.js

@@ -1,399 +0,0 @@
-import { n as dbError } from "./errors-2M6CKMP4.js";
-import { a as ok, r as err, t as AsyncResult } from "./result-DEqHCMKP.js";
-import { n as isRecord } from "./guards-6F2bCtQR.js";
-import { n as credentialRefInTenant, r as foreignCredentialRef } from "./provider-DxRTex4x.js";
-import { A as stringsOf, C as recordOrEmpty, D as seconds, S as recordOf, T as requiredInstant, _ as optionalInstant, b as randomToken, c as enumOrThrow, i as blockCall, j as textOf, n as applyTemporal, u as injectableOf, v as optionalText, w as recordsOf } from "./block-helpers-Cy3pB96I.js";
-import { t as createWorkflows } from "./workflows-IvxzG2cl.js";
-import { o as graphOf, r as diffGraphs } from "./graph-BGyLLFLX.js";
-//#region src/blocks/workflow-builder/rows.ts
-const VERSION_STATUSES = [
-	"draft",
-	"published",
-	"archived"
-];
-const TRIGGER_KINDS = [
-	"manual",
-	"webhook",
-	"schedule",
-	"event",
-	"form",
-	"chat"
-];
-const NODE_RUN_STATUSES = [
-	"running",
-	"waiting",
-	"completed",
-	"failed",
-	"skipped"
-];
-function definitionOf(row) {
-	const published = row["published"];
-	return {
-		id: textOf(row["id"]),
-		tenant: optionalText(row["tenant"]),
-		slug: textOf(row["slug"]),
-		name: textOf(row["name"]),
-		description: optionalText(row["description"]),
-		createdBy: optionalText(row["createdBy"]),
-		createdAt: requiredInstant(row["createdAt"], "createdAt"),
-		updatedAt: requiredInstant(row["updatedAt"], "updatedAt"),
-		..."published" in row ? { published: typeof published === "number" ? published : void 0 } : {},
-		..."draft" in row ? { draft: row["draft"] === true } : {}
-	};
-}
-function versionOf(row) {
-	return {
-		id: textOf(row["id"]),
-		definition: textOf(row["definition"]),
-		version: Number(row["version"]),
-		status: enumOrThrow(row["status"], VERSION_STATUSES, "version status"),
-		createdBy: optionalText(row["createdBy"]),
-		createdAt: requiredInstant(row["createdAt"], "createdAt"),
-		publishedAt: optionalInstant(row["publishedAt"]),
-		..."graph" in row ? { graph: graphOf(row["graph"]) } : {},
-		..."compiled" in row && row["compiled"] !== null ? { compiled: row["compiled"] } : {}
-	};
-}
-function triggerOf(row) {
-	return {
-		id: textOf(row["id"]),
-		definition: textOf(row["definition"]),
-		kind: enumOrThrow(row["kind"], TRIGGER_KINDS, "trigger kind"),
-		config: recordOrEmpty(row["config"]),
-		enabled: row["enabled"] !== false,
-		createdAt: requiredInstant(row["createdAt"], "createdAt"),
-		updatedAt: requiredInstant(row["updatedAt"], "updatedAt")
-	};
-}
-function refOf(value) {
-	if (!isRecord(value) || typeof value["provider"] !== "string") throw new TypeError("workflow-builder: a credential_ref has no provider");
-	return {
-		...value,
-		provider: value["provider"]
-	};
-}
-function credentialOf(row) {
-	return {
-		id: textOf(row["id"]),
-		tenant: optionalText(row["tenant"]),
-		kind: textOf(row["kind"]),
-		name: textOf(row["name"]),
-		ref: refOf(row["ref"]),
-		scopes: Array.isArray(row["scopes"]) ? stringsOf(row["scopes"]) : [],
-		createdBy: optionalText(row["createdBy"]),
-		createdAt: requiredInstant(row["createdAt"], "createdAt")
-	};
-}
-function stepOf(row) {
-	return {
-		name: textOf(row["name"]),
-		title: textOf(row["title"]),
-		description: optionalText(row["description"]),
-		inputSchema: recordOrEmpty(row["inputSchema"]),
-		outputSchema: recordOrEmpty(row["outputSchema"]),
-		credentialKind: optionalText(row["credentialKind"])
-	};
-}
-function nodeRunOf(row) {
-	return {
-		run: textOf(row["run"]),
-		node: textOf(row["node"]),
-		status: enumOrThrow(row["status"], NODE_RUN_STATUSES, "node status"),
-		attempts: Number(row["attempts"] ?? 0),
-		output: row["output"] ?? void 0,
-		error: optionalText(row["error"]),
-		startedAt: optionalInstant(row["startedAt"]),
-		endedAt: optionalInstant(row["endedAt"])
-	};
-}
-function alertOf(row) {
-	const threshold = row["threshold"];
-	return {
-		id: textOf(row["id"]),
-		definition: textOf(row["definition"]),
-		onEvent: row["onEvent"] === "slow" ? "slow" : "failed",
-		threshold: threshold === null || threshold === void 0 ? void 0 : Number(threshold),
-		channel: recordOrEmpty(row["channel"]),
-		createdBy: optionalText(row["createdBy"]),
-		createdAt: requiredInstant(row["createdAt"], "createdAt")
-	};
-}
-/** `map` over an object result, or `undefined` for anything else. */
-function optionalOf(map) {
-	return (value) => isRecord(value) ? map(value) : void 0;
-}
-//#endregion
-//#region src/blocks/workflow-builder/workflow-builder.ts
-const BUILDER_PREFIX = "builder:";
-/**
-* The `workflow-builder` module's definitions, versions, triggers,
-* credentials, step library, node runs and alerts. The engine plugs in
-* through `compile` and `start`; credential rows resolve through the
-* `credentials` providers.
-*
-* ```ts
-* const builder = createBuilder({
-*   transport: rpcTransport(supabase),
-*   compile: compileGraph,
-*   start: graphStarter({ executor: builderWorkflow, steps: { runNode } }),
-* });
-* ```
-*/
-function createBuilder(options) {
-	applyTemporal(options);
-	injectableOf("workflow-builder compiler", options.compile);
-	injectableOf("workflow-builder starter", options.start);
-	const call = blockCall(options.transport, options.schema, options.mappers);
-	const serviceCall = blockCall(options.service ?? options.transport, options.schema, options.mappers);
-	const providers = options.credentials === void 0 ? [] : Array.isArray(options.credentials) ? options.credentials : [options.credentials];
-	const providerFor = (ref) => providers.find((provider) => provider.name === ref.provider);
-	const noProvider = (ref) => dbError("invalid_request", `No credential provider named "${ref.provider}" was passed to createBuilder`);
-	const getVersion = (version) => call("workflow_version_get", { version }, optionalOf(versionOf));
-	const startTarget = (caller, definition, start) => caller("workflow_start_target", { definition }, (value) => recordOf(value, "workflow_start_target")).andThen(async (row) => {
-		const target = {
-			definition: definitionOf(recordOf(row["definition"], "definition")),
-			version: versionOf(recordOf(row["version"], "version"))
-		};
-		return ok(await start(target));
-	});
-	const starterOf = () => options.start;
-	const missingStarter = () => dbError("invalid_request", "Pass `start` to createBuilder to run workflows");
-	const runWith = (caller, input) => {
-		const start = starterOf();
-		if (start === void 0) return AsyncResult.err(missingStarter());
-		return startTarget(caller, input.definition, (target) => start({
-			definition: target.definition,
-			version: target.version,
-			input: input.input ?? {},
-			tenant: target.definition.tenant,
-			actor: input.actor,
-			idempotencyKey: input.idempotencyKey ?? `run:${randomToken(16)}`,
-			...input.trigger === void 0 ? {} : { trigger: input.trigger }
-		}));
-	};
-	const credentialRow = (id) => serviceCall("workflow_credential_get", { credential: id }, (value) => isRecord(value) ? credentialOf(value) : void 0);
-	return {
-		definitions: {
-			save: (input) => call("save_workflow_definition", {
-				tenant: input.tenant,
-				slug: input.slug,
-				name: input.name,
-				description: input.description
-			}, (value) => definitionOf(recordOf(value, "save_workflow_definition"))),
-			list: (tenant) => call("workflow_definitions_list", { tenant }, (value) => recordsOf(value, "workflow_definitions_list").map(definitionOf)),
-			get: (id) => call("workflow_definition_get", { definition: id }, optionalOf(definitionOf)),
-			remove: (id) => call("remove_workflow_definition", { definition: id }, (value) => value === true)
-		},
-		versions: {
-			save: (definition, graph) => call("save_workflow_draft", {
-				definition,
-				graph
-			}, (value) => versionOf(recordOf(value, "save_workflow_draft"))),
-			publish: (version) => getVersion(version).andThen(async (found) => {
-				if (found === void 0) return err(dbError("not_found", "No such workflow version"));
-				let compiled = null;
-				if (options.compile !== void 0 && found.status !== "published") try {
-					compiled = await options.compile(found.graph ?? graphOf(void 0)) ?? null;
-				} catch (cause) {
-					return err(dbError("invalid_input", cause instanceof Error ? cause.message : String(cause)));
-				}
-				const publish = (caller, stored) => caller("publish_workflow_version", {
-					version,
-					compiled: stored
-				}, (value) => versionOf(recordOf(value, "publish_workflow_version")));
-				const result = await publish(call, null);
-				if (!result.ok || compiled === null || options.service === void 0) return result;
-				return publish(serviceCall, compiled);
-			}),
-			list: (definition) => call("workflow_versions_list", { definition }, (value) => recordsOf(value, "workflow_versions_list").map(versionOf)),
-			get: getVersion,
-			diff: (from, to) => getVersion(from).andThen(async (before) => {
-				const after = await getVersion(to);
-				if (!after.ok) return after;
-				if (before === void 0 || after.data === void 0) return err(dbError("not_found", "No such workflow version"));
-				return ok(diffGraphs(before.graph ?? graphOf(void 0), after.data.graph ?? graphOf(void 0)));
-			})
-		},
-		run: (input) => runWith(call, input),
-		triggers: {
-			save: (input) => call("save_workflow_trigger", {
-				definition: input.definition,
-				kind: input.kind,
-				config: input.config ?? {},
-				enabled: input.enabled ?? true,
-				trigger: input.id
-			}, (value) => triggerOf(recordOf(value, "save_workflow_trigger"))),
-			list: (definition) => call("workflow_triggers_list", { definition }, (value) => recordsOf(value, "workflow_triggers_list").map(triggerOf)),
-			remove: (id) => call("remove_workflow_trigger", { trigger: id }, (value) => value === true),
-			rotateToken: (id) => call("rotate_workflow_webhook_token", { trigger: id }, textOf),
-			webhook: async (request) => {
-				if (request.method !== "POST") return Response.json({ error: "Method not allowed" }, {
-					status: 405,
-					headers: { allow: "POST" }
-				});
-				const token = webhookToken(request);
-				if (token === void 0) return Response.json({ error: "Not found" }, { status: 404 });
-				const target = await serviceCall("workflow_webhook_target", { token }, (value) => isRecord(value) ? value : void 0);
-				if (!target.ok) return Response.json({ error: target.error.message }, { status: 500 });
-				if (target.data === void 0) return Response.json({ error: "Not found" }, { status: 404 });
-				const trigger = triggerOf(recordOf(target.data["trigger"], "trigger"));
-				const key = request.headers.get("idempotency-key");
-				const started = await runWith(serviceCall, {
-					definition: trigger.definition,
-					input: await bodyOf(request),
-					idempotencyKey: key === null || key.length === 0 ? `webhook:${trigger.id}:${randomToken(16)}` : `webhook:${trigger.id}:${key}`,
-					trigger
-				});
-				return started.ok ? Response.json({ runId: started.data }, { status: 202 }) : Response.json({ error: started.error.message }, { status: started.error.status });
-			},
-			onEvent: (event) => serviceCall("workflow_event_targets", {
-				type: event.type,
-				tenant: event.tenant
-			}, (value) => recordsOf(value, "workflow_event_targets")).andThen(async (rows) => {
-				const runs = [];
-				for (const row of rows) {
-					const trigger = triggerOf(recordOf(row["trigger"], "trigger"));
-					const started = await runWith(serviceCall, {
-						definition: trigger.definition,
-						input: event.payload ?? {},
-						idempotencyKey: `event:${trigger.id}:${event.id}`,
-						trigger
-					});
-					if (!started.ok) return started;
-					runs.push(started.data);
-				}
-				return ok(runs);
-			}),
-			syncSchedule: (trigger, tenant) => {
-				const cron = trigger.config["cron"];
-				if (trigger.kind !== "schedule" || typeof cron !== "string") return AsyncResult.err(dbError("invalid_input", "Only a schedule trigger with config.cron has a schedule"));
-				const timezone = trigger.config["timezone"];
-				return createWorkflows({
-					transport: options.service ?? options.transport,
-					...options.mappers === void 0 ? {} : { mappers: options.mappers }
-				}).schedules.create({
-					name: `builder-trigger:${trigger.id}`,
-					workflow: `${BUILDER_PREFIX}${trigger.definition}`,
-					cron,
-					...typeof timezone === "string" ? { timezone } : {},
-					input: trigger.config["input"] ?? {},
-					...tenant === void 0 ? {} : { tenant }
-				});
-			},
-			starter: (fallback) => async (scheduled) => {
-				if (!scheduled.workflow.startsWith(BUILDER_PREFIX)) {
-					if (fallback === void 0) throw new Error(`better-supabase: no starter for workflow "${scheduled.workflow}"`);
-					return fallback(scheduled);
-				}
-				return runWith(serviceCall, {
-					definition: scheduled.workflow.slice(8),
-					input: scheduled.input,
-					idempotencyKey: scheduled.idempotencyKey,
-					...scheduled.actor === void 0 ? {} : { actor: scheduled.actor }
-				}).orThrow();
-			}
-		},
-		credentials: {
-			list: (tenant) => call("workflow_credentials_list", { tenant }, (value) => recordsOf(value, "workflow_credentials_list").map(credentialOf)),
-			create: (input) => {
-				const save = () => call("save_workflow_credential", {
-					tenant: input.tenant,
-					kind: input.kind,
-					name: input.name,
-					ref: input.ref,
-					scopes: input.scopes ?? []
-				}, (value) => credentialOf(recordOf(value, "save_workflow_credential")));
-				if (input.secret === void 0) return save();
-				if (!credentialRefInTenant(input.ref, input.tenant)) return AsyncResult.err(foreignCredentialRef(input.tenant));
-				const provider = providerFor(input.ref);
-				if (provider === void 0) return AsyncResult.err(noProvider(input.ref));
-				if (provider.set === void 0) return AsyncResult.err(dbError("unsupported", `The credential provider "${provider.name}" can't store secrets`));
-				return provider.set(input.ref, input.secret, { subject: { type: "app" } }).andThen(() => save());
-			},
-			authorize: (id, authorize) => credentialRow(id).andThen(async (row) => {
-				if (row === void 0) return err(dbError("not_found", "No such credential"));
-				const provider = providerFor(row.ref);
-				if (provider === void 0) return err(noProvider(row.ref));
-				if (provider.startAuthorization === void 0 || !provider.capabilities(row.ref).authorization) return err(dbError("unsupported", `The credential provider "${provider.name}" doesn't authorize accounts`));
-				return provider.startAuthorization(row.ref, {
-					subject: { type: "app" },
-					redirectUri: authorize.redirectUri,
-					scopes: row.scopes,
-					...authorize.state === void 0 ? {} : { state: authorize.state }
-				}).map((started) => started.url);
-			}),
-			revoke: (id) => call("remove_workflow_credential", { credential: id }, (value) => isRecord(value) ? credentialOf(value) : void 0).andThen(async (row) => {
-				if (row === void 0) return ok(false);
-				if (!credentialRefInTenant(row.ref, row.tenant)) return ok(true);
-				const provider = providerFor(row.ref);
-				if (provider === void 0) return err(noProvider(row.ref));
-				if (!provider.capabilities(row.ref).revoke) return ok(true);
-				const revoked = await provider.revoke(row.ref, { subject: { type: "app" } });
-				return revoked.ok ? ok(true) : revoked;
-			}),
-			resolve: (id) => credentialRow(id).andThen(async (row) => {
-				if (row === void 0) return err(dbError("not_found", "No such credential"));
-				if (!credentialRefInTenant(row.ref, row.tenant)) return err(foreignCredentialRef(row.tenant));
-				const provider = providerFor(row.ref);
-				if (provider === void 0) return err(noProvider(row.ref));
-				return provider.getToken(row.ref, {
-					subject: { type: "app" },
-					scopes: row.scopes
-				});
-			})
-		},
-		steps: {
-			sync: (steps = options.steps ?? []) => serviceCall("sync_workflow_steps", { steps: Object.fromEntries(steps.map((step) => [step.name, {
-				title: step.title,
-				description: step.description,
-				inputSchema: step.inputSchema ?? {},
-				outputSchema: step.outputSchema ?? {},
-				credentialKind: step.credentialKind
-			}])) }, Number),
-			list: () => call("workflow_steps_list", {}, (value) => recordsOf(value, "workflow_steps_list").map(stepOf))
-		},
-		nodeRuns: {
-			record: (input) => serviceCall("record_workflow_node_run", {
-				run: input.run,
-				node: input.node,
-				status: input.status,
-				attempt: input.attempt,
-				output: input.output,
-				error: input.error
-			}, (value) => value === true),
-			list: (run) => call("workflow_node_runs_list", { run }, (value) => recordsOf(value, "workflow_node_runs_list").map(nodeRunOf))
-		},
-		alerts: {
-			save: (input) => call("save_workflow_alert", {
-				definition: input.definition,
-				on_event: input.onEvent,
-				channel: input.channel ?? {},
-				threshold: input.threshold === void 0 ? void 0 : seconds(input.threshold),
-				alert: input.id
-			}, (value) => alertOf(recordOf(value, "save_workflow_alert"))),
-			list: (definition) => call("workflow_alerts_list", { definition }, (value) => recordsOf(value, "workflow_alerts_list").map(alertOf)),
-			remove: (id) => call("remove_workflow_alert", { alert: id }, (value) => value === true),
-			check: (check = {}) => serviceCall("check_workflow_alerts", { batch: check.batch }, Number)
-		}
-	};
-}
-function webhookToken(request) {
-	const header = request.headers.get("authorization");
-	if (header !== null && /^bearer\s+/i.test(header)) {
-		const token = header.replace(/^bearer\s+/i, "").trim();
-		return token.length > 0 ? token : void 0;
-	}
-	const segment = new URL(request.url).pathname.split("/").findLast(Boolean);
-	return segment?.startsWith("wfh_") === true ? decodeURIComponent(segment) : void 0;
-}
-async function bodyOf(request) {
-	const text = await request.text();
-	if (text.length === 0) return {};
-	try {
-		return JSON.parse(text);
-	} catch {
-		return { body: text };
-	}
-}
-//#endregion
-export { createBuilder as t };

package/dist/workflow-sdk-C2WJ_G2O.js

@@ -1,173 +0,0 @@
-import { n as withContext, t as unwrap } from "./envelope-DqnYGRw7.js";
-import { t as WORKFLOW_ATTRIBUTES } from "./attributes-5dYul0u0.js";
-import { getHookByToken, getRun, start } from "workflow/api";
-import { getWorld } from "workflow/runtime";
-//#region src/workflow-sdk/workflow-sdk.ts
-/**
-* The actor and tenant of `context` as plain data, to pass into a workflow
-* as an argument; inside a step, `bs.forContext(context)` runs as that user
-* with RLS. Claims and anything else in `context` stay out of the run's
-* serialized state.
-*/
-function workflowContext(context) {
-	return unwrap(withContext(null, context)).context;
-}
-/** The `bs.tenant` and `bs.actor` attributes for `context`. */
-function contextAttributes(context) {
-	const recorded = workflowContext(context);
-	return {
-		...recorded.tenant === void 0 ? {} : { [WORKFLOW_ATTRIBUTES.tenant]: recorded.tenant },
-		...recorded.actor?.kind === "user" ? { [WORKFLOW_ATTRIBUTES.actor]: recorded.actor.id } : {}
-	};
-}
-/** The run a start with idempotency `key` created, while it is in the World. */
-async function runForKey(key, world) {
-	const target = world ?? await getWorld();
-	if (target.analytics === void 0) return void 0;
-	return (await target.analytics.runs.list({
-		attributes: { [WORKFLOW_ATTRIBUTES.key]: key },
-		pagination: { limit: 1 }
-	})).data[0]?.runId;
-}
-/**
-* `start(workflow, args)` for the caller in `context`: the run carries
-* `bs.tenant` and `bs.actor`, so `workflow_runs` lists it to the tenant and
-* the actor under RLS. With `idempotencyKey`, a run that already has the key
-* is returned instead of starting another (the key lookup needs a World with
-* `analytics`, as the Supabase World has).
-*/
-async function startFor(context, workflow, args, options = {}) {
-	const key = options.idempotencyKey;
-	if (key !== void 0) {
-		const existing = await runForKey(key, options.world);
-		if (existing !== void 0) return getRun(existing);
-	}
-	return start(workflow, args, {
-		attributes: {
-			...options.attributes,
-			...contextAttributes(context),
-			...key === void 0 ? {} : { [WORKFLOW_ATTRIBUTES.key]: key }
-		},
-		...options.world === void 0 ? {} : { world: options.world }
-	});
-}
-function userContext(call) {
-	const actor = call.actor === void 0 ? void 0 : {
-		id: call.actor,
-		kind: "user"
-	};
-	return {
-		...actor === void 0 ? {} : { actor },
-		...call.tenant === void 0 ? {} : { tenant: call.tenant }
-	};
-}
-/**
-* The `start` callback for `schedules.tick` and `admission.tick` of
-* `better-supabase/blocks/workflows`: looks the workflow up by the name the
-* schedule or request stored and starts it with `startFor`, keyed by the
-* tick's idempotency key.
-*/
-function workflowStarter(workflows, options = {}) {
-	return async (call) => {
-		const workflow = workflows[call.workflow];
-		if (workflow === void 0) throw new Error(`better-supabase: no workflow named "${call.workflow}" was passed to workflowStarter`);
-		const args = Array.isArray(call.input) ? call.input : [call.input];
-		return (await startFor(userContext(call), workflow, args, {
-			idempotencyKey: call.idempotencyKey,
-			...options
-		})).runId;
-	};
-}
-/**
-* Hook metadata that `authorizeHook` checks: the actor and tenant of
-* `context`, and the permission a tenant member needs to resume it instead.
-*/
-function hookMetadata(context, permission) {
-	return {
-		...contextAttributes(context),
-		...permission === void 0 ? {} : { "bs.permission": permission }
-	};
-}
-/** `authorizeHook` refused the caller. */
-var HookForbiddenError = class extends Error {
-	status = 403;
-	constructor(message) {
-		super(message);
-		this.name = "HookForbiddenError";
-	}
-};
-function stringField(value, key) {
-	if (typeof value !== "object" || value === null) return void 0;
-	const field = { ...value }[key];
-	return typeof field === "string" ? field : void 0;
-}
-/**
-* The hook for `token` when the caller in `context` may resume it: the
-* actor in its `hookMetadata`, or a member of its tenant whom `can` grants
-* its permission. Throws `HookForbiddenError` otherwise, so a leaked token
-* alone never resumes a run.
-*/
-async function authorizeHook(token, context, options = {}) {
-	const hook = await getHookByToken(token);
-	const metadata = await hook.metadata;
-	const actor = context.actor?.kind === "user" ? context.actor.id : void 0;
-	const owner = stringField(metadata, WORKFLOW_ATTRIBUTES.actor);
-	if (actor !== void 0 && owner === actor) return hook;
-	const tenant = stringField(metadata, WORKFLOW_ATTRIBUTES.tenant);
-	const permission = stringField(metadata, "bs.permission");
-	if (actor !== void 0 && tenant !== void 0 && permission !== void 0 && options.can !== void 0 && await options.can(tenant, permission)) return hook;
-	throw new HookForbiddenError("better-supabase: the caller may not resume this workflow hook");
-}
-/** Whether `type` matches `pattern` (`invoice.paid`, `organization.*` or `*`). */
-function matches(pattern, type) {
-	if (pattern === "*" || pattern === type) return true;
-	return pattern.endsWith(".*") && type.startsWith(pattern.slice(0, -1));
-}
-/**
-* An outbox handler (`outbox.consume(name, handler)`) that starts
-* `workflow` for each matching event, as the event's actor in its tenant,
-* keyed by `event:{id}` so a redelivered batch starts nothing twice.
-*/
-function startOnEvent(workflow, options) {
-	return async (events) => {
-		for (const event of events) {
-			if (!options.types.some((pattern) => matches(pattern, event.type))) continue;
-			const args = options.args?.(event) ?? [event.payload];
-			await startFor({
-				...event.actorId === null ? {} : { actor: {
-					id: event.actorId,
-					kind: "user"
-				} },
-				...event.tenant === null ? {} : { tenant: event.tenant }
-			}, workflow, args, {
-				idempotencyKey: `event:${event.id}`,
-				...options.world === void 0 ? {} : { world: options.world }
-			});
-		}
-	};
-}
-function problem(status) {
-	return new Response(JSON.stringify({
-		type: "about:blank",
-		title: status === 401 ? "Unauthorized" : "Forbidden",
-		status
-	}), {
-		status,
-		headers: { "content-type": "application/problem+json" }
-	});
-}
-/**
-* Puts a route of the workflow web UI or a run's stream behind
-* `permission`: answers 401 without a session and 403 without the
-* permission, as `application/problem+json`.
-*/
-function protectWebHandler(handler, permission, options) {
-	return async (request) => {
-		const allowed = await options.can(request, permission);
-		if (allowed === void 0) return problem(401);
-		if (!allowed) return problem(403);
-		return handler(request);
-	};
-}
-//#endregion
-export { protectWebHandler as a, startOnEvent as c, hookMetadata as i, workflowContext as l, authorizeHook as n, runForKey as o, contextAttributes as r, startFor as s, HookForbiddenError as t, workflowStarter as u };