better-supabase 0.8.0 → 0.9.0

package/dist/blocks/shared-signals/index.js

@@ -0,0 +1,880 @@
+import { n as dbError } from "../../errors-8i6tSICm.js";
+import { a as ok, r as err, t as AsyncResult } from "../../result-BlgnMB0H.js";
+import { t as consoleLogger } from "../../logger-glM28NVN.js";
+import { n as isRecord } from "../../guards-6F2bCtQR.js";
+import { o as problemResponse } from "../../problem-pIiL3WbE.js";
+import { n as event, t as defineEvents } from "../../event-map-Dy2vKHai.js";
+import { i as sqlTransport } from "../../block-transport-G4t1umrR.js";
+import { A as requiredInstant, D as recordOf, E as readBodyCapped, F as stringsOf, I as textOf, f as errorText, k as recordsOf, n as applyTemporal, o as blockCall, y as nullableText } from "../../block-helpers-CfG_MvDR.js";
+import { a as jwksOf, c as verifyCompact, t as JwsError } from "../../jws-milwSg7E.js";
+import { r as withBlockHooks } from "../../block-hooks-BsXncUlZ.js";
+import { n as defineBlock } from "../../define-block-B6Gjs57G.js";
+import { n as SSF_POLL, r as SSF_PUSH, t as sharedSignalsSqlOptions } from "../../options-BQ07tTYr.js";
+//#region src/blocks/shared-signals/set.ts
+/** The `typ` header of a Security Event Token (RFC 8417 §2.3). */
+const SET_TYP = "secevent+jwt";
+/** The media type a pushed SET is sent with (RFC 8935 §2). */
+const SET_CONTENT_TYPE = "application/secevent+jwt";
+/** The SSF 1.0 stream events (§8.1.4, §8.1.5). */
+const SSF_EVENTS = {
+	verification: "https://schemas.openid.net/secevent/ssf/event-type/verification",
+	streamUpdated: "https://schemas.openid.net/secevent/ssf/event-type/stream-updated"
+};
+/** The CAEP 1.0 event types (§3). */
+const CAEP_EVENTS = {
+	sessionRevoked: "https://schemas.openid.net/secevent/caep/event-type/session-revoked",
+	tokenClaimsChange: "https://schemas.openid.net/secevent/caep/event-type/token-claims-change",
+	credentialChange: "https://schemas.openid.net/secevent/caep/event-type/credential-change",
+	assuranceLevelChange: "https://schemas.openid.net/secevent/caep/event-type/assurance-level-change",
+	deviceComplianceChange: "https://schemas.openid.net/secevent/caep/event-type/device-compliance-change",
+	sessionEstablished: "https://schemas.openid.net/secevent/caep/event-type/session-established",
+	sessionPresented: "https://schemas.openid.net/secevent/caep/event-type/session-presented",
+	riskLevelChange: "https://schemas.openid.net/secevent/caep/event-type/risk-level-change"
+};
+/** The RISC 1.0 event types (§2), without the deprecated `sessions-revoked`. */
+const RISC_EVENTS = {
+	accountCredentialChangeRequired: "https://schemas.openid.net/secevent/risc/event-type/account-credential-change-required",
+	accountPurged: "https://schemas.openid.net/secevent/risc/event-type/account-purged",
+	accountDisabled: "https://schemas.openid.net/secevent/risc/event-type/account-disabled",
+	accountEnabled: "https://schemas.openid.net/secevent/risc/event-type/account-enabled",
+	identifierChanged: "https://schemas.openid.net/secevent/risc/event-type/identifier-changed",
+	identifierRecycled: "https://schemas.openid.net/secevent/risc/event-type/identifier-recycled",
+	credentialCompromise: "https://schemas.openid.net/secevent/risc/event-type/credential-compromise",
+	optIn: "https://schemas.openid.net/secevent/risc/event-type/opt-in",
+	optOutInitiated: "https://schemas.openid.net/secevent/risc/event-type/opt-out-initiated",
+	optOutCancelled: "https://schemas.openid.net/secevent/risc/event-type/opt-out-cancelled",
+	optOutEffective: "https://schemas.openid.net/secevent/risc/event-type/opt-out-effective",
+	recoveryActivated: "https://schemas.openid.net/secevent/risc/event-type/recovery-activated",
+	recoveryInformationChanged: "https://schemas.openid.net/secevent/risc/event-type/recovery-information-changed"
+};
+/**
+* A signed SET (RFC 8417) with the SSF profile: `typ: secevent+jwt`, a
+* top-level `sub_id`, exactly one event, and no `sub` or `exp` claim.
+*/
+function mintSet(signer, input) {
+	const jti = crypto.randomUUID().replaceAll("-", "");
+	const audience = typeof input.audience === "string" ? input.audience : input.audience.length === 1 ? input.audience[0] : [...input.audience];
+	return signer.signJwt({
+		iss: input.issuer,
+		jti,
+		iat: Math.floor(Date.now() / 1e3),
+		aud: audience,
+		...input.txn === void 0 ? {} : { txn: input.txn },
+		sub_id: input.subject,
+		events: { [input.event.type]: input.event.claims }
+	}, { typ: SET_TYP }).map((token) => ({
+		jti,
+		token
+	}));
+}
+const SSF_MEMBERS = [
+	"user",
+	"device",
+	"session",
+	"application",
+	"tenant",
+	"org_unit",
+	"group"
+];
+const fail = (err, description) => ({
+	ok: false,
+	err,
+	description
+});
+const jwsFailure = (cause) => {
+	if (!(cause instanceof JwsError)) throw cause;
+	switch (cause.code) {
+		case "JWS_MALFORMED":
+		case "JWS_TYP": return fail("invalid_request", cause.message);
+		default: return fail("invalid_key", cause.message);
+	}
+};
+/**
+* Verifies a SET as an RFC 8935 receiver: the signature against `jwks`,
+* `typ`, `iss`, `aud`, `jti`, `iat`, one event and an SSF `sub_id`. A
+* failure carries the error code to answer the transmitter with.
+*/
+async function verifySet(token, options) {
+	let header;
+	let payload;
+	try {
+		({header, payload} = await verifyCompact(token, options.jwks));
+	} catch (cause) {
+		return jwsFailure(cause);
+	}
+	const typ = typeof header["typ"] === "string" ? header["typ"].toLowerCase() : "";
+	if (typ !== "secevent+jwt" && typ !== "application/secevent+jwt") return fail("invalid_request", `The typ must be ${SET_TYP}`);
+	if (payload["iss"] !== options.issuer) return fail("invalid_issuer", "The iss is not the transmitter's issuer");
+	const aud = payload["aud"];
+	const audience = typeof aud === "string" ? [aud] : Array.isArray(aud) ? aud.filter((value) => typeof value === "string") : [];
+	if (!audience.includes(options.audience)) return fail("invalid_audience", "The aud does not name this receiver");
+	const jti = payload["jti"];
+	if (typeof jti !== "string" || jti === "") return fail("invalid_request", "The SET has no jti");
+	const iat = payload["iat"];
+	if (typeof iat !== "number" || !Number.isFinite(iat)) return fail("invalid_request", "The SET has no iat");
+	if (iat > Date.now() / 1e3 + (options.skewSeconds ?? 300)) return fail("invalid_request", "The iat is in the future");
+	const events = payload["events"];
+	const entries = isRecord(events) ? Object.entries(events) : [];
+	const [entry] = entries;
+	if (entry === void 0 || entries.length !== 1 || !isRecord(entry[1])) return fail("invalid_request", "A SET carries exactly one event");
+	const subject = payload["sub_id"];
+	if (!isRecord(subject) || typeof subject["format"] !== "string") return fail("invalid_request", "The SET has no sub_id");
+	const understood = options.understoodSubjectMembers ?? SSF_MEMBERS;
+	const unknown = (options.criticalSubjectMembers ?? []).find((member) => member in subject && !understood.includes(member));
+	if (unknown !== void 0) return fail("invalid_request", `The critical subject member ${unknown} is not understood`);
+	const txn = payload["txn"];
+	return {
+		ok: true,
+		set: {
+			jti,
+			issuer: options.issuer,
+			issuedAt: iat,
+			audience,
+			subject,
+			type: entry[0],
+			claims: entry[1],
+			txn: typeof txn === "string" ? txn : void 0,
+			token
+		}
+	};
+}
+//#endregion
+//#region src/blocks/shared-signals/receiver.ts
+const failure$1 = (code, description) => ({
+	ok: false,
+	err: code,
+	description
+});
+const rejected = (code, description, status = 400) => Response.json({
+	err: code,
+	description
+}, { status });
+function wellKnown(issuer) {
+	const parsed = new URL(issuer);
+	const path = parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/$/, "");
+	return `${parsed.origin}/.well-known/ssf-configuration${path}`;
+}
+/**
+* An SSF receiver: verifies pushed or polled SETs with the transmitter's
+* keys, drops replays through the `shared-signals` module's `(iss, jti)`
+* table, and calls the handler for the event type. Service role only.
+*/
+function createSsfReceiver(options) {
+	applyTemporal(options);
+	const call = blockCall(options.service ?? options.transport, options.schema, options.mappers);
+	const http = options.fetch ?? fetch;
+	const cacheMs = (options.cacheSeconds ?? 300) * 1e3;
+	const maxBody = options.maxBodyBytes ?? 65536;
+	const logger = options.logger ?? consoleLogger;
+	let metadata;
+	let keys;
+	const getJson = async (url, init = {}) => {
+		let response;
+		try {
+			const headers = new Headers(init.headers);
+			if (!headers.has("accept")) headers.set("accept", "application/json");
+			response = await http(url, {
+				...init,
+				headers
+			});
+		} catch (cause) {
+			return err(dbError("network", `${url}: ${errorText(cause)}`));
+		}
+		if (!response.ok) return err(dbError(response.status === 404 ? "not_found" : "unexpected", `${url} answered ${String(response.status)}`));
+		if (response.status === 204) return ok(null);
+		try {
+			const value = await response.json();
+			return ok(value);
+		} catch {
+			return err(dbError("unexpected", `${url} did not answer JSON`));
+		}
+	};
+	const discover = () => AsyncResult.from(async () => {
+		if (metadata && Date.now() - metadata.at < cacheMs) return ok(metadata.value);
+		const fetched = await getJson(wellKnown(options.issuer));
+		if (!fetched.ok) return fetched;
+		if (!isRecord(fetched.data) || fetched.data["issuer"] !== options.issuer) return err(dbError("unexpected", "The transmitter metadata names another issuer", { hint: "SSF_ISSUER_MISMATCH" }));
+		metadata = {
+			value: fetched.data,
+			at: Date.now()
+		};
+		return ok(fetched.data);
+	});
+	const jwks = async (refresh) => {
+		if (options.jwks !== void 0) return ok(typeof options.jwks === "function" ? await options.jwks() : options.jwks);
+		if (keys && !refresh && Date.now() - keys.at < cacheMs) return ok(keys.value);
+		if (keys && refresh && Date.now() - keys.at < 3e4) return ok(keys.value);
+		const meta = await discover();
+		if (!meta.ok) return meta;
+		const uri = meta.data["jwks_uri"];
+		if (typeof uri !== "string") return err(dbError("unexpected", "The transmitter metadata has no jwks_uri"));
+		const fetched = await getJson(uri);
+		if (!fetched.ok) return fetched;
+		keys = {
+			value: jwksOf(fetched.data),
+			at: Date.now()
+		};
+		return ok(keys.value);
+	};
+	const verify = async (token) => {
+		for (const refresh of [false, true]) {
+			const found = await jwks(refresh);
+			if (!found.ok) return failure$1("invalid_key", found.error.message);
+			const verified = await verifySet(token, {
+				jwks: found.data,
+				issuer: options.issuer,
+				audience: options.audience,
+				...options.criticalSubjectMembers === void 0 ? {} : { criticalSubjectMembers: options.criticalSubjectMembers }
+			});
+			if (verified.ok || verified.err !== "invalid_key" || options.jwks !== void 0) return verified;
+		}
+		return failure$1("invalid_key", "No transmitter key verifies the SET");
+	};
+	const receive = async (token) => {
+		const verified = await verify(token);
+		if (!verified.ok) return verified;
+		const { set } = verified;
+		const fresh = await call("record_ssf_received", {
+			issuer: set.issuer,
+			jti: set.jti
+		}, (value) => value === true);
+		if (!fresh.ok) throw new Error(fresh.error.message, { cause: fresh.error });
+		if (!fresh.data) return {
+			ok: true,
+			set,
+			duplicate: true
+		};
+		const handler = options.handlers?.[set.type] ?? options.handlers?.["*"];
+		try {
+			await handler?.(set);
+		} catch (cause) {
+			await call("forget_ssf_received", {
+				issuer: set.issuer,
+				jti: set.jti
+			}, () => void 0);
+			throw cause;
+		}
+		return {
+			ok: true,
+			set,
+			duplicate: false
+		};
+	};
+	const pushHandler = () => async (request) => {
+		if (request.method !== "POST") return new Response(null, {
+			status: 405,
+			headers: { allow: "POST" }
+		});
+		if (options.authorization !== void 0 && request.headers.get("authorization") !== options.authorization) return rejected("authentication_failed", "The Authorization header is not accepted", 401);
+		if ((request.headers.get("content-type") ?? "").split(";")[0]?.trim().toLowerCase() !== "application/secevent+jwt") return rejected("invalid_request", `The content type must be ${SET_CONTENT_TYPE}`);
+		const token = await readBodyCapped(request, maxBody);
+		if (token === void 0) return rejected("invalid_request", "The SET is too large");
+		try {
+			const result = await receive(token.trim());
+			return result.ok ? new Response(null, { status: 202 }) : rejected(result.err, result.description);
+		} catch (cause) {
+			logger.error("shared-signals: a SET handler failed", { error: errorText(cause) });
+			return new Response(null, { status: 500 });
+		}
+	};
+	const poll = (pollOptions) => AsyncResult.from(async () => {
+		const totals = {
+			received: 0,
+			rejected: 0,
+			failed: 0
+		};
+		let ack = [];
+		let setErrs = {};
+		let more = true;
+		const maxRequests = pollOptions.maxRequests ?? 10;
+		for (let request = 0; request < maxRequests && more; request += 1) {
+			const response = await getJson(pollOptions.endpoint, {
+				method: "POST",
+				headers: {
+					authorization: pollOptions.authorization,
+					"content-type": "application/json"
+				},
+				body: JSON.stringify({
+					maxEvents: pollOptions.maxEvents ?? 100,
+					returnImmediately: true,
+					ack,
+					...Object.keys(setErrs).length === 0 ? {} : { setErrs }
+				})
+			});
+			if (!response.ok) return response;
+			const body = isRecord(response.data) ? response.data : {};
+			const sets = isRecord(body["sets"]) ? body["sets"] : {};
+			ack = [];
+			setErrs = {};
+			for (const [jti, token] of Object.entries(sets)) {
+				if (typeof token !== "string") continue;
+				try {
+					const result = await receive(token);
+					if (result.ok) {
+						ack.push(jti);
+						totals.received += result.duplicate ? 0 : 1;
+					} else {
+						setErrs[jti] = {
+							err: result.err,
+							description: result.description
+						};
+						totals.rejected += 1;
+					}
+				} catch (cause) {
+					logger.error("shared-signals: a SET handler failed", { error: errorText(cause) });
+					totals.failed += 1;
+				}
+			}
+			more = body["moreAvailable"] === true;
+		}
+		if (ack.length > 0 || Object.keys(setErrs).length > 0) {
+			const final = await getJson(pollOptions.endpoint, {
+				method: "POST",
+				headers: {
+					authorization: pollOptions.authorization,
+					"content-type": "application/json"
+				},
+				body: JSON.stringify({
+					maxEvents: 0,
+					returnImmediately: true,
+					ack,
+					...Object.keys(setErrs).length === 0 ? {} : { setErrs }
+				})
+			});
+			if (!final.ok) return final;
+		}
+		return ok({
+			...totals,
+			moreAvailable: more
+		});
+	});
+	const streams = (authorization) => {
+		const endpoint = (key) => discover().andThen((meta) => {
+			const value = meta[key];
+			return Promise.resolve(typeof value === "string" ? ok(value) : err(dbError("unsupported", `The transmitter publishes no ${key}`)));
+		});
+		const send = (key, method, body, query) => endpoint(key).andThen((url) => getJson(query === void 0 ? url : `${url}?stream_id=${encodeURIComponent(query)}`, {
+			method,
+			headers: {
+				authorization,
+				...body === void 0 ? {} : { "content-type": "application/json" }
+			},
+			...body === void 0 ? {} : { body: JSON.stringify(body) }
+		}));
+		const record = (value) => isRecord(value) ? value : {};
+		return {
+			create: (request) => send("configuration_endpoint", "POST", {
+				delivery: {
+					method: request.method === "push" ? SSF_PUSH : SSF_POLL,
+					...request.endpointUrl === void 0 ? {} : { endpoint_url: request.endpointUrl },
+					...request.authorizationHeader === void 0 ? {} : { authorization_header: request.authorizationHeader }
+				},
+				events_requested: request.eventsRequested,
+				...request.description === void 0 ? {} : { description: request.description }
+			}).andThen((value) => {
+				const config = record(value);
+				const aud = config["aud"];
+				const audience = typeof aud === "string" ? [aud] : Array.isArray(aud) ? aud : [];
+				return Promise.resolve(audience.includes(options.audience) ? ok(config) : err(dbError("unexpected", "The created stream's aud does not name this receiver", { hint: "SSF_AUDIENCE_MISMATCH" })));
+			}),
+			read: (streamId) => send("configuration_endpoint", "GET", void 0, streamId).map(record),
+			remove: (streamId) => send("configuration_endpoint", "DELETE", void 0, streamId).map(() => void 0),
+			status: (streamId) => send("status_endpoint", "GET", void 0, streamId).map(record),
+			setStatus: (streamId, status, reason) => send("status_endpoint", "POST", {
+				stream_id: streamId,
+				status,
+				...reason === void 0 ? {} : { reason }
+			}).map(record),
+			verify: (streamId, state) => endpoint("verification_endpoint").andThen(async (url) => {
+				let response;
+				try {
+					response = await http(url, {
+						method: "POST",
+						headers: {
+							authorization,
+							"content-type": "application/json"
+						},
+						body: JSON.stringify({
+							stream_id: streamId,
+							...state === void 0 ? {} : { state }
+						})
+					});
+				} catch (cause) {
+					return err(dbError("network", errorText(cause)));
+				}
+				if (response.status === 429) return ok(false);
+				return response.ok ? ok(true) : err(dbError("unexpected", `${url} answered ${String(response.status)}`));
+			})
+		};
+	};
+	return withBlockHooks({
+		discover,
+		receive,
+		pushHandler,
+		poll,
+		streams,
+		purge: (olderThan) => call("purge_shared_signals", { older_than: olderThan === void 0 ? null : `${String(olderThan.total({ unit: "seconds" }))} seconds` }, Number)
+	}, options.hooks, {
+		block: "shared-signals",
+		logger
+	});
+}
+//#endregion
+//#region src/blocks/shared-signals/transmitter.ts
+const METHODS = {
+	push: SSF_PUSH,
+	poll: SSF_POLL
+};
+const methodOf = (urn) => urn === "urn:ietf:rfc:8935" ? "push" : "poll";
+const STATUSES = [
+	"enabled",
+	"paused",
+	"disabled"
+];
+const statusOf = (value) => {
+	const found = STATUSES.find((status) => status === value);
+	if (found === void 0) throw new TypeError(`Unknown stream status ${String(value)}`);
+	return found;
+};
+function streamOf(value) {
+	const row = recordOf(value, "ssf_stream");
+	return {
+		id: textOf(row["id"]),
+		tenant: nullableText(row["tenant"]),
+		receiver: textOf(row["receiver"]),
+		audience: stringsOf(row["audience"]),
+		description: nullableText(row["description"]),
+		eventsRequested: stringsOf(row["eventsRequested"]),
+		eventsDelivered: stringsOf(row["eventsDelivered"]),
+		method: methodOf(row["method"]),
+		endpointUrl: nullableText(row["endpointUrl"]),
+		status: statusOf(row["status"]),
+		reason: nullableText(row["reason"]),
+		createdAt: requiredInstant(row["createdAt"], "createdAt"),
+		updatedAt: requiredInstant(row["updatedAt"], "updatedAt")
+	};
+}
+const interval = (seconds) => `${String(seconds)} seconds`;
+const invalid = (message) => dbError("invalid_input", message, { hint: "SSF_REQUEST_INVALID" });
+const json = (body, status = 200, headers = {}) => Response.json(body, {
+	status,
+	headers: noStore(headers)
+});
+const noStore = (init) => {
+	const headers = new Headers(init);
+	if (!headers.has("cache-control")) headers.set("cache-control", "no-store");
+	return headers;
+};
+const strings = (value) => Array.isArray(value) && value.every((item) => typeof item === "string") ? value : void 0;
+/**
+* An SSF transmitter: streams and their status live in the `shared-signals`
+* module, push SETs go out through webhooks-out endpoints with format
+* `set`, and poll SETs wait in the module's queue. Service role only.
+*/
+function createSsfTransmitter(options) {
+	applyTemporal(options);
+	const call = blockCall(options.service ?? options.transport, options.schema, options.mappers);
+	const issuer = options.issuer.replace(/\/$/, "");
+	const base = (options.basePath ?? "/ssf").replace(/\/$/, "");
+	const url = (path) => `${issuer}${base}${path}`;
+	const supported = options.eventsSupported ?? [...Object.values(CAEP_EVENTS), ...Object.values(RISC_EVENTS)];
+	const methods = options.deliveryMethods ?? ["push", "poll"];
+	const minVerification = options.minVerificationInterval ?? 30;
+	const maxBody = options.maxBodyBytes ?? 65536;
+	const delivered = (requested) => requested.filter((type) => supported.includes(type));
+	const queue = (stream, jti, token) => call("queue_ssf_set", {
+		stream_id: stream,
+		jti,
+		token
+	}, textOf);
+	const send = (stream, audience, subject, event, txn) => mintSet(options.signer, {
+		issuer,
+		audience,
+		subject,
+		event,
+		...txn === void 0 ? {} : { txn }
+	}).andThen(({ jti, token }) => queue(stream, jti, token));
+	const streamSubject = (id) => ({
+		format: "opaque",
+		id
+	});
+	const stream = (id) => call("ssf_stream", { id }, (value) => value === null || value === void 0 ? null : streamOf(value));
+	const createStream = (input) => AsyncResult.from(async () => {
+		if (!methods.includes(input.method)) return err(invalid(`The delivery method ${input.method} is not supported`));
+		const id = crypto.randomUUID();
+		const identity = input.receiver;
+		const tenant = identity.tenant ?? null;
+		const audience = identity.audience ?? identity.receiver;
+		let credentialRef = null;
+		if (input.method === "push") {
+			if (input.endpointUrl === void 0 || !/^https:\/\//i.test(input.endpointUrl)) return err(invalid("A push stream needs an https endpoint_url"));
+			if (input.authorizationHeader !== void 0) {
+				if (options.credentials === void 0) return err(invalid("This transmitter does not accept an authorization_header"));
+				credentialRef = {
+					provider: "vault",
+					secret: `ssf/${id}`,
+					header: "authorization",
+					scheme: null,
+					...tenant === null ? {} : { tenant }
+				};
+				const stored = await options.credentials.set(credentialRef, input.authorizationHeader);
+				if (!stored.ok) return stored;
+			}
+		}
+		return call("create_ssf_stream", {
+			id,
+			receiver: identity.receiver,
+			tenant,
+			audience: typeof audience === "string" ? [audience] : [...audience],
+			delivery_method: METHODS[input.method],
+			events_requested: [...input.eventsRequested],
+			events_delivered: delivered(input.eventsRequested),
+			description: input.description ?? null,
+			endpoint_url: input.method === "push" ? input.endpointUrl ?? null : null,
+			credential_ref: credentialRef
+		}, streamOf);
+	});
+	const setStatus = (id, status, reason) => stream(id).andThen(async (found) => {
+		if (found === null) return err(dbError("not_found", "Stream not found", { hint: "SSF_STREAM_NOT_FOUND" }));
+		const update = {
+			type: SSF_EVENTS.streamUpdated,
+			claims: {
+				status,
+				...reason === void 0 ? {} : { reason }
+			}
+		};
+		if (found.status === "enabled" && status !== "enabled") {
+			const sent = await send(id, found.audience, streamSubject(id), update);
+			if (!sent.ok) return sent;
+		}
+		const previous = await call("set_ssf_stream_status", {
+			id,
+			status,
+			reason: reason ?? null
+		}, statusOf);
+		if (!previous.ok) return previous;
+		if (status === "enabled" && previous.data !== "enabled") {
+			const sent = await send(id, found.audience, streamSubject(id), update);
+			if (!sent.ok) return sent;
+		}
+		return ok(previous.data);
+	});
+	const verify = (id, state) => stream(id).andThen((found) => found === null ? AsyncResult.err(dbError("not_found", "Stream not found", { hint: "SSF_STREAM_NOT_FOUND" })) : send(id, found.audience, streamSubject(id), {
+		type: SSF_EVENTS.verification,
+		claims: state === void 0 ? {} : { state }
+	}));
+	const emit = (input) => call("ssf_streams_for_event", {
+		tenant: input.tenant ?? null,
+		event_type: input.event.type
+	}, (value) => recordsOf(value, "ssf_streams_for_event").map((row) => ({
+		id: textOf(row["id"]),
+		audience: stringsOf(row["audience"])
+	}))).andThen(async (targets) => {
+		const counts = {
+			dispatched: 0,
+			queued: 0,
+			held: 0
+		};
+		for (const target of targets) {
+			const sent = await send(target.id, target.audience, input.subject, input.event, input.txn);
+			if (!sent.ok) return sent;
+			if (sent.data === "dispatched" || sent.data === "queued" || sent.data === "held") counts[sent.data] += 1;
+		}
+		return ok({
+			streams: targets.length,
+			...counts
+		});
+	});
+	const poll = (id, request) => call("poll_ssf_events", {
+		stream_id: id,
+		max_events: request.maxEvents ?? null,
+		ack: [...request.ack ?? []],
+		errors: request.setErrs ?? {}
+	}, (value) => {
+		const row = recordOf(value, "poll_ssf_events");
+		const sets = isRecord(row["sets"]) ? row["sets"] : {};
+		return {
+			sets: Object.fromEntries(Object.entries(sets).map(([jti, token]) => [jti, textOf(token)])),
+			moreAvailable: row["moreAvailable"] === true
+		};
+	});
+	const hooked = withBlockHooks({
+		metadata: () => ({
+			spec_version: "1_0",
+			issuer,
+			jwks_uri: options.jwksUri,
+			delivery_methods_supported: methods.map((method) => METHODS[method]),
+			configuration_endpoint: url("/stream"),
+			status_endpoint: url("/status"),
+			verification_endpoint: url("/verify"),
+			authorization_schemes: options.authorizationSchemes ?? [{ spec_urn: "urn:ietf:rfc:6749" }],
+			default_subjects: "ALL"
+		}),
+		createStream,
+		stream,
+		streams: (receiver) => call("ssf_streams", { receiver }, (value) => recordsOf(value, "ssf_streams").map(streamOf)),
+		updateStream: (id, input) => call("update_ssf_stream", {
+			id,
+			patch: {
+				...input.description === void 0 ? {} : { description: input.description },
+				...input.eventsRequested === void 0 ? {} : {
+					eventsRequested: input.eventsRequested,
+					eventsDelivered: delivered(input.eventsRequested)
+				},
+				...input.endpointUrl === void 0 ? {} : { endpointUrl: input.endpointUrl }
+			}
+		}, (value) => value === null || value === void 0 ? null : streamOf(value)),
+		deleteStream: (id) => stream(id).andThen(async (found) => {
+			if (found === null) return ok(false);
+			const deleted = await call("delete_ssf_stream", { id }, (value) => value === true);
+			if (deleted.ok && found.method === "push" && options.credentials !== void 0) await options.credentials.revoke({
+				provider: "vault",
+				secret: `ssf/${id}`,
+				...found.tenant === null ? {} : { tenant: found.tenant }
+			}, { subject: { type: "app" } });
+			return deleted;
+		}),
+		setStatus,
+		verify,
+		emit,
+		poll,
+		purge: (olderThan) => call("purge_shared_signals", { older_than: olderThan === void 0 ? null : interval(olderThan.total({ unit: "seconds" })) }, Number),
+		handler: () => routes(hooked, {
+			base,
+			authorize: options.authorize,
+			maxBody,
+			minVerification,
+			call,
+			supported
+		})
+	}, options.hooks, {
+		block: "shared-signals",
+		...options.logger ? { logger: options.logger } : {}
+	});
+	return hooked;
+}
+const failure = (error) => problemResponse(error);
+const unauthorized = () => failure(dbError("unauthorized", "The request is not authorized", { hint: "SSF_UNAUTHORIZED" }));
+const notFound = () => failure(dbError("not_found", "Stream not found", { hint: "SSF_STREAM_NOT_FOUND" }));
+async function bodyOf(request, limit) {
+	const text = await readBodyCapped(request, limit);
+	if (text === void 0 || text === "") return;
+	try {
+		const value = JSON.parse(text);
+		return isRecord(value) ? value : void 0;
+	} catch {
+		return;
+	}
+}
+function configOf(stream, issuer, supported, minVerification, pollUrl) {
+	return {
+		stream_id: stream.id,
+		iss: issuer,
+		aud: stream.audience.length === 1 ? stream.audience[0] : stream.audience,
+		events_supported: supported,
+		events_requested: stream.eventsRequested,
+		events_delivered: stream.eventsDelivered,
+		delivery: {
+			method: METHODS[stream.method],
+			endpoint_url: stream.method === "push" ? stream.endpointUrl : pollUrl
+		},
+		min_verification_interval: minVerification,
+		...stream.description === null ? {} : { description: stream.description }
+	};
+}
+function routes(transmitter, context) {
+	const metadata = transmitter.metadata();
+	const issuer = textOf(metadata["issuer"]);
+	const pollUrl = (id) => `${issuer}${context.base}/poll/${id}`;
+	const config = (stream) => configOf(stream, issuer, context.supported, context.minVerification, pollUrl(stream.id));
+	/** The stream when it belongs to the receiver; another receiver's stream is a 404. */
+	const owned = async (id, identity) => {
+		if (typeof id !== "string" || id === "") return failure(invalid("stream_id is required"));
+		if (!/^[0-9a-f-]{36}$/i.test(id)) return notFound();
+		const found = await transmitter.stream(id);
+		if (!found.ok) return failure(found.error);
+		if (found.data === null || found.data.receiver !== identity.receiver) return notFound();
+		return found.data;
+	};
+	const manage = async (request, identity) => {
+		const query = new URL(request.url).searchParams;
+		switch (request.method) {
+			case "GET": {
+				const id = query.get("stream_id");
+				if (id === null) {
+					const all = await transmitter.streams(identity.receiver);
+					return all.ok ? json(all.data.map(config)) : failure(all.error);
+				}
+				const found = await owned(id, identity);
+				return found instanceof Response ? found : json(config(found));
+			}
+			case "POST": {
+				const body = await bodyOf(request, context.maxBody);
+				const delivery = isRecord(body?.["delivery"]) ? body["delivery"] : {};
+				const method = delivery["method"] === "urn:ietf:rfc:8935" ? "push" : delivery["method"] === "urn:ietf:rfc:8936" ? "poll" : void 0;
+				const requested = strings(body?.["events_requested"]) ?? [];
+				if (body === void 0 || method === void 0) return failure(invalid("delivery.method must be a supported delivery method"));
+				const endpoint = delivery["endpoint_url"];
+				const authorization = delivery["authorization_header"];
+				const created = await transmitter.createStream({
+					receiver: identity,
+					method,
+					eventsRequested: requested,
+					...typeof endpoint === "string" ? { endpointUrl: endpoint } : {},
+					...typeof authorization === "string" ? { authorizationHeader: authorization } : {},
+					...typeof body["description"] === "string" ? { description: body["description"] } : {}
+				});
+				return created.ok ? json(config(created.data), 201) : failure(created.error);
+			}
+			case "PATCH":
+			case "PUT": {
+				const body = await bodyOf(request, context.maxBody);
+				if (body === void 0) return failure(invalid("The body must be a stream configuration"));
+				const found = await owned(textOf(body["stream_id"] ?? ""), identity);
+				if (found instanceof Response) return found;
+				const replace = request.method === "PUT";
+				const delivery = isRecord(body["delivery"]) ? body["delivery"] : void 0;
+				if (delivery?.["method"] !== void 0 && delivery["method"] !== METHODS[found.method]) return failure(invalid("The delivery method of a stream can't change"));
+				const requested = strings(body["events_requested"]);
+				const endpoint = delivery?.["endpoint_url"];
+				const description = body["description"];
+				const updated = await transmitter.updateStream(found.id, {
+					...typeof description === "string" ? { description } : replace ? { description: null } : {},
+					...requested === void 0 ? replace ? { eventsRequested: [] } : {} : { eventsRequested: requested },
+					...found.method === "push" && typeof endpoint === "string" ? { endpointUrl: endpoint } : {}
+				});
+				if (!updated.ok) return failure(updated.error);
+				return updated.data === null ? notFound() : json(config(updated.data));
+			}
+			case "DELETE": {
+				const found = await owned(query.get("stream_id"), identity);
+				if (found instanceof Response) return found;
+				const deleted = await transmitter.deleteStream(found.id);
+				return deleted.ok ? new Response(null, { status: 204 }) : failure(deleted.error);
+			}
+			default: return new Response(null, {
+				status: 405,
+				headers: { allow: "GET, POST, PATCH, PUT, DELETE" }
+			});
+		}
+	};
+	const status = async (request, identity) => {
+		if (request.method === "GET") {
+			const found = await owned(new URL(request.url).searchParams.get("stream_id"), identity);
+			if (found instanceof Response) return found;
+			return json({
+				stream_id: found.id,
+				status: found.status,
+				...found.reason === null ? {} : { reason: found.reason }
+			});
+		}
+		if (request.method !== "POST") return new Response(null, {
+			status: 405,
+			headers: { allow: "GET, POST" }
+		});
+		const body = await bodyOf(request, context.maxBody);
+		const found = await owned(typeof body?.["stream_id"] === "string" ? body["stream_id"] : void 0, identity);
+		if (found instanceof Response) return found;
+		const next = STATUSES.find((value) => value === body?.["status"]);
+		if (next === void 0) return failure(invalid("status is enabled, paused or disabled"));
+		const reason = typeof body?.["reason"] === "string" ? body["reason"] : void 0;
+		const changed = await transmitter.setStatus(found.id, next, reason);
+		if (!changed.ok) return failure(changed.error);
+		return json({
+			stream_id: found.id,
+			status: next,
+			...reason === void 0 ? {} : { reason }
+		});
+	};
+	const verification = async (request, identity) => {
+		if (request.method !== "POST") return new Response(null, {
+			status: 405,
+			headers: { allow: "POST" }
+		});
+		const body = await bodyOf(request, context.maxBody);
+		const found = await owned(typeof body?.["stream_id"] === "string" ? body["stream_id"] : void 0, identity);
+		if (found instanceof Response) return found;
+		const noted = await context.call("note_ssf_verification", {
+			stream_id: found.id,
+			min_interval: interval(context.minVerification)
+		}, (value) => value === true);
+		if (!noted.ok) return failure(noted.error);
+		if (!noted.data) return new Response(null, {
+			status: 429,
+			headers: { "retry-after": String(context.minVerification) }
+		});
+		const state = body?.["state"];
+		const sent = await transmitter.verify(found.id, typeof state === "string" ? state : void 0);
+		return sent.ok ? new Response(null, { status: 204 }) : failure(sent.error);
+	};
+	const pollRoute = async (request, identity, id) => {
+		if (request.method !== "POST") return new Response(null, {
+			status: 405,
+			headers: { allow: "POST" }
+		});
+		const found = await owned(id, identity);
+		if (found instanceof Response) return found;
+		if (found.method !== "poll") return notFound();
+		const body = await bodyOf(request, context.maxBody) ?? {};
+		const max = body["maxEvents"];
+		const errs = isRecord(body["setErrs"]) ? body["setErrs"] : {};
+		const polled = await transmitter.poll(found.id, {
+			...typeof max === "number" ? { maxEvents: max } : {},
+			ack: strings(body["ack"]) ?? [],
+			setErrs: Object.fromEntries(Object.entries(errs).flatMap(([jti, value]) => isRecord(value) && typeof value["err"] === "string" ? [[jti, { err: value["err"] }]] : []))
+		});
+		return polled.ok ? json(polled.data) : failure(polled.error);
+	};
+	return async (request) => {
+		const path = new URL(request.url).pathname;
+		if (path.includes("/.well-known/ssf-configuration")) return request.method === "GET" ? json(metadata, 200, { "cache-control": "public, max-age=300" }) : new Response(null, {
+			status: 405,
+			headers: { allow: "GET" }
+		});
+		const route = path.startsWith(context.base) ? path.slice(context.base.length) : void 0;
+		if (route === void 0) return notFound();
+		const identity = await context.authorize(request);
+		if (identity === null) return unauthorized();
+		if (route === "/stream") return manage(request, identity);
+		if (route === "/status") return status(request, identity);
+		if (route === "/verify") return verification(request, identity);
+		if (route.startsWith("/poll/")) return pollRoute(request, identity, route.slice(6));
+		return notFound();
+	};
+}
+//#endregion
+//#region src/blocks/shared-signals/shared-signals.ts
+/** What `createBlocks` builds: each transmitter and receiver takes the block's transport. */
+function createSharedSignals(options) {
+	return {
+		transmitter: (config) => createSsfTransmitter({
+			...options,
+			...config
+		}),
+		receiver: (config) => createSsfReceiver({
+			...options,
+			...config
+		})
+	};
+}
+//#endregion
+//#region src/blocks/shared-signals/events.ts
+/** The `shared-signals` block's event types, for its manifest and `onBlockEvent`. */
+const sharedSignalsEvents = defineEvents({
+	"ssf_stream.created": event(),
+	"ssf_stream.status_changed": event(),
+	"ssf_stream.deleted": event()
+});
+//#endregion
+//#region src/blocks/shared-signals/manifest.ts
+/** The `shared-signals` block's manifest (ADR 0029). */
+const sharedSignalsBlock = defineBlock({
+	name: "shared-signals",
+	sql: ["shared-signals"],
+	options: { "shared-signals": sharedSignalsSqlOptions },
+	events: sharedSignalsEvents,
+	create: createSharedSignals,
+	category: "developer"
+});
+//#endregion
+export { CAEP_EVENTS, RISC_EVENTS, SET_CONTENT_TYPE, SET_TYP, SSF_EVENTS, SSF_POLL, SSF_PUSH, createSharedSignals, createSsfReceiver, createSsfTransmitter, mintSet, sharedSignalsBlock, sharedSignalsEvents, sqlTransport, verifySet };