@amerged/ohmyhost-mcp 0.1.10

package/src/packages/workos-auth-contracts/organizations.ts

@@ -0,0 +1,113 @@
+import { expectRecord, expectString, parseIsoDate, WorkosContractError } from "./parsing.js";
+
+export type WorkosMembershipState = "active" | "inactive" | "pending";
+
+export interface WorkosOrganizationSnapshot {
+  readonly organization: {
+    readonly id: string;
+    readonly name: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+  };
+  readonly memberships: readonly {
+    readonly id: string;
+    readonly userId: string;
+    readonly status: WorkosMembershipState;
+    readonly roles: readonly string[];
+    readonly createdAt: string;
+    readonly updatedAt: string;
+  }[];
+  readonly fetchedAt: string;
+}
+
+const parseMembership = (value: unknown, organizationId: string) => {
+  const input = expectRecord(value, "invalid_membership");
+  if (input["organization_id"] !== organizationId) {
+    throw new WorkosContractError(
+      "organization_mismatch",
+      "Membership belongs to a different organization",
+    );
+  }
+  if (
+    input["status"] !== "active" &&
+    input["status"] !== "inactive" &&
+    input["status"] !== "pending"
+  ) {
+    throw new WorkosContractError("invalid_membership", "Membership status is invalid");
+  }
+  const rawRoles = input["roles"];
+  if (!Array.isArray(rawRoles) || rawRoles.length === 0) {
+    throw new WorkosContractError("invalid_membership", "Membership roles are required");
+  }
+  const roles = rawRoles.map((value) => {
+    const role = expectRecord(value, "invalid_role");
+    return expectString(role["slug"], "role.slug");
+  });
+  const uniqueRoles = [...new Set(roles)].sort();
+  if (uniqueRoles.length > 1) {
+    throw new WorkosContractError(
+      "unsupported_multiple_roles",
+      "Membership has unsupported multiple roles",
+    );
+  }
+  return {
+    id: expectString(input["id"], "membership.id"),
+    userId: expectString(input["user_id"], "membership.user_id"),
+    status: input["status"],
+    roles: uniqueRoles,
+    createdAt: parseIsoDate(input["created_at"], "membership.created_at"),
+    updatedAt: parseIsoDate(input["updated_at"], "membership.updated_at"),
+  } satisfies WorkosOrganizationSnapshot["memberships"][number];
+};
+
+export const parseWorkosOrganizationSnapshot = (
+  value: unknown,
+  fetchedAt: Date,
+): WorkosOrganizationSnapshot => {
+  const input = expectRecord(value, "invalid_organization_snapshot");
+  const organization = expectRecord(input["organization"], "invalid_organization");
+  const organizationId = expectString(organization["id"], "organization.id");
+  if (!Array.isArray(input["memberships"])) {
+    throw new WorkosContractError("invalid_organization_snapshot", "Membership list is required");
+  }
+  const memberships = input["memberships"].map((item) => parseMembership(item, organizationId));
+  const seenIds = new Set<string>();
+  const seenUsers = new Set<string>();
+  for (const membership of memberships) {
+    if (seenIds.has(membership.id) || seenUsers.has(membership.userId)) {
+      throw new WorkosContractError(
+        "duplicate_membership",
+        "Membership snapshot contains duplicates",
+      );
+    }
+    seenIds.add(membership.id);
+    seenUsers.add(membership.userId);
+  }
+  return {
+    organization: {
+      id: organizationId,
+      name: expectString(organization["name"], "organization.name"),
+      createdAt: parseIsoDate(organization["created_at"], "organization.created_at"),
+      updatedAt: parseIsoDate(organization["updated_at"], "organization.updated_at"),
+    },
+    memberships: memberships.sort((left, right) => left.userId.localeCompare(right.userId)),
+    fetchedAt: fetchedAt.toISOString(),
+  };
+};
+
+export const canonicalizeWorkosOrganizationSnapshot = (
+  snapshot: WorkosOrganizationSnapshot,
+): string =>
+  JSON.stringify({ organization: snapshot.organization, memberships: snapshot.memberships });
+
+export interface WorkosOrganizationSnapshotSource {
+  fetchCurrentOrganizationSnapshot(workosOrganizationId: string): Promise<unknown>;
+}
+
+export interface WorkosOrganizationSnapshotSink {
+  applyCurrentSnapshot(input: {
+    readonly triggerEventId: string;
+    readonly snapshot: WorkosOrganizationSnapshot;
+    readonly canonicalSnapshot: string;
+  }): Promise<{ readonly changed: boolean; readonly mappingRevision: number }>;
+}

package/src/packages/workos-auth-contracts/parsing.ts

@@ -0,0 +1,75 @@
+export class WorkosContractError extends Error {
+  public constructor(
+    public readonly code: string,
+    message: string,
+  ) {
+    super(message);
+    this.name = "WorkosContractError";
+  }
+}
+
+export const expectRecord = (value: unknown, code = "invalid_object"): Record<string, unknown> => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new WorkosContractError(code, "WorkOS response must be an object");
+  }
+  return value as Record<string, unknown>;
+};
+
+export function expectString(value: unknown, field: string): string;
+export function expectString(
+  value: unknown,
+  field: string,
+  options: { readonly optional: true },
+): string | undefined;
+export function expectString(
+  value: unknown,
+  field: string,
+  options: { readonly optional?: boolean } = {},
+): string | undefined {
+  if (value === undefined && options.optional === true) return undefined;
+  if (typeof value !== "string" || value.length === 0) {
+    throw new WorkosContractError(
+      "invalid_field",
+      `WorkOS field ${field} must be a non-empty string`,
+    );
+  }
+  return value;
+}
+
+export function expectPositiveInteger(value: unknown, field: string): number;
+export function expectPositiveInteger(
+  value: unknown,
+  field: string,
+  options: { readonly optional: true },
+): number | undefined;
+export function expectPositiveInteger(
+  value: unknown,
+  field: string,
+  options: { readonly optional?: boolean } = {},
+): number | undefined {
+  if (value === undefined && options.optional === true) return undefined;
+  if (!Number.isSafeInteger(value) || (value as number) <= 0) {
+    throw new WorkosContractError("invalid_field", `WorkOS field ${field} must be positive`);
+  }
+  return value as number;
+}
+
+export const parseJsonObject = (body: string): Record<string, unknown> => {
+  try {
+    return expectRecord(JSON.parse(body) as unknown);
+  } catch (error) {
+    if (error instanceof WorkosContractError) throw error;
+    throw new WorkosContractError("invalid_json", "WorkOS returned invalid JSON");
+  }
+};
+
+export const parseIsoDate = (value: unknown, field: string): string => {
+  const text = expectString(value, field);
+  if (text === undefined || !Number.isFinite(Date.parse(text))) {
+    throw new WorkosContractError(
+      "invalid_field",
+      `WorkOS field ${field} must be an ISO timestamp`,
+    );
+  }
+  return new Date(text).toISOString();
+};

package/src/packages/workos-auth-contracts/session-status.ts

@@ -0,0 +1,53 @@
+import {
+  expectPositiveInteger,
+  expectRecord,
+  expectString,
+  WorkosContractError,
+} from "./parsing.js";
+
+export interface WorkosSessionStatusRequest {
+  readonly sessionId: string;
+  readonly userId: string;
+  readonly organizationId: string | null;
+  readonly tokenExpiresAt: number;
+}
+
+export interface WorkosSessionStatusResponse {
+  readonly active: boolean;
+}
+
+const assertOnlyKeys = (input: Record<string, unknown>, allowed: readonly string[]): void => {
+  const allowedKeys = new Set(allowed);
+  if (Object.keys(input).some((key) => !allowedKeys.has(key))) {
+    throw new WorkosContractError(
+      "session_status_field_not_allowed",
+      "Session-status field is not allowed",
+    );
+  }
+};
+
+export const parseWorkosSessionStatusRequest = (value: unknown): WorkosSessionStatusRequest => {
+  const input = expectRecord(value, "invalid_session_status_request");
+  assertOnlyKeys(input, ["sessionId", "userId", "organizationId", "tokenExpiresAt"]);
+  return {
+    sessionId: expectString(input["sessionId"], "sessionId"),
+    userId: expectString(input["userId"], "userId"),
+    organizationId:
+      input["organizationId"] === null
+        ? null
+        : expectString(input["organizationId"], "organizationId"),
+    tokenExpiresAt: expectPositiveInteger(input["tokenExpiresAt"], "tokenExpiresAt"),
+  };
+};
+
+export const parseWorkosSessionStatusResponse = (value: unknown): WorkosSessionStatusResponse => {
+  const input = expectRecord(value, "invalid_session_status_response");
+  assertOnlyKeys(input, ["active"]);
+  if (typeof input["active"] !== "boolean") {
+    throw new WorkosContractError(
+      "invalid_session_status_response",
+      "Session-status active field must be a boolean",
+    );
+  }
+  return { active: input["active"] };
+};

package/src/packages/workos-auth-contracts/tokens.ts

@@ -0,0 +1,216 @@
+import {
+  expectPositiveInteger,
+  expectRecord,
+  expectString,
+  WorkosContractError,
+} from "./parsing.js";
+
+export interface WorkosJwtHeader {
+  readonly alg: "RS256";
+  readonly kid: string;
+  readonly typ?: string;
+}
+
+export interface WorkosSessionClaims {
+  readonly kind: "session";
+  readonly issuer: string;
+  readonly subject: string;
+  readonly clientId: string;
+  readonly expiresAt: number;
+  readonly issuedAt: number;
+  readonly notBefore?: number;
+  readonly organizationId?: string;
+  readonly sessionId?: string;
+  readonly role?: string;
+  readonly permissions: readonly string[];
+}
+
+export interface WorkosM2mClaims {
+  readonly kind: "m2m";
+  readonly issuer: string;
+  readonly audience: readonly string[];
+  readonly subject: string;
+  readonly clientId: string;
+  readonly organizationId: string;
+  readonly expiresAt: number;
+  readonly issuedAt: number;
+  readonly notBefore?: number;
+  readonly sessionId?: string;
+  readonly tokenId?: string;
+  readonly scopes: readonly string[];
+}
+
+export type WorkosTokenClaims = WorkosSessionClaims | WorkosM2mClaims;
+
+export interface WorkosRsaJwk {
+  readonly kty: "RSA";
+  readonly kid: string;
+  readonly alg: "RS256";
+  readonly use: "sig";
+  readonly n: string;
+  readonly e: string;
+}
+
+const parseAudience = (value: unknown): readonly string[] => {
+  if (typeof value === "string" && value.length > 0) return [value];
+  if (
+    Array.isArray(value) &&
+    value.length > 0 &&
+    value.every((item) => typeof item === "string" && item.length > 0)
+  ) {
+    return [...new Set(value)];
+  }
+  throw new WorkosContractError("invalid_claim", "Token audience is invalid");
+};
+
+const parseScopes = (value: unknown): readonly string[] => {
+  if (value === undefined) return [];
+  if (typeof value === "string") return [...new Set(value.split(" ").filter(Boolean))].sort();
+  if (
+    Array.isArray(value) &&
+    value.every((scope) => typeof scope === "string" && scope.length > 0)
+  ) {
+    return [...new Set(value)].sort();
+  }
+  throw new WorkosContractError("invalid_claim", "Token scopes are invalid");
+};
+
+const parseEpoch = (value: unknown, field: string): number => expectPositiveInteger(value, field);
+
+const decodeCanonicalBase64Url = (value: unknown, field: string): Uint8Array => {
+  const encoded = expectString(value, field);
+  if (!/^[A-Za-z0-9_-]+$/u.test(encoded) || encoded.length % 4 === 1) {
+    throw new WorkosContractError("invalid_jwk", `JWK field ${field} is invalid`);
+  }
+  try {
+    const normalized = encoded.replaceAll("-", "+").replaceAll("_", "/");
+    const binary = globalThis.atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, "="));
+    const canonical = globalThis
+      .btoa(binary)
+      .replaceAll("+", "-")
+      .replaceAll("/", "_")
+      .replace(/=+$/u, "");
+    if (canonical !== encoded) throw new Error("Non-canonical base64url");
+    return Uint8Array.from(binary, (character) => character.charCodeAt(0));
+  } catch {
+    throw new WorkosContractError("invalid_jwk", `JWK field ${field} is invalid`);
+  }
+};
+
+const validateRsaMaterial = (modulus: unknown, exponent: unknown) => {
+  const n = decodeCanonicalBase64Url(modulus, "n");
+  const e = decodeCanonicalBase64Url(exponent, "e");
+  if (
+    n.length < 256 ||
+    (n.length === 256 && (n[0] ?? 0) < 0x80) ||
+    ((n[n.length - 1] ?? 0) & 1) === 0
+  ) {
+    throw new WorkosContractError("invalid_jwk", "JWK RSA modulus is too short");
+  }
+  if (e.length === 0 || e.length > 4) {
+    throw new WorkosContractError("invalid_jwk", "JWK RSA exponent is invalid");
+  }
+  const exponentValue = e.reduce((value, byte) => value * 256 + byte, 0);
+  if (!Number.isSafeInteger(exponentValue) || exponentValue < 3 || exponentValue % 2 === 0) {
+    throw new WorkosContractError("invalid_jwk", "JWK RSA exponent is invalid");
+  }
+};
+
+export const parseWorkosJwtHeader = (value: unknown): WorkosJwtHeader => {
+  const input = expectRecord(value, "invalid_jwt_header");
+  if (input["alg"] !== "RS256") {
+    throw new WorkosContractError("unsupported_algorithm", "Token algorithm is not allowed");
+  }
+  const typ = expectString(input["typ"], "typ", { optional: true });
+  return {
+    alg: "RS256",
+    kid: expectString(input["kid"], "kid"),
+    ...(typ === undefined ? {} : { typ }),
+  };
+};
+
+export const parseWorkosTokenClaims = (
+  value: unknown,
+  kind: "session" | "m2m",
+): WorkosTokenClaims => {
+  const input = expectRecord(value, "invalid_jwt_claims");
+  const common = {
+    issuer: expectString(input["iss"], "iss"),
+    subject: expectString(input["sub"], "sub"),
+    expiresAt: parseEpoch(input["exp"], "exp"),
+    issuedAt: parseEpoch(input["iat"], "iat"),
+  };
+  const notBefore = input["nbf"] === undefined ? undefined : parseEpoch(input["nbf"], "nbf");
+  if (kind === "m2m") {
+    if (!common.subject.startsWith("client_")) {
+      throw new WorkosContractError(
+        "invalid_principal_kind",
+        "Connect M2M token subject must identify a client",
+      );
+    }
+    const organizationId = expectString(input["org_id"], "org_id");
+    const sessionId = expectString(input["sid"], "sid", { optional: true });
+    const tokenId = expectString(input["jti"], "jti", { optional: true });
+    return {
+      kind,
+      ...common,
+      audience: parseAudience(input["aud"]),
+      clientId: common.subject,
+      organizationId,
+      ...(notBefore === undefined ? {} : { notBefore }),
+      ...(sessionId === undefined ? {} : { sessionId }),
+      ...(tokenId === undefined ? {} : { tokenId }),
+      scopes: parseScopes(input["scope"]),
+    };
+  }
+  if (!common.subject.startsWith("user_")) {
+    throw new WorkosContractError(
+      "invalid_principal_kind",
+      "Session token subject must identify a user",
+    );
+  }
+  const clientId = expectString(input["client_id"], "client_id");
+  const organizationId = expectString(input["org_id"], "org_id", {
+    optional: true,
+  });
+  const sessionId = expectString(input["sid"], "sid", { optional: true });
+  const role = expectString(input["role"], "role", { optional: true });
+  const permissions = parseScopes(input["permissions"]);
+  return {
+    kind,
+    ...common,
+    ...(notBefore === undefined ? {} : { notBefore }),
+    clientId,
+    ...(organizationId === undefined ? {} : { organizationId }),
+    ...(sessionId === undefined ? {} : { sessionId }),
+    ...(role === undefined ? {} : { role }),
+    permissions,
+  };
+};
+
+export const parseWorkosJwks = (value: unknown): readonly WorkosRsaJwk[] => {
+  const input = expectRecord(value, "invalid_jwks");
+  if (!Array.isArray(input["keys"]) || input["keys"].length === 0) {
+    throw new WorkosContractError("invalid_jwks", "JWKS must contain signing keys");
+  }
+  const seen = new Set<string>();
+  return input["keys"].map((candidate) => {
+    const key = expectRecord(candidate, "invalid_jwk");
+    if (key["kty"] !== "RSA" || key["alg"] !== "RS256" || key["use"] !== "sig") {
+      throw new WorkosContractError("invalid_jwk", "JWKS contains an unsupported signing key");
+    }
+    const kid = expectString(key["kid"], "kid");
+    if (seen.has(kid))
+      throw new WorkosContractError("duplicate_jwk", "JWKS key IDs must be unique");
+    seen.add(kid);
+    validateRsaMaterial(key["n"], key["e"]);
+    return {
+      kty: "RSA",
+      kid,
+      alg: "RS256",
+      use: "sig",
+      n: expectString(key["n"], "n"),
+      e: expectString(key["e"], "e"),
+    };
+  });
+};

package/src/packages/workos-auth-contracts/user-api-keys.ts

@@ -0,0 +1,85 @@
+import { expectRecord, parseIsoDate, WorkosContractError } from "./parsing.js";
+
+export const WORKOS_USER_API_KEY_PATTERN = /^sk_[A-Za-z0-9_-]{20,128}$/u;
+
+export interface WorkosUserApiKeyMetadata {
+  readonly id: string;
+  readonly userId: string;
+  readonly organizationId: string;
+  readonly permissions: readonly string[];
+  readonly expiresAt: string | null;
+}
+
+export interface WorkosUserApiKeyObservationRequest {
+  readonly keyId: string;
+  readonly userId: string;
+  readonly organizationId: string;
+}
+
+export function parseWorkosUserApiKeyObservationRequest(
+  value: unknown,
+): WorkosUserApiKeyObservationRequest {
+  const input = expectRecord(value, "invalid_api_key_request");
+  if (
+    Object.keys(input).sort().join(",") !== "keyId,organizationId,userId" ||
+    typeof input["keyId"] !== "string" ||
+    !/^api_key_[A-Za-z0-9_]{1,120}$/u.test(input["keyId"]) ||
+    typeof input["userId"] !== "string" ||
+    !/^user_[A-Za-z0-9_]{1,123}$/u.test(input["userId"]) ||
+    typeof input["organizationId"] !== "string" ||
+    !/^org_[A-Za-z0-9_]{1,124}$/u.test(input["organizationId"])
+  )
+    throw new WorkosContractError("invalid_api_key_request", "Invalid API key observation");
+  return {
+    keyId: input["keyId"],
+    userId: input["userId"],
+    organizationId: input["organizationId"],
+  };
+}
+
+export function parseWorkosUserApiKeyRequest(value: unknown): { value: string } {
+  const input = expectRecord(value, "invalid_api_key_request");
+  if (
+    Object.keys(input).join(",") !== "value" ||
+    typeof input["value"] !== "string" ||
+    !WORKOS_USER_API_KEY_PATTERN.test(input["value"])
+  )
+    throw new WorkosContractError("invalid_api_key_request", "Invalid API key request");
+  return { value: input["value"] };
+}
+
+export function parseWorkosUserApiKeyResponse(value: unknown): {
+  key: WorkosUserApiKeyMetadata | null;
+} {
+  const input = expectRecord(value, "invalid_api_key_response");
+  if (Object.keys(input).join(",") !== "key")
+    throw new WorkosContractError("invalid_api_key_response", "Invalid API key response");
+  if (input["key"] === null) return { key: null };
+  const key = expectRecord(input["key"], "invalid_api_key_response");
+  if (
+    Object.keys(key).sort().join(",") !== "expiresAt,id,organizationId,permissions,userId" ||
+    typeof key["id"] !== "string" ||
+    !/^api_key_[A-Za-z0-9_]{1,120}$/u.test(key["id"]) ||
+    typeof key["userId"] !== "string" ||
+    !/^user_[A-Za-z0-9_]{1,123}$/u.test(key["userId"]) ||
+    typeof key["organizationId"] !== "string" ||
+    !/^org_[A-Za-z0-9_]{1,124}$/u.test(key["organizationId"]) ||
+    !Array.isArray(key["permissions"]) ||
+    key["permissions"].length > 100 ||
+    key["permissions"].some(
+      (permission: unknown) =>
+        typeof permission !== "string" || !/^[a-zA-Z0-9_.*:-]{1,128}$/u.test(permission),
+    ) ||
+    new Set(key["permissions"]).size !== key["permissions"].length
+  )
+    throw new WorkosContractError("invalid_api_key_response", "Invalid API key response");
+  return {
+    key: {
+      id: key["id"],
+      userId: key["userId"],
+      organizationId: key["organizationId"],
+      permissions: key["permissions"] as string[],
+      expiresAt: key["expiresAt"] === null ? null : parseIsoDate(key["expiresAt"], "expiresAt"),
+    },
+  };
+}

package/src/packages/workos-auth-contracts/webhooks.ts

@@ -0,0 +1,127 @@
+import { expectRecord, expectString, parseJsonObject, WorkosContractError } from "./parsing.js";
+
+export interface WorkosWebhookSignature {
+  readonly issuedAtMs: number;
+  readonly signatures: readonly string[];
+}
+
+export interface WorkosWebhookEnvelope {
+  readonly id: string;
+  readonly event: string;
+  readonly createdAt: string;
+  readonly data: Readonly<Record<string, unknown>>;
+}
+
+export interface VerifyWorkosWebhookInput {
+  readonly rawBody: Uint8Array;
+  readonly signatureHeader: string;
+  readonly secret: string;
+  readonly now: Date;
+  readonly toleranceMs: number;
+  readonly maximumBodyBytes: number;
+}
+
+export const parseWorkosWebhookSignature = (header: string): WorkosWebhookSignature => {
+  let issuedAtMs: number | undefined;
+  const signatures: string[] = [];
+  for (const rawPart of header.split(",")) {
+    const [rawName, rawValue, ...rest] = rawPart.trim().split("=");
+    if (rest.length > 0 || rawName === undefined || rawValue === undefined) continue;
+    if (rawName === "t") {
+      if (issuedAtMs !== undefined || !/^\d+$/u.test(rawValue)) {
+        throw new WorkosContractError("invalid_signature_header", "Webhook timestamp is invalid");
+      }
+      issuedAtMs = Number(rawValue);
+    } else if (rawName === "v1" && /^[a-f0-9]{64}$/iu.test(rawValue)) {
+      signatures.push(rawValue.toLowerCase());
+    }
+  }
+  if (issuedAtMs === undefined || !Number.isSafeInteger(issuedAtMs) || signatures.length === 0) {
+    throw new WorkosContractError(
+      "invalid_signature_header",
+      "Webhook signature header is invalid",
+    );
+  }
+  return { issuedAtMs, signatures };
+};
+
+export const parseWorkosWebhookEnvelope = (value: unknown): WorkosWebhookEnvelope => {
+  const input = expectRecord(value, "invalid_webhook_envelope");
+  const event = expectString(input["event"], "event");
+  if (!/^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/u.test(event)) {
+    throw new WorkosContractError("invalid_webhook_event", "Webhook event type is invalid");
+  }
+  const createdAt = expectString(input["created_at"], "created_at");
+  if (!Number.isFinite(Date.parse(createdAt))) {
+    throw new WorkosContractError("invalid_webhook_envelope", "Webhook creation time is invalid");
+  }
+  return {
+    id: expectString(input["id"], "id"),
+    event,
+    createdAt: new Date(createdAt).toISOString(),
+    data: expectRecord(input["data"], "invalid_webhook_data"),
+  };
+};
+
+export const verifyAndParseWorkosWebhook = async (
+  input: VerifyWorkosWebhookInput,
+): Promise<WorkosWebhookEnvelope> => {
+  if (input.secret.length === 0) {
+    throw new WorkosContractError("invalid_webhook_secret", "Webhook secret is invalid");
+  }
+  if (
+    !Number.isSafeInteger(input.maximumBodyBytes) ||
+    input.maximumBodyBytes <= 0 ||
+    input.rawBody.byteLength > input.maximumBodyBytes
+  ) {
+    throw new WorkosContractError("webhook_body_too_large", "Webhook body exceeds its limit");
+  }
+  if (!Number.isSafeInteger(input.toleranceMs) || input.toleranceMs < 0) {
+    throw new WorkosContractError("invalid_tolerance", "Webhook tolerance is invalid");
+  }
+  const signature = parseWorkosWebhookSignature(input.signatureHeader);
+  const nowMs = input.now.getTime();
+  if (!Number.isFinite(nowMs)) {
+    throw new WorkosContractError("invalid_clock", "Webhook verification clock is invalid");
+  }
+  if (Math.abs(nowMs - signature.issuedAtMs) > input.toleranceMs) {
+    throw new WorkosContractError(
+      "webhook_timestamp_outside_tolerance",
+      "Webhook timestamp is stale",
+    );
+  }
+  const prefix = new TextEncoder().encode(`${signature.issuedAtMs}.`);
+  const message = new Uint8Array(prefix.byteLength + input.rawBody.byteLength);
+  message.set(prefix);
+  message.set(input.rawBody, prefix.byteLength);
+  const importKey = async () => {
+    try {
+      return await globalThis.crypto.subtle.importKey(
+        "raw",
+        new TextEncoder().encode(input.secret),
+        { name: "HMAC", hash: "SHA-256" },
+        false,
+        ["verify"],
+      );
+    } catch {
+      throw new WorkosContractError("invalid_webhook_secret", "Webhook secret is invalid");
+    }
+  };
+  const key = await importKey();
+  let valid = false;
+  for (const expectedHexDigest of signature.signatures) {
+    const expected = Uint8Array.from(expectedHexDigest.match(/.{2}/gu) ?? [], (byte) =>
+      Number.parseInt(byte, 16),
+    );
+    try {
+      valid = (await globalThis.crypto.subtle.verify("HMAC", key, expected, message)) || valid;
+    } catch {
+      // Only a verified signature can change the accumulated result.
+    }
+  }
+  if (!valid)
+    throw new WorkosContractError("invalid_webhook_signature", "Webhook signature is invalid");
+  return parseWorkosWebhookEnvelope(
+    parseJsonObject(new TextDecoder("utf-8", { fatal: true }).decode(input.rawBody)),
+  );
+};