@automate.ax/integration-contracts 0.105.0 → 0.107.0

package/dist/whatsapp/index.d.ts

@@ -324,8 +324,8 @@ export declare const whatsappTriggerContracts: {
                 type: z.ZodEnum<{
                     unknown: "unknown";
                     text: "text";
-                    document: "document";
                     audio: "audio";
+                    document: "document";
                     image: "image";
                     video: "video";
                     location: "location";
@@ -419,8 +419,8 @@ export declare const whatsappTriggerContracts: {
                 type: z.ZodEnum<{
                     unknown: "unknown";
                     text: "text";
-                    document: "document";
                     audio: "audio";
+                    document: "document";
                     image: "image";
                     video: "video";
                     location: "location";

package/dist/whatsapp/schemas.d.ts

@@ -90,8 +90,8 @@ export declare const WHATSAPP_WEBHOOK_SCHEMA: z.ZodObject<{
                     type: z.ZodEnum<{
                         unknown: "unknown";
                         text: "text";
-                        document: "document";
                         audio: "audio";
+                        document: "document";
                         image: "image";
                         video: "video";
                         location: "location";
@@ -183,8 +183,8 @@ export declare const WHATSAPP_MESSAGE_RECEIVED_EVENT_SCHEMA: z.ZodObject<{
         type: z.ZodEnum<{
             unknown: "unknown";
             text: "text";
-            document: "document";
             audio: "audio";
+            document: "document";
             image: "image";
             video: "video";
             location: "location";
@@ -278,8 +278,8 @@ export declare const WHATSAPP_MESSAGE_RECEIVED_EVENT_SCHEMA: z.ZodObject<{
         type: z.ZodEnum<{
             unknown: "unknown";
             text: "text";
-            document: "document";
             audio: "audio";
+            document: "document";
             image: "image";
             video: "video";
             location: "location";
@@ -768,7 +768,7 @@ export declare function normalizeWhatsAppWebhook(input: unknown): {
         message: {
             id: string;
             timestamp: string;
-            type: "unknown" | "text" | "document" | "audio" | "image" | "video" | "location" | "system" | "order" | "reaction" | "button" | "contacts" | "interactive" | "sticker" | "unsupported";
+            type: "unknown" | "text" | "audio" | "document" | "image" | "video" | "location" | "system" | "order" | "reaction" | "button" | "contacts" | "interactive" | "sticker" | "unsupported";
             content?: z.core.util.JSONType | undefined;
             context?: {
                 messageId: string;
@@ -781,7 +781,7 @@ export declare function normalizeWhatsAppWebhook(input: unknown): {
             from: string;
             id: string;
             timestamp: string;
-            type: "unknown" | "text" | "document" | "audio" | "image" | "video" | "location" | "system" | "order" | "reaction" | "button" | "contacts" | "interactive" | "sticker" | "unsupported";
+            type: "unknown" | "text" | "audio" | "document" | "image" | "video" | "location" | "system" | "order" | "reaction" | "button" | "contacts" | "interactive" | "sticker" | "unsupported";
             audio?: {
                 id: string;
                 mime_type?: string | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@automate.ax/integration-contracts",
-  "version": "0.105.0",
+  "version": "0.107.0",
   "description": "Shared integration payload contracts and provider primitives for Automate.ax.",
   "license": "MIT",
   "repository": {
@@ -22,6 +22,7 @@
       "./automate": "./src/automate/index.ts",
       "./asana": "./src/asana/index.ts",
       "./brevo": "./src/brevo/index.ts",
+      "./cloudflare": "./src/cloudflare/index.ts",
       "./convex": "./src/convex/index.ts",
       "./close": "./src/close/index.ts",
       "./gmail": "./src/gmail/index.ts",
@@ -49,7 +50,7 @@
     }
   },
   "dependencies": {
-    "@automate.ax/codec": "0.105.0",
+    "@automate.ax/codec": "0.107.0",
     "@cfworker/json-schema": "^4.1.1",
     "@googleapis/calendar": "^15.0.0",
     "@googleapis/forms": "^6.0.1",
@@ -120,6 +121,11 @@
       "types": "./dist/brevo/index.d.ts",
       "default": "./dist/brevo/index.js"
     },
+    "./cloudflare": {
+      "bun": "./src/cloudflare/index.ts",
+      "types": "./dist/cloudflare/index.d.ts",
+      "default": "./dist/cloudflare/index.js"
+    },
     "./convex": {
       "bun": "./src/convex/index.ts",
       "types": "./dist/convex/index.d.ts",

package/src/cloudflare/api.ts

@@ -0,0 +1,340 @@
+import type { Encodable } from "@automate.ax/codec"
+import * as z from "zod"
+
+const CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4/"
+const CLOUDFLARE_API_ORIGIN = new URL(CLOUDFLARE_API_BASE_URL).origin
+const CLOUDFLARE_API_TOKEN_SECRET_SCHEMA = z.object({
+  apiKey: z.string().min(1),
+})
+const CLOUDFLARE_OAUTH_SECRET_SCHEMA = z.object({
+  accessToken: z.string().min(1),
+})
+const CLOUDFLARE_RESPONSE_INFO_SCHEMA = z.looseObject({
+  code: z.number().optional(),
+  documentation_url: z.string().optional(),
+  message: z.string(),
+  source: z.object({ pointer: z.string().optional() }).optional(),
+})
+const CLOUDFLARE_ENVELOPE_SCHEMA = z.looseObject({
+  errors: CLOUDFLARE_RESPONSE_INFO_SCHEMA.array().default([]),
+  messages: CLOUDFLARE_RESPONSE_INFO_SCHEMA.array().default([]),
+  result: z.unknown().optional(),
+  result_info: z
+    .looseObject({
+      count: z.number().int().nonnegative().optional(),
+      page: z.number().int().positive().optional(),
+      per_page: z.number().int().positive().optional(),
+      total_count: z.number().int().nonnegative().optional(),
+      total_pages: z.number().int().nonnegative().optional(),
+    })
+    .optional(),
+  success: z.boolean(),
+})
+const CLOUDFLARE_RESULT_INFO_SCHEMA = z.looseObject({
+  count: z.number().int().nonnegative().optional(),
+  page: z.number().int().positive().optional(),
+  perPage: z.number().int().positive().optional(),
+  totalCount: z.number().int().nonnegative().optional(),
+  totalPages: z.number().int().nonnegative().optional(),
+})
+
+/** Scalar query value supported by the Cloudflare client. */
+type CloudflareQueryValue = boolean | number | string | undefined
+
+/** Resolved Cloudflare account accepted by the shared API client. */
+export interface CloudflareResolvedAccount {
+  connectionMethodId: string
+  secret: Record<string, unknown>
+  serviceId: "cloudflare"
+}
+
+/** Options for one authenticated Cloudflare REST request. */
+export interface CloudflareRequestOptions<TSchema extends z.ZodType> {
+  /** Public camelCase JSON body. */
+  body?: Encodable
+
+  /** HTTP verb. Defaults to `GET`. */
+  method?: "DELETE" | "GET" | "PATCH" | "POST" | "PUT"
+
+  /** Public camelCase query parameters. */
+  query?: Record<string, CloudflareQueryValue>
+
+  /** Schema for the normalized provider result. */
+  responseSchema: TSchema
+}
+
+/** One normalized Cloudflare result page. */
+export interface CloudflarePage<T> {
+  result: T
+  resultInfo?: {
+    count?: number
+    page?: number
+    perPage?: number
+    totalCount?: number
+    totalPages?: number
+  }
+}
+
+/** Structured Cloudflare REST error. */
+export class CloudflareApiError extends Error {
+  /** Provider error records. */
+  readonly errors: z.output<typeof CLOUDFLARE_RESPONSE_INFO_SCHEMA>[]
+
+  /** Parsed Cloudflare rate-limit header, when present. */
+  readonly rateLimit?: string
+
+  /** Parsed Cloudflare rate-limit policy header, when present. */
+  readonly rateLimitPolicy?: string
+
+  /** Retry delay in seconds, when Cloudflare returned one. */
+  readonly retryAfter?: number
+
+  /** HTTP status returned by Cloudflare. */
+  readonly status: number
+
+  /**
+   * Creates a structured error from one Cloudflare response.
+   *
+   * @param options - Response status, provider errors, and limit metadata.
+   * @param options.errors - Provider error records.
+   * @param options.rateLimit - Current rate-limit header.
+   * @param options.rateLimitPolicy - Current rate-limit policy header.
+   * @param options.retryAfter - Retry delay in seconds.
+   * @param options.status - HTTP response status.
+   */
+  constructor(options: {
+    errors?: z.output<typeof CLOUDFLARE_RESPONSE_INFO_SCHEMA>[]
+    rateLimit?: string
+    rateLimitPolicy?: string
+    retryAfter?: number
+    status: number
+  }) {
+    const errors = options.errors ?? []
+    super(
+      errors[0]?.message
+        ? `Cloudflare API error (${options.status}): ${errors[0].message}`
+        : `Cloudflare API request failed with status ${options.status}.`,
+    )
+    this.name = "CloudflareApiError"
+    this.errors = errors
+    this.rateLimit = options.rateLimit
+    this.rateLimitPolicy = options.rateLimitPolicy
+    this.retryAfter = options.retryAfter
+    this.status = options.status
+  }
+}
+
+/**
+ * Creates an authenticated Cloudflare REST client.
+ *
+ * @param account - Resolved OAuth or API-token account.
+ * @throws When the connection method or secret shape is unsupported.
+ */
+export function getCloudflareApi(account: CloudflareResolvedAccount) {
+  const accessToken =
+    account.connectionMethodId === "oauth"
+      ? CLOUDFLARE_OAUTH_SECRET_SCHEMA.parse(account.secret).accessToken
+      : account.connectionMethodId === "api-token"
+        ? CLOUDFLARE_API_TOKEN_SECRET_SCHEMA.parse(account.secret).apiKey
+        : undefined
+  if (!accessToken) {
+    throw new Error(
+      `Unsupported Cloudflare connection method: ${account.connectionMethodId}`,
+    )
+  }
+
+  /**
+   * Runs one request and returns its normalized result.
+   *
+   * @param path - Cloudflare API path relative to the v4 root.
+   * @param options - Method, parameters, and response schema.
+   */
+  async function request<TSchema extends z.ZodType>(
+    path: string,
+    options: CloudflareRequestOptions<TSchema>,
+  ): Promise<z.output<TSchema>> {
+    return (await requestPage(path, options)).result
+  }
+
+  /**
+   * Runs one request and preserves Cloudflare page metadata.
+   *
+   * @param path - Cloudflare API path relative to the v4 root.
+   * @param options - Method, parameters, and response schema.
+   */
+  async function requestPage<TSchema extends z.ZodType>(
+    path: string,
+    options: CloudflareRequestOptions<TSchema>,
+  ): Promise<CloudflarePage<z.output<TSchema>>> {
+    const url = new URL(path.replace(/^\//, ""), CLOUDFLARE_API_BASE_URL)
+    if (url.origin !== CLOUDFLARE_API_ORIGIN) {
+      throw new Error(
+        "Cloudflare API paths must use the Cloudflare API origin.",
+      )
+    }
+    for (const [name, value] of Object.entries(options.query ?? {})) {
+      if (value !== undefined)
+        url.searchParams.set(toSnakeCase(name), String(value))
+    }
+    const response = await fetch(url, {
+      body:
+        options.body === undefined
+          ? undefined
+          : JSON.stringify(toCloudflare(options.body)),
+      headers: {
+        Accept: "application/json",
+        Authorization: `Bearer ${accessToken}`,
+        ...(options.body === undefined
+          ? {}
+          : { "Content-Type": "application/json" }),
+      },
+      method: options.method ?? "GET",
+    })
+    const parsed = CLOUDFLARE_ENVELOPE_SCHEMA.safeParse(
+      parseJson(await response.text()),
+    )
+    if (!response.ok || !parsed.success || !parsed.data.success) {
+      throw new CloudflareApiError({
+        errors: parsed.success ? parsed.data.errors : undefined,
+        rateLimit: response.headers.get("Ratelimit") ?? undefined,
+        rateLimitPolicy: response.headers.get("Ratelimit-Policy") ?? undefined,
+        retryAfter: parseFiniteNumber(response.headers.get("Retry-After")),
+        status: response.status,
+      })
+    }
+    return {
+      result: options.responseSchema.parse(fromCloudflare(parsed.data.result)),
+      ...(parsed.data.result_info && {
+        resultInfo: CLOUDFLARE_RESULT_INFO_SCHEMA.parse(
+          fromCloudflare(parsed.data.result_info),
+        ),
+      }),
+    }
+  }
+
+  return { request, requestPage }
+}
+
+/**
+ * Converts public camelCase JSON to Cloudflare wire keys.
+ *
+ * @param value - Codec-safe public value.
+ */
+export function toCloudflare(value: Encodable): Encodable {
+  return convertToCloudflare(value, false)
+}
+
+/**
+ * Converts one value while optionally preserving object keys.
+ *
+ * @param value - Public value to convert.
+ * @param preserveKeys - Whether this object is a provider-defined map.
+ */
+function convertToCloudflare(
+  value: Encodable,
+  preserveKeys: boolean,
+): Encodable {
+  if (value instanceof Date) return value.toISOString()
+  if (Array.isArray(value))
+    return value.map((item) => convertToCloudflare(item, preserveKeys))
+  if (!isPlainObject(value)) return value
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => [
+      preserveKeys ? key : toSnakeCase(key),
+      convertToCloudflare(item, key === "header" || key === "headers"),
+    ]),
+  )
+}
+
+/**
+ * Converts Cloudflare wire JSON to public camelCase keys.
+ *
+ * @param value - Untrusted provider JSON value.
+ */
+export function fromCloudflare(value: unknown): Encodable {
+  return convertFromCloudflare(value, false)
+}
+
+/**
+ * Converts one provider value while optionally preserving object keys.
+ *
+ * @param value - Provider value to convert.
+ * @param preserveKeys - Whether this object is a provider-defined map.
+ */
+function convertFromCloudflare(
+  value: unknown,
+  preserveKeys: boolean,
+): Encodable {
+  if (Array.isArray(value))
+    return value.map((item) => convertFromCloudflare(item, preserveKeys))
+  if (!isPlainObject(value)) return CLOUDFLARE_VALUE_SCHEMA.parse(value)
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => [
+      preserveKeys ? key : toCamelCase(key),
+      convertFromCloudflare(item, key === "header" || key === "headers"),
+    ]),
+  )
+}
+
+const CLOUDFLARE_VALUE_SCHEMA = z.union([
+  z.boolean(),
+  z.number(),
+  z.string(),
+  z.null(),
+  z.undefined(),
+])
+
+/**
+ * Returns whether a value is a plain JSON object.
+ *
+ * @param value - Candidate value.
+ */
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}
+
+/**
+ * Parses JSON without obscuring the eventual structured API error.
+ *
+ * @param value - Raw response text.
+ */
+function parseJson(value: string): unknown {
+  try {
+    return JSON.parse(value)
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Parses a finite numeric response header.
+ *
+ * @param value - Header value.
+ */
+function parseFiniteNumber(value: string | null) {
+  if (value === null) return undefined
+  const number = Number(value)
+  return Number.isFinite(number) ? number : undefined
+}
+
+/**
+ * Converts one Cloudflare snake_case key to camelCase.
+ *
+ * @param value - Provider key.
+ */
+function toCamelCase(value: string) {
+  return value.replace(/_([a-z0-9])/g, (_match, character: string) =>
+    character.toUpperCase(),
+  )
+}
+
+/**
+ * Converts one public camelCase key to snake_case.
+ *
+ * @param value - Public key.
+ */
+function toSnakeCase(value: string) {
+  return value
+    .replace(/([a-zA-Z])([0-9])/g, "$1_$2")
+    .replace(/[A-Z]/g, (character) => `_${character.toLowerCase()}`)
+}

package/src/cloudflare/events.ts

@@ -0,0 +1,212 @@
+import * as z from "zod"
+import { encodableSchema } from "@automate.ax/codec"
+import { fromCloudflare } from "./api"
+import {
+  CLOUDFLARE_ALERT_TYPE_SCHEMA,
+  CLOUDFLARE_NOTIFICATION_FILTERS_SCHEMA,
+} from "./schemas"
+
+const PROVIDER_EVENT_SCHEMA = z.looseObject({
+  account_id: z.string().optional(),
+  alert_correlation_id: z.string().optional(),
+  alert_event: z.string().optional(),
+  alert_type: CLOUDFLARE_ALERT_TYPE_SCHEMA.optional(),
+  data: z.record(z.string(), z.unknown()).optional(),
+  name: z.string().optional(),
+  policy_id: z.string().optional(),
+  policy_name: z.string().optional(),
+  text: z.string().optional(),
+  ts: z.union([z.number(), z.string()]).optional(),
+})
+
+export const CLOUDFLARE_EVENT_SCHEMA = z.object({
+  accountId: z.string().optional(),
+  alertCorrelationId: z.string().optional(),
+  alertEvent: z.string().optional(),
+  alertType: CLOUDFLARE_ALERT_TYPE_SCHEMA,
+  data: z.record(z.string(), encodableSchema).prefault({}),
+  name: z.string().optional(),
+  policyId: z.string().optional(),
+  policyName: z.string().optional(),
+  text: z.string().optional(),
+  timestamp: z.union([z.number(), z.string()]).optional(),
+})
+
+const LAYER_4_DDOS_DATA_SCHEMA = z.object({
+  accountName: z.string().optional(),
+  accountTag: z.string().optional(),
+  action: z.string().optional(),
+  attackId: z.string().optional(),
+  attackVector: z.string().optional(),
+  dashboardLink: z.string().optional(),
+  maxRate: z.string().optional(),
+  megabitsPerSecond: z.number().optional(),
+  mitigation: z.string().optional(),
+  packetsPerSecond: z.number().optional(),
+  protocol: z.string().optional(),
+  ruleDescription: z.string().optional(),
+  ruleId: z.string().optional(),
+  ruleName: z.string().optional(),
+  rulesetId: z.string().optional(),
+  rulesetOverrideId: z.string().optional(),
+  startTime: z.string().optional(),
+  targetId: z.string().optional(),
+  targetIp: z.string().optional(),
+  targetPort: z.number().optional(),
+})
+const LAYER_7_DDOS_DATA_SCHEMA = z.object({
+  accountName: z.string().optional(),
+  accountTag: z.string().optional(),
+  action: z.string().optional(),
+  attackId: z.string().optional(),
+  attackType: z.string().optional(),
+  dashboardLink: z.string().optional(),
+  maxRate: z.string().optional(),
+  mitigation: z.string().optional(),
+  requestsPerSecond: z.number().optional(),
+  ruleDescription: z.string().optional(),
+  ruleId: z.string().optional(),
+  ruleLink: z.string().optional(),
+  rulesetId: z.string().optional(),
+  rulesetOverrideId: z.string().optional(),
+  startTime: z.string().optional(),
+  targetHostname: z.string().optional(),
+  zoneName: z.string().optional(),
+  zoneTag: z.string().optional(),
+})
+const SSL_DATA_SCHEMA = z.object({
+  accountName: z.string().optional(),
+  accountTag: z.string().optional(),
+  certificateId: z.string().optional(),
+  certificatePackId: z.string().optional(),
+  certificateStatus: z.string().optional(),
+  eventType: z.string().optional(),
+  hostnames: z.string().optional(),
+  packCa: z.string().optional(),
+  packId: z.string().optional(),
+  packStatus: z.string().optional(),
+  packValidation: z.string().optional(),
+  zoneName: z.string().optional(),
+  zoneTag: z.string().optional(),
+})
+const HEALTH_CHECK_DATA_SCHEMA = z.object({
+  accountName: z.string().optional(),
+  accountTag: z.string().optional(),
+  failingRegions: z.string().optional(),
+  healthCheckId: z.string().optional(),
+  healthCheckName: z.string().optional(),
+  newHealthStatus: z.string().optional(),
+  newStatus: z.string().optional(),
+  oldStatus: z.string().optional(),
+  originIp: z.string().optional(),
+  reason: z.string().optional(),
+  statusChangeTime: z.string().optional(),
+  timeSinceLastFailure: z.string().optional(),
+  zoneName: z.string().optional(),
+  zoneTag: z.string().optional(),
+})
+const ACCESS_CERTIFICATE_DATA_SCHEMA = z.object({
+  accountName: z.string().optional(),
+  accountTag: z.string().optional(),
+  certificateId: z.string().optional(),
+  daysTilExpiration: z.number().optional(),
+  hostnames: z.string().optional(),
+  zoneName: z.string().optional(),
+  zoneTag: z.string().optional(),
+})
+
+/**
+ * Builds one alert-type-specific Cloudflare event schema.
+ *
+ * @param alertType - Exact Cloudflare policy alert type.
+ * @param data - Stable documented alert data schema.
+ */
+function semanticEvent<
+  TType extends z.ZodLiteral<string>,
+  TData extends z.ZodType,
+>(alertType: TType, data: TData) {
+  return CLOUDFLARE_EVENT_SCHEMA.extend({ alertType, data })
+}
+export const CLOUDFLARE_LAYER_4_DDOS_EVENT_SCHEMA = semanticEvent(
+  z.literal("advanced_ddos_attack_l4_alert"),
+  LAYER_4_DDOS_DATA_SCHEMA,
+)
+export const CLOUDFLARE_LAYER_7_DDOS_EVENT_SCHEMA = semanticEvent(
+  z.literal("advanced_ddos_attack_l7_alert"),
+  LAYER_7_DDOS_DATA_SCHEMA,
+)
+export const CLOUDFLARE_SSL_CERTIFICATE_EVENT_SCHEMA = semanticEvent(
+  z.literal("dedicated_ssl_certificate_event_type"),
+  SSL_DATA_SCHEMA,
+)
+export const CLOUDFLARE_ORIGIN_HEALTH_CHECK_EVENT_SCHEMA = semanticEvent(
+  z.literal("health_check_status_notification"),
+  HEALTH_CHECK_DATA_SCHEMA,
+)
+export const CLOUDFLARE_ACCESS_CERTIFICATE_EVENT_SCHEMA = semanticEvent(
+  z.literal("access_custom_certificate_expiration_type"),
+  ACCESS_CERTIFICATE_DATA_SCHEMA,
+)
+
+export const CLOUDFLARE_TRIGGER_CONFIG_SCHEMA = z.object({
+  accountId: z.string().trim().min(1),
+  alertTypes: CLOUDFLARE_ALERT_TYPE_SCHEMA.array()
+    .min(1)
+    .refine(
+      (alertTypes) => new Set(alertTypes).size === alertTypes.length,
+      "Choose each alert type once.",
+    ),
+  filters: CLOUDFLARE_NOTIFICATION_FILTERS_SCHEMA.optional(),
+})
+
+export const cloudflareTriggerContracts = {
+  "cloudflare.accessCertificate.expiring": {
+    configSchema: CLOUDFLARE_TRIGGER_CONFIG_SCHEMA,
+    eventSchema: CLOUDFLARE_ACCESS_CERTIFICATE_EVENT_SCHEMA,
+  },
+  "cloudflare.layer4DdosAttack": {
+    configSchema: CLOUDFLARE_TRIGGER_CONFIG_SCHEMA,
+    eventSchema: CLOUDFLARE_LAYER_4_DDOS_EVENT_SCHEMA,
+  },
+  "cloudflare.layer7DdosAttack": {
+    configSchema: CLOUDFLARE_TRIGGER_CONFIG_SCHEMA,
+    eventSchema: CLOUDFLARE_LAYER_7_DDOS_EVENT_SCHEMA,
+  },
+  "cloudflare.notification": {
+    configSchema: CLOUDFLARE_TRIGGER_CONFIG_SCHEMA,
+    eventSchema: CLOUDFLARE_EVENT_SCHEMA,
+  },
+  "cloudflare.originHealthCheckStatusChanged": {
+    configSchema: CLOUDFLARE_TRIGGER_CONFIG_SCHEMA,
+    eventSchema: CLOUDFLARE_ORIGIN_HEALTH_CHECK_EVENT_SCHEMA,
+  },
+  "cloudflare.sslCertificate.event": {
+    configSchema: CLOUDFLARE_TRIGGER_CONFIG_SCHEMA,
+    eventSchema: CLOUDFLARE_SSL_CERTIFICATE_EVENT_SCHEMA,
+  },
+} as const
+
+/**
+ * Normalizes an authenticated Cloudflare notification webhook.
+ *
+ * @param value - Untrusted provider webhook payload.
+ * @param expectedAlertType - Alert type owned by the authenticated source.
+ */
+export function normalizeCloudflareEvent(
+  value: unknown,
+  expectedAlertType?: z.output<typeof CLOUDFLARE_ALERT_TYPE_SCHEMA>,
+) {
+  const event = PROVIDER_EVENT_SCHEMA.parse(value)
+  return CLOUDFLARE_EVENT_SCHEMA.parse({
+    accountId: event.account_id,
+    alertCorrelationId: event.alert_correlation_id,
+    alertEvent: event.alert_event,
+    alertType: event.alert_type ?? expectedAlertType,
+    data: fromCloudflare(event.data ?? {}),
+    name: event.name,
+    policyId: event.policy_id,
+    policyName: event.policy_name,
+    text: event.text,
+    timestamp: event.ts,
+  })
+}

package/src/cloudflare/index.ts

@@ -0,0 +1,3 @@
+export * from "./api"
+export * from "./events"
+export * from "./schemas"