@cursor/bdk 0.2.24 → 0.2.25

package/dist/channels/pagerduty/self-user.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The PagerDuty user the agent acts as, for skipping its own echoed
+ * actions. Precedence: the authored `selfUserIds`, then the
+ * `PAGERDUTY_USER_ID` env var / deployment secret, then inference from the
+ * deployment's `PAGERDUTY_TOKEN`.
+ *
+ * Inference asks `GET /users/me`, which PagerDuty serves only to a
+ * user-level REST API key or an OAuth user token. An account-level REST
+ * API key or an OAuth app token has no user of its own; with
+ * `PAGERDUTY_FROM_EMAIL` set, the user whose email matches it exactly (the
+ * `From` user those tokens write as) is used instead. Results are cached
+ * in memory per credential set, never in agent storage.
+ */
+import { type PagerDutyClientOptions } from "./api.js";
+import type { PagerDutyChannelOptions } from "./types.js";
+/** Env var / deployment secret naming the agent's own PagerDuty user id. */
+export declare const PAGERDUTY_USER_ID_ENV = "PAGERDUTY_USER_ID";
+export interface PagerDutySelfUserDeps {
+    fetch?: typeof fetch;
+    now?: () => number;
+    warn?: (line: string) => void;
+}
+/**
+ * The secret the agent's user id is read from: a named `selfUserIds`, else
+ * `PAGERDUTY_USER_ID`. `undefined` when the ids are authored in code.
+ */
+export declare function pagerDutySelfUserIdSecretName(options: Pick<PagerDutyChannelOptions, "selfUserIds">): string | undefined;
+/**
+ * The user ids the agent acts as, resolved per delivery. Authored ids, a
+ * getter, or a named secret are used as given and never fall back. With
+ * nothing authored, `PAGERDUTY_USER_ID` (one id) wins, else the id inferred
+ * from the channel's token (`PAGERDUTY_TOKEN` unless `token` is set).
+ * Empty when none resolves, which turns echo skip off.
+ */
+export declare function resolvePagerDutySelfUserIds(input: {
+    options: Pick<PagerDutyChannelOptions, "selfUserIds" | "token" | "from" | "apiBaseUrl">;
+    deps?: PagerDutySelfUserDeps;
+}): Promise<ReadonlySet<string>>;
+/**
+ * The user the channel's token acts as (`token`, else `PAGERDUTY_TOKEN`),
+ * cached for an hour per base URL, token, and `From` email (an unresolved
+ * answer for five minutes). `undefined` without a token or when PagerDuty
+ * names no single user.
+ */
+export declare function inferPagerDutySelfUserId(input?: {
+    credentials?: Pick<PagerDutyClientOptions, "token" | "from" | "apiBaseUrl">;
+    deps?: PagerDutySelfUserDeps;
+}): Promise<string | undefined>;
+/** Forget every inferred user, so the next delivery asks PagerDuty again. */
+export declare function clearPagerDutySelfUserCache(): void;
+//# sourceMappingURL=self-user.d.ts.map

package/dist/channels/pagerduty/self-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"self-user.d.ts","sourceRoot":"","sources":["../../../src/channels/pagerduty/self-user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAKL,KAAK,sBAAsB,EAC5B,MAAM,UAAU,CAAC;AAElB,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,4EAA4E;AAC5E,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAWzD,MAAM,WAAW,qBAAqB;IACpC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,CAAC,GACpD,MAAM,GAAG,SAAS,CAKpB;AAED;;;;;;GAMG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,OAAO,EAAE,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC,CAAC;IACxF,IAAI,CAAC,EAAE,qBAAqB,CAAC;CAC9B,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAiB/B;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,GAAE;IACL,WAAW,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,OAAO,GAAG,MAAM,GAAG,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC,EAAE,qBAAqB,CAAC;CACzB,GACL,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAiD7B;AAED,6EAA6E;AAC7E,wBAAgB,2BAA2B,IAAI,IAAI,CAElD"}

package/dist/channels/pagerduty/self-user.js

@@ -0,0 +1,157 @@
+/**
+ * The PagerDuty user the agent acts as, for skipping its own echoed
+ * actions. Precedence: the authored `selfUserIds`, then the
+ * `PAGERDUTY_USER_ID` env var / deployment secret, then inference from the
+ * deployment's `PAGERDUTY_TOKEN`.
+ *
+ * Inference asks `GET /users/me`, which PagerDuty serves only to a
+ * user-level REST API key or an OAuth user token. An account-level REST
+ * API key or an OAuth app token has no user of its own; with
+ * `PAGERDUTY_FROM_EMAIL` set, the user whose email matches it exactly (the
+ * `From` user those tokens write as) is used instead. Results are cached
+ * in memory per credential set, never in agent storage.
+ */
+import { createHash } from "node:crypto";
+import { isSecretRef } from "../../types.js";
+import { PAGERDUTY_FROM_EMAIL_ENV, PAGERDUTY_TOKEN_ENV, pagerDutyApiBaseUrl, pagerDutyAuthorizationHeader, } from "./api.js";
+import { resolvePagerDutySecret } from "./secrets.js";
+/** Env var / deployment secret naming the agent's own PagerDuty user id. */
+export const PAGERDUTY_USER_ID_ENV = "PAGERDUTY_USER_ID";
+const RESOLVED_TTL_MS = 60 * 60 * 1000;
+const UNRESOLVED_TTL_MS = 5 * 60 * 1000;
+const LOOKUP_TIMEOUT_MS = 5_000;
+const MAX_CACHED_CREDENTIALS = 256;
+const inferredSelfUsers = new Map();
+/**
+ * The secret the agent's user id is read from: a named `selfUserIds`, else
+ * `PAGERDUTY_USER_ID`. `undefined` when the ids are authored in code.
+ */
+export function pagerDutySelfUserIdSecretName(options) {
+    if (options.selfUserIds === undefined) {
+        return PAGERDUTY_USER_ID_ENV;
+    }
+    return isSecretRef(options.selfUserIds) ? options.selfUserIds.secretName : undefined;
+}
+/**
+ * The user ids the agent acts as, resolved per delivery. Authored ids, a
+ * getter, or a named secret are used as given and never fall back. With
+ * nothing authored, `PAGERDUTY_USER_ID` (one id) wins, else the id inferred
+ * from the channel's token (`PAGERDUTY_TOKEN` unless `token` is set).
+ * Empty when none resolves, which turns echo skip off.
+ */
+export async function resolvePagerDutySelfUserIds(input) {
+    const options = input.options;
+    const selfUserIds = options.selfUserIds;
+    if (selfUserIds !== undefined) {
+        const ids = isSecretRef(selfUserIds)
+            ? [resolvePagerDutySecret(selfUserIds, selfUserIds.secretName) ?? ""]
+            : typeof selfUserIds === "function"
+                ? (selfUserIds() ?? [])
+                : selfUserIds;
+        return new Set(ids.map((id) => id.trim()).filter(Boolean));
+    }
+    const configured = resolvePagerDutySecret(undefined, PAGERDUTY_USER_ID_ENV);
+    if (configured !== undefined) {
+        return new Set([configured]);
+    }
+    const inferred = await inferPagerDutySelfUserId({ credentials: options, deps: input.deps });
+    return new Set(inferred === undefined ? [] : [inferred]);
+}
+/**
+ * The user the channel's token acts as (`token`, else `PAGERDUTY_TOKEN`),
+ * cached for an hour per base URL, token, and `From` email (an unresolved
+ * answer for five minutes). `undefined` without a token or when PagerDuty
+ * names no single user.
+ */
+export async function inferPagerDutySelfUserId(input = {}) {
+    const credentials = input.credentials ?? {};
+    const deps = input.deps ?? {};
+    const token = resolvePagerDutySecret(credentials.token, PAGERDUTY_TOKEN_ENV);
+    if (token === undefined) {
+        return undefined;
+    }
+    const from = resolvePagerDutySecret(credentials.from, PAGERDUTY_FROM_EMAIL_ENV);
+    const baseUrl = pagerDutyApiBaseUrl(credentials.apiBaseUrl);
+    const key = createHash("sha256")
+        .update(`${baseUrl}\n${token}\n${from ?? ""}`)
+        .digest("hex");
+    const now = deps.now ?? Date.now;
+    const cached = inferredSelfUsers.get(key);
+    if (cached !== undefined && cached.expiresAt > now()) {
+        return cached.userId;
+    }
+    const entry = {
+        expiresAt: now() + UNRESOLVED_TTL_MS,
+        userId: lookUpSelfUser({ baseUrl, token, from, fetch: deps.fetch ?? fetch }).then((userId) => {
+            if (userId === undefined) {
+                (deps.warn ?? console.warn)(`[bdk/pagerduty] warn ${PAGERDUTY_TOKEN_ENV} names no single PagerDuty user (an account-level key or app token needs ${PAGERDUTY_FROM_EMAIL_ENV} set to one user's email); set ${PAGERDUTY_USER_ID_ENV} to skip the agent's own actions`);
+            }
+            else {
+                entry.expiresAt = now() + RESOLVED_TTL_MS;
+            }
+            return userId;
+        }, (error) => {
+            (deps.warn ?? console.warn)(`[bdk/pagerduty] warn could not look up the agent's PagerDuty user; echo skip is off until it resolves: ${error instanceof Error ? error.message : String(error)}`);
+            return undefined;
+        }),
+    };
+    inferredSelfUsers.delete(key);
+    inferredSelfUsers.set(key, entry);
+    while (inferredSelfUsers.size > MAX_CACHED_CREDENTIALS) {
+        const oldest = inferredSelfUsers.keys().next().value;
+        if (oldest === undefined) {
+            break;
+        }
+        inferredSelfUsers.delete(oldest);
+    }
+    return entry.userId;
+}
+/** Forget every inferred user, so the next delivery asks PagerDuty again. */
+export function clearPagerDutySelfUserCache() {
+    inferredSelfUsers.clear();
+}
+async function lookUpSelfUser(input) {
+    const get = async (path) => input.fetch(`${input.baseUrl}${path}`, {
+        method: "GET",
+        headers: {
+            Accept: "application/vnd.pagerduty+json;version=2",
+            Authorization: pagerDutyAuthorizationHeader(input.token),
+        },
+        signal: AbortSignal.timeout(LOOKUP_TIMEOUT_MS),
+    });
+    const me = await get("/users/me");
+    if (me.ok) {
+        const id = userIdOf((await me.json()).user);
+        if (id !== undefined) {
+            return id;
+        }
+    }
+    else {
+        await me.body?.cancel();
+        if (me.status === 401 || me.status >= 500) {
+            throw new Error(`GET /users/me answered ${me.status}`);
+        }
+    }
+    if (input.from === undefined) {
+        return undefined;
+    }
+    const email = input.from.toLowerCase();
+    const found = await get(`/users?query=${encodeURIComponent(input.from)}&limit=100`);
+    if (!found.ok) {
+        await found.body?.cancel();
+        throw new Error(`GET /users?query= answered ${found.status}`);
+    }
+    const users = (await found.json()).users;
+    const matches = (Array.isArray(users) ? users : []).filter((user) => typeof user === "object" &&
+        user !== null &&
+        typeof user.email === "string" &&
+        user.email.toLowerCase() === email);
+    return matches.length === 1 ? userIdOf(matches[0]) : undefined;
+}
+function userIdOf(user) {
+    if (typeof user !== "object" || user === null) {
+        return undefined;
+    }
+    const id = user.id;
+    return typeof id === "string" && id.trim() !== "" ? id.trim() : undefined;
+}

package/dist/channels/pagerduty/state.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Durable per-session PagerDuty channel state, persisted with the turn so
+ * stream-event handlers can address the incident without re-parsing the
+ * webhook.
+ */
+export interface PagerDutyChannelState {
+    /** Incident the latest dispatched event named. */
+    incidentId: string | null;
+    incidentNumber: number | null;
+    /** That incident's dedup key, when the event carried one. */
+    incidentKey: string | null;
+    serviceId: string | null;
+    /** v3 `event_type` that woke the turn. */
+    eventType: string | null;
+    /** v3 `event.id` that woke the turn. */
+    eventId: string | null;
+    deliveryId: string | null;
+    occurredAt: string | null;
+}
+export declare function emptyPagerDutyChannelState(overrides?: Partial<PagerDutyChannelState>): PagerDutyChannelState;
+export declare function pagerDutyChannelStateForEvent(input: {
+    eventType: string;
+    eventId: string;
+    incidentId?: string;
+    incidentNumber?: number;
+    incidentKey?: string;
+    serviceId?: string;
+    deliveryId?: string;
+    occurredAt?: string;
+}): PagerDutyChannelState;
+//# sourceMappingURL=state.d.ts.map

package/dist/channels/pagerduty/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/channels/pagerduty/state.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,qBAAqB;IACpC,kDAAkD;IAClD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,6DAA6D;IAC7D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,wCAAwC;IACxC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,0BAA0B,CACxC,SAAS,GAAE,OAAO,CAAC,qBAAqB,CAAM,GAC7C,qBAAqB,CAYvB;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,qBAAqB,CAWxB"}

package/dist/channels/pagerduty/state.js

@@ -0,0 +1,30 @@
+/**
+ * Durable per-session PagerDuty channel state, persisted with the turn so
+ * stream-event handlers can address the incident without re-parsing the
+ * webhook.
+ */
+export function emptyPagerDutyChannelState(overrides = {}) {
+    return {
+        incidentId: null,
+        incidentNumber: null,
+        incidentKey: null,
+        serviceId: null,
+        eventType: null,
+        eventId: null,
+        deliveryId: null,
+        occurredAt: null,
+        ...overrides,
+    };
+}
+export function pagerDutyChannelStateForEvent(input) {
+    return emptyPagerDutyChannelState({
+        incidentId: input.incidentId ?? null,
+        incidentNumber: input.incidentNumber ?? null,
+        incidentKey: input.incidentKey ?? null,
+        serviceId: input.serviceId ?? null,
+        eventType: input.eventType,
+        eventId: input.eventId,
+        deliveryId: input.deliveryId ?? null,
+        occurredAt: input.occurredAt ?? null,
+    });
+}

package/dist/channels/pagerduty/types.d.ts

@@ -0,0 +1,217 @@
+import type { ContinuationIdentity } from "../../internal/continuation-identity.js";
+import type { AgentCloudOptions, ArtifactsApi, AuthContext, AuthPolicy, ChannelEventHandlers, ChannelStartArgs, HostContext, SecretRef, SendMessageFn } from "../../types.js";
+import type { PagerDutyClient } from "./api.js";
+import type { PagerDutyIncidentLifecycleEvent } from "./events.js";
+import type { PagerDutyChannelState } from "./state.js";
+/** A PagerDuty object reference (`user_reference`, `service_reference`, …). */
+export interface PagerDutyReference {
+    id: string;
+    /** PagerDuty's `type`, e.g. `user_reference` or `service_reference`. */
+    type?: string;
+    summary?: string;
+    htmlUrl?: string;
+}
+/** The incident a lifecycle event carries as its `data`. */
+export interface PagerDutyIncident {
+    id: string;
+    number?: number;
+    title?: string;
+    /** `triggered`, `acknowledged`, or `resolved`. */
+    status?: string;
+    /** `high` or `low`. */
+    urgency?: string;
+    /** The dedup key of the alert that opened the incident. */
+    incidentKey?: string;
+    htmlUrl?: string;
+    createdAt?: string;
+    service?: PagerDutyReference;
+    escalationPolicy?: PagerDutyReference;
+    priority?: PagerDutyReference;
+    assignees: PagerDutyReference[];
+    teams: PagerDutyReference[];
+    resolveReason?: string;
+}
+/**
+ * The incident a sub-resource event names. PagerDuty sends a reference here,
+ * so `incidentKey` is present only when the delivery includes it.
+ */
+export interface PagerDutyIncidentRef extends PagerDutyReference {
+    incidentKey?: string;
+}
+/** An incident lifecycle event: `incident.triggered`, `.acknowledged`, … */
+export interface PagerDutyIncidentEvent {
+    eventType: PagerDutyIncidentLifecycleEvent;
+    /** The event type without its `incident.` prefix: `triggered`, `priority_updated`, … */
+    action: string;
+    incident: PagerDutyIncident;
+}
+/** `incident.annotated`: a note added to an incident. */
+export interface PagerDutyIncidentNote {
+    id?: string;
+    content: string;
+    /** True when PagerDuty truncated `content` for the webhook. */
+    trimmed: boolean;
+    incident: PagerDutyIncidentRef;
+}
+/** `incident.responder.added` / `incident.responder.replied`. */
+export interface PagerDutyResponderEvent {
+    action: "added" | "replied";
+    incident: PagerDutyIncidentRef;
+    /** The requested responder. */
+    user?: PagerDutyReference;
+    escalationPolicy?: PagerDutyReference;
+    message?: string;
+    /** `pending`, `joined`, or `declined`. */
+    state?: string;
+}
+export interface PagerDutyEventContext {
+    /** `X-Webhook-Id` of the delivery, when present. */
+    deliveryId?: string;
+    /** `event.id`: the same across PagerDuty's retries of one event. */
+    eventId: string;
+    /** `event.event_type`, e.g. `incident.triggered`. */
+    eventType: string;
+    /** `event.resource_type`, e.g. `incident`. */
+    resourceType?: string;
+    /** When the change happened in PagerDuty (ISO-8601). */
+    occurredAt?: string;
+    /** Who made the change: a user, a service integration, or absent for PagerDuty itself. */
+    agent?: PagerDutyReference;
+    /** The incident the event names, when it names one. */
+    incidentId?: string;
+    /** That incident's dedup key, when the delivery carries it. */
+    incidentKey?: string;
+    /** The account subdomain, e.g. `acme` for `acme.pagerduty.com`, read from the event's URLs. */
+    accountSubdomain?: string;
+    /** The raw `event` record, for fields the typed views omit. */
+    payload: Record<string, unknown>;
+    /**
+     * PagerDuty REST client with the channel's credentials (`token`, `from`,
+     * `apiBaseUrl`, else their well-known secrets), read per call.
+     */
+    pagerduty: PagerDutyClient;
+    /**
+     * Channel `send`. Set on every delivery path so a hook can start a turn
+     * itself instead of returning `{ auth, message }` or a deferred `{ task }`.
+     */
+    send?: SendMessageFn;
+    host: HostContext;
+    artifacts: ArtifactsApi;
+}
+export type PagerDutyTurnDispatch = {
+    auth: AuthContext;
+    message?: string;
+    title?: string;
+    context?: readonly string[];
+};
+/** Bound per-delivery helpers passed to a {@link PagerDutyTaskDispatch.task}. */
+export interface PagerDutyTaskArgs {
+    send: SendMessageFn;
+    waitUntil: (promise: Promise<unknown>) => void;
+}
+/** Run a host-side handler after the webhook is acknowledged with a 202. */
+export type PagerDutyTaskDispatch = {
+    task: (args: PagerDutyTaskArgs) => void | Promise<void>;
+};
+export type PagerDutyDispatch = PagerDutyTurnDispatch | PagerDutyTaskDispatch;
+export type PagerDutyDispatchResult = PagerDutyDispatch | null | Promise<PagerDutyDispatch | null>;
+export type PagerDutyIncidentHook = (ctx: PagerDutyEventContext, event: PagerDutyIncidentEvent) => PagerDutyDispatchResult;
+export type PagerDutyNoteHook = (ctx: PagerDutyEventContext, note: PagerDutyIncidentNote) => PagerDutyDispatchResult;
+export type PagerDutyResponderHook = (ctx: PagerDutyEventContext, responder: PagerDutyResponderEvent) => PagerDutyDispatchResult;
+export type PagerDutyEventHook = (ctx: PagerDutyEventContext, event: {
+    eventType: string;
+    data: unknown;
+}) => PagerDutyDispatchResult;
+/** One parsed v3 delivery handed to {@link dispatchPagerDutyWebhook}. */
+export interface PagerDutyWebhookDelivery {
+    eventType: string;
+    /** The whole delivery body, `{ event: { … } }`. */
+    payload: Record<string, unknown>;
+    deliveryId?: string;
+}
+export interface PagerDutyChannelOptions {
+    /**
+     * The v3 webhook subscription's signing secret. PagerDuty signs the raw
+     * body as `X-PagerDuty-Signature: v1=<hex>`, listing one `v1=` entry per
+     * active secret while a secret rotates; any matching entry admits.
+     * While the default secret is unset, production stays loopback-strict
+     * and `serve --dev` admits unsigned loopback deliveries.
+     *
+     * Omitted, it names `PAGERDUTY_WEBHOOK_SECRET`: locally that env var; on
+     * Cursor hosting the deployment secret of that name, which the control
+     * plane verifies before any compute starts. Pass `{ secretName }` to
+     * name another secret. Architecture `v2` rejects a literal or getter,
+     * which never reaches the manifest.
+     */
+    webhookSecret?: string | SecretRef | (() => string | undefined);
+    /**
+     * PagerDuty user ids this agent acts as. An event whose `agent` is one of
+     * them is the agent's own action echoed back, and is acknowledged without
+     * running a hook or starting a turn. Pass ids, a getter, or
+     * `{ secretName }` naming a secret that holds one id; any of them is used
+     * as given. Omitted, each delivery reads the `PAGERDUTY_USER_ID` env var
+     * / deployment secret (one id), else infers the user `PAGERDUTY_TOKEN`
+     * acts as. When none resolves, echo skip is off.
+     */
+    selfUserIds?: readonly string[] | SecretRef | (() => readonly string[] | undefined);
+    /**
+     * API token for `ctx.pagerduty`, reply notes, and inferring the agent's
+     * own user: a REST API key, or an OAuth access token written as
+     * `Bearer <token>`. Falls back to `PAGERDUTY_TOKEN`.
+     */
+    token?: string | SecretRef | (() => string | undefined);
+    /**
+     * Email of the PagerDuty user that writes made with an account-level key
+     * or app token are attributed to, sent as `From`. Falls back to
+     * `PAGERDUTY_FROM_EMAIL`.
+     */
+    from?: string | SecretRef | (() => string | undefined);
+    /** REST base, e.g. `https://api.eu.pagerduty.com`. Falls back to `PAGERDUTY_API_BASE_URL`. */
+    apiBaseUrl?: string;
+    /**
+     * When true, post each completed reply (and a short note when a turn
+     * fails) to the session's incident as a note. Off by default: an agent
+     * that writes to PagerDuty through its own path posts only what it asks for.
+     */
+    deliverReplies?: boolean;
+    /** Route auth chain; defaults follow {@link webhookSecret}. */
+    auth?: AuthPolicy[];
+    /** Route path under `/v1/channels/<name>`. Defaults to `/`. */
+    path?: string;
+    /**
+     * Pin the v3 event types this channel declares. Published as
+     * `meta.pagerdutyWebhookEvents`; defaults to every incident event type.
+     */
+    webhookEvents?: readonly string[];
+    /**
+     * Continuation selector. Omit this to inherit the agent architecture's
+     * default (`pagerduty.incident/v2` on v2). Set it explicitly only when
+     * migrating persisted identities.
+     */
+    continuation?: ContinuationIdentity;
+    /**
+     * Decide whether an incident lifecycle event starts a turn. Without this
+     * hook, `incident.triggered` and `incident.reopened` start one as the
+     * event's agent and every other lifecycle event is acknowledged.
+     */
+    onIncident?: PagerDutyIncidentHook;
+    /** Opt-in `incident.annotated` handler. */
+    onNote?: PagerDutyNoteHook;
+    /** Opt-in `incident.responder.added` / `.replied` handler. */
+    onResponder?: PagerDutyResponderHook;
+    /**
+     * Catch-all for event types without a typed hook (status updates,
+     * conference bridges, workflows, service events). NOT a fallback: typed
+     * events never reach it.
+     */
+    onEvent?: PagerDutyEventHook;
+    /** Per-session cloud options for every turn the channel starts. */
+    cloud?: AgentCloudOptions;
+    /** Channel stream-event handlers. */
+    events?: ChannelEventHandlers<PagerDutyChannelState>;
+    /** Called once when the server mounts this channel. */
+    onStart?: (args: ChannelStartArgs) => void | Promise<void>;
+    /** Called when the server shuts down. */
+    onStop?: () => void | Promise<void>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/channels/pagerduty/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/channels/pagerduty/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,aAAa,EACd,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAExD,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uBAAuB;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,+BAA+B,CAAC;IAC3C,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,iBAAiB,CAAC;CAC7B;AAED,yDAAyD;AACzD,MAAM,WAAW,qBAAqB;IACpC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,oBAAoB,CAAC;CAChC;AAED,iEAAiE;AACjE,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,+BAA+B;IAC/B,IAAI,CAAC,EAAE,kBAAkB,CAAC;IAC1B,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC;;;OAGG;IACH,SAAS,EAAE,eAAe,CAAC;IAC3B;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,IAAI,EAAE,WAAW,CAAC;IAClB,SAAS,EAAE,YAAY,CAAC;CACzB;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;CAChD;AAED,4EAA4E;AAC5E,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,EAAE,CAAC,IAAI,EAAE,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG,qBAAqB,CAAC;AAE9E,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,IAAI,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;AAEnG,MAAM,MAAM,qBAAqB,GAAG,CAClC,GAAG,EAAE,qBAAqB,EAC1B,KAAK,EAAE,sBAAsB,KAC1B,uBAAuB,CAAC;AAE7B,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,qBAAqB,EAC1B,IAAI,EAAE,qBAAqB,KACxB,uBAAuB,CAAC;AAE7B,MAAM,MAAM,sBAAsB,GAAG,CACnC,GAAG,EAAE,qBAAqB,EAC1B,SAAS,EAAE,uBAAuB,KAC/B,uBAAuB,CAAC;AAE7B,MAAM,MAAM,kBAAkB,GAAG,CAC/B,GAAG,EAAE,qBAAqB,EAC1B,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,KACxC,uBAAuB,CAAC;AAE7B,yEAAyE;AACzE,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IAChE;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAAG,CAAC,MAAM,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACpF;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IACxD;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC;IACvD,8FAA8F;IAC9F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,UAAU,EAAE,CAAC;IACpB,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC;;;;OAIG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC;;;;OAIG;IACH,UAAU,CAAC,EAAE,qBAAqB,CAAC;IACnC,2CAA2C;IAC3C,MAAM,CAAC,EAAE,iBAAiB,CAAC;IAC3B,8DAA8D;IAC9D,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC;;;;OAIG;IACH,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,mEAAmE;IACnE,KAAK,CAAC,EAAE,iBAAiB,CAAC;IAC1B,qCAAqC;IACrC,MAAM,CAAC,EAAE,oBAAoB,CAAC,qBAAqB,CAAC,CAAC;IACrD,uDAAuD;IACvD,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/dist/channels/pagerduty/types.js

@@ -0,0 +1 @@
+export {};

package/dist/channels.d.ts

@@ -172,6 +172,12 @@ export declare function sharedSecretAuth(options: {
  * while a secret rotates, e.g. PagerDuty's
  * `X-PagerDuty-Signature: v1=<hex>,v1=<hex>` with `prefix: "v1="` and
  * `separator: ","`. The request is admitted when any entry matches.
+ *
+ * The named secret may hold several signing secrets, one per line (for
+ * example one per provider subscription, or old and new during a
+ * rotation); any of them verifies. Lines are trimmed and blank lines
+ * ignored, a value with no line break is one secret used as-is, and a
+ * value holding more secrets than the cap admits nothing.
  */
 export declare function hmacSignatureAuth(options: {
     header: string;

package/dist/channels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"channels.d.ts","sourceRoot":"","sources":["../src/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,WAAW,EACX,aAAa,GACd,MAAM,sBAAsB,CAAC;AAO9B,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,YAAY,EAEZ,kBAAkB,EAGlB,SAAS,EAEV,MAAM,YAAY,CAAC;AAEpB,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAChE,YAAY,EACV,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,0BAA0B,EAC1B,kCAAkC,EAClC,2BAA2B,EAC3B,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,+BAA+B;AAC/B,wBAAgB,aAAa,CAAC,MAAM,GAAG,SAAS,EAC9C,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAC5B,iBAAiB,CAAC,MAAM,CAAC,CAQ3B;AAoCD,4EAA4E;AAC5E,wBAAgB,GAAG,CAAC,MAAM,SAAS,kBAAkB,EACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAChC,YAAY,CAMd;AAED,2CAA2C;AAC3C,wBAAgB,IAAI,CAClB,KAAK,SAAS,kBAAkB,EAChC,MAAM,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EACzD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY,CAOvE;AAED,0CAA0C;AAC1C,wBAAgB,GAAG,CACjB,KAAK,SAAS,kBAAkB,EAChC,MAAM,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EACzD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY,CAOvE;AAED,4CAA4C;AAC5C,wBAAgB,KAAK,CACnB,KAAK,SAAS,kBAAkB,EAChC,MAAM,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EACzD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY,CAOvE;AAED,qCAAqC;AACrC,wBAAgB,MAAM,CACpB,KAAK,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EACxD,MAAM,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EACzD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY,CAOzE;AAMD;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,IAAI,UAAU,CAcrC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAoB3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,IAAI,UAAU,CAWzC;AAOD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAc9C;AAWD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,aAAa,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,GAC5F,UAAU,CAmBZ;AAWD;;;GAGG;AACH,wBAAgB,QAAQ,IAAI,UAAU,CAMrC;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAY3C;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAElE;AAID;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AACH,oFAAoF;GAClF;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAMvB,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,oBAAoB,GAAG,SAAS,CAKzF;AASD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAwBxF;AA+BD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,UAAU,CAoCb"}
+{"version":3,"file":"channels.d.ts","sourceRoot":"","sources":["../src/channels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EACL,KAAK,OAAO,EACZ,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,WAAW,EACX,aAAa,GACd,MAAM,sBAAsB,CAAC;AAQ9B,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,YAAY,EAEZ,kBAAkB,EAGlB,SAAS,EAEV,MAAM,YAAY,CAAC;AAEpB,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAChE,YAAY,EACV,WAAW,EACX,UAAU,EACV,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,0BAA0B,EAC1B,kCAAkC,EAClC,2BAA2B,EAC3B,YAAY,EACZ,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,aAAa,EACb,kBAAkB,GACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnD,+BAA+B;AAC/B,wBAAgB,aAAa,CAAC,MAAM,GAAG,SAAS,EAC9C,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,GAC5B,iBAAiB,CAAC,MAAM,CAAC,CAQ3B;AAoCD,4EAA4E;AAC5E,wBAAgB,GAAG,CAAC,MAAM,SAAS,kBAAkB,EACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,GAChC,YAAY,CAMd;AAED,2CAA2C;AAC3C,wBAAgB,IAAI,CAClB,KAAK,SAAS,kBAAkB,EAChC,MAAM,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EACzD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY,CAOvE;AAED,0CAA0C;AAC1C,wBAAgB,GAAG,CACjB,KAAK,SAAS,kBAAkB,EAChC,MAAM,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EACzD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY,CAOvE;AAED,4CAA4C;AAC5C,wBAAgB,KAAK,CACnB,KAAK,SAAS,kBAAkB,EAChC,MAAM,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EACzD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY,CAOvE;AAED,qCAAqC;AACrC,wBAAgB,MAAM,CACpB,KAAK,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EACxD,MAAM,SAAS,kBAAkB,GAAG,SAAS,GAAG,SAAS,EACzD,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,YAAY,CAOzE;AAMD;;;;;;;;;GASG;AACH,wBAAgB,QAAQ,IAAI,UAAU,CAcrC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAoB3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,IAAI,UAAU,CAWzC;AAOD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAc9C;AAWD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,aAAa,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW,GAAG,IAAI,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,GAC5F,UAAU,CAmBZ;AAWD;;;GAGG;AACH,wBAAgB,QAAQ,IAAI,UAAU,CAMrC;AAQD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAY3C;AAED,gEAAgE;AAChE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAElE;AAID;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClD;IACE,IAAI,EAAE,aAAa,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AACH,oFAAoF;GAClF;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAMvB,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU,GAAG,oBAAoB,GAAG,SAAS,CAKzF;AASD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAwBxF;AAID;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,UAAU,CAmCb"}

package/dist/channels.js

@@ -46,8 +46,9 @@
  */
 export { openCiCheck, resumeCiCheck, } from "./channels/checks.js";
 import { Buffer } from "node:buffer";
-import { createHmac, timingSafeEqual } from "node:crypto";
+import { timingSafeEqual } from "node:crypto";
 import { brandDefinition } from "./internal/brand.js";
+import { hmacSignatureMatchesAny, parseHmacSecrets } from "./internal/hmac-secret-values.js";
 import { attachCatchAdmission } from "./internal/hosted-catch.js";
 import { isLoopbackAddress, isLoopbackHostname } from "./internal/net.js";
 /** Configure the built-in HTTP session channel at `agent/channels/http.ts`. */
@@ -369,24 +370,6 @@ export function sharedSecretAuth(options) {
     });
 }
 const MAX_HMAC_SEPARATOR_LENGTH = 8;
-/**
- * True when any signature in `presented` is `prefix` + the hex `expected`
- * digest. Without a `separator` the whole value is one signature. Every
- * entry is compared, so timing does not reveal which one matched; entries
- * without the prefix never match.
- */
-function presentedHmacMatches(args) {
-    const entries = args.separator === undefined ? [args.presented] : args.presented.split(args.separator);
-    let matched = false;
-    for (const raw of entries) {
-        const entry = raw.trim();
-        if (entry.startsWith(args.prefix) &&
-            constantTimeEquals(entry.slice(args.prefix.length).toLowerCase(), args.expected)) {
-            matched = true;
-        }
-    }
-    return matched;
-}
 /**
  * Admit requests whose `header` carries the hex HMAC-SHA256 of the raw body
  * under the secret named `secret` (optionally behind a literal `prefix`
@@ -397,6 +380,12 @@ function presentedHmacMatches(args) {
  * while a secret rotates, e.g. PagerDuty's
  * `X-PagerDuty-Signature: v1=<hex>,v1=<hex>` with `prefix: "v1="` and
  * `separator: ","`. The request is admitted when any entry matches.
+ *
+ * The named secret may hold several signing secrets, one per line (for
+ * example one per provider subscription, or old and new during a
+ * rotation); any of them verifies. Lines are trimmed and blank lines
+ * ignored, a value with no line break is one secret used as-is, and a
+ * value holding more secrets than the cap admits nothing.
  */
 export function hmacSignatureAuth(options) {
     const header = options.header.toLowerCase();
@@ -407,14 +396,13 @@ export function hmacSignatureAuth(options) {
         throw new Error(`hmacSignatureAuth separator must be 1-${MAX_HMAC_SEPARATOR_LENGTH} characters.`);
     }
     const policy = async (request) => {
-        const secret = process.env[options.secret];
+        const parsed = parseHmacSecrets(process.env[options.secret]);
         const presented = request.headers.get(header)?.trim();
-        if (secret === undefined || secret.length === 0 || presented === undefined) {
+        if (!parsed.ok || presented === undefined) {
             return null;
         }
         const body = Buffer.from(await request.clone().arrayBuffer());
-        const expected = createHmac("sha256", secret).update(body).digest("hex");
-        if (!presentedHmacMatches({ presented, expected, prefix, separator })) {
+        if (!hmacSignatureMatchesAny({ body, presented, secrets: parsed.secrets, prefix, separator })) {
             return null;
         }
         return {