@dual-os/sdk 0.0.0-stage → 0.8.0-next.0

package/dist/Trigger.d.ts

@@ -0,0 +1,358 @@
+import { Any as Any$1 } from "./AuthMethod.js";
+import { ContextForMethods } from "./internal/auth-context.js";
+import { ConnectionResolutionContext } from "./ConnectionResolver.js";
+import { RuntimeConnectionErrorsFor } from "./internal/auth-execution.js";
+import { EntryAuthMethods, EntryTrigger, TriggerAppError, TriggerEncodedOutput, TriggerEncodedState, TriggerIdOf, TriggerRuntimeRequirements } from "./internal/trigger-runtime-shared.js";
+import { Context, Effect, Pipeable, Schema } from "effect";
+declare namespace Trigger_d_exports {
+  export { ActivateSuccess, ActivationResult, Any, Config, ConfigSchema, Constructor, ContractOptions, DeactivateSuccess, EmitResult, EmittedEventsSuccess, Handler, InvalidTriggerConfigError, InvalidTriggerOutputError, InvalidTriggerStateError, KeyedEvent, LifecycleInput, LifecycleRequest, Output, OutputSchema, PollExecutionRequest, PollingInput, PollingRuntime, RuntimeContext, RuntimeContract, RuntimeMeta, RuntimePhase, RuntimeTriggerEntry, State, StateSchema, StateValue, Trigger, TriggerKind, TriggerOptions, TypeId, UnsupportedTriggerRuntimeError, VerifyResult, VerifySuccess, WebhookActivationInput, WebhookActivationRequest, WebhookExecutionRequest, WebhookLifecycleInput, WebhookRequest, WebhookResponse, WebhookRuntime, activate, bodyDigest, deactivate, handlerKey, isTrigger, parse, poll, polling, verify, verifyEcdsaP256, verifyHmac, verifyHmacSha256, verifyStandardWebhook, verifyToken, webhook };
+}
+/** @since 0.0.0 @category type ids */
+export declare const TypeId: "@dual-os/sdk/Trigger";
+/** @since 0.0.0 @category type ids */
+export type TypeId = typeof TypeId;
+/** @since 0.0.0 @category models */
+export type TriggerKind = "webhook" | "polling";
+/** @since 0.0.0 @category models */
+export type RuntimePhase = "activate" | "deactivate" | "verify" | "parse" | "poll";
+/** @since 0.0.0 @category models */
+export interface WebhookRequest {
+  readonly body: unknown;
+  /** Header names are lowercase: the runtime lowercases them before `verify` and `parse`. */
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly rawBody?: string | Uint8Array;
+  readonly method?: string;
+  readonly url?: string;
+  readonly query?: Readonly<Record<string, string | readonly string[]>>;
+}
+/** @since 0.0.0 @category models */
+export interface WebhookResponse {
+  readonly status: number;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly body?: unknown;
+}
+type MessagePart = string | Uint8Array;
+declare const hmacHashes: {
+  readonly sha1: "SHA-1";
+  readonly sha256: "SHA-256";
+};
+/**
+ * The hex SHA-256 of a delivery's raw body. Use it as the event key when the provider signs the
+ * body but not its delivery identifier header, so a replayed delivery keeps one identity.
+ *
+ * @since 0.0.0
+ * @category webhooks
+ */
+export declare const bodyDigest: (rawBody: string | Uint8Array<ArrayBufferLike>) => Effect.Effect<string, never, never>;
+/**
+ * Whether `signature` is the HMAC-SHA256 of `message` keyed with `secret`, the way most webhook
+ * providers sign their deliveries. The comparison runs in constant time.
+ *
+ * @since 0.0.0
+ * @category webhooks
+ */
+export declare const verifyHmacSha256: (secret: string, message: string | Uint8Array<ArrayBufferLike>, signature: Uint8Array<ArrayBufferLike>) => Effect.Effect<boolean, never, never>;
+/**
+ * Whether `signature`, written in `encoding`, is the HMAC of `message` keyed with `secret`, given
+ * as text or as raw key bytes such as a decoded `whsec_` secret. A message given as parts is signed
+ * as their concatenation, such as a timestamp followed by the raw body. Given several signatures,
+ * such as one per rotated secret, it verifies when any of them matches and hashes the message once.
+ * A missing secret, or signatures none of which is valid `encoding`, never verifies. The comparison
+ * runs in constant time.
+ *
+ * @since 0.0.0
+ * @category webhooks
+ */
+export declare const verifyHmac: (options: {
+  readonly algorithm: keyof typeof hmacHashes;
+  readonly encoding: "hex" | "base64";
+  readonly message: MessagePart | readonly MessagePart[];
+  readonly secret: MessagePart;
+  readonly signature: string | readonly string[];
+}) => Effect.Effect<boolean, never, never>;
+/**
+ * Whether a [Standard Webhooks](https://www.standardwebhooks.com) delivery is signed with `secret`:
+ * one `v1,<base64>` entry of its `webhook-signature` header (`svix-signature` from Svix) must be the
+ * HMAC-SHA256 of `id.timestamp.body` keyed with the bytes of the `whsec_` secret, and its timestamp
+ * must be within five minutes of now. Header names are lowercase, as in `WebhookRequest`. Missing
+ * headers or secret never verify.
+ *
+ * @since 0.0.0
+ * @category webhooks
+ */
+export declare const verifyStandardWebhook: (options: {
+  readonly body: MessagePart;
+  readonly headers: Readonly<Record<string, string>>;
+  readonly secret: string;
+}) => Effect.Effect<boolean, never, never>;
+/**
+ * Whether `actual` equals the shared secret `expected`, for providers that send the secret itself
+ * back with each delivery. An empty or missing secret never verifies. The comparison runs in
+ * constant time.
+ *
+ * @since 0.0.0
+ * @category webhooks
+ */
+export declare const verifyToken: (expected: string, actual: string | undefined) => Effect.Effect<boolean, never, never>;
+/**
+ * Whether `signature`, a base64 DER ECDSA signature, signs `message` with the ECDSA P-256 key
+ * `publicKey`, a base64 DER SubjectPublicKeyInfo, hashed with SHA-256. A message given as parts is
+ * signed as their concatenation, such as a timestamp followed by the raw body. A missing key or a
+ * key or signature that is not valid never verifies.
+ *
+ * @since 0.0.0
+ * @category webhooks
+ */
+export declare const verifyEcdsaP256: (options: {
+  readonly message: MessagePart | readonly MessagePart[];
+  readonly publicKey: string;
+  readonly signature: string;
+}) => Effect.Effect<boolean, never, never>;
+/** @since 0.0.0 @category models */
+export type RuntimeContext<EffectiveAuthMethods extends readonly Any$1[]> = ContextForMethods<EffectiveAuthMethods> & ConnectionResolutionContext;
+/** @since 0.0.0 @category type-level */
+export type StateValue<State extends Schema.Top | undefined> = [State] extends [Schema.Top] ? Schema.Schema.Type<Exclude<State, undefined>> | undefined : undefined;
+/** @since 0.0.0 @category models */
+export interface RuntimeMeta<TriggerId extends string = string, Phase extends RuntimePhase = RuntimePhase> {
+  readonly triggerId: TriggerId;
+  readonly phase: Phase;
+}
+/** @since 0.0.0 @category models */
+export interface ActivateSuccess<TriggerId extends string = string, State = unknown> {
+  readonly state: State;
+  readonly meta: RuntimeMeta<TriggerId, "activate">;
+}
+/** @since 0.0.0 @category models */
+export interface DeactivateSuccess<TriggerId extends string = string> {
+  readonly meta: RuntimeMeta<TriggerId, "deactivate">;
+}
+/** @since 0.0.0 @category models */
+export interface VerifySuccess<TriggerId extends string = string, State = unknown> {
+  readonly verified: true;
+  readonly response?: WebhookResponse;
+  readonly state?: State;
+  readonly meta: RuntimeMeta<TriggerId, "verify">;
+}
+/**
+ * What `verify` returns when the delivery is more than an authenticated event: the `response` the
+ * host sends back to the provider, such as a handshake answer, and the new trigger `state`, such as
+ * a secret the handshake delivered.
+ *
+ * @since 0.0.0
+ * @category models
+ */
+export interface VerifyResult<State> {
+  readonly response?: WebhookResponse;
+  readonly state?: State;
+}
+/** @since 0.0.0 @category models */
+export interface KeyedEvent<Payload = unknown> {
+  readonly key: string;
+  readonly payload: Payload;
+}
+/** @since 0.0.0 @category models */
+export interface EmittedEventsSuccess<TriggerId extends string = string, Phase extends "parse" | "poll" = "parse" | "poll", Output = unknown, State = unknown> {
+  readonly events: readonly KeyedEvent<Output>[];
+  readonly state: State;
+  readonly meta: RuntimeMeta<TriggerId, Phase>;
+}
+/** @since 0.0.0 @category models */
+export interface LifecycleInput<Config, State> {
+  readonly config: Config;
+  readonly state: State;
+}
+/** @since 0.0.0 @category models */
+export interface WebhookActivationInput<Config, State> extends LifecycleInput<Config, State> {
+  /** The absolute URL the host serves this trigger's deliveries on. */
+  readonly webhookUrl: string;
+}
+/** @since 0.0.0 @category models */
+export interface WebhookLifecycleInput<Config, State> extends WebhookActivationInput<Config, State> {
+  readonly request: WebhookRequest;
+}
+/** @since 0.0.0 @category models */
+export interface PollingInput<Config, State> extends LifecycleInput<Config, State> {}
+/** @since 0.0.0 @category models */
+export interface ActivationResult<State> {
+  readonly state: State;
+}
+/** @since 0.0.0 @category models */
+export interface EmitResult<Output, State> {
+  readonly events: readonly KeyedEvent<Output>[];
+  readonly state: State;
+}
+/** @since 0.0.0 @category models */
+export interface WebhookRuntime<Config extends Schema.Top, Output extends Schema.Top, State extends Schema.Top | undefined, AppError = never, Requirements = never, EffectiveAuthMethods extends readonly Any$1[] = readonly Any$1[]> {
+  readonly activate?: (input: WebhookActivationInput<Schema.Schema.Type<Config>, StateValue<State>>, context: RuntimeContext<EffectiveAuthMethods>) => Effect.Effect<ActivationResult<StateValue<State>>, AppError, Requirements>;
+  readonly deactivate?: (input: WebhookActivationInput<Schema.Schema.Type<Config>, StateValue<State>>, context: RuntimeContext<EffectiveAuthMethods>) => Effect.Effect<void, AppError, Requirements>;
+  readonly verify?: (input: WebhookLifecycleInput<Schema.Schema.Type<Config>, StateValue<State>>, context: RuntimeContext<EffectiveAuthMethods>) => Effect.Effect<void | VerifyResult<StateValue<State>>, AppError, Requirements>;
+  /**
+   * Parses one accepted webhook delivery.
+   *
+   * The Dual runtime may retry `parse` for the same delivery until the delivery
+   * reaches a durable final status. Implementations must be idempotent and
+   * tolerate at-least-once calls for the same request/context.
+   *
+   * @since 0.0.0 @category handlers
+   */
+  readonly parse?: (input: WebhookLifecycleInput<Schema.Schema.Type<Config>, StateValue<State>>, context: RuntimeContext<EffectiveAuthMethods>) => Effect.Effect<EmitResult<Schema.Schema.Type<Output>, StateValue<State>>, AppError, Requirements>;
+}
+/** @since 0.0.0 @category models */
+export interface PollingRuntime<Config extends Schema.Top, Output extends Schema.Top, State extends Schema.Top | undefined, AppError = never, Requirements = never, EffectiveAuthMethods extends readonly Any$1[] = readonly Any$1[]> {
+  /**
+   * Polls one scheduled trigger occurrence.
+   *
+   * The Dual runtime may retry `poll` for the same occurrence until its cursor
+   * and emitted events commit. Implementations must be idempotent and tolerate
+   * at-least-once calls for the same occurrence metadata.
+   *
+   * @since 0.0.0 @category handlers
+   */
+  readonly poll?: (input: PollingInput<Schema.Schema.Type<Config>, StateValue<State>>, context: RuntimeContext<EffectiveAuthMethods>) => Effect.Effect<EmitResult<Schema.Schema.Type<Output>, StateValue<State>>, AppError, Requirements>;
+}
+/** @since 0.0.0 @category models */
+export type RuntimeContract<Kind extends TriggerKind, Config extends Schema.Top, Output extends Schema.Top, State extends Schema.Top | undefined, AppError = never, Requirements = never, EffectiveAuthMethods extends readonly Any$1[] = readonly Any$1[]> = Kind extends "webhook" ? WebhookRuntime<Config, Output, State, AppError, Requirements, EffectiveAuthMethods> : PollingRuntime<Config, Output, State, AppError, Requirements, EffectiveAuthMethods>;
+/** @since 0.0.0 @category models */
+export interface Handler<TriggerId extends string = string> {
+  readonly _: unique symbol;
+  readonly triggerId: TriggerId;
+  readonly context: Context.Context<never>;
+  readonly runtime: RuntimeContract<any, any, any, any, any, any, any>;
+}
+/** @since 0.0.0 @category handlers */
+export declare const handlerKey: (triggerId: string) => string;
+/** @since 0.0.0 @category type-level */
+export interface Any extends Pipeable.Pipeable {
+  readonly [TypeId]: TypeId;
+  readonly identifier: string;
+  readonly name: string | undefined;
+  readonly description: string | undefined;
+  readonly kind: TriggerKind;
+  readonly config: Schema.Top;
+  readonly output: Schema.Top;
+  readonly state: Schema.Top | undefined;
+  readonly requireAuth: boolean;
+}
+/** @since 0.0.0 @category models */
+export interface TriggerOptions {
+  readonly name?: string | undefined;
+  readonly description?: string | undefined;
+}
+/**
+ * Options used to declare a trigger contract.
+ *
+ * @since 0.6.0
+ * @category models
+ */
+export interface ContractOptions<Config extends Schema.Top, Output extends Schema.Top, State extends Schema.Top | undefined, RequireAuth extends boolean> extends TriggerOptions {
+  readonly config: Config;
+  readonly output: Output;
+  readonly state?: State;
+  /** Set to `false` to make a connection optional for this trigger. */
+  readonly requireAuth?: RequireAuth;
+}
+/** @since 0.0.0 @category models */
+export interface Trigger<out Identifier extends string = string, out Kind extends TriggerKind = TriggerKind, out Config extends Schema.Top = Schema.Top, out Output extends Schema.Top = Schema.Top, out State extends Schema.Top | undefined = Schema.Top | undefined, out RequireAuth extends boolean = boolean> extends Pipeable.Pipeable {
+  readonly [TypeId]: TypeId;
+  readonly identifier: Identifier;
+  readonly name: string | undefined;
+  readonly description: string | undefined;
+  readonly kind: Kind;
+  readonly config: Config;
+  readonly output: Output;
+  readonly state: State;
+  readonly requireAuth: RequireAuth;
+}
+export type ConfigSchema<TriggerDef extends Any> = TriggerDef["config"];
+export type OutputSchema<TriggerDef extends Any> = TriggerDef["output"];
+export type StateSchema<TriggerDef extends Any> = TriggerDef["state"];
+export type Config<TriggerDef extends Any> = Schema.Schema.Type<ConfigSchema<TriggerDef>>;
+export type Output<TriggerDef extends Any> = Schema.Schema.Type<OutputSchema<TriggerDef>>;
+export type State<TriggerDef extends Any> = StateValue<StateSchema<TriggerDef>>;
+/** @since 0.0.0 @category models */
+export interface RuntimeTriggerEntry<out TriggerDef extends Any = Any, out AllowedMethods extends readonly Any$1[] = readonly Any$1[], out TriggerId extends string = string, out ProviderId extends string = string> {
+  readonly providerId: ProviderId;
+  readonly triggerId: TriggerId;
+  readonly pluginVersion: string | undefined;
+  readonly trigger: TriggerDef;
+  readonly authMethods: AllowedMethods;
+}
+/**
+ * Constructor for one trigger kind.
+ *
+ * @since 0.6.0
+ * @category constructors
+ */
+export type Constructor<Kind extends TriggerKind> = <const Identifier extends string, Config extends Schema.Top, Output extends Schema.Top, State extends Schema.Top | undefined = undefined, const RequireAuth extends boolean = true>(identifier: Identifier, options: ContractOptions<Config, Output, State, RequireAuth>) => Trigger<Identifier, Kind, Config, Output, State, RequireAuth>;
+/**
+ * Provider webhook triggers must own isolated per-trigger/per-deploy-version
+ * ingress/subscription state, or no external provider resource at all.
+ * Activating or deactivating one Dual trigger must never mutate provider state
+ * that another trigger, deploy version, mailbox, account, or app-level
+ * subscription depends on. Shared provider watches must be modeled as polling.
+ *
+ * @since 0.0.0 @category constructors
+ */
+export declare const webhook: Constructor<"webhook">;
+/** @since 0.0.0 @category constructors */
+export declare const polling: Constructor<"polling">;
+/** @since 0.0.0 @category guards */
+export declare const isTrigger: (u: unknown) => u is Any;
+declare const InvalidTriggerConfigError_base: Schema.Class<InvalidTriggerConfigError, Schema.TaggedStruct<"InvalidTriggerConfigError", {
+  readonly description: Schema.String;
+  readonly triggerId: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** @since 0.0.0 @category errors */
+export declare class InvalidTriggerConfigError extends InvalidTriggerConfigError_base {}
+declare const InvalidTriggerStateError_base: Schema.Class<InvalidTriggerStateError, Schema.TaggedStruct<"InvalidTriggerStateError", {
+  readonly description: Schema.String;
+  readonly location: Schema.Literals<readonly ["input", "result"]>;
+  readonly phase: Schema.Literals<readonly ["activate", "deactivate", "verify", "parse", "poll"]>;
+  readonly triggerId: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** @since 0.0.0 @category errors */
+export declare class InvalidTriggerStateError extends InvalidTriggerStateError_base {}
+declare const InvalidTriggerOutputError_base: Schema.Class<InvalidTriggerOutputError, Schema.TaggedStruct<"InvalidTriggerOutputError", {
+  readonly description: Schema.String;
+  readonly phase: Schema.Literals<readonly ["parse", "poll"]>;
+  readonly triggerId: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** @since 0.0.0 @category errors */
+export declare class InvalidTriggerOutputError extends InvalidTriggerOutputError_base {}
+declare const UnsupportedTriggerRuntimeError_base: Schema.Class<UnsupportedTriggerRuntimeError, Schema.TaggedStruct<"UnsupportedTriggerRuntimeError", {
+  readonly kind: Schema.Literals<readonly ["webhook", "polling"]>;
+  readonly phase: Schema.Literals<readonly ["activate", "deactivate", "verify", "parse", "poll"]>;
+  readonly triggerId: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** @since 0.0.0 @category errors */
+export declare class UnsupportedTriggerRuntimeError extends UnsupportedTriggerRuntimeError_base {}
+/** @since 0.0.0 @category models */
+export interface LifecycleRequest {
+  readonly config: unknown;
+  readonly state?: unknown;
+  readonly connectionId?: string;
+  readonly context?: ConnectionResolutionContext;
+}
+/** @since 0.0.0 @category models */
+export interface WebhookActivationRequest extends LifecycleRequest {
+  readonly webhookUrl: string;
+}
+/** @since 0.0.0 @category models */
+export interface WebhookExecutionRequest extends WebhookActivationRequest {
+  readonly request: WebhookRequest;
+}
+/** @since 0.0.0 @category models */
+export interface PollExecutionRequest extends LifecycleRequest {}
+/** @since 0.0.0 @category execution */
+export declare const activate: <Entry extends RuntimeTriggerEntry<any, any, any, any>>(entry: Entry, request: WebhookActivationRequest) => Effect.Effect<ActivateSuccess<TriggerIdOf<Entry>, TriggerEncodedState<EntryTrigger<Entry>>>, InvalidTriggerConfigError | InvalidTriggerStateError | UnsupportedTriggerRuntimeError | RuntimeConnectionErrorsFor<EntryAuthMethods<Entry>> | TriggerAppError<EntryTrigger<Entry>>, TriggerRuntimeRequirements<Entry, "activate">>;
+/** @since 0.0.0 @category execution */
+export declare const deactivate: <Entry extends RuntimeTriggerEntry<any, any, any, any>>(entry: Entry, request: WebhookActivationRequest) => Effect.Effect<DeactivateSuccess<TriggerIdOf<Entry>>, InvalidTriggerConfigError | InvalidTriggerStateError | UnsupportedTriggerRuntimeError | RuntimeConnectionErrorsFor<EntryAuthMethods<Entry>> | TriggerAppError<EntryTrigger<Entry>>, TriggerRuntimeRequirements<Entry, "deactivate">>;
+/** @since 0.0.0 @category execution */
+export declare const verify: <Entry extends RuntimeTriggerEntry<any, any, any, any>>(entry: Entry, request: WebhookExecutionRequest) => Effect.Effect<VerifySuccess<TriggerIdOf<Entry>, TriggerEncodedState<EntryTrigger<Entry>>>, InvalidTriggerConfigError | InvalidTriggerStateError | UnsupportedTriggerRuntimeError | RuntimeConnectionErrorsFor<EntryAuthMethods<Entry>> | TriggerAppError<EntryTrigger<Entry>>, TriggerRuntimeRequirements<Entry, "verify">>;
+/** @since 0.0.0 @category execution */
+export declare const parse: <Entry extends RuntimeTriggerEntry<any, any, any, any>>(entry: Entry, request: WebhookExecutionRequest) => Effect.Effect<EmittedEventsSuccess<TriggerIdOf<Entry>, "parse", TriggerEncodedOutput<EntryTrigger<Entry>>, TriggerEncodedState<EntryTrigger<Entry>>>, InvalidTriggerConfigError | InvalidTriggerStateError | InvalidTriggerOutputError | UnsupportedTriggerRuntimeError | RuntimeConnectionErrorsFor<EntryAuthMethods<Entry>> | TriggerAppError<EntryTrigger<Entry>>, TriggerRuntimeRequirements<Entry, "parse">>;
+/** @since 0.0.0 @category execution */
+export declare const poll: <Entry extends RuntimeTriggerEntry<any, any, any, any>>(entry: Entry, request: PollExecutionRequest) => Effect.Effect<EmittedEventsSuccess<TriggerIdOf<Entry>, "poll", TriggerEncodedOutput<EntryTrigger<Entry>>, TriggerEncodedState<EntryTrigger<Entry>>>, InvalidTriggerConfigError | InvalidTriggerStateError | InvalidTriggerOutputError | UnsupportedTriggerRuntimeError | RuntimeConnectionErrorsFor<EntryAuthMethods<Entry>> | TriggerAppError<EntryTrigger<Entry>>, TriggerRuntimeRequirements<Entry, "poll">>;
+//#endregion
+export { Trigger_d_exports };
+//# sourceMappingURL=Trigger.d.ts.map

package/dist/Trigger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Trigger.d.ts","names":["AuthMethod.Any","_$__internal_trigger_runtime_shared_ts0.TriggerIdOf","_$__internal_trigger_runtime_shared_ts0.EntryTrigger","_$__internal_trigger_runtime_shared_ts0.TriggerEncodedState","_$__internal_trigger_runtime_shared_ts0.EntryAuthMethods","_$__internal_auth_execution_ts0.RuntimeConnectionErrorsFor","_$__internal_trigger_runtime_shared_ts0.TriggerAppError","_$__internal_trigger_runtime_shared_ts0.TriggerRuntimeRequirements","_$__internal_trigger_runtime_shared_ts0.TriggerEncodedOutput"],"sources":["../src/Trigger.ts"],"mappings":";;;;;;;;;;qBAgCa;;YAED,gBAAgB;;YAGhB;;YAEA;;iBAGK;WACN;;WAEA,UAAU,SAAS;WACnB,mBAAmB;WACnB;WACA;WACA,QAAQ,SAAS;;;iBAIX;WACN;WACA,UAAU,SAAS;WACnB;;KAGN,uBAAuB;cA0BtB;WAAe;WAAe;;;;;;;;;qBAoCvB,aAAU,kBAAA,WAAA,qBAAA,OAAA;;;;;;;;qBAYV,mBAAgB,gBAAA,kBAAA,WAAA,kBAAA,WAAA,WAAA,qBAAA,OAAA;;;;;;;;;;;;qBAmBhB,aAAU;WACD,wBAAa;WACd;WACD,SAAA,uBAAuB;WACxB,QAAA;WACG;MAcpB,OAAA;;;;;;;;;;;qBAYW,wBAAqB;WAEf,MAAA;WACG,SAAA,SAAS;WACV;MAsCpB,OAAA;;;;;;;;;qBAUY,cAAW,kBAAA,+BAAA,OAAA;;;;;;;;;;qBAgEX,kBAAe;WACR,SAAA,uBAAuB;WACrB;WACA;MA4BpB,OAAA;;YAGU,eAAe,sCAAsCA,WAC/D,kBAAkB,wBAAwB;;YAGhC,WAAW,cAAc,OAAO,oBAAoB,gBAAgB,OAAO,OACnF,OAAO,OAAO,KAAK,QAAQ;;iBAId,YACf,mCACA,cAAc,eAAe;WAEpB,WAAW;WACX,OAAO;;;iBAID,gBAAgB,mCAAmC;WACzD,OAAO;WACP,MAAM,YAAY;;;iBAGZ,kBAAkB;WACxB,MAAM,YAAY;;;iBAGZ,cAAc,mCAAmC;WACvD;WACA,WAAW;WACX,QAAQ;WACR,MAAM,YAAY;;;;;;;;;;iBAUZ,aAAa;WACnB,WAAW;WACX,QAAQ;;;iBAGF,WAAW;WACjB;WACA,SAAS;;;iBAGH,qBACf,mCACA,mDACA,kBACA;WAES,iBAAiB,WAAW;WAC5B,OAAO;WACP,MAAM,YAAY,WAAW;;;iBAIvB,eAAe,QAAQ;WAC7B,QAAQ;WACR,OAAO;;;iBAGD,uBAAuB,QAAQ,eAAe,eAAe,QAAQ;;WAE3E;;;iBAGM,sBAAsB,QAAQ,eAAe,uBAC5D,QACA;WAES,SAAS;;;iBAGH,aAAa,QAAQ,eAAe,eAAe,QAAQ;;iBAE3D,iBAAiB;WACvB,OAAO;;;iBAGD,WAAW,QAAQ;WACzB,iBAAiB,WAAW;WAC5B,OAAO;;;iBAID,eACf,eAAe,OAAO,KACtB,eAAe,OAAO,KACtB,cAAc,OAAO,iBACrB,kBACA,sBACA,sCAAsCA,mBAA4BA;WAEzD,YACP,OAAO,uBAAuB,OAAO,OAAO,KAAK,SAAS,WAAW,SACrE,SAAS,eAAe,0BACrB,OAAO,OAAO,iBAAiB,WAAW,SAAS,UAAU;WACzD,cACP,OAAO,uBAAuB,OAAO,OAAO,KAAK,SAAS,WAAW,SACrE,SAAS,eAAe,0BACrB,OAAO,aAAa,UAAU;WAC1B,UACP,OAAO,sBAAsB,OAAO,OAAO,KAAK,SAAS,WAAW,SACpE,SAAS,eAAe,0BACrB,OAAO,cAAc,aAAa,WAAW,SAAS,UAAU;;;;;;;;;;WAU5D,SACP,OAAO,sBAAsB,OAAO,OAAO,KAAK,SAAS,WAAW,SACpE,SAAS,eAAe,0BACrB,OAAO,OACV,WAAW,OAAO,OAAO,KAAK,SAAS,WAAW,SAClD,UACA;;;iBAKa,eACf,eAAe,OAAO,KACtB,eAAe,OAAO,KACtB,cAAc,OAAO,iBACrB,kBACA,sBACA,sCAAsCA,mBAA4BA;;;;;;;;;;WAWzD,QACP,OAAO,aAAa,OAAO,OAAO,KAAK,SAAS,WAAW,SAC3D,SAAS,eAAe,0BACrB,OAAO,OACV,WAAW,OAAO,OAAO,KAAK,SAAS,WAAW,SAClD,UACA;;;YAKQ,gBACV,aAAa,aACb,eAAe,OAAO,KACtB,eAAe,OAAO,KACtB,cAAc,OAAO,iBACrB,kBACA,sBACA,sCAAsCA,mBAA4BA,WAChE,yBACA,eAAe,QAAQ,QAAQ,OAAO,UAAU,cAAc,wBAC9D,eAAe,QAAQ,QAAQ,OAAO,UAAU,cAAc;;iBAGjD,QAAQ;WACd;WACA,WAAW;WACX,SAAS,QAAQ;WACjB,SAAS;;;qBAIP,aAAU;;iBAIN,YAAY,SAAS;YAC1B,SAAS;WACV;WACA;WACA;WACA,MAAM;WACN,QAAQ,OAAO;WACf,QAAQ,OAAO;WACf,OAAO,OAAO;WACd;;;iBAIM;WACN;WACA;;;;;;;;iBASM,gBACf,eAAe,OAAO,KACtB,eAAe,OAAO,KACtB,cAAc,OAAO,iBACrB,qCACQ;WACC,QAAQ;WACR,QAAQ;WACR,QAAQ;;WAER,cAAc;;;iBAIR,YACX,wCACA,aAAa,cAAc,iBAC3B,eAAe,OAAO,MAAM,OAAO,SACnC,eAAe,OAAO,MAAM,OAAO,SACnC,cAAc,OAAO,kBAAkB,OAAO,qBAC9C,+CAEI,SAAS;YACP,SAAS;WACV,YAAY;WACZ;WACA;WACA,MAAM;WACN,QAAQ;WACR,QAAQ;WACR,OAAO;WACP,aAAa;;YAGZ,aAAa,mBAAmB,OAAO;YAEvC,aAAa,mBAAmB,OAAO;YAEvC,YAAY,mBAAmB,OAAO;YAEtC,OAAO,mBAAmB,OAAO,OAAO,OAAO,KAAK,aAAa;YAEjE,OAAO,mBAAmB,OAAO,OAAO,OAAO,KAAK,aAAa;YAEjE,MAAM,mBAAmB,OAAO,WAAW,YAAY;;iBAGlD,wBACX,mBAAmB,MAAM,SACzB,gCAAgCA,mBAA4BA,aAC5D,uCACA;WAEK,YAAY;WACZ,WAAW;WACX;WACA,SAAS;WACT,aAAa;;;;;;;;YAWZ,YAAY,aAAa,sBAC7B,2BACN,eAAe,OAAO,KACtB,eAAe,OAAO,KACtB,cAAc,OAAO,mCACf,oCAEN,YAAY,YACZ,SAAS,gBAAgB,QAAQ,QAAQ,OAAO,iBAC7C,QAAQ,YAAY,MAAM,QAAQ,QAAQ,OAAO;;;;;;;;;;qBA2BzC,SAAS;;qBAGT,SAAS;;qBAGT,YAAS,eAAiB,KAAK;;;;;;qBAG/B,kCAAkC;;;;;;;;qBAMlC,iCAAiC;;;;;;;qBAWjC,kCAAkC;;;;;;;qBAUlC,uCAAuC;;iBAUnC;WACN;WACA;WACA;WACA,UAAU;;;iBAIJ,iCAAiC;WACvC;;;iBAIM,gCAAgC;WACtC,SAAS;;;iBAIH,6BAA6B;;qBAGjC,WAAQ,cAAA,yCAAA,OAAA,OAAA,SAAA,6BAAA,OAAA,OAAA,gBAAAC,YAAA,QAAAE,oBAAAD,aAAA,UAAA,4BAAA,2BAAA,iCAAAG,2BAAAD,iBAAA,UAAAE,gBAAAJ,aAAA,SAAAK,2BAAA;;qBAER,aAAU,cAAA,yCAAA,OAAA,OAAA,SAAA,6BAAA,OAAA,OAAA,kBAAAN,YAAA,SAAA,4BAAA,2BAAA,iCAAAI,2BAAAD,iBAAA,UAAAE,gBAAAJ,aAAA,SAAAK,2BAAA;;qBAEV,SAAM,cAAA,yCAAA,OAAA,OAAA,SAAA,4BAAA,OAAA,OAAA,cAAAN,YAAA,QAAAE,oBAAAD,aAAA,UAAA,4BAAA,2BAAA,iCAAAG,2BAAAD,iBAAA,UAAAE,gBAAAJ,aAAA,SAAAK,2BAAA;;qBAEN,QAAK,cAAA,yCAAA,OAAA,OAAA,SAAA,4BAAA,OAAA,OAAA,qBAAAN,YAAA,iBAAAO,qBAAAN,aAAA,SAAAC,oBAAAD,aAAA,UAAA,4BAAA,2BAAA,4BAAA,iCAAAG,2BAAAD,iBAAA,UAAAE,gBAAAJ,aAAA,SAAAK,2BAAA;;qBAEL,OAAI,cAAA,yCAAA,OAAA,OAAA,SAAA,yBAAA,OAAA,OAAA,qBAAAN,YAAA,gBAAAO,qBAAAN,aAAA,SAAAC,oBAAAD,aAAA,UAAA,4BAAA,2BAAA,4BAAA,iCAAAG,2BAAAD,iBAAA,UAAAE,gBAAAJ,aAAA,SAAAK,2BAAA"}

package/dist/Trigger.js

@@ -0,0 +1,287 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.js";
+import { validateIdentifier } from "./internal/identifier.js";
+import { PipeableProto } from "./internal/proto.js";
+import { activate as activate$1, deactivate as deactivate$1, parse as parse$1, poll as poll$1, verify as verify$1 } from "./internal/trigger-runtime.js";
+import { Array, Clock, Duration, Effect, Match, Number, Option, Predicate, Record, Result, Schema, String, pipe } from "effect";
+import { Base64, Hex } from "effect/encoding";
+//#region src/Trigger.ts
+var Trigger_exports = /* @__PURE__ */ __exportAll({
+	InvalidTriggerConfigError: () => InvalidTriggerConfigError,
+	InvalidTriggerOutputError: () => InvalidTriggerOutputError,
+	InvalidTriggerStateError: () => InvalidTriggerStateError,
+	TypeId: () => TypeId,
+	UnsupportedTriggerRuntimeError: () => UnsupportedTriggerRuntimeError,
+	activate: () => activate,
+	bodyDigest: () => bodyDigest,
+	deactivate: () => deactivate,
+	handlerKey: () => handlerKey,
+	isTrigger: () => isTrigger,
+	parse: () => parse,
+	poll: () => poll,
+	polling: () => polling,
+	verify: () => verify,
+	verifyEcdsaP256: () => verifyEcdsaP256,
+	verifyHmac: () => verifyHmac,
+	verifyHmacSha256: () => verifyHmacSha256,
+	verifyStandardWebhook: () => verifyStandardWebhook,
+	verifyToken: () => verifyToken,
+	webhook: () => webhook
+});
+/** @since 0.0.0 @category type ids */
+const TypeId = "@dual-os/sdk/Trigger";
+function encoded(part) {
+	return Predicate.isString(part) ? new TextEncoder().encode(part) : part;
+}
+function bytes(value) {
+	if (Predicate.isString(value)) return new TextEncoder().encode(value);
+	if (value instanceof Uint8Array) return new Uint8Array(value);
+	const parts = Array.map(value, encoded);
+	const joined = new Uint8Array(Number.sumAll(Array.map(parts, (part) => part.length)));
+	Array.reduce(parts, 0, (offset, part) => {
+		joined.set(part, offset);
+		return offset + part.length;
+	});
+	return joined;
+}
+function sameBytes(left, right) {
+	return left.length === right.length && Number.sumAll(Array.zipWith(left, right, (a, b) => a ^ b)) === 0;
+}
+const hmacHashes = {
+	sha1: "SHA-1",
+	sha256: "SHA-256"
+};
+const matchesAny = Effect.fnUntraced(function* (algorithm, secret, message, signatures) {
+	if (secret.length === 0 || signatures.length === 0) return false;
+	const key = yield* Effect.promise(() => crypto.subtle.importKey("raw", bytes(secret), {
+		hash: hmacHashes[algorithm],
+		name: "HMAC"
+	}, false, ["sign"]));
+	const expected = new Uint8Array(yield* Effect.promise(() => crypto.subtle.sign("HMAC", key, bytes(message))));
+	return Array.contains(Array.map(signatures, (signature) => sameBytes(signature, expected)), true);
+});
+/**
+* The hex SHA-256 of a delivery's raw body. Use it as the event key when the provider signs the
+* body but not its delivery identifier header, so a replayed delivery keeps one identity.
+*
+* @since 0.0.0
+* @category webhooks
+*/
+const bodyDigest = Effect.fn("Trigger.bodyDigest")(function* (rawBody) {
+	const digest = yield* Effect.promise(() => crypto.subtle.digest("SHA-256", bytes(rawBody)));
+	return Hex.encode(new Uint8Array(digest));
+});
+/**
+* Whether `signature` is the HMAC-SHA256 of `message` keyed with `secret`, the way most webhook
+* providers sign their deliveries. The comparison runs in constant time.
+*
+* @since 0.0.0
+* @category webhooks
+*/
+const verifyHmacSha256 = Effect.fn("Trigger.verifyHmacSha256")(function* (secret, message, signature) {
+	return yield* matchesAny("sha256", secret, message, [signature]);
+});
+/**
+* Whether `signature`, written in `encoding`, is the HMAC of `message` keyed with `secret`, given
+* as text or as raw key bytes such as a decoded `whsec_` secret. A message given as parts is signed
+* as their concatenation, such as a timestamp followed by the raw body. Given several signatures,
+* such as one per rotated secret, it verifies when any of them matches and hashes the message once.
+* A missing secret, or signatures none of which is valid `encoding`, never verifies. The comparison
+* runs in constant time.
+*
+* @since 0.0.0
+* @category webhooks
+*/
+const verifyHmac = Effect.fn("Trigger.verifyHmac")(function* (options) {
+	const decode = pipe(Match.value(options.encoding), Match.when("hex", () => Hex.decode), Match.when("base64", () => Base64.decode), Match.exhaustive);
+	return yield* matchesAny(options.algorithm, options.secret, options.message, Array.filterMap(Array.ensure(options.signature), (signature) => decode(signature)));
+});
+/**
+* Whether a [Standard Webhooks](https://www.standardwebhooks.com) delivery is signed with `secret`:
+* one `v1,<base64>` entry of its `webhook-signature` header (`svix-signature` from Svix) must be the
+* HMAC-SHA256 of `id.timestamp.body` keyed with the bytes of the `whsec_` secret, and its timestamp
+* must be within five minutes of now. Header names are lowercase, as in `WebhookRequest`. Missing
+* headers or secret never verify.
+*
+* @since 0.0.0
+* @category webhooks
+*/
+const verifyStandardWebhook = Effect.fn("Trigger.verifyStandardWebhook")(function* (options) {
+	const now = yield* Clock.currentTimeMillis;
+	function header(name) {
+		return Option.orElse(Record.get(options.headers, `webhook-${name}`), () => Record.get(options.headers, `svix-${name}`));
+	}
+	const signed = Option.all({
+		id: header("id"),
+		key: Result.getSuccess(Base64.decode(pipe(options.secret, String.replace(/^whsec_/u, "")))),
+		signature: header("signature"),
+		timestamp: Option.filter(header("timestamp"), (timestamp) => Option.exists(Number.parse(timestamp), (seconds) => Number.between(seconds * 1e3, {
+			maximum: now + Duration.toMillis(Duration.minutes(5)),
+			minimum: now - Duration.toMillis(Duration.minutes(5))
+		})))
+	});
+	return yield* Option.match(signed, {
+		onNone: () => Effect.succeed(false),
+		onSome: (delivery) => verifyHmac({
+			algorithm: "sha256",
+			encoding: "base64",
+			message: [`${delivery.id}.${delivery.timestamp}.`, options.body],
+			secret: delivery.key,
+			signature: pipe(delivery.signature, String.split(" "), Array.filter(String.startsWith("v1,")), Array.map(String.slice(3)))
+		})
+	});
+});
+/**
+* Whether `actual` equals the shared secret `expected`, for providers that send the secret itself
+* back with each delivery. An empty or missing secret never verifies. The comparison runs in
+* constant time.
+*
+* @since 0.0.0
+* @category webhooks
+*/
+const verifyToken = Effect.fn("Trigger.verifyToken")(function* (expected, actual) {
+	if (expected === "" || actual === void 0) return false;
+	const key = yield* Effect.promise(() => crypto.subtle.importKey("raw", crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)), {
+		hash: "SHA-256",
+		name: "HMAC"
+	}, false, ["sign", "verify"]));
+	const reference = yield* Effect.promise(() => crypto.subtle.sign("HMAC", key, bytes(expected)));
+	return yield* Effect.promise(() => crypto.subtle.verify("HMAC", key, reference, bytes(actual)));
+});
+const p256ScalarLength = 32;
+function paddedScalar(integer) {
+	const trimmed = Array.dropWhile(integer, (byte) => byte === 0);
+	return Option.liftPredicate(Array.appendAll(Array.take(Array.replicate(0, p256ScalarLength), p256ScalarLength - trimmed.length), trimmed), (scalar) => scalar.length === p256ScalarLength);
+}
+function derInteger(der, offset) {
+	return Option.gen(function* () {
+		yield* Option.liftPredicate(yield* Array.get(der, offset), (tag) => tag === 2);
+		const length = yield* Array.get(der, offset + 1);
+		const value = Array.take(Array.drop(der, offset + 2), length);
+		yield* Option.liftPredicate(value, (taken) => taken.length === length);
+		return {
+			next: offset + 2 + length,
+			value
+		};
+	});
+}
+function derToP1363(signature) {
+	return Option.gen(function* () {
+		const der = Array.fromIterable(signature);
+		yield* Option.liftPredicate(yield* Array.get(der, 0), (tag) => tag === 48);
+		yield* Option.liftPredicate(yield* Array.get(der, 1), (length) => length === der.length - 2);
+		const r = yield* derInteger(der, 2);
+		const s = yield* derInteger(der, r.next);
+		yield* Option.liftPredicate(s.next, (next) => next === der.length);
+		return new Uint8Array(Array.appendAll(yield* paddedScalar(r.value), yield* paddedScalar(s.value)));
+	});
+}
+/**
+* Whether `signature`, a base64 DER ECDSA signature, signs `message` with the ECDSA P-256 key
+* `publicKey`, a base64 DER SubjectPublicKeyInfo, hashed with SHA-256. A message given as parts is
+* signed as their concatenation, such as a timestamp followed by the raw body. A missing key or a
+* key or signature that is not valid never verifies.
+*
+* @since 0.0.0
+* @category webhooks
+*/
+const verifyEcdsaP256 = Effect.fn("Trigger.verifyEcdsaP256")(function* (options) {
+	const decoded = Option.all({
+		publicKey: Result.getSuccess(Base64.decode(options.publicKey)),
+		signature: Option.flatMap(Result.getSuccess(Base64.decode(options.signature)), derToP1363)
+	});
+	return yield* Option.match(decoded, {
+		onNone: () => Effect.succeed(false),
+		onSome: Effect.fnUntraced(function* (keys) {
+			return yield* pipe(Effect.tryPromise(async () => crypto.subtle.verify({
+				hash: "SHA-256",
+				name: "ECDSA"
+			}, await crypto.subtle.importKey("spki", bytes(keys.publicKey), {
+				name: "ECDSA",
+				namedCurve: "P-256"
+			}, false, ["verify"]), keys.signature, bytes(options.message))), Effect.orElseSucceed(() => false));
+		})
+	});
+});
+/** @since 0.0.0 @category handlers */
+const handlerKey = (triggerId) => `@dual-os/sdk/Trigger/Handler/${triggerId}`;
+const Proto = {
+	...PipeableProto,
+	[TypeId]: TypeId
+};
+const constructor = (kind) => (identifier, options) => {
+	validateIdentifier("trigger", identifier);
+	return Object.assign(Object.create(Proto), {
+		config: options.config,
+		description: options.description,
+		identifier,
+		kind,
+		name: options.name,
+		output: options.output,
+		requireAuth: options.requireAuth ?? true,
+		state: options.state
+	});
+};
+/**
+* Provider webhook triggers must own isolated per-trigger/per-deploy-version
+* ingress/subscription state, or no external provider resource at all.
+* Activating or deactivating one Dual trigger must never mutate provider state
+* that another trigger, deploy version, mailbox, account, or app-level
+* subscription depends on. Shared provider watches must be modeled as polling.
+*
+* @since 0.0.0 @category constructors
+*/
+const webhook = constructor("webhook");
+/** @since 0.0.0 @category constructors */
+const polling = constructor("polling");
+/** @since 0.0.0 @category guards */
+const isTrigger = (u) => Predicate.hasProperty(u, TypeId);
+/** @since 0.0.0 @category errors */
+var InvalidTriggerConfigError = class extends Schema.TaggedError()("InvalidTriggerConfigError", {
+	description: Schema.String,
+	triggerId: Schema.String
+}) {};
+/** @since 0.0.0 @category errors */
+var InvalidTriggerStateError = class extends Schema.TaggedError()("InvalidTriggerStateError", {
+	description: Schema.String,
+	location: Schema.Literals(["input", "result"]),
+	phase: Schema.Literals([
+		"activate",
+		"deactivate",
+		"verify",
+		"parse",
+		"poll"
+	]),
+	triggerId: Schema.String
+}) {};
+/** @since 0.0.0 @category errors */
+var InvalidTriggerOutputError = class extends Schema.TaggedError()("InvalidTriggerOutputError", {
+	description: Schema.String,
+	phase: Schema.Literals(["parse", "poll"]),
+	triggerId: Schema.String
+}) {};
+/** @since 0.0.0 @category errors */
+var UnsupportedTriggerRuntimeError = class extends Schema.TaggedError()("UnsupportedTriggerRuntimeError", {
+	kind: Schema.Literals(["webhook", "polling"]),
+	phase: Schema.Literals([
+		"activate",
+		"deactivate",
+		"verify",
+		"parse",
+		"poll"
+	]),
+	triggerId: Schema.String
+}) {};
+/** @since 0.0.0 @category execution */
+const activate = activate$1;
+/** @since 0.0.0 @category execution */
+const deactivate = deactivate$1;
+/** @since 0.0.0 @category execution */
+const verify = verify$1;
+/** @since 0.0.0 @category execution */
+const parse = parse$1;
+/** @since 0.0.0 @category execution */
+const poll = poll$1;
+//#endregion
+export { InvalidTriggerConfigError, InvalidTriggerOutputError, InvalidTriggerStateError, Trigger_exports, TypeId, UnsupportedTriggerRuntimeError, activate, bodyDigest, deactivate, handlerKey, isTrigger, parse, poll, polling, verify, verifyEcdsaP256, verifyHmac, verifyHmacSha256, verifyStandardWebhook, verifyToken, webhook };
+
+//# sourceMappingURL=Trigger.js.map