@fragno-dev/api-fragment 0.0.0-stage → 0.0.1

package/dist/node/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","names":[],"sources":["../../src/server.ts"],"mappings":";;;;;iBAQgB,kBACd,QAAQ,mBACR,cAAc,4DAA8B,gEAAA,0EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kGAA9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+BAQ+9O"}

package/dist/node/server.js

@@ -0,0 +1,12 @@
+import { apiFragmentDefinition } from "./definition.js";
+import { apiRoutesFactory } from "./routes.js";
+import { instantiate } from "@fragno-dev/core";
+//#region src/server.ts
+const apiRoutes = [apiRoutesFactory];
+function createApiFragment(config, fragnoConfig) {
+	return instantiate(apiFragmentDefinition).withConfig(config).withRoutes(apiRoutes).withOptions(fragnoConfig).build();
+}
+//#endregion
+export { createApiFragment };
+
+//# sourceMappingURL=server.js.map

package/dist/node/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","names":[],"sources":["../../src/server.ts"],"sourcesContent":["import { instantiate } from \"@fragno-dev/core\";\nimport type { FragnoPublicConfigWithDatabase } from \"@fragno-dev/db\";\n\nimport { apiFragmentDefinition, type ApiFragmentConfig } from \"./definition\";\nimport { apiRoutesFactory } from \"./routes\";\n\nconst apiRoutes = [apiRoutesFactory] as const;\n\nexport function createApiFragment(\n  config: ApiFragmentConfig,\n  fragnoConfig: FragnoPublicConfigWithDatabase,\n) {\n  return instantiate(apiFragmentDefinition)\n    .withConfig(config)\n    .withRoutes(apiRoutes)\n    .withOptions(fragnoConfig)\n    .build();\n}\n"],"mappings":";;;;AAMA,MAAM,YAAY,CAAC,gBAAgB;AAEnC,SAAgB,kBACd,QACA,cACA;CACA,OAAO,YAAY,qBAAqB,CAAC,CACtC,WAAW,MAAM,CAAC,CAClB,WAAW,SAAS,CAAC,CACrB,YAAY,YAAY,CAAC,CACzB,MAAM;AACX"}

package/dist/node/services.d.ts

@@ -0,0 +1,10 @@
+import "./api-types.js";
+import { z } from "zod";
+//#region src/services.d.ts
+interface AuthPersistenceChanges {
+  authPayload?: string;
+  authExpiresAt?: Date | null;
+}
+//#endregion
+export { AuthPersistenceChanges };
+//# sourceMappingURL=services.d.ts.map

package/dist/node/services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.ts","names":[],"sources":["../../src/services.ts"],"mappings":";;;UA+CiB;EACf;EACA,gBAAgB"}

package/dist/node/services.js

@@ -0,0 +1,304 @@
+import { bytesToBase64, randomBase64Url, utf8Bytes } from "./crypto.js";
+import { authConfigSchema } from "./api-types.js";
+import { createAuthorizationUrl, createCodeChallenge, exchangeAuthorizationCode, oauthTokensSchema, refreshOAuthToken, requestClientCredentialsToken, tokenExpiry } from "./oauth.js";
+import { z } from "zod";
+//#region src/services.ts
+const storedAuthPayloadSchema = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("bearer"),
+		token: z.string().min(1)
+	}),
+	z.object({
+		type: z.literal("basic"),
+		username: z.string().min(1),
+		password: z.string().min(1)
+	}),
+	authConfigSchema.options[3].extend({ tokens: oauthTokensSchema.optional() }),
+	authConfigSchema.options[4].extend({
+		tokens: oauthTokensSchema.optional(),
+		redirectUri: z.url().optional()
+	})
+]);
+const TOKEN_EXPIRY_SKEW_MS = 3e4;
+function assertAllowedBaseUrl(baseUrl, config) {
+	const url = new URL(baseUrl);
+	if (url.protocol !== "https:" && url.protocol !== "http:") throw new Error("API base URL must be an HTTP(S) URL");
+	if (config.allowedBaseUrls && !config.allowedBaseUrls(url)) throw new Error("API base URL is not allowed");
+	return url;
+}
+function secretByKind(secrets, kind) {
+	return secrets.find((secret) => secret.kind === kind);
+}
+function secretExpiresInFuture(secret) {
+	if (!secret?.expiresAt) return false;
+	return new Date(secret.expiresAt).getTime() > Date.now() + TOKEN_EXPIRY_SKEW_MS;
+}
+function secretIsUnexpired(secret) {
+	return !secret?.expiresAt || secretExpiresInFuture(secret);
+}
+/** Projects stored auth without secrets; whether credentials work can only be learned by using them. */
+function projectApiAuthStatus(args) {
+	const mode = args.authMode;
+	if (mode === "none") return { mode };
+	if (mode !== "oauth") return {
+		mode,
+		credentials: args.authSecret ? "present" : "missing"
+	};
+	if (!args.authSecret) return {
+		mode,
+		state: "client-missing"
+	};
+	const auth = storedAuthPayloadSchema.parse(JSON.parse(args.authSecret.payload));
+	const tokens = auth.type === "oauth" ? auth.tokens : void 0;
+	if (tokens?.accessToken && (tokens.refreshToken || secretIsUnexpired(args.authSecret))) return {
+		mode,
+		state: "authorized"
+	};
+	if (args.hasPendingOAuth) return {
+		mode,
+		state: "consent-pending"
+	};
+	return {
+		mode,
+		state: tokens?.accessToken ? "expired" : "consent-required"
+	};
+}
+/** Whether stored auth can authorize requests without new consent or credentials. */
+function isApiAuthReady(authMode, authSecret) {
+	const status = projectApiAuthStatus({
+		authMode,
+		authSecret,
+		hasPendingOAuth: false
+	});
+	switch (status.mode) {
+		case "none": return true;
+		case "oauth": return status.state === "authorized";
+		case "bearer":
+		case "basic":
+		case "client_credentials": return status.credentials === "present";
+		default: throw new Error("Unknown API auth mode.", { cause: status });
+	}
+}
+/**
+* When stored auth stops authorizing requests because its access token expires without renewal,
+* whether or not that moment has passed. Null when a refresh token renews it or nothing expires.
+*/
+function apiAuthReadyUntil(authMode, authSecret) {
+	if (authMode !== "oauth" || !authSecret.expiresAt) return null;
+	const auth = storedAuthPayloadSchema.parse(JSON.parse(authSecret.payload));
+	if (auth.type !== "oauth" || !auth.tokens?.accessToken || auth.tokens.refreshToken) return null;
+	return /* @__PURE__ */ new Date(new Date(authSecret.expiresAt).getTime() - TOKEN_EXPIRY_SKEW_MS);
+}
+/**
+* Projects the newest unexpired, unconsumed state; any such state completes the same connection.
+* States started before links were retained have no URL and cannot be resumed.
+*/
+function pendingOAuthLink(state) {
+	return state?.authorizationUrl ? {
+		authorizationUrl: state.authorizationUrl,
+		expiresAt: state.expiresAt
+	} : null;
+}
+async function createOAuthStartSnapshot(args) {
+	const codeVerifier = randomBase64Url(32);
+	const codeChallenge = await createCodeChallenge(codeVerifier);
+	const scopes = args.scopes ?? args.auth.scopes;
+	const authorizationUrl = createAuthorizationUrl({
+		authorizationEndpoint: args.auth.authorizationEndpoint,
+		clientId: args.auth.clientId,
+		redirectUri: args.redirectUri,
+		state: args.stateId,
+		scopes,
+		codeChallenge,
+		extraParams: {
+			...args.auth.extraAuthorizationParams,
+			...args.extraAuthorizationParams
+		}
+	});
+	return {
+		authorizationUrl,
+		oauthState: {
+			id: args.stateId,
+			connectionId: args.connection.id.toString(),
+			authorizationUrl: authorizationUrl.toString(),
+			codeVerifier,
+			redirectUri: args.redirectUri,
+			scope: scopes?.join(" ") ?? null,
+			expiresAt: new Date(Date.now() + 600 * 1e3)
+		}
+	};
+}
+async function createOAuthCallbackSnapshot(args) {
+	const tokens = await exchangeAuthorizationCode({
+		auth: args.auth,
+		code: args.code,
+		redirectUri: args.state.redirectUri,
+		codeVerifier: args.state.codeVerifier,
+		fetchImplementation: args.config.fetch
+	});
+	return {
+		authPayload: JSON.stringify({
+			...args.auth,
+			redirectUri: args.state.redirectUri,
+			tokens
+		}),
+		authExpiresAt: tokenExpiry(tokens)
+	};
+}
+async function resolveOAuthAuth(args) {
+	if (!args.authPayload.tokens?.accessToken) return {};
+	if (secretIsUnexpired(args.authSecret)) return { authorization: `Bearer ${args.authPayload.tokens.accessToken}` };
+	if (!args.authPayload.tokens.refreshToken) throw new Error("OAuth access token expired and no refresh token is available");
+	const tokens = await refreshOAuthToken({
+		auth: args.authPayload,
+		refreshToken: args.authPayload.tokens.refreshToken,
+		fetchImplementation: args.config.fetch
+	});
+	if (!tokens.accessToken) throw new Error("OAuth refresh did not return an access token");
+	return {
+		authorization: `Bearer ${tokens.accessToken}`,
+		authChanges: {
+			authPayload: JSON.stringify({
+				...args.authPayload,
+				tokens
+			}),
+			authExpiresAt: tokenExpiry(tokens)
+		}
+	};
+}
+async function resolveClientCredentialsAuth(args) {
+	if (args.authPayload.tokens?.accessToken && secretExpiresInFuture(args.authSecret)) return { authorization: `Bearer ${args.authPayload.tokens.accessToken}` };
+	const tokens = await requestClientCredentialsToken({
+		auth: args.authPayload,
+		fetchImplementation: args.config.fetch
+	});
+	if (!tokens.accessToken) throw new Error("Client credentials flow did not return an access token");
+	return {
+		authorization: `Bearer ${tokens.accessToken}`,
+		authChanges: {
+			authPayload: JSON.stringify({
+				...args.authPayload,
+				tokens
+			}),
+			authExpiresAt: tokenExpiry(tokens)
+		}
+	};
+}
+async function resolveApiOperationAuth(args) {
+	const authSecret = secretByKind(args.secrets, "auth");
+	const authPayload = authSecret ? storedAuthPayloadSchema.parse(JSON.parse(authSecret.payload)) : void 0;
+	if (!authPayload) return {};
+	if (authPayload.type === "bearer") return { authorization: `Bearer ${authPayload.token}` };
+	if (authPayload.type === "basic") return { authorization: `Basic ${bytesToBase64(utf8Bytes(`${authPayload.username}:${authPayload.password}`))}` };
+	if (authPayload.type === "oauth") return resolveOAuthAuth({
+		config: args.config,
+		authSecret,
+		authPayload
+	});
+	return resolveClientCredentialsAuth({
+		config: args.config,
+		authSecret,
+		authPayload
+	});
+}
+function resolveRequestUrl(baseUrl, path, query) {
+	if (/^[a-z][a-z0-9+.-]*:/i.test(path) || path.startsWith("//")) throw new Error("API request path must be relative");
+	const url = new URL(path.startsWith("/") ? path.slice(1) : path, baseUrl.endsWith("/") ? baseUrl : `${baseUrl}/`);
+	for (const [key, value] of Object.entries(query ?? {})) url.searchParams.set(key, value);
+	return url;
+}
+function boundedErrorMessage(message) {
+	const normalized = message.trim();
+	return normalized.length > 500 ? `${normalized.slice(0, 500)}…` : normalized;
+}
+async function performApiRequest(args) {
+	const controller = args.request.timeoutMs ? new AbortController() : void 0;
+	const timeout = controller ? setTimeout(() => {
+		controller.abort();
+	}, args.request.timeoutMs) : void 0;
+	try {
+		const url = resolveRequestUrl(args.baseUrl, args.request.path, args.request.query);
+		const headers = new Headers(args.request.headers ?? {});
+		headers.delete("authorization");
+		headers.delete("Authorization");
+		if (args.authorization) headers.set("authorization", args.authorization);
+		let body;
+		if (args.request.body.type === "json") {
+			headers.set("content-type", headers.get("content-type") ?? "application/json");
+			body = JSON.stringify(args.request.body.value);
+		} else if (args.request.body.type === "text") body = args.request.body.value;
+		const response = await (args.config.fetch ?? fetch)(url, {
+			method: args.request.method,
+			headers,
+			body,
+			signal: controller?.signal
+		});
+		const responseHeaders = Object.fromEntries(response.headers.entries());
+		const responseText = await response.text();
+		const contentType = response.headers.get("content-type") ?? "";
+		let responseBody;
+		let responseDecodingFailed = false;
+		if (!responseText) responseBody = {
+			type: "empty",
+			value: null
+		};
+		else if (contentType.includes("application/json")) try {
+			responseBody = {
+				type: "json",
+				value: JSON.parse(responseText)
+			};
+		} catch {
+			responseBody = {
+				type: "text",
+				value: responseText
+			};
+			responseDecodingFailed = true;
+		}
+		else responseBody = {
+			type: "text",
+			value: responseText
+		};
+		const apiResponse = {
+			status: response.status,
+			statusText: response.statusText,
+			headers: responseHeaders,
+			body: responseBody
+		};
+		if (responseDecodingFailed) return {
+			ok: false,
+			response: apiResponse,
+			error: {
+				code: "RESPONSE_DECODING_ERROR",
+				message: "Upstream response declared JSON but could not be decoded"
+			}
+		};
+		if (response.ok) return {
+			ok: true,
+			response: apiResponse,
+			error: null
+		};
+		return {
+			ok: false,
+			response: apiResponse,
+			error: {
+				code: "HTTP_ERROR",
+				message: responseBody.type === "json" && responseBody.value && typeof responseBody.value === "object" && "message" in responseBody.value ? boundedErrorMessage(String(responseBody.value.message)) : boundedErrorMessage(responseText) || response.statusText || `HTTP ${response.status}`
+			}
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			response: null,
+			error: {
+				code: "REQUEST_ERROR",
+				message: error instanceof Error && error.name === "AbortError" ? `API request timed out after ${args.request.timeoutMs}ms` : error instanceof Error ? error.message : String(error)
+			}
+		};
+	} finally {
+		if (timeout) clearTimeout(timeout);
+	}
+}
+//#endregion
+export { apiAuthReadyUntil, assertAllowedBaseUrl, createOAuthCallbackSnapshot, createOAuthStartSnapshot, isApiAuthReady, pendingOAuthLink, performApiRequest, projectApiAuthStatus, resolveApiOperationAuth, storedAuthPayloadSchema };
+
+//# sourceMappingURL=services.js.map

package/dist/node/services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.js","names":[],"sources":["../../src/services.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport {\n  authConfigSchema,\n  type ApiAuthStatus,\n  type ApiFragmentConfig,\n  type ApiRequestInput,\n  type ApiRequestOutput,\n  type AuthConfig,\n} from \"./api-types\";\nimport { bytesToBase64, utf8Bytes } from \"./crypto\";\nimport {\n  createAuthorizationUrl,\n  createCodeChallenge,\n  exchangeAuthorizationCode,\n  randomBase64Url,\n  refreshOAuthToken,\n  requestClientCredentialsToken,\n  tokenExpiry,\n  oauthTokensSchema,\n} from \"./oauth\";\n\nexport type SecretRecord = {\n  id: { toString(): string } | string;\n  kind: string;\n  payload: string;\n  expiresAt?: Date | string | null;\n};\n\nexport const storedAuthPayloadSchema = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"bearer\"), token: z.string().min(1) }),\n  z.object({\n    type: z.literal(\"basic\"),\n    username: z.string().min(1),\n    password: z.string().min(1),\n  }),\n  authConfigSchema.options[3].extend({ tokens: oauthTokensSchema.optional() }),\n  authConfigSchema.options[4].extend({\n    tokens: oauthTokensSchema.optional(),\n    redirectUri: z.url().optional(),\n  }),\n]);\n\ntype StoredAuthPayload = z.infer<typeof storedAuthPayloadSchema>;\n\nconst TOKEN_EXPIRY_SKEW_MS = 30_000;\n\nexport interface AuthPersistenceChanges {\n  authPayload?: string;\n  authExpiresAt?: Date | null;\n}\n\nexport function assertAllowedBaseUrl(baseUrl: string, config: ApiFragmentConfig) {\n  const url = new URL(baseUrl);\n  if (url.protocol !== \"https:\" && url.protocol !== \"http:\") {\n    throw new Error(\"API base URL must be an HTTP(S) URL\");\n  }\n  if (config.allowedBaseUrls && !config.allowedBaseUrls(url)) {\n    throw new Error(\"API base URL is not allowed\");\n  }\n  return url;\n}\n\nfunction secretByKind<TSecret extends { kind: string }>(secrets: TSecret[], kind: string) {\n  return secrets.find((secret) => secret.kind === kind);\n}\n\nfunction secretExpiresInFuture(secret: Pick<SecretRecord, \"expiresAt\"> | undefined) {\n  if (!secret?.expiresAt) {\n    return false;\n  }\n  return new Date(secret.expiresAt).getTime() > Date.now() + TOKEN_EXPIRY_SKEW_MS;\n}\n\nfunction secretIsUnexpired(secret: Pick<SecretRecord, \"expiresAt\"> | undefined) {\n  return !secret?.expiresAt || secretExpiresInFuture(secret);\n}\n\n/** Projects stored auth without secrets; whether credentials work can only be learned by using them. */\nexport function projectApiAuthStatus(args: {\n  authMode: string;\n  authSecret: Pick<SecretRecord, \"payload\" | \"expiresAt\"> | undefined;\n  hasPendingOAuth: boolean;\n}): ApiAuthStatus {\n  // Routes write authMode only from authConfigSchema discriminators.\n  const mode = args.authMode as AuthConfig[\"type\"];\n  if (mode === \"none\") {\n    return { mode };\n  }\n  if (mode !== \"oauth\") {\n    return { mode, credentials: args.authSecret ? \"present\" : \"missing\" };\n  }\n  if (!args.authSecret) {\n    return { mode, state: \"client-missing\" };\n  }\n  const auth = storedAuthPayloadSchema.parse(JSON.parse(args.authSecret.payload));\n  const tokens = auth.type === \"oauth\" ? auth.tokens : undefined;\n  // Matches request-time resolution: a refresh token renews an expired access token.\n  if (tokens?.accessToken && (tokens.refreshToken || secretIsUnexpired(args.authSecret))) {\n    return { mode, state: \"authorized\" };\n  }\n  // Expired tokens without a refresh token are unusable, so a pending link is the actionable state.\n  if (args.hasPendingOAuth) {\n    return { mode, state: \"consent-pending\" };\n  }\n  return { mode, state: tokens?.accessToken ? \"expired\" : \"consent-required\" };\n}\n\n/** Whether stored auth can authorize requests without new consent or credentials. */\nexport function isApiAuthReady(\n  authMode: string,\n  authSecret: Pick<SecretRecord, \"payload\" | \"expiresAt\"> | undefined,\n): boolean {\n  // Pending consent only distinguishes states that are not ready.\n  const status = projectApiAuthStatus({ authMode, authSecret, hasPendingOAuth: false });\n  switch (status.mode) {\n    case \"none\":\n      return true;\n    case \"oauth\":\n      return status.state === \"authorized\";\n    case \"bearer\":\n    case \"basic\":\n    case \"client_credentials\":\n      return status.credentials === \"present\";\n    default:\n      throw new Error(\"Unknown API auth mode.\", { cause: status satisfies never });\n  }\n}\n\n/**\n * When stored auth stops authorizing requests because its access token expires without renewal,\n * whether or not that moment has passed. Null when a refresh token renews it or nothing expires.\n */\nexport function apiAuthReadyUntil(\n  authMode: string,\n  authSecret: Pick<SecretRecord, \"payload\" | \"expiresAt\">,\n): Date | null {\n  if (authMode !== \"oauth\" || !authSecret.expiresAt) {\n    return null;\n  }\n  const auth = storedAuthPayloadSchema.parse(JSON.parse(authSecret.payload));\n  if (auth.type !== \"oauth\" || !auth.tokens?.accessToken || auth.tokens.refreshToken) {\n    return null;\n  }\n  return new Date(new Date(authSecret.expiresAt).getTime() - TOKEN_EXPIRY_SKEW_MS);\n}\n\n/**\n * Projects the newest unexpired, unconsumed state; any such state completes the same connection.\n * States started before links were retained have no URL and cannot be resumed.\n */\nexport function pendingOAuthLink(\n  state: { authorizationUrl: string | null; expiresAt: Date } | null,\n): { authorizationUrl: string; expiresAt: Date } | null {\n  return state?.authorizationUrl\n    ? { authorizationUrl: state.authorizationUrl, expiresAt: state.expiresAt }\n    : null;\n}\n\nexport async function createOAuthStartSnapshot(args: {\n  connection: { id: { toString(): string } | string };\n  auth: Extract<AuthConfig, { type: \"oauth\" }>;\n  stateId: string;\n  redirectUri: string;\n  scopes?: string[];\n  extraAuthorizationParams?: Record<string, string>;\n}) {\n  const codeVerifier = randomBase64Url(32);\n  const codeChallenge = await createCodeChallenge(codeVerifier);\n  const scopes = args.scopes ?? args.auth.scopes;\n  const authorizationUrl = createAuthorizationUrl({\n    authorizationEndpoint: args.auth.authorizationEndpoint,\n    clientId: args.auth.clientId,\n    redirectUri: args.redirectUri,\n    state: args.stateId,\n    scopes,\n    codeChallenge,\n    extraParams: {\n      ...args.auth.extraAuthorizationParams,\n      ...args.extraAuthorizationParams,\n    },\n  });\n  return {\n    authorizationUrl,\n    oauthState: {\n      id: args.stateId,\n      connectionId: args.connection.id.toString(),\n      // The link carries only the PKCE challenge, never the verifier.\n      authorizationUrl: authorizationUrl.toString(),\n      codeVerifier,\n      redirectUri: args.redirectUri,\n      scope: scopes?.join(\" \") ?? null,\n      expiresAt: new Date(Date.now() + 10 * 60 * 1000),\n    },\n  };\n}\n\nexport async function createOAuthCallbackSnapshot(args: {\n  config: ApiFragmentConfig;\n  stateId: string;\n  code: string;\n  state: {\n    codeVerifier: string;\n    redirectUri: string;\n    scope?: string | null;\n    expiresAt: Date | string;\n    consumedAt?: Date | string | null;\n  };\n  auth: Extract<AuthConfig, { type: \"oauth\" }>;\n}) {\n  const tokens = await exchangeAuthorizationCode({\n    auth: args.auth,\n    code: args.code,\n    redirectUri: args.state.redirectUri,\n    codeVerifier: args.state.codeVerifier,\n    fetchImplementation: args.config.fetch,\n  });\n  return {\n    authPayload: JSON.stringify({\n      ...args.auth,\n      redirectUri: args.state.redirectUri,\n      tokens,\n    }),\n    authExpiresAt: tokenExpiry(tokens),\n  } satisfies AuthPersistenceChanges;\n}\n\nasync function resolveOAuthAuth(args: {\n  config: ApiFragmentConfig;\n  authSecret: SecretRecord;\n  authPayload: Extract<StoredAuthPayload, { type: \"oauth\" }>;\n}) {\n  if (!args.authPayload.tokens?.accessToken) {\n    return {};\n  }\n  if (secretIsUnexpired(args.authSecret)) {\n    return { authorization: `Bearer ${args.authPayload.tokens.accessToken}` };\n  }\n  if (!args.authPayload.tokens.refreshToken) {\n    throw new Error(\"OAuth access token expired and no refresh token is available\");\n  }\n  const tokens = await refreshOAuthToken({\n    auth: args.authPayload,\n    refreshToken: args.authPayload.tokens.refreshToken,\n    fetchImplementation: args.config.fetch,\n  });\n  if (!tokens.accessToken) {\n    throw new Error(\"OAuth refresh did not return an access token\");\n  }\n  return {\n    authorization: `Bearer ${tokens.accessToken}`,\n    authChanges: {\n      authPayload: JSON.stringify({ ...args.authPayload, tokens }),\n      authExpiresAt: tokenExpiry(tokens),\n    },\n  };\n}\n\nasync function resolveClientCredentialsAuth(args: {\n  config: ApiFragmentConfig;\n  authSecret: SecretRecord;\n  authPayload: Extract<StoredAuthPayload, { type: \"client_credentials\" }>;\n}) {\n  if (args.authPayload.tokens?.accessToken && secretExpiresInFuture(args.authSecret)) {\n    return { authorization: `Bearer ${args.authPayload.tokens.accessToken}` };\n  }\n  const tokens = await requestClientCredentialsToken({\n    auth: args.authPayload,\n    fetchImplementation: args.config.fetch,\n  });\n  if (!tokens.accessToken) {\n    throw new Error(\"Client credentials flow did not return an access token\");\n  }\n  return {\n    authorization: `Bearer ${tokens.accessToken}`,\n    authChanges: {\n      authPayload: JSON.stringify({ ...args.authPayload, tokens }),\n      authExpiresAt: tokenExpiry(tokens),\n    },\n  };\n}\n\nexport async function resolveApiOperationAuth(args: {\n  config: ApiFragmentConfig;\n  secrets: SecretRecord[];\n}): Promise<{ authorization?: string; authChanges?: AuthPersistenceChanges }> {\n  const authSecret = secretByKind(args.secrets, \"auth\");\n  const authPayload = authSecret\n    ? storedAuthPayloadSchema.parse(JSON.parse(authSecret.payload))\n    : undefined;\n  if (!authPayload) {\n    return {};\n  }\n  if (authPayload.type === \"bearer\") {\n    return { authorization: `Bearer ${authPayload.token}` };\n  }\n  if (authPayload.type === \"basic\") {\n    const credentials = bytesToBase64(utf8Bytes(`${authPayload.username}:${authPayload.password}`));\n    return { authorization: `Basic ${credentials}` };\n  }\n  if (authPayload.type === \"oauth\") {\n    return resolveOAuthAuth({ config: args.config, authSecret: authSecret!, authPayload });\n  }\n  return resolveClientCredentialsAuth({\n    config: args.config,\n    authSecret: authSecret!,\n    authPayload,\n  });\n}\n\nfunction resolveRequestUrl(baseUrl: string, path: string, query?: Record<string, string>) {\n  if (/^[a-z][a-z0-9+.-]*:/i.test(path) || path.startsWith(\"//\")) {\n    throw new Error(\"API request path must be relative\");\n  }\n  const url = new URL(\n    path.startsWith(\"/\") ? path.slice(1) : path,\n    baseUrl.endsWith(\"/\") ? baseUrl : `${baseUrl}/`,\n  );\n  for (const [key, value] of Object.entries(query ?? {})) {\n    url.searchParams.set(key, value);\n  }\n  return url;\n}\n\nfunction boundedErrorMessage(message: string) {\n  const normalized = message.trim();\n  return normalized.length > 500 ? `${normalized.slice(0, 500)}…` : normalized;\n}\n\nexport async function performApiRequest(args: {\n  config: ApiFragmentConfig;\n  baseUrl: string;\n  authorization?: string;\n  request: ApiRequestInput;\n}): Promise<ApiRequestOutput> {\n  const controller = args.request.timeoutMs ? new AbortController() : undefined;\n  const timeout = controller\n    ? setTimeout(() => {\n        controller.abort();\n      }, args.request.timeoutMs)\n    : undefined;\n\n  try {\n    const url = resolveRequestUrl(args.baseUrl, args.request.path, args.request.query);\n    const headers = new Headers(args.request.headers ?? {});\n    headers.delete(\"authorization\");\n    headers.delete(\"Authorization\");\n    if (args.authorization) {\n      headers.set(\"authorization\", args.authorization);\n    }\n    let body: BodyInit | undefined;\n    if (args.request.body.type === \"json\") {\n      headers.set(\"content-type\", headers.get(\"content-type\") ?? \"application/json\");\n      body = JSON.stringify(args.request.body.value);\n    } else if (args.request.body.type === \"text\") {\n      body = args.request.body.value;\n    }\n\n    const response = await (args.config.fetch ?? fetch)(url, {\n      method: args.request.method,\n      headers,\n      body,\n      signal: controller?.signal,\n    });\n    const responseHeaders = Object.fromEntries(response.headers.entries());\n    const responseText = await response.text();\n    const contentType = response.headers.get(\"content-type\") ?? \"\";\n    let responseBody:\n      | { type: \"json\"; value: unknown }\n      | { type: \"text\"; value: string }\n      | { type: \"empty\"; value: null };\n    let responseDecodingFailed = false;\n    if (!responseText) {\n      responseBody = { type: \"empty\", value: null };\n    } else if (contentType.includes(\"application/json\")) {\n      try {\n        responseBody = { type: \"json\", value: JSON.parse(responseText) as unknown };\n      } catch {\n        responseBody = { type: \"text\", value: responseText };\n        responseDecodingFailed = true;\n      }\n    } else {\n      responseBody = { type: \"text\", value: responseText };\n    }\n    const apiResponse = {\n      status: response.status,\n      statusText: response.statusText,\n      headers: responseHeaders,\n      body: responseBody,\n    };\n    if (responseDecodingFailed) {\n      return {\n        ok: false,\n        response: apiResponse,\n        error: {\n          code: \"RESPONSE_DECODING_ERROR\",\n          message: \"Upstream response declared JSON but could not be decoded\",\n        },\n      };\n    }\n    if (response.ok) {\n      return { ok: true, response: apiResponse, error: null };\n    }\n\n    const responseMessage =\n      responseBody.type === \"json\" &&\n      responseBody.value &&\n      typeof responseBody.value === \"object\" &&\n      \"message\" in responseBody.value\n        ? boundedErrorMessage(String(responseBody.value.message))\n        : boundedErrorMessage(responseText) || response.statusText || `HTTP ${response.status}`;\n    return {\n      ok: false,\n      response: apiResponse,\n      error: { code: \"HTTP_ERROR\", message: responseMessage },\n    };\n  } catch (error) {\n    const message =\n      error instanceof Error && error.name === \"AbortError\"\n        ? `API request timed out after ${args.request.timeoutMs}ms`\n        : error instanceof Error\n          ? error.message\n          : String(error);\n    return {\n      ok: false,\n      response: null,\n      error: { code: \"REQUEST_ERROR\", message },\n    };\n  } finally {\n    if (timeout) {\n      clearTimeout(timeout);\n    }\n  }\n}\n"],"mappings":";;;;;AA6BA,MAAa,0BAA0B,EAAE,mBAAmB,QAAQ;CAClE,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,QAAQ;EAAG,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAAE,CAAC;CAChE,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,OAAO;EACvB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;EAC1B,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC5B,CAAC;CACD,iBAAiB,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,kBAAkB,SAAS,EAAE,CAAC;CAC3E,iBAAiB,QAAQ,EAAE,CAAC,OAAO;EACjC,QAAQ,kBAAkB,SAAS;EACnC,aAAa,EAAE,IAAI,CAAC,CAAC,SAAS;CAChC,CAAC;AACH,CAAC;AAID,MAAM,uBAAuB;AAO7B,SAAgB,qBAAqB,SAAiB,QAA2B;CAC/E,MAAM,MAAM,IAAI,IAAI,OAAO;CAC3B,IAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAChD,MAAM,IAAI,MAAM,qCAAqC;CAEvD,IAAI,OAAO,mBAAmB,CAAC,OAAO,gBAAgB,GAAG,GACvD,MAAM,IAAI,MAAM,6BAA6B;CAE/C,OAAO;AACT;AAEA,SAAS,aAA+C,SAAoB,MAAc;CACxF,OAAO,QAAQ,MAAM,WAAW,OAAO,SAAS,IAAI;AACtD;AAEA,SAAS,sBAAsB,QAAqD;CAClF,IAAI,CAAC,QAAQ,WACX,OAAO;CAET,OAAO,IAAI,KAAK,OAAO,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI,IAAI;AAC7D;AAEA,SAAS,kBAAkB,QAAqD;CAC9E,OAAO,CAAC,QAAQ,aAAa,sBAAsB,MAAM;AAC3D;;AAGA,SAAgB,qBAAqB,MAInB;CAEhB,MAAM,OAAO,KAAK;CAClB,IAAI,SAAS,QACX,OAAO,EAAE,KAAK;CAEhB,IAAI,SAAS,SACX,OAAO;EAAE;EAAM,aAAa,KAAK,aAAa,YAAY;CAAU;CAEtE,IAAI,CAAC,KAAK,YACR,OAAO;EAAE;EAAM,OAAO;CAAiB;CAEzC,MAAM,OAAO,wBAAwB,MAAM,KAAK,MAAM,KAAK,WAAW,OAAO,CAAC;CAC9E,MAAM,SAAS,KAAK,SAAS,UAAU,KAAK,SAAS,KAAA;CAErD,IAAI,QAAQ,gBAAgB,OAAO,gBAAgB,kBAAkB,KAAK,UAAU,IAClF,OAAO;EAAE;EAAM,OAAO;CAAa;CAGrC,IAAI,KAAK,iBACP,OAAO;EAAE;EAAM,OAAO;CAAkB;CAE1C,OAAO;EAAE;EAAM,OAAO,QAAQ,cAAc,YAAY;CAAmB;AAC7E;;AAGA,SAAgB,eACd,UACA,YACS;CAET,MAAM,SAAS,qBAAqB;EAAE;EAAU;EAAY,iBAAiB;CAAM,CAAC;CACpF,QAAQ,OAAO,MAAf;EACE,KAAK,QACH,OAAO;EACT,KAAK,SACH,OAAO,OAAO,UAAU;EAC1B,KAAK;EACL,KAAK;EACL,KAAK,sBACH,OAAO,OAAO,gBAAgB;EAChC,SACE,MAAM,IAAI,MAAM,0BAA0B,EAAE,OAAO,OAAuB,CAAC;CAC/E;AACF;;;;;AAMA,SAAgB,kBACd,UACA,YACa;CACb,IAAI,aAAa,WAAW,CAAC,WAAW,WACtC,OAAO;CAET,MAAM,OAAO,wBAAwB,MAAM,KAAK,MAAM,WAAW,OAAO,CAAC;CACzE,IAAI,KAAK,SAAS,WAAW,CAAC,KAAK,QAAQ,eAAe,KAAK,OAAO,cACpE,OAAO;CAET,uBAAO,IAAI,KAAK,IAAI,KAAK,WAAW,SAAS,CAAC,CAAC,QAAQ,IAAI,oBAAoB;AACjF;;;;;AAMA,SAAgB,iBACd,OACsD;CACtD,OAAO,OAAO,mBACV;EAAE,kBAAkB,MAAM;EAAkB,WAAW,MAAM;CAAU,IACvE;AACN;AAEA,eAAsB,yBAAyB,MAO5C;CACD,MAAM,eAAe,gBAAgB,EAAE;CACvC,MAAM,gBAAgB,MAAM,oBAAoB,YAAY;CAC5D,MAAM,SAAS,KAAK,UAAU,KAAK,KAAK;CACxC,MAAM,mBAAmB,uBAAuB;EAC9C,uBAAuB,KAAK,KAAK;EACjC,UAAU,KAAK,KAAK;EACpB,aAAa,KAAK;EAClB,OAAO,KAAK;EACZ;EACA;EACA,aAAa;GACX,GAAG,KAAK,KAAK;GACb,GAAG,KAAK;EACV;CACF,CAAC;CACD,OAAO;EACL;EACA,YAAY;GACV,IAAI,KAAK;GACT,cAAc,KAAK,WAAW,GAAG,SAAS;GAE1C,kBAAkB,iBAAiB,SAAS;GAC5C;GACA,aAAa,KAAK;GAClB,OAAO,QAAQ,KAAK,GAAG,KAAK;GAC5B,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,MAAU,GAAI;EACjD;CACF;AACF;AAEA,eAAsB,4BAA4B,MAY/C;CACD,MAAM,SAAS,MAAM,0BAA0B;EAC7C,MAAM,KAAK;EACX,MAAM,KAAK;EACX,aAAa,KAAK,MAAM;EACxB,cAAc,KAAK,MAAM;EACzB,qBAAqB,KAAK,OAAO;CACnC,CAAC;CACD,OAAO;EACL,aAAa,KAAK,UAAU;GAC1B,GAAG,KAAK;GACR,aAAa,KAAK,MAAM;GACxB;EACF,CAAC;EACD,eAAe,YAAY,MAAM;CACnC;AACF;AAEA,eAAe,iBAAiB,MAI7B;CACD,IAAI,CAAC,KAAK,YAAY,QAAQ,aAC5B,OAAO,CAAC;CAEV,IAAI,kBAAkB,KAAK,UAAU,GACnC,OAAO,EAAE,eAAe,UAAU,KAAK,YAAY,OAAO,cAAc;CAE1E,IAAI,CAAC,KAAK,YAAY,OAAO,cAC3B,MAAM,IAAI,MAAM,8DAA8D;CAEhF,MAAM,SAAS,MAAM,kBAAkB;EACrC,MAAM,KAAK;EACX,cAAc,KAAK,YAAY,OAAO;EACtC,qBAAqB,KAAK,OAAO;CACnC,CAAC;CACD,IAAI,CAAC,OAAO,aACV,MAAM,IAAI,MAAM,8CAA8C;CAEhE,OAAO;EACL,eAAe,UAAU,OAAO;EAChC,aAAa;GACX,aAAa,KAAK,UAAU;IAAE,GAAG,KAAK;IAAa;GAAO,CAAC;GAC3D,eAAe,YAAY,MAAM;EACnC;CACF;AACF;AAEA,eAAe,6BAA6B,MAIzC;CACD,IAAI,KAAK,YAAY,QAAQ,eAAe,sBAAsB,KAAK,UAAU,GAC/E,OAAO,EAAE,eAAe,UAAU,KAAK,YAAY,OAAO,cAAc;CAE1E,MAAM,SAAS,MAAM,8BAA8B;EACjD,MAAM,KAAK;EACX,qBAAqB,KAAK,OAAO;CACnC,CAAC;CACD,IAAI,CAAC,OAAO,aACV,MAAM,IAAI,MAAM,wDAAwD;CAE1E,OAAO;EACL,eAAe,UAAU,OAAO;EAChC,aAAa;GACX,aAAa,KAAK,UAAU;IAAE,GAAG,KAAK;IAAa;GAAO,CAAC;GAC3D,eAAe,YAAY,MAAM;EACnC;CACF;AACF;AAEA,eAAsB,wBAAwB,MAGgC;CAC5E,MAAM,aAAa,aAAa,KAAK,SAAS,MAAM;CACpD,MAAM,cAAc,aAChB,wBAAwB,MAAM,KAAK,MAAM,WAAW,OAAO,CAAC,IAC5D,KAAA;CACJ,IAAI,CAAC,aACH,OAAO,CAAC;CAEV,IAAI,YAAY,SAAS,UACvB,OAAO,EAAE,eAAe,UAAU,YAAY,QAAQ;CAExD,IAAI,YAAY,SAAS,SAEvB,OAAO,EAAE,eAAe,SADJ,cAAc,UAAU,GAAG,YAAY,SAAS,GAAG,YAAY,UAAU,CAClD,IAAI;CAEjD,IAAI,YAAY,SAAS,SACvB,OAAO,iBAAiB;EAAE,QAAQ,KAAK;EAAoB;EAAa;CAAY,CAAC;CAEvF,OAAO,6BAA6B;EAClC,QAAQ,KAAK;EACD;EACZ;CACF,CAAC;AACH;AAEA,SAAS,kBAAkB,SAAiB,MAAc,OAAgC;CACxF,IAAI,uBAAuB,KAAK,IAAI,KAAK,KAAK,WAAW,IAAI,GAC3D,MAAM,IAAI,MAAM,mCAAmC;CAErD,MAAM,MAAM,IAAI,IACd,KAAK,WAAW,GAAG,IAAI,KAAK,MAAM,CAAC,IAAI,MACvC,QAAQ,SAAS,GAAG,IAAI,UAAU,GAAG,QAAQ,EAC/C;CACA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,SAAS,CAAC,CAAC,GACnD,IAAI,aAAa,IAAI,KAAK,KAAK;CAEjC,OAAO;AACT;AAEA,SAAS,oBAAoB,SAAiB;CAC5C,MAAM,aAAa,QAAQ,KAAK;CAChC,OAAO,WAAW,SAAS,MAAM,GAAG,WAAW,MAAM,GAAG,GAAG,EAAE,KAAK;AACpE;AAEA,eAAsB,kBAAkB,MAKV;CAC5B,MAAM,aAAa,KAAK,QAAQ,YAAY,IAAI,gBAAgB,IAAI,KAAA;CACpE,MAAM,UAAU,aACZ,iBAAiB;EACf,WAAW,MAAM;CACnB,GAAG,KAAK,QAAQ,SAAS,IACzB,KAAA;CAEJ,IAAI;EACF,MAAM,MAAM,kBAAkB,KAAK,SAAS,KAAK,QAAQ,MAAM,KAAK,QAAQ,KAAK;EACjF,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,WAAW,CAAC,CAAC;EACtD,QAAQ,OAAO,eAAe;EAC9B,QAAQ,OAAO,eAAe;EAC9B,IAAI,KAAK,eACP,QAAQ,IAAI,iBAAiB,KAAK,aAAa;EAEjD,IAAI;EACJ,IAAI,KAAK,QAAQ,KAAK,SAAS,QAAQ;GACrC,QAAQ,IAAI,gBAAgB,QAAQ,IAAI,cAAc,KAAK,kBAAkB;GAC7E,OAAO,KAAK,UAAU,KAAK,QAAQ,KAAK,KAAK;EAC/C,OAAO,IAAI,KAAK,QAAQ,KAAK,SAAS,QACpC,OAAO,KAAK,QAAQ,KAAK;EAG3B,MAAM,WAAW,OAAO,KAAK,OAAO,SAAS,MAAA,CAAO,KAAK;GACvD,QAAQ,KAAK,QAAQ;GACrB;GACA;GACA,QAAQ,YAAY;EACtB,CAAC;EACD,MAAM,kBAAkB,OAAO,YAAY,SAAS,QAAQ,QAAQ,CAAC;EACrE,MAAM,eAAe,MAAM,SAAS,KAAK;EACzC,MAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;EAC5D,IAAI;EAIJ,IAAI,yBAAyB;EAC7B,IAAI,CAAC,cACH,eAAe;GAAE,MAAM;GAAS,OAAO;EAAK;OACvC,IAAI,YAAY,SAAS,kBAAkB,GAChD,IAAI;GACF,eAAe;IAAE,MAAM;IAAQ,OAAO,KAAK,MAAM,YAAY;GAAa;EAC5E,QAAQ;GACN,eAAe;IAAE,MAAM;IAAQ,OAAO;GAAa;GACnD,yBAAyB;EAC3B;OAEA,eAAe;GAAE,MAAM;GAAQ,OAAO;EAAa;EAErD,MAAM,cAAc;GAClB,QAAQ,SAAS;GACjB,YAAY,SAAS;GACrB,SAAS;GACT,MAAM;EACR;EACA,IAAI,wBACF,OAAO;GACL,IAAI;GACJ,UAAU;GACV,OAAO;IACL,MAAM;IACN,SAAS;GACX;EACF;EAEF,IAAI,SAAS,IACX,OAAO;GAAE,IAAI;GAAM,UAAU;GAAa,OAAO;EAAK;EAUxD,OAAO;GACL,IAAI;GACJ,UAAU;GACV,OAAO;IAAE,MAAM;IAAc,SAT7B,aAAa,SAAS,UACtB,aAAa,SACb,OAAO,aAAa,UAAU,YAC9B,aAAa,aAAa,QACtB,oBAAoB,OAAO,aAAa,MAAM,OAAO,CAAC,IACtD,oBAAoB,YAAY,KAAK,SAAS,cAAc,QAAQ,SAAS;GAI3B;EACxD;CACF,SAAS,OAAO;EAOd,OAAO;GACL,IAAI;GACJ,UAAU;GACV,OAAO;IAAE,MAAM;IAAiB,SARhC,iBAAiB,SAAS,MAAM,SAAS,eACrC,+BAA+B,KAAK,QAAQ,UAAU,MACtD,iBAAiB,QACf,MAAM,UACN,OAAO,KAAK;GAIsB;EAC1C;CACF,UAAU;EACR,IAAI,SACF,aAAa,OAAO;CAExB;AACF"}

package/dist/node/webhooks/auth.d.ts

@@ -0,0 +1,133 @@
+import { timingSafeEqualBytes, timingSafeEqualText } from "../crypto.js";
+import { z } from "zod";
+//#region src/webhooks/auth.d.ts
+declare const webhookAuthConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  type: z.ZodLiteral<"none">;
+}, z.core.$strip>, z.ZodObject<{
+  type: z.ZodLiteral<"bearer">;
+  tokenRef: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+  type: z.ZodLiteral<"apiKey">;
+  location: z.ZodEnum<{
+    header: "header";
+    query: "query";
+  }>;
+  name: z.ZodString;
+  secretRef: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+  type: z.ZodLiteral<"basic">;
+  usernameRef: z.ZodString;
+  passwordRef: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+  type: z.ZodLiteral<"hmac">;
+  secretRef: z.ZodString;
+  algorithm: z.ZodEnum<{
+    sha1: "sha1";
+    sha256: "sha256";
+    sha512: "sha512";
+  }>;
+  signature: z.ZodObject<{
+    location: z.ZodEnum<{
+      header: "header";
+      query: "query";
+    }>;
+    name: z.ZodString;
+    encoding: z.ZodEnum<{
+      hex: "hex";
+      base64: "base64";
+      base64url: "base64url";
+    }>;
+    prefix: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>;
+  signedPayload: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"rawBody">;
+  }, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"timestampedBody">;
+    prefix: z.ZodString;
+    timestampHeader: z.ZodString;
+    delimiter: z.ZodString;
+    toleranceSeconds: z.ZodNumber;
+  }, z.core.$strip>], "type">;
+}, z.core.$strip>], "type">;
+type WebhookAuthConfig = z.infer<typeof webhookAuthConfigSchema>;
+type WebhookAuthType = WebhookAuthConfig["type"];
+type WebhookAuthSecretRef = string;
+type WebhookSecretResolver = {
+  get(ref: WebhookAuthSecretRef): string | undefined | Promise<string | undefined>;
+};
+type WebhookAuthFailureReason = "missing_secret" | "missing_credential" | "invalid_credential" | "timestamp_out_of_range" | "bad_config";
+type WebhookAuthResult = {
+  ok: true;
+} | {
+  ok: false;
+  reason: WebhookAuthFailureReason;
+};
+type SensitiveRequestValue = {
+  location: "header" | "query";
+  name: string;
+};
+type WebhookAuthVerificationContext = {
+  request: Request;
+  now: Date;
+  secrets: WebhookSecretResolver;
+  rawBodyBytes(): Promise<Uint8Array>;
+};
+interface WebhookAuthVerifier<TConfig extends WebhookAuthConfig> {
+  type: TConfig["type"];
+  requiredSecretRefs(config: TConfig): readonly WebhookAuthSecretRef[];
+  sensitiveRequestValues(config: TConfig): readonly SensitiveRequestValue[];
+  verify(config: TConfig, context: WebhookAuthVerificationContext): Promise<WebhookAuthResult>;
+}
+type VerifyWebhookAuthInput = {
+  config: WebhookAuthConfig;
+  /** Pass the original web-standard Request or a clone. The body is read from request.clone(). */
+  request: Request;
+  secrets: WebhookSecretResolver;
+  now?: Date;
+};
+declare const webhookAuthVerifiers: {
+  none: WebhookAuthVerifier<{
+    type: "none";
+  }>;
+  bearer: WebhookAuthVerifier<{
+    type: "bearer";
+    tokenRef: string;
+  }>;
+  apiKey: WebhookAuthVerifier<{
+    type: "apiKey";
+    location: "header" | "query";
+    name: string;
+    secretRef: string;
+  }>;
+  basic: WebhookAuthVerifier<{
+    type: "basic";
+    usernameRef: string;
+    passwordRef: string;
+  }>;
+  hmac: WebhookAuthVerifier<{
+    type: "hmac";
+    secretRef: string;
+    algorithm: "sha1" | "sha256" | "sha512";
+    signature: {
+      location: "header" | "query";
+      name: string;
+      encoding: "hex" | "base64" | "base64url";
+      prefix?: string | undefined;
+    };
+    signedPayload: {
+      type: "rawBody";
+    } | {
+      type: "timestampedBody";
+      prefix: string;
+      timestampHeader: string;
+      delimiter: string;
+      toleranceSeconds: number;
+    };
+  }>;
+};
+declare function verifyWebhookAuth({ config, request, secrets, now }: VerifyWebhookAuthInput): Promise<WebhookAuthResult>;
+declare function getWebhookAuthSecretRefs(config: WebhookAuthConfig): readonly WebhookAuthSecretRef[];
+declare function getSensitiveWebhookAuthValues(config: WebhookAuthConfig): readonly SensitiveRequestValue[];
+//#endregion
+export { SensitiveRequestValue, VerifyWebhookAuthInput, WebhookAuthConfig, WebhookAuthFailureReason, WebhookAuthResult, WebhookAuthSecretRef, WebhookAuthType, WebhookAuthVerificationContext, WebhookAuthVerifier, WebhookSecretResolver, getSensitiveWebhookAuthValues, getWebhookAuthSecretRefs, timingSafeEqualBytes, timingSafeEqualText, verifyWebhookAuth, webhookAuthConfigSchema, webhookAuthVerifiers };
+//# sourceMappingURL=auth.d.ts.map

package/dist/node/webhooks/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","names":[],"sources":["../../../src/webhooks/auth.ts"],"mappings":";;;cAca,yBAAuB,EAAA,uBAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAqCxB,oBAAoB,EAAE,aAAa;KACnC,kBAAkB;KAClB;KAEA;EACV,IAAI,KAAK,4CAA4C;;KAG3C;KAOA;EAAsB;;EAAe;EAAW,QAAQ;;KAExD;EACV;EACA;;KAGU;EACV,SAAS;EACT,KAAK;EACL,SAAS;EACT,gBAAgB,QAAQ;;UAGT,oBAAoB,gBAAgB;EACnD,MAAM;EACN,mBAAmB,QAAQ,mBAAmB;EAC9C,uBAAuB,QAAQ,mBAAmB;EAClD,OAAO,QAAQ,SAAS,SAAS,iCAAiC,QAAQ;;KAOhE;EACV,QAAQ;;EAER,SAAS;EACT,SAAS;EACT,MAAM;;cAoLK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQS,oBACpB,QACA,SACA,SACA,OACC,yBAAyB,QAAQ;iBAepB,yBACd,QAAQ,6BACE;iBAII,8BACd,QAAQ,6BACE"}