@fragno-dev/api-fragment 0.0.0-stage → 0.0.1

package/dist/node/webhooks/auth.js

@@ -0,0 +1,268 @@
+import { decodeBase64, decodeBase64ToText, decodeHex, timingSafeEqualBytes, timingSafeEqualText, utf8Bytes, verifyHmacSignature } from "../crypto.js";
+import { z } from "zod";
+//#region src/webhooks/auth.ts
+const secretRefSchema = z.string().trim().min(1);
+const requestValueNameSchema = z.string().trim().min(1);
+const webhookAuthConfigSchema = z.discriminatedUnion("type", [
+	z.object({ type: z.literal("none") }),
+	z.object({
+		type: z.literal("bearer"),
+		tokenRef: secretRefSchema
+	}),
+	z.object({
+		type: z.literal("apiKey"),
+		location: z.enum(["header", "query"]),
+		name: requestValueNameSchema,
+		secretRef: secretRefSchema
+	}),
+	z.object({
+		type: z.literal("basic"),
+		usernameRef: secretRefSchema,
+		passwordRef: secretRefSchema
+	}),
+	z.object({
+		type: z.literal("hmac"),
+		secretRef: secretRefSchema,
+		algorithm: z.enum([
+			"sha1",
+			"sha256",
+			"sha512"
+		]),
+		signature: z.object({
+			location: z.enum(["header", "query"]),
+			name: requestValueNameSchema,
+			encoding: z.enum([
+				"hex",
+				"base64",
+				"base64url"
+			]),
+			prefix: z.string().optional()
+		}),
+		signedPayload: z.discriminatedUnion("type", [z.object({ type: z.literal("rawBody") }), z.object({
+			type: z.literal("timestampedBody"),
+			prefix: z.string(),
+			timestampHeader: requestValueNameSchema,
+			delimiter: z.string(),
+			toleranceSeconds: z.number().int().positive()
+		})])
+	})
+]);
+const getHeaderAuthorizationCredential = (request, scheme) => {
+	const header = request.headers.get("authorization");
+	if (!header) return null;
+	const [headerScheme, ...rest] = header.split(/\s+/);
+	if (headerScheme?.toLowerCase() !== scheme || rest.length === 0) return null;
+	return rest.join(" ");
+};
+const getRequestValue = (request, location, name) => {
+	if (location === "header") return request.headers.get(name);
+	return new URL(request.url).searchParams.get(name);
+};
+const requireSecret = async (context, ref) => {
+	const secret = await context.secrets.get(ref);
+	if (!secret) return {
+		ok: false,
+		reason: "missing_secret"
+	};
+	return {
+		ok: true,
+		secret
+	};
+};
+const webhookAuthVerifiers = {
+	none: {
+		type: "none",
+		requiredSecretRefs: () => [],
+		sensitiveRequestValues: () => [],
+		verify: async () => ({ ok: true })
+	},
+	bearer: {
+		type: "bearer",
+		requiredSecretRefs: (config) => [config.tokenRef],
+		sensitiveRequestValues: () => [{
+			location: "header",
+			name: "authorization"
+		}],
+		verify: async (config, context) => {
+			const secret = await requireSecret(context, config.tokenRef);
+			if (!secret.ok) return secret;
+			const token = getHeaderAuthorizationCredential(context.request, "bearer");
+			if (!token) return {
+				ok: false,
+				reason: "missing_credential"
+			};
+			return await timingSafeEqualText(token, secret.secret) ? { ok: true } : {
+				ok: false,
+				reason: "invalid_credential"
+			};
+		}
+	},
+	apiKey: {
+		type: "apiKey",
+		requiredSecretRefs: (config) => [config.secretRef],
+		sensitiveRequestValues: (config) => [{
+			location: config.location,
+			name: config.name
+		}],
+		verify: async (config, context) => {
+			const secret = await requireSecret(context, config.secretRef);
+			if (!secret.ok) return secret;
+			const credential = getRequestValue(context.request, config.location, config.name);
+			if (!credential) return {
+				ok: false,
+				reason: "missing_credential"
+			};
+			return await timingSafeEqualText(credential, secret.secret) ? { ok: true } : {
+				ok: false,
+				reason: "invalid_credential"
+			};
+		}
+	},
+	basic: {
+		type: "basic",
+		requiredSecretRefs: (config) => [config.usernameRef, config.passwordRef],
+		sensitiveRequestValues: () => [{
+			location: "header",
+			name: "authorization"
+		}],
+		verify: async (config, context) => {
+			const username = await requireSecret(context, config.usernameRef);
+			if (!username.ok) return username;
+			const password = await requireSecret(context, config.passwordRef);
+			if (!password.ok) return password;
+			const encodedCredential = getHeaderAuthorizationCredential(context.request, "basic");
+			if (!encodedCredential) return {
+				ok: false,
+				reason: "missing_credential"
+			};
+			const decodedCredential = decodeBase64ToText(encodedCredential, "base64");
+			if (decodedCredential === null) return {
+				ok: false,
+				reason: "invalid_credential"
+			};
+			const separatorIndex = decodedCredential.indexOf(":");
+			if (separatorIndex === -1) return {
+				ok: false,
+				reason: "invalid_credential"
+			};
+			const actualUsername = decodedCredential.slice(0, separatorIndex);
+			const actualPassword = decodedCredential.slice(separatorIndex + 1);
+			return await timingSafeEqualText(actualUsername, username.secret) && await timingSafeEqualText(actualPassword, password.secret) ? { ok: true } : {
+				ok: false,
+				reason: "invalid_credential"
+			};
+		}
+	},
+	hmac: {
+		type: "hmac",
+		requiredSecretRefs: (config) => [config.secretRef],
+		sensitiveRequestValues: (config) => [{
+			location: config.signature.location,
+			name: config.signature.name
+		}],
+		verify: async (config, context) => {
+			const secret = await requireSecret(context, config.secretRef);
+			if (!secret.ok) return secret;
+			const signatureValue = getRequestValue(context.request, config.signature.location, config.signature.name);
+			if (!signatureValue) return {
+				ok: false,
+				reason: "missing_credential"
+			};
+			const normalizedSignature = normalizeSignature(signatureValue, config.signature.prefix);
+			if (normalizedSignature === null) return {
+				ok: false,
+				reason: "invalid_credential"
+			};
+			const signedPayload = await buildSignedPayload(config, context);
+			if (!signedPayload.ok) return signedPayload;
+			const providedSignature = decodeSignature(normalizedSignature, config.signature.encoding);
+			if (!providedSignature) return {
+				ok: false,
+				reason: "invalid_credential"
+			};
+			return await verifyHmacSignature({
+				algorithm: config.algorithm,
+				secret: secret.secret,
+				payload: signedPayload.payload,
+				signature: providedSignature
+			}) ? { ok: true } : {
+				ok: false,
+				reason: "invalid_credential"
+			};
+		}
+	}
+};
+async function verifyWebhookAuth({ config, request, secrets, now = /* @__PURE__ */ new Date() }) {
+	const verifier = getWebhookAuthVerifier(config);
+	let rawBodyBytes = null;
+	return await verifier.verify(config, {
+		request,
+		now,
+		secrets,
+		rawBodyBytes: async () => {
+			rawBodyBytes ??= new Uint8Array(await request.clone().arrayBuffer());
+			return rawBodyBytes;
+		}
+	});
+}
+function getWebhookAuthSecretRefs(config) {
+	return getWebhookAuthVerifier(config).requiredSecretRefs(config);
+}
+function getSensitiveWebhookAuthValues(config) {
+	return getWebhookAuthVerifier(config).sensitiveRequestValues(config);
+}
+function getWebhookAuthVerifier(config) {
+	return webhookAuthVerifiers[config.type];
+}
+async function buildSignedPayload(config, context) {
+	if (config.signedPayload.type === "rawBody") return {
+		ok: true,
+		payload: await context.rawBodyBytes()
+	};
+	const timestamp = context.request.headers.get(config.signedPayload.timestampHeader);
+	if (!timestamp) return {
+		ok: false,
+		reason: "missing_credential"
+	};
+	const timestampMs = parseWebhookTimestampMs(timestamp);
+	if (timestampMs === null) return {
+		ok: false,
+		reason: "invalid_credential"
+	};
+	const toleranceMs = config.signedPayload.toleranceSeconds * 1e3;
+	if (Math.abs(context.now.getTime() - timestampMs) > toleranceMs) return {
+		ok: false,
+		reason: "timestamp_out_of_range"
+	};
+	return {
+		ok: true,
+		payload: concatBytes(utf8Bytes(`${config.signedPayload.prefix}${timestamp}${config.signedPayload.delimiter}`), await context.rawBodyBytes())
+	};
+}
+function normalizeSignature(signature, prefix) {
+	const trimmed = signature.trim();
+	if (!prefix) return trimmed || null;
+	if (!trimmed.startsWith(prefix)) return null;
+	return trimmed.slice(prefix.length).trim() || null;
+}
+function decodeSignature(signature, encoding) {
+	if (encoding === "hex") return decodeHex(signature);
+	return decodeBase64(signature, encoding);
+}
+function parseWebhookTimestampMs(value) {
+	const normalized = value.trim();
+	if (!/^\d+$/.test(normalized)) return null;
+	const numeric = Number(normalized);
+	if (!Number.isSafeInteger(numeric) || numeric <= 0) return null;
+	return numeric < 0xe8d4a51000 ? numeric * 1e3 : numeric;
+}
+function concatBytes(first, second) {
+	const output = new Uint8Array(first.length + second.length);
+	output.set(first, 0);
+	output.set(second, first.length);
+	return output;
+}
+//#endregion
+export { getSensitiveWebhookAuthValues, getWebhookAuthSecretRefs, timingSafeEqualBytes, timingSafeEqualText, verifyWebhookAuth, webhookAuthConfigSchema, webhookAuthVerifiers };
+
+//# sourceMappingURL=auth.js.map

package/dist/node/webhooks/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","names":["verifySecretText"],"sources":["../../../src/webhooks/auth.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport {\n  decodeBase64,\n  decodeBase64ToText,\n  decodeHex,\n  timingSafeEqualText as verifySecretText,\n  utf8Bytes,\n  verifyHmacSignature,\n} from \"../crypto\";\n\nconst secretRefSchema = z.string().trim().min(1);\nconst requestValueNameSchema = z.string().trim().min(1);\n\nexport const webhookAuthConfigSchema = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"none\") }),\n  z.object({ type: z.literal(\"bearer\"), tokenRef: secretRefSchema }),\n  z.object({\n    type: z.literal(\"apiKey\"),\n    location: z.enum([\"header\", \"query\"]),\n    name: requestValueNameSchema,\n    secretRef: secretRefSchema,\n  }),\n  z.object({\n    type: z.literal(\"basic\"),\n    usernameRef: secretRefSchema,\n    passwordRef: secretRefSchema,\n  }),\n  z.object({\n    type: z.literal(\"hmac\"),\n    secretRef: secretRefSchema,\n    algorithm: z.enum([\"sha1\", \"sha256\", \"sha512\"]),\n    signature: z.object({\n      location: z.enum([\"header\", \"query\"]),\n      name: requestValueNameSchema,\n      encoding: z.enum([\"hex\", \"base64\", \"base64url\"]),\n      prefix: z.string().optional(),\n    }),\n    signedPayload: z.discriminatedUnion(\"type\", [\n      z.object({ type: z.literal(\"rawBody\") }),\n      z.object({\n        type: z.literal(\"timestampedBody\"),\n        prefix: z.string(),\n        timestampHeader: requestValueNameSchema,\n        delimiter: z.string(),\n        toleranceSeconds: z.number().int().positive(),\n      }),\n    ]),\n  }),\n]);\n\nexport type WebhookAuthConfig = z.infer<typeof webhookAuthConfigSchema>;\nexport type WebhookAuthType = WebhookAuthConfig[\"type\"];\nexport type WebhookAuthSecretRef = string;\n\nexport type WebhookSecretResolver = {\n  get(ref: WebhookAuthSecretRef): string | undefined | Promise<string | undefined>;\n};\n\nexport type WebhookAuthFailureReason =\n  | \"missing_secret\"\n  | \"missing_credential\"\n  | \"invalid_credential\"\n  | \"timestamp_out_of_range\"\n  | \"bad_config\";\n\nexport type WebhookAuthResult = { ok: true } | { ok: false; reason: WebhookAuthFailureReason };\n\nexport type SensitiveRequestValue = {\n  location: \"header\" | \"query\";\n  name: string;\n};\n\nexport type WebhookAuthVerificationContext = {\n  request: Request;\n  now: Date;\n  secrets: WebhookSecretResolver;\n  rawBodyBytes(): Promise<Uint8Array>;\n};\n\nexport interface WebhookAuthVerifier<TConfig extends WebhookAuthConfig> {\n  type: TConfig[\"type\"];\n  requiredSecretRefs(config: TConfig): readonly WebhookAuthSecretRef[];\n  sensitiveRequestValues(config: TConfig): readonly SensitiveRequestValue[];\n  verify(config: TConfig, context: WebhookAuthVerificationContext): Promise<WebhookAuthResult>;\n}\n\ntype WebhookAuthVerifierRegistry = {\n  [TType in WebhookAuthType]: WebhookAuthVerifier<Extract<WebhookAuthConfig, { type: TType }>>;\n};\n\nexport type VerifyWebhookAuthInput = {\n  config: WebhookAuthConfig;\n  /** Pass the original web-standard Request or a clone. The body is read from request.clone(). */\n  request: Request;\n  secrets: WebhookSecretResolver;\n  now?: Date;\n};\n\nconst getHeaderAuthorizationCredential = (request: Request, scheme: \"basic\" | \"bearer\") => {\n  const header = request.headers.get(\"authorization\");\n  if (!header) {\n    return null;\n  }\n\n  const [headerScheme, ...rest] = header.split(/\\s+/);\n  if (headerScheme?.toLowerCase() !== scheme || rest.length === 0) {\n    return null;\n  }\n\n  return rest.join(\" \");\n};\n\nconst getRequestValue = (\n  request: Request,\n  location: \"header\" | \"query\",\n  name: string,\n): string | null => {\n  if (location === \"header\") {\n    return request.headers.get(name);\n  }\n\n  return new URL(request.url).searchParams.get(name);\n};\n\ntype WebhookAuthFailure = Extract<WebhookAuthResult, { ok: false }>;\n\ntype ResolvedSecret = WebhookAuthFailure | { ok: true; secret: string };\n\nconst requireSecret = async (\n  context: WebhookAuthVerificationContext,\n  ref: WebhookAuthSecretRef,\n): Promise<ResolvedSecret> => {\n  const secret = await context.secrets.get(ref);\n  if (!secret) {\n    return { ok: false, reason: \"missing_secret\" };\n  }\n\n  return { ok: true, secret };\n};\n\nconst noneVerifier: WebhookAuthVerifier<Extract<WebhookAuthConfig, { type: \"none\" }>> = {\n  type: \"none\",\n  requiredSecretRefs: () => [],\n  sensitiveRequestValues: () => [],\n  verify: async () => ({ ok: true }),\n};\n\nconst bearerVerifier: WebhookAuthVerifier<Extract<WebhookAuthConfig, { type: \"bearer\" }>> = {\n  type: \"bearer\",\n  requiredSecretRefs: (config) => [config.tokenRef],\n  sensitiveRequestValues: () => [{ location: \"header\", name: \"authorization\" }],\n  verify: async (config, context) => {\n    const secret = await requireSecret(context, config.tokenRef);\n    if (!secret.ok) {\n      return secret;\n    }\n\n    const token = getHeaderAuthorizationCredential(context.request, \"bearer\");\n    if (!token) {\n      return { ok: false, reason: \"missing_credential\" };\n    }\n\n    return (await verifySecretText(token, secret.secret))\n      ? { ok: true }\n      : { ok: false, reason: \"invalid_credential\" };\n  },\n};\n\nconst apiKeyVerifier: WebhookAuthVerifier<Extract<WebhookAuthConfig, { type: \"apiKey\" }>> = {\n  type: \"apiKey\",\n  requiredSecretRefs: (config) => [config.secretRef],\n  sensitiveRequestValues: (config) => [{ location: config.location, name: config.name }],\n  verify: async (config, context) => {\n    const secret = await requireSecret(context, config.secretRef);\n    if (!secret.ok) {\n      return secret;\n    }\n\n    const credential = getRequestValue(context.request, config.location, config.name);\n    if (!credential) {\n      return { ok: false, reason: \"missing_credential\" };\n    }\n\n    return (await verifySecretText(credential, secret.secret))\n      ? { ok: true }\n      : { ok: false, reason: \"invalid_credential\" };\n  },\n};\n\nconst basicVerifier: WebhookAuthVerifier<Extract<WebhookAuthConfig, { type: \"basic\" }>> = {\n  type: \"basic\",\n  requiredSecretRefs: (config) => [config.usernameRef, config.passwordRef],\n  sensitiveRequestValues: () => [{ location: \"header\", name: \"authorization\" }],\n  verify: async (config, context) => {\n    const username = await requireSecret(context, config.usernameRef);\n    if (!username.ok) {\n      return username;\n    }\n    const password = await requireSecret(context, config.passwordRef);\n    if (!password.ok) {\n      return password;\n    }\n\n    const encodedCredential = getHeaderAuthorizationCredential(context.request, \"basic\");\n    if (!encodedCredential) {\n      return { ok: false, reason: \"missing_credential\" };\n    }\n\n    const decodedCredential = decodeBase64ToText(encodedCredential, \"base64\");\n    if (decodedCredential === null) {\n      return { ok: false, reason: \"invalid_credential\" };\n    }\n\n    const separatorIndex = decodedCredential.indexOf(\":\");\n    if (separatorIndex === -1) {\n      return { ok: false, reason: \"invalid_credential\" };\n    }\n\n    const actualUsername = decodedCredential.slice(0, separatorIndex);\n    const actualPassword = decodedCredential.slice(separatorIndex + 1);\n\n    return (await verifySecretText(actualUsername, username.secret)) &&\n      (await verifySecretText(actualPassword, password.secret))\n      ? { ok: true }\n      : { ok: false, reason: \"invalid_credential\" };\n  },\n};\n\nconst hmacVerifier: WebhookAuthVerifier<Extract<WebhookAuthConfig, { type: \"hmac\" }>> = {\n  type: \"hmac\",\n  requiredSecretRefs: (config) => [config.secretRef],\n  sensitiveRequestValues: (config) => [\n    { location: config.signature.location, name: config.signature.name },\n  ],\n  verify: async (config, context) => {\n    const secret = await requireSecret(context, config.secretRef);\n    if (!secret.ok) {\n      return secret;\n    }\n\n    const signatureValue = getRequestValue(\n      context.request,\n      config.signature.location,\n      config.signature.name,\n    );\n    if (!signatureValue) {\n      return { ok: false, reason: \"missing_credential\" };\n    }\n\n    const normalizedSignature = normalizeSignature(signatureValue, config.signature.prefix);\n    if (normalizedSignature === null) {\n      return { ok: false, reason: \"invalid_credential\" };\n    }\n\n    const signedPayload = await buildSignedPayload(config, context);\n    if (!signedPayload.ok) {\n      return signedPayload;\n    }\n\n    const providedSignature = decodeSignature(normalizedSignature, config.signature.encoding);\n    if (!providedSignature) {\n      return { ok: false, reason: \"invalid_credential\" };\n    }\n\n    return (await verifyHmacSignature({\n      algorithm: config.algorithm,\n      secret: secret.secret,\n      payload: signedPayload.payload,\n      signature: providedSignature,\n    }))\n      ? { ok: true }\n      : { ok: false, reason: \"invalid_credential\" };\n  },\n};\n\nexport const webhookAuthVerifiers = {\n  none: noneVerifier,\n  bearer: bearerVerifier,\n  apiKey: apiKeyVerifier,\n  basic: basicVerifier,\n  hmac: hmacVerifier,\n} satisfies WebhookAuthVerifierRegistry;\n\nexport async function verifyWebhookAuth({\n  config,\n  request,\n  secrets,\n  now = new Date(),\n}: VerifyWebhookAuthInput): Promise<WebhookAuthResult> {\n  const verifier = getWebhookAuthVerifier(config);\n  let rawBodyBytes: Uint8Array | null = null;\n\n  return await verifier.verify(config, {\n    request,\n    now,\n    secrets,\n    rawBodyBytes: async () => {\n      rawBodyBytes ??= new Uint8Array(await request.clone().arrayBuffer());\n      return rawBodyBytes;\n    },\n  });\n}\n\nexport function getWebhookAuthSecretRefs(\n  config: WebhookAuthConfig,\n): readonly WebhookAuthSecretRef[] {\n  return getWebhookAuthVerifier(config).requiredSecretRefs(config);\n}\n\nexport function getSensitiveWebhookAuthValues(\n  config: WebhookAuthConfig,\n): readonly SensitiveRequestValue[] {\n  return getWebhookAuthVerifier(config).sensitiveRequestValues(config);\n}\n\nfunction getWebhookAuthVerifier<TConfig extends WebhookAuthConfig>(\n  config: TConfig,\n): WebhookAuthVerifier<TConfig> {\n  return webhookAuthVerifiers[config.type] as WebhookAuthVerifier<TConfig>;\n}\n\nasync function buildSignedPayload(\n  config: Extract<WebhookAuthConfig, { type: \"hmac\" }>,\n  context: WebhookAuthVerificationContext,\n): Promise<{ ok: true; payload: Uint8Array } | WebhookAuthFailure> {\n  if (config.signedPayload.type === \"rawBody\") {\n    return { ok: true, payload: await context.rawBodyBytes() };\n  }\n\n  const timestamp = context.request.headers.get(config.signedPayload.timestampHeader);\n  if (!timestamp) {\n    return { ok: false, reason: \"missing_credential\" };\n  }\n\n  const timestampMs = parseWebhookTimestampMs(timestamp);\n  if (timestampMs === null) {\n    return { ok: false, reason: \"invalid_credential\" };\n  }\n\n  const toleranceMs = config.signedPayload.toleranceSeconds * 1000;\n  if (Math.abs(context.now.getTime() - timestampMs) > toleranceMs) {\n    return { ok: false, reason: \"timestamp_out_of_range\" };\n  }\n\n  return {\n    ok: true,\n    payload: concatBytes(\n      utf8Bytes(`${config.signedPayload.prefix}${timestamp}${config.signedPayload.delimiter}`),\n      await context.rawBodyBytes(),\n    ),\n  };\n}\n\nfunction normalizeSignature(signature: string, prefix: string | undefined) {\n  const trimmed = signature.trim();\n  if (!prefix) {\n    return trimmed || null;\n  }\n\n  if (!trimmed.startsWith(prefix)) {\n    return null;\n  }\n\n  const withoutPrefix = trimmed.slice(prefix.length).trim();\n  return withoutPrefix || null;\n}\n\nfunction decodeSignature(signature: string, encoding: \"hex\" | \"base64\" | \"base64url\") {\n  if (encoding === \"hex\") {\n    return decodeHex(signature);\n  }\n\n  return decodeBase64(signature, encoding);\n}\n\nfunction parseWebhookTimestampMs(value: string) {\n  const normalized = value.trim();\n  if (!/^\\d+$/.test(normalized)) {\n    return null;\n  }\n\n  const numeric = Number(normalized);\n  if (!Number.isSafeInteger(numeric) || numeric <= 0) {\n    return null;\n  }\n\n  return numeric < 1_000_000_000_000 ? numeric * 1000 : numeric;\n}\n\nfunction concatBytes(first: Uint8Array, second: Uint8Array) {\n  const output = new Uint8Array(first.length + second.length);\n  output.set(first, 0);\n  output.set(second, first.length);\n  return output;\n}\n\nexport { timingSafeEqualBytes, timingSafeEqualText } from \"../crypto\";\n"],"mappings":";;;AAWA,MAAM,kBAAkB,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;AAC/C,MAAM,yBAAyB,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;AAEtD,MAAa,0BAA0B,EAAE,mBAAmB,QAAQ;CAClE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC;CACpC,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,QAAQ;EAAG,UAAU;CAAgB,CAAC;CACjE,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,QAAQ;EACxB,UAAU,EAAE,KAAK,CAAC,UAAU,OAAO,CAAC;EACpC,MAAM;EACN,WAAW;CACb,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,OAAO;EACvB,aAAa;EACb,aAAa;CACf,CAAC;CACD,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,MAAM;EACtB,WAAW;EACX,WAAW,EAAE,KAAK;GAAC;GAAQ;GAAU;EAAQ,CAAC;EAC9C,WAAW,EAAE,OAAO;GAClB,UAAU,EAAE,KAAK,CAAC,UAAU,OAAO,CAAC;GACpC,MAAM;GACN,UAAU,EAAE,KAAK;IAAC;IAAO;IAAU;GAAW,CAAC;GAC/C,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;EAC9B,CAAC;EACD,eAAe,EAAE,mBAAmB,QAAQ,CAC1C,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC,GACvC,EAAE,OAAO;GACP,MAAM,EAAE,QAAQ,iBAAiB;GACjC,QAAQ,EAAE,OAAO;GACjB,iBAAiB;GACjB,WAAW,EAAE,OAAO;GACpB,kBAAkB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS;EAC9C,CAAC,CACH,CAAC;CACH,CAAC;AACH,CAAC;AAkDD,MAAM,oCAAoC,SAAkB,WAA+B;CACzF,MAAM,SAAS,QAAQ,QAAQ,IAAI,eAAe;CAClD,IAAI,CAAC,QACH,OAAO;CAGT,MAAM,CAAC,cAAc,GAAG,QAAQ,OAAO,MAAM,KAAK;CAClD,IAAI,cAAc,YAAY,MAAM,UAAU,KAAK,WAAW,GAC5D,OAAO;CAGT,OAAO,KAAK,KAAK,GAAG;AACtB;AAEA,MAAM,mBACJ,SACA,UACA,SACkB;CAClB,IAAI,aAAa,UACf,OAAO,QAAQ,QAAQ,IAAI,IAAI;CAGjC,OAAO,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,aAAa,IAAI,IAAI;AACnD;AAMA,MAAM,gBAAgB,OACpB,SACA,QAC4B;CAC5B,MAAM,SAAS,MAAM,QAAQ,QAAQ,IAAI,GAAG;CAC5C,IAAI,CAAC,QACH,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAiB;CAG/C,OAAO;EAAE,IAAI;EAAM;CAAO;AAC5B;AAyIA,MAAa,uBAAuB;CAClC,MAAM;EAvIN,MAAM;EACN,0BAA0B,CAAC;EAC3B,8BAA8B,CAAC;EAC/B,QAAQ,aAAa,EAAE,IAAI,KAAK;CAoI1B;CACN,QAAQ;EAjIR,MAAM;EACN,qBAAqB,WAAW,CAAC,OAAO,QAAQ;EAChD,8BAA8B,CAAC;GAAE,UAAU;GAAU,MAAM;EAAgB,CAAC;EAC5E,QAAQ,OAAO,QAAQ,YAAY;GACjC,MAAM,SAAS,MAAM,cAAc,SAAS,OAAO,QAAQ;GAC3D,IAAI,CAAC,OAAO,IACV,OAAO;GAGT,MAAM,QAAQ,iCAAiC,QAAQ,SAAS,QAAQ;GACxE,IAAI,CAAC,OACH,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAqB;GAGnD,OAAQ,MAAMA,oBAAiB,OAAO,OAAO,MAAM,IAC/C,EAAE,IAAI,KAAK,IACX;IAAE,IAAI;IAAO,QAAQ;GAAqB;EAChD;CAgHQ;CACR,QAAQ;EA7GR,MAAM;EACN,qBAAqB,WAAW,CAAC,OAAO,SAAS;EACjD,yBAAyB,WAAW,CAAC;GAAE,UAAU,OAAO;GAAU,MAAM,OAAO;EAAK,CAAC;EACrF,QAAQ,OAAO,QAAQ,YAAY;GACjC,MAAM,SAAS,MAAM,cAAc,SAAS,OAAO,SAAS;GAC5D,IAAI,CAAC,OAAO,IACV,OAAO;GAGT,MAAM,aAAa,gBAAgB,QAAQ,SAAS,OAAO,UAAU,OAAO,IAAI;GAChF,IAAI,CAAC,YACH,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAqB;GAGnD,OAAQ,MAAMA,oBAAiB,YAAY,OAAO,MAAM,IACpD,EAAE,IAAI,KAAK,IACX;IAAE,IAAI;IAAO,QAAQ;GAAqB;EAChD;CA4FQ;CACR,OAAO;EAzFP,MAAM;EACN,qBAAqB,WAAW,CAAC,OAAO,aAAa,OAAO,WAAW;EACvE,8BAA8B,CAAC;GAAE,UAAU;GAAU,MAAM;EAAgB,CAAC;EAC5E,QAAQ,OAAO,QAAQ,YAAY;GACjC,MAAM,WAAW,MAAM,cAAc,SAAS,OAAO,WAAW;GAChE,IAAI,CAAC,SAAS,IACZ,OAAO;GAET,MAAM,WAAW,MAAM,cAAc,SAAS,OAAO,WAAW;GAChE,IAAI,CAAC,SAAS,IACZ,OAAO;GAGT,MAAM,oBAAoB,iCAAiC,QAAQ,SAAS,OAAO;GACnF,IAAI,CAAC,mBACH,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAqB;GAGnD,MAAM,oBAAoB,mBAAmB,mBAAmB,QAAQ;GACxE,IAAI,sBAAsB,MACxB,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAqB;GAGnD,MAAM,iBAAiB,kBAAkB,QAAQ,GAAG;GACpD,IAAI,mBAAmB,IACrB,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAqB;GAGnD,MAAM,iBAAiB,kBAAkB,MAAM,GAAG,cAAc;GAChE,MAAM,iBAAiB,kBAAkB,MAAM,iBAAiB,CAAC;GAEjE,OAAQ,MAAMA,oBAAiB,gBAAgB,SAAS,MAAM,KAC3D,MAAMA,oBAAiB,gBAAgB,SAAS,MAAM,IACrD,EAAE,IAAI,KAAK,IACX;IAAE,IAAI;IAAO,QAAQ;GAAqB;EAChD;CAsDO;CACP,MAAM;EAnDN,MAAM;EACN,qBAAqB,WAAW,CAAC,OAAO,SAAS;EACjD,yBAAyB,WAAW,CAClC;GAAE,UAAU,OAAO,UAAU;GAAU,MAAM,OAAO,UAAU;EAAK,CACrE;EACA,QAAQ,OAAO,QAAQ,YAAY;GACjC,MAAM,SAAS,MAAM,cAAc,SAAS,OAAO,SAAS;GAC5D,IAAI,CAAC,OAAO,IACV,OAAO;GAGT,MAAM,iBAAiB,gBACrB,QAAQ,SACR,OAAO,UAAU,UACjB,OAAO,UAAU,IACnB;GACA,IAAI,CAAC,gBACH,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAqB;GAGnD,MAAM,sBAAsB,mBAAmB,gBAAgB,OAAO,UAAU,MAAM;GACtF,IAAI,wBAAwB,MAC1B,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAqB;GAGnD,MAAM,gBAAgB,MAAM,mBAAmB,QAAQ,OAAO;GAC9D,IAAI,CAAC,cAAc,IACjB,OAAO;GAGT,MAAM,oBAAoB,gBAAgB,qBAAqB,OAAO,UAAU,QAAQ;GACxF,IAAI,CAAC,mBACH,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAqB;GAGnD,OAAQ,MAAM,oBAAoB;IAChC,WAAW,OAAO;IAClB,QAAQ,OAAO;IACf,SAAS,cAAc;IACvB,WAAW;GACb,CAAC,IACG,EAAE,IAAI,KAAK,IACX;IAAE,IAAI;IAAO,QAAQ;GAAqB;EAChD;CAQM;AACR;AAEA,eAAsB,kBAAkB,EACtC,QACA,SACA,SACA,sBAAM,IAAI,KAAK,KACsC;CACrD,MAAM,WAAW,uBAAuB,MAAM;CAC9C,IAAI,eAAkC;CAEtC,OAAO,MAAM,SAAS,OAAO,QAAQ;EACnC;EACA;EACA;EACA,cAAc,YAAY;GACxB,iBAAiB,IAAI,WAAW,MAAM,QAAQ,MAAM,CAAC,CAAC,YAAY,CAAC;GACnE,OAAO;EACT;CACF,CAAC;AACH;AAEA,SAAgB,yBACd,QACiC;CACjC,OAAO,uBAAuB,MAAM,CAAC,CAAC,mBAAmB,MAAM;AACjE;AAEA,SAAgB,8BACd,QACkC;CAClC,OAAO,uBAAuB,MAAM,CAAC,CAAC,uBAAuB,MAAM;AACrE;AAEA,SAAS,uBACP,QAC8B;CAC9B,OAAO,qBAAqB,OAAO;AACrC;AAEA,eAAe,mBACb,QACA,SACiE;CACjE,IAAI,OAAO,cAAc,SAAS,WAChC,OAAO;EAAE,IAAI;EAAM,SAAS,MAAM,QAAQ,aAAa;CAAE;CAG3D,MAAM,YAAY,QAAQ,QAAQ,QAAQ,IAAI,OAAO,cAAc,eAAe;CAClF,IAAI,CAAC,WACH,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAqB;CAGnD,MAAM,cAAc,wBAAwB,SAAS;CACrD,IAAI,gBAAgB,MAClB,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAqB;CAGnD,MAAM,cAAc,OAAO,cAAc,mBAAmB;CAC5D,IAAI,KAAK,IAAI,QAAQ,IAAI,QAAQ,IAAI,WAAW,IAAI,aAClD,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAyB;CAGvD,OAAO;EACL,IAAI;EACJ,SAAS,YACP,UAAU,GAAG,OAAO,cAAc,SAAS,YAAY,OAAO,cAAc,WAAW,GACvF,MAAM,QAAQ,aAAa,CAC7B;CACF;AACF;AAEA,SAAS,mBAAmB,WAAmB,QAA4B;CACzE,MAAM,UAAU,UAAU,KAAK;CAC/B,IAAI,CAAC,QACH,OAAO,WAAW;CAGpB,IAAI,CAAC,QAAQ,WAAW,MAAM,GAC5B,OAAO;CAIT,OADsB,QAAQ,MAAM,OAAO,MAAM,CAAC,CAAC,KAChC,KAAK;AAC1B;AAEA,SAAS,gBAAgB,WAAmB,UAA0C;CACpF,IAAI,aAAa,OACf,OAAO,UAAU,SAAS;CAG5B,OAAO,aAAa,WAAW,QAAQ;AACzC;AAEA,SAAS,wBAAwB,OAAe;CAC9C,MAAM,aAAa,MAAM,KAAK;CAC9B,IAAI,CAAC,QAAQ,KAAK,UAAU,GAC1B,OAAO;CAGT,MAAM,UAAU,OAAO,UAAU;CACjC,IAAI,CAAC,OAAO,cAAc,OAAO,KAAK,WAAW,GAC/C,OAAO;CAGT,OAAO,UAAU,eAAoB,UAAU,MAAO;AACxD;AAEA,SAAS,YAAY,OAAmB,QAAoB;CAC1D,MAAM,SAAS,IAAI,WAAW,MAAM,SAAS,OAAO,MAAM;CAC1D,OAAO,IAAI,OAAO,CAAC;CACnB,OAAO,IAAI,QAAQ,MAAM,MAAM;CAC/B,OAAO;AACT"}

package/dist/node/webhooks/verification.d.ts

@@ -0,0 +1,102 @@
+import { z } from "zod";
+//#region src/webhooks/verification.d.ts
+declare const webhookRequestValueSourceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  type: z.ZodLiteral<"header">;
+  name: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+  type: z.ZodLiteral<"query">;
+  name: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+  type: z.ZodLiteral<"jsonBodyPath">;
+  path: z.ZodArray<z.ZodString>;
+}, z.core.$strip>], "type">;
+declare const webhookVerificationConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+  type: z.ZodLiteral<"none">;
+}, z.core.$strip>, z.ZodObject<{
+  type: z.ZodLiteral<"challenge">;
+  method: z.ZodEnum<{
+    GET: "GET";
+    POST: "POST";
+  }>;
+  when: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"present">;
+    source: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      type: z.ZodLiteral<"header">;
+      name: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+      type: z.ZodLiteral<"query">;
+      name: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+      type: z.ZodLiteral<"jsonBodyPath">;
+      path: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>], "type">;
+  }, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"equals">;
+    source: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      type: z.ZodLiteral<"header">;
+      name: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+      type: z.ZodLiteral<"query">;
+      name: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+      type: z.ZodLiteral<"jsonBodyPath">;
+      path: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>], "type">;
+    value: z.ZodString;
+  }, z.core.$strip>], "type">;
+  response: z.ZodObject<{
+    type: z.ZodLiteral<"echoText">;
+    source: z.ZodDiscriminatedUnion<[z.ZodObject<{
+      type: z.ZodLiteral<"header">;
+      name: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+      type: z.ZodLiteral<"query">;
+      name: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+      type: z.ZodLiteral<"jsonBodyPath">;
+      path: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>], "type">;
+  }, z.core.$strip>;
+}, z.core.$strip>], "type">;
+type WebhookRequestValueSource = z.infer<typeof webhookRequestValueSourceSchema>;
+type WebhookVerificationConfig = z.infer<typeof webhookVerificationConfigSchema>;
+type WebhookJsonBodyResult = {
+  ok: true;
+  body: Record<string, unknown>;
+} | {
+  ok: false;
+  reason: "invalid_json" | "invalid_value";
+};
+type WebhookRequestValueResult = {
+  ok: true;
+  value: string;
+} | {
+  ok: false;
+  reason: "missing" | "invalid_json" | "invalid_value";
+};
+type WebhookRequestValues = {
+  jsonBody(): WebhookJsonBodyResult;
+  read(source: WebhookRequestValueSource): WebhookRequestValueResult;
+};
+type WebhookVerificationResult = {
+  type: "not_verification";
+} | {
+  type: "response";
+  body: string;
+} | {
+  type: "invalid_response";
+  reason: "missing" | "invalid_json" | "invalid_value";
+};
+declare function createWebhookRequestValues(input: {
+  headers: Headers;
+  query: URLSearchParams;
+  rawBody: string | undefined;
+}): WebhookRequestValues;
+declare function evaluateWebhookVerification(input: {
+  config: WebhookVerificationConfig;
+  method: "GET" | "POST";
+  requestValues: WebhookRequestValues;
+}): WebhookVerificationResult;
+//#endregion
+export { WebhookJsonBodyResult, WebhookRequestValueResult, WebhookRequestValueSource, WebhookRequestValues, WebhookVerificationConfig, WebhookVerificationResult, createWebhookRequestValues, evaluateWebhookVerification, webhookRequestValueSourceSchema, webhookVerificationConfigSchema };
+//# sourceMappingURL=verification.d.ts.map

package/dist/node/webhooks/verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.d.ts","names":[],"sources":["../../../src/webhooks/verification.ts"],"mappings":";;cAIa,iCAA+B,EAAA,uBAAA,EAAA;;;;;;;;;;cAqB/B,iCAA+B,EAAA,uBAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAahC,4BAA4B,EAAE,aAAa;KAC3C,4BAA4B,EAAE,aAAa;KAE3C;EACN;EAAU,MAAM;;EAChB;EAAW;;KAEL;EACN;EAAU;;EACV;EAAW;;KAEL;EACV,YAAY;EACZ,KAAK,QAAQ,4BAA4B;;KAG/B;EACN;;EACA;EAAkB;;EAElB;EACA;;iBAGU,2BAA2B;EACzC,SAAS;EACT,OAAO;EACP;IACE;iBAgDY,4BAA4B;EAC1C,QAAQ;EACR;EACA,eAAe;IACb"}

package/dist/node/webhooks/verification.js

@@ -0,0 +1,119 @@
+import { z } from "zod";
+//#region src/webhooks/verification.ts
+const webhookRequestValueNameSchema = z.string().trim().min(1);
+const webhookRequestValueSourceSchema = z.discriminatedUnion("type", [
+	z.object({
+		type: z.literal("header"),
+		name: webhookRequestValueNameSchema
+	}),
+	z.object({
+		type: z.literal("query"),
+		name: webhookRequestValueNameSchema
+	}),
+	z.object({
+		type: z.literal("jsonBodyPath"),
+		path: z.array(z.string().trim().min(1)).min(1)
+	})
+]);
+const webhookVerificationPredicateSchema = z.discriminatedUnion("type", [z.object({
+	type: z.literal("present"),
+	source: webhookRequestValueSourceSchema
+}), z.object({
+	type: z.literal("equals"),
+	source: webhookRequestValueSourceSchema,
+	value: z.string().min(1)
+})]);
+const webhookVerificationConfigSchema = z.discriminatedUnion("type", [z.object({ type: z.literal("none") }), z.object({
+	type: z.literal("challenge"),
+	method: z.enum(["GET", "POST"]),
+	when: webhookVerificationPredicateSchema,
+	response: z.object({
+		type: z.literal("echoText"),
+		source: webhookRequestValueSourceSchema
+	})
+})]);
+function createWebhookRequestValues(input) {
+	let parsedJsonBody;
+	function jsonBody() {
+		if (parsedJsonBody) return parsedJsonBody;
+		let value;
+		try {
+			value = JSON.parse(input.rawBody ?? "");
+		} catch {
+			parsedJsonBody = {
+				ok: false,
+				reason: "invalid_json"
+			};
+			return parsedJsonBody;
+		}
+		parsedJsonBody = isJsonObject(value) ? {
+			ok: true,
+			body: value
+		} : {
+			ok: false,
+			reason: "invalid_value"
+		};
+		return parsedJsonBody;
+	}
+	function read(source) {
+		if (source.type === "header") return requestValue(input.headers.get(source.name));
+		if (source.type === "query") return requestValue(input.query.get(source.name));
+		const body = jsonBody();
+		if (!body.ok) return body;
+		let value = body.body;
+		for (const segment of source.path) {
+			if (!isJsonObject(value) || !(segment in value)) return {
+				ok: false,
+				reason: "missing"
+			};
+			value = value[segment];
+		}
+		return requestValue(value);
+	}
+	return {
+		jsonBody,
+		read
+	};
+}
+function evaluateWebhookVerification(input) {
+	if (input.config.type === "none" || input.config.method !== input.method) return { type: "not_verification" };
+	const predicateValue = input.requestValues.read(input.config.when.source);
+	if (!predicateValue.ok) return { type: "not_verification" };
+	if (!(input.config.when.type === "present" || predicateValue.value === input.config.when.value)) return { type: "not_verification" };
+	const responseValue = input.requestValues.read(input.config.response.source);
+	if (!responseValue.ok) return {
+		type: "invalid_response",
+		reason: responseValue.reason
+	};
+	return {
+		type: "response",
+		body: responseValue.value
+	};
+}
+function requestValue(value) {
+	if (typeof value === "string") return value.length > 0 ? {
+		ok: true,
+		value
+	} : {
+		ok: false,
+		reason: "missing"
+	};
+	if (typeof value === "number") return {
+		ok: true,
+		value: `${value}`
+	};
+	return value == null ? {
+		ok: false,
+		reason: "missing"
+	} : {
+		ok: false,
+		reason: "invalid_value"
+	};
+}
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+export { createWebhookRequestValues, evaluateWebhookVerification, webhookRequestValueSourceSchema, webhookVerificationConfigSchema };
+
+//# sourceMappingURL=verification.js.map

package/dist/node/webhooks/verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification.js","names":[],"sources":["../../../src/webhooks/verification.ts"],"sourcesContent":["import { z } from \"zod\";\n\nconst webhookRequestValueNameSchema = z.string().trim().min(1);\n\nexport const webhookRequestValueSourceSchema = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"header\"), name: webhookRequestValueNameSchema }),\n  z.object({ type: z.literal(\"query\"), name: webhookRequestValueNameSchema }),\n  z.object({\n    type: z.literal(\"jsonBodyPath\"),\n    path: z.array(z.string().trim().min(1)).min(1),\n  }),\n]);\n\nconst webhookVerificationPredicateSchema = z.discriminatedUnion(\"type\", [\n  z.object({\n    type: z.literal(\"present\"),\n    source: webhookRequestValueSourceSchema,\n  }),\n  z.object({\n    type: z.literal(\"equals\"),\n    source: webhookRequestValueSourceSchema,\n    value: z.string().min(1),\n  }),\n]);\n\nexport const webhookVerificationConfigSchema = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"none\") }),\n  z.object({\n    type: z.literal(\"challenge\"),\n    method: z.enum([\"GET\", \"POST\"]),\n    when: webhookVerificationPredicateSchema,\n    response: z.object({\n      type: z.literal(\"echoText\"),\n      source: webhookRequestValueSourceSchema,\n    }),\n  }),\n]);\n\nexport type WebhookRequestValueSource = z.infer<typeof webhookRequestValueSourceSchema>;\nexport type WebhookVerificationConfig = z.infer<typeof webhookVerificationConfigSchema>;\n\nexport type WebhookJsonBodyResult =\n  | { ok: true; body: Record<string, unknown> }\n  | { ok: false; reason: \"invalid_json\" | \"invalid_value\" };\n\nexport type WebhookRequestValueResult =\n  | { ok: true; value: string }\n  | { ok: false; reason: \"missing\" | \"invalid_json\" | \"invalid_value\" };\n\nexport type WebhookRequestValues = {\n  jsonBody(): WebhookJsonBodyResult;\n  read(source: WebhookRequestValueSource): WebhookRequestValueResult;\n};\n\nexport type WebhookVerificationResult =\n  | { type: \"not_verification\" }\n  | { type: \"response\"; body: string }\n  | {\n      type: \"invalid_response\";\n      reason: \"missing\" | \"invalid_json\" | \"invalid_value\";\n    };\n\nexport function createWebhookRequestValues(input: {\n  headers: Headers;\n  query: URLSearchParams;\n  rawBody: string | undefined;\n}): WebhookRequestValues {\n  let parsedJsonBody: WebhookJsonBodyResult | undefined;\n\n  function jsonBody(): WebhookJsonBodyResult {\n    if (parsedJsonBody) {\n      return parsedJsonBody;\n    }\n\n    let value: unknown;\n    try {\n      value = JSON.parse(input.rawBody ?? \"\");\n    } catch {\n      parsedJsonBody = { ok: false, reason: \"invalid_json\" };\n      return parsedJsonBody;\n    }\n\n    parsedJsonBody = isJsonObject(value)\n      ? { ok: true, body: value }\n      : { ok: false, reason: \"invalid_value\" };\n    return parsedJsonBody;\n  }\n\n  function read(source: WebhookRequestValueSource): WebhookRequestValueResult {\n    if (source.type === \"header\") {\n      return requestValue(input.headers.get(source.name));\n    }\n    if (source.type === \"query\") {\n      return requestValue(input.query.get(source.name));\n    }\n\n    const body = jsonBody();\n    if (!body.ok) {\n      return body;\n    }\n\n    let value: unknown = body.body;\n    for (const segment of source.path) {\n      if (!isJsonObject(value) || !(segment in value)) {\n        return { ok: false, reason: \"missing\" };\n      }\n      value = value[segment];\n    }\n    return requestValue(value);\n  }\n\n  return { jsonBody, read };\n}\n\nexport function evaluateWebhookVerification(input: {\n  config: WebhookVerificationConfig;\n  method: \"GET\" | \"POST\";\n  requestValues: WebhookRequestValues;\n}): WebhookVerificationResult {\n  if (input.config.type === \"none\" || input.config.method !== input.method) {\n    return { type: \"not_verification\" };\n  }\n\n  const predicateValue = input.requestValues.read(input.config.when.source);\n  if (!predicateValue.ok) {\n    return { type: \"not_verification\" };\n  }\n\n  const matches =\n    input.config.when.type === \"present\" || predicateValue.value === input.config.when.value;\n  if (!matches) {\n    return { type: \"not_verification\" };\n  }\n\n  const responseValue = input.requestValues.read(input.config.response.source);\n  if (!responseValue.ok) {\n    return { type: \"invalid_response\", reason: responseValue.reason };\n  }\n\n  return { type: \"response\", body: responseValue.value };\n}\n\nfunction requestValue(value: unknown): WebhookRequestValueResult {\n  if (typeof value === \"string\") {\n    return value.length > 0 ? { ok: true, value } : { ok: false, reason: \"missing\" };\n  }\n  if (typeof value === \"number\") {\n    return { ok: true, value: `${value}` };\n  }\n  return value == null ? { ok: false, reason: \"missing\" } : { ok: false, reason: \"invalid_value\" };\n}\n\nfunction isJsonObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n"],"mappings":";;AAEA,MAAM,gCAAgC,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;AAE7D,MAAa,kCAAkC,EAAE,mBAAmB,QAAQ;CAC1E,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,QAAQ;EAAG,MAAM;CAA8B,CAAC;CAC3E,EAAE,OAAO;EAAE,MAAM,EAAE,QAAQ,OAAO;EAAG,MAAM;CAA8B,CAAC;CAC1E,EAAE,OAAO;EACP,MAAM,EAAE,QAAQ,cAAc;EAC9B,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;CAC/C,CAAC;AACH,CAAC;AAED,MAAM,qCAAqC,EAAE,mBAAmB,QAAQ,CACtE,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,SAAS;CACzB,QAAQ;AACV,CAAC,GACD,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,QAAQ;CACxB,QAAQ;CACR,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC,CACH,CAAC;AAED,MAAa,kCAAkC,EAAE,mBAAmB,QAAQ,CAC1E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC,GACpC,EAAE,OAAO;CACP,MAAM,EAAE,QAAQ,WAAW;CAC3B,QAAQ,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC;CAC9B,MAAM;CACN,UAAU,EAAE,OAAO;EACjB,MAAM,EAAE,QAAQ,UAAU;EAC1B,QAAQ;CACV,CAAC;AACH,CAAC,CACH,CAAC;AA0BD,SAAgB,2BAA2B,OAIlB;CACvB,IAAI;CAEJ,SAAS,WAAkC;EACzC,IAAI,gBACF,OAAO;EAGT,IAAI;EACJ,IAAI;GACF,QAAQ,KAAK,MAAM,MAAM,WAAW,EAAE;EACxC,QAAQ;GACN,iBAAiB;IAAE,IAAI;IAAO,QAAQ;GAAe;GACrD,OAAO;EACT;EAEA,iBAAiB,aAAa,KAAK,IAC/B;GAAE,IAAI;GAAM,MAAM;EAAM,IACxB;GAAE,IAAI;GAAO,QAAQ;EAAgB;EACzC,OAAO;CACT;CAEA,SAAS,KAAK,QAA8D;EAC1E,IAAI,OAAO,SAAS,UAClB,OAAO,aAAa,MAAM,QAAQ,IAAI,OAAO,IAAI,CAAC;EAEpD,IAAI,OAAO,SAAS,SAClB,OAAO,aAAa,MAAM,MAAM,IAAI,OAAO,IAAI,CAAC;EAGlD,MAAM,OAAO,SAAS;EACtB,IAAI,CAAC,KAAK,IACR,OAAO;EAGT,IAAI,QAAiB,KAAK;EAC1B,KAAK,MAAM,WAAW,OAAO,MAAM;GACjC,IAAI,CAAC,aAAa,KAAK,KAAK,EAAE,WAAW,QACvC,OAAO;IAAE,IAAI;IAAO,QAAQ;GAAU;GAExC,QAAQ,MAAM;EAChB;EACA,OAAO,aAAa,KAAK;CAC3B;CAEA,OAAO;EAAE;EAAU;CAAK;AAC1B;AAEA,SAAgB,4BAA4B,OAId;CAC5B,IAAI,MAAM,OAAO,SAAS,UAAU,MAAM,OAAO,WAAW,MAAM,QAChE,OAAO,EAAE,MAAM,mBAAmB;CAGpC,MAAM,iBAAiB,MAAM,cAAc,KAAK,MAAM,OAAO,KAAK,MAAM;CACxE,IAAI,CAAC,eAAe,IAClB,OAAO,EAAE,MAAM,mBAAmB;CAKpC,IAAI,EADF,MAAM,OAAO,KAAK,SAAS,aAAa,eAAe,UAAU,MAAM,OAAO,KAAK,QAEnF,OAAO,EAAE,MAAM,mBAAmB;CAGpC,MAAM,gBAAgB,MAAM,cAAc,KAAK,MAAM,OAAO,SAAS,MAAM;CAC3E,IAAI,CAAC,cAAc,IACjB,OAAO;EAAE,MAAM;EAAoB,QAAQ,cAAc;CAAO;CAGlE,OAAO;EAAE,MAAM;EAAY,MAAM,cAAc;CAAM;AACvD;AAEA,SAAS,aAAa,OAA2C;CAC/D,IAAI,OAAO,UAAU,UACnB,OAAO,MAAM,SAAS,IAAI;EAAE,IAAI;EAAM;CAAM,IAAI;EAAE,IAAI;EAAO,QAAQ;CAAU;CAEjF,IAAI,OAAO,UAAU,UACnB,OAAO;EAAE,IAAI;EAAM,OAAO,GAAG;CAAQ;CAEvC,OAAO,SAAS,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAU,IAAI;EAAE,IAAI;EAAO,QAAQ;CAAgB;AACjG;AAEA,SAAS,aAAa,OAAkD;CACtE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E"}