@invect/webhooks 0.0.1 → 0.0.3

package/dist/backend/index.d.cts

@@ -0,0 +1,115 @@
+import { InvectPluginDefinition } from "@invect/core";
+
+//#region src/backend/plugin.d.ts
+interface WebhooksPluginOptions {
+  /** Base URL for webhook endpoints (e.g. "https://example.com/api/invect") */
+  webhookBaseUrl?: string;
+  /** Rate limit: max requests per window. @default 60 */
+  rateLimitMaxRequests?: number;
+  /** Rate limit: window size in ms. @default 60000 */
+  rateLimitWindowMs?: number;
+  /** Dedup TTL in ms. @default 86400000 (24h) */
+  dedupTtlMs?: number;
+  /**
+   * Frontend plugin (sidebar, routes) for the webhooks UI.
+   *
+   * Import from `@invect/webhooks/ui` and pass here.
+   * Omit for backend-only setups.
+   */
+  frontend?: unknown;
+}
+declare function webhooks(options?: WebhooksPluginOptions): InvectPluginDefinition;
+//#endregion
+//#region src/backend/webhook-signature.service.d.ts
+/**
+ * Webhook Signature Verification Service
+ *
+ * Validates HMAC signatures from webhook providers (GitHub, Slack, Stripe, Linear, etc.).
+ * Moved from @invect/core to the webhooks plugin.
+ */
+interface WebhookProviderSignatureConfig {
+  signatureHeader: string;
+  algorithm: 'sha256' | 'sha1';
+  signaturePrefix: string;
+  deliveryIdHeader?: string;
+  eventTypeHeader?: string;
+}
+declare const WEBHOOK_PROVIDER_SIGNATURES: Record<string, WebhookProviderSignatureConfig>;
+type LoggerLike = {
+  warn: (msg: string, meta?: unknown) => void;
+  error: (msg: string, meta?: unknown) => void;
+};
+declare class WebhookSignatureService {
+  private readonly logger;
+  constructor(logger: LoggerLike);
+  verify(provider: string, secret: string, rawBody: string | Buffer, headers: Record<string, string>): {
+    valid: boolean;
+    error?: string;
+  };
+  getDeliveryId(provider: string, headers: Record<string, string>): string | undefined;
+  getEventType(provider: string, headers: Record<string, string>): string | undefined;
+  /**
+   * Verify a custom HMAC signature where the user specifies the header name and secret.
+   * Supports hex-encoded SHA-256 signatures, with or without a `sha256=` prefix.
+   */
+  verifyCustomHmac(secret: string, headerName: string, rawBody: string | Buffer, headers: Record<string, string>): {
+    valid: boolean;
+    error?: string;
+  };
+  private verifyHmac;
+  private verifySlack;
+  private verifyStripe;
+}
+//#endregion
+//#region src/backend/webhook-rate-limiter.d.ts
+/**
+ * Webhook Rate Limiter — sliding-window in-memory rate limiter.
+ * Moved from @invect/core to the webhooks plugin.
+ */
+interface RateLimiterOptions {
+  maxRequests?: number;
+  windowMs?: number;
+}
+declare class WebhookRateLimiter {
+  private readonly maxRequests;
+  private readonly windowMs;
+  private readonly windows;
+  private cleanupTimer;
+  constructor(options?: RateLimiterOptions);
+  check(key: string): {
+    allowed: boolean;
+    retryAfterMs?: number;
+    remaining?: number;
+  };
+  private cleanup;
+  dispose(): void;
+}
+//#endregion
+//#region src/backend/webhook-dedup.service.d.ts
+/**
+ * Webhook Dedup Service — prevents duplicate webhook events.
+ * Moved from @invect/core to the webhooks plugin.
+ */
+interface WebhookDedupOptions {
+  ttlMs?: number;
+  maxEntries?: number;
+}
+interface DedupEntry {
+  createdAt: number;
+  flowRunIds: string[];
+}
+declare class WebhookDedupService {
+  private readonly ttlMs;
+  private readonly maxEntries;
+  private readonly entries;
+  private cleanupTimer;
+  constructor(options?: WebhookDedupOptions);
+  private key;
+  check(webhookPath: string, deliveryId: string | undefined): DedupEntry | null;
+  record(webhookPath: string, deliveryId: string | undefined, flowRunIds: string[]): void;
+  private cleanup;
+  dispose(): void;
+}
+//#endregion
+export { WEBHOOK_PROVIDER_SIGNATURES, WebhookDedupService, type WebhookProviderSignatureConfig, WebhookRateLimiter, WebhookSignatureService, type WebhooksPluginOptions, webhooks };
+//# sourceMappingURL=index.d.cts.map

package/dist/backend/index.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/backend/plugin.ts","../../src/backend/webhook-signature.service.ts","../../src/backend/webhook-rate-limiter.ts","../../src/backend/webhook-dedup.service.ts"],"mappings":";;;UA4BiB,qBAAA;EAQf;EANA,cAAA;EAcQ;EAZR,oBAAA;EA6Ec;EA3Ed,iBAAA;;EAEA,UAAA;EAyEiC;;;;;;EAjEjC,QAAA;AAAA;AAAA,iBAiEc,QAAA,CAAS,OAAA,GAAU,qBAAA,GAAwB,sBAAA;;;;;;AAjF3D;;;UCjBiB,8BAAA;EACf,eAAA;EACA,SAAA;EACA,eAAA;EACA,gBAAA;EACA,eAAA;AAAA;AAAA,cAGW,2BAAA,EAA6B,MAAA,SAAe,8BAAA;AAAA,KAiCpD,UAAA;EACH,IAAA,GAAO,GAAA,UAAa,IAAA;EACpB,KAAA,GAAQ,GAAA,UAAa,IAAA;AAAA;AAAA,cAGV,uBAAA;EAAA,iBACkB,MAAA;cAAA,MAAA,EAAQ,UAAA;EAErC,MAAA,CACE,QAAA,UACA,MAAA,UACA,OAAA,WAAkB,MAAA,EAClB,OAAA,EAAS,MAAA;IACN,KAAA;IAAgB,KAAA;EAAA;EAsCrB,aAAA,CAAc,QAAA,UAAkB,OAAA,EAAS,MAAA;EAWzC,YAAA,CAAa,QAAA,UAAkB,OAAA,EAAS,MAAA;EAvGK;;;;EAsH7C,gBAAA,CACE,MAAA,UACA,UAAA,UACA,OAAA,WAAkB,MAAA,EAClB,OAAA,EAAS,MAAA;IACN,KAAA;IAAgB,KAAA;EAAA;EAAA,QAkCb,UAAA;EAAA,QAqBA,WAAA;EAAA,QAiCA,YAAA;AAAA;;;;;;ADlMV;UEvBiB,kBAAA;EACf,WAAA;EACA,QAAA;AAAA;AAAA,cAOW,kBAAA;EAAA,iBACM,WAAA;EAAA,iBACA,QAAA;EAAA,iBACA,OAAA;EAAA,QACT,YAAA;cAEI,OAAA,GAAU,kBAAA;EAUtB,KAAA,CAAM,GAAA;IAAgB,OAAA;IAAkB,YAAA;IAAuB,SAAA;EAAA;EAAA,QAsBvD,OAAA;EAYR,OAAA,CAAA;AAAA;;;;;;AFpCF;UGvBiB,mBAAA;EACf,KAAA;EACA,UAAA;AAAA;AAAA,UAGQ,UAAA;EACR,SAAA;EACA,UAAA;AAAA;AAAA,cAGW,mBAAA;EAAA,iBACM,KAAA;EAAA,iBACA,UAAA;EAAA,iBACA,OAAA;EAAA,QACT,YAAA;cAEI,OAAA,GAAU,mBAAA;EAAA,QAUd,GAAA;EAIR,KAAA,CAAM,WAAA,UAAqB,UAAA,uBAAiC,UAAA;EAmB5D,MAAA,CAAO,WAAA,UAAqB,UAAA,sBAAgC,UAAA;EAAA,QAiBpD,OAAA;EASR,OAAA,CAAA;AAAA"}

package/dist/backend/index.d.mts

@@ -0,0 +1,115 @@
+import { InvectPluginDefinition } from "@invect/core";
+
+//#region src/backend/plugin.d.ts
+interface WebhooksPluginOptions {
+  /** Base URL for webhook endpoints (e.g. "https://example.com/api/invect") */
+  webhookBaseUrl?: string;
+  /** Rate limit: max requests per window. @default 60 */
+  rateLimitMaxRequests?: number;
+  /** Rate limit: window size in ms. @default 60000 */
+  rateLimitWindowMs?: number;
+  /** Dedup TTL in ms. @default 86400000 (24h) */
+  dedupTtlMs?: number;
+  /**
+   * Frontend plugin (sidebar, routes) for the webhooks UI.
+   *
+   * Import from `@invect/webhooks/ui` and pass here.
+   * Omit for backend-only setups.
+   */
+  frontend?: unknown;
+}
+declare function webhooks(options?: WebhooksPluginOptions): InvectPluginDefinition;
+//#endregion
+//#region src/backend/webhook-signature.service.d.ts
+/**
+ * Webhook Signature Verification Service
+ *
+ * Validates HMAC signatures from webhook providers (GitHub, Slack, Stripe, Linear, etc.).
+ * Moved from @invect/core to the webhooks plugin.
+ */
+interface WebhookProviderSignatureConfig {
+  signatureHeader: string;
+  algorithm: 'sha256' | 'sha1';
+  signaturePrefix: string;
+  deliveryIdHeader?: string;
+  eventTypeHeader?: string;
+}
+declare const WEBHOOK_PROVIDER_SIGNATURES: Record<string, WebhookProviderSignatureConfig>;
+type LoggerLike = {
+  warn: (msg: string, meta?: unknown) => void;
+  error: (msg: string, meta?: unknown) => void;
+};
+declare class WebhookSignatureService {
+  private readonly logger;
+  constructor(logger: LoggerLike);
+  verify(provider: string, secret: string, rawBody: string | Buffer, headers: Record<string, string>): {
+    valid: boolean;
+    error?: string;
+  };
+  getDeliveryId(provider: string, headers: Record<string, string>): string | undefined;
+  getEventType(provider: string, headers: Record<string, string>): string | undefined;
+  /**
+   * Verify a custom HMAC signature where the user specifies the header name and secret.
+   * Supports hex-encoded SHA-256 signatures, with or without a `sha256=` prefix.
+   */
+  verifyCustomHmac(secret: string, headerName: string, rawBody: string | Buffer, headers: Record<string, string>): {
+    valid: boolean;
+    error?: string;
+  };
+  private verifyHmac;
+  private verifySlack;
+  private verifyStripe;
+}
+//#endregion
+//#region src/backend/webhook-rate-limiter.d.ts
+/**
+ * Webhook Rate Limiter — sliding-window in-memory rate limiter.
+ * Moved from @invect/core to the webhooks plugin.
+ */
+interface RateLimiterOptions {
+  maxRequests?: number;
+  windowMs?: number;
+}
+declare class WebhookRateLimiter {
+  private readonly maxRequests;
+  private readonly windowMs;
+  private readonly windows;
+  private cleanupTimer;
+  constructor(options?: RateLimiterOptions);
+  check(key: string): {
+    allowed: boolean;
+    retryAfterMs?: number;
+    remaining?: number;
+  };
+  private cleanup;
+  dispose(): void;
+}
+//#endregion
+//#region src/backend/webhook-dedup.service.d.ts
+/**
+ * Webhook Dedup Service — prevents duplicate webhook events.
+ * Moved from @invect/core to the webhooks plugin.
+ */
+interface WebhookDedupOptions {
+  ttlMs?: number;
+  maxEntries?: number;
+}
+interface DedupEntry {
+  createdAt: number;
+  flowRunIds: string[];
+}
+declare class WebhookDedupService {
+  private readonly ttlMs;
+  private readonly maxEntries;
+  private readonly entries;
+  private cleanupTimer;
+  constructor(options?: WebhookDedupOptions);
+  private key;
+  check(webhookPath: string, deliveryId: string | undefined): DedupEntry | null;
+  record(webhookPath: string, deliveryId: string | undefined, flowRunIds: string[]): void;
+  private cleanup;
+  dispose(): void;
+}
+//#endregion
+export { WEBHOOK_PROVIDER_SIGNATURES, WebhookDedupService, type WebhookProviderSignatureConfig, WebhookRateLimiter, WebhookSignatureService, type WebhooksPluginOptions, webhooks };
+//# sourceMappingURL=index.d.mts.map

package/dist/backend/index.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/backend/plugin.ts","../../src/backend/webhook-signature.service.ts","../../src/backend/webhook-rate-limiter.ts","../../src/backend/webhook-dedup.service.ts"],"mappings":";;;UA4BiB,qBAAA;EAQf;EANA,cAAA;EAcQ;EAZR,oBAAA;EA6Ec;EA3Ed,iBAAA;;EAEA,UAAA;EAyEiC;;;;;;EAjEjC,QAAA;AAAA;AAAA,iBAiEc,QAAA,CAAS,OAAA,GAAU,qBAAA,GAAwB,sBAAA;;;;;;AAjF3D;;;UCjBiB,8BAAA;EACf,eAAA;EACA,SAAA;EACA,eAAA;EACA,gBAAA;EACA,eAAA;AAAA;AAAA,cAGW,2BAAA,EAA6B,MAAA,SAAe,8BAAA;AAAA,KAiCpD,UAAA;EACH,IAAA,GAAO,GAAA,UAAa,IAAA;EACpB,KAAA,GAAQ,GAAA,UAAa,IAAA;AAAA;AAAA,cAGV,uBAAA;EAAA,iBACkB,MAAA;cAAA,MAAA,EAAQ,UAAA;EAErC,MAAA,CACE,QAAA,UACA,MAAA,UACA,OAAA,WAAkB,MAAA,EAClB,OAAA,EAAS,MAAA;IACN,KAAA;IAAgB,KAAA;EAAA;EAsCrB,aAAA,CAAc,QAAA,UAAkB,OAAA,EAAS,MAAA;EAWzC,YAAA,CAAa,QAAA,UAAkB,OAAA,EAAS,MAAA;EAvGK;;;;EAsH7C,gBAAA,CACE,MAAA,UACA,UAAA,UACA,OAAA,WAAkB,MAAA,EAClB,OAAA,EAAS,MAAA;IACN,KAAA;IAAgB,KAAA;EAAA;EAAA,QAkCb,UAAA;EAAA,QAqBA,WAAA;EAAA,QAiCA,YAAA;AAAA;;;;;;ADlMV;UEvBiB,kBAAA;EACf,WAAA;EACA,QAAA;AAAA;AAAA,cAOW,kBAAA;EAAA,iBACM,WAAA;EAAA,iBACA,QAAA;EAAA,iBACA,OAAA;EAAA,QACT,YAAA;cAEI,OAAA,GAAU,kBAAA;EAUtB,KAAA,CAAM,GAAA;IAAgB,OAAA;IAAkB,YAAA;IAAuB,SAAA;EAAA;EAAA,QAsBvD,OAAA;EAYR,OAAA,CAAA;AAAA;;;;;;AFpCF;UGvBiB,mBAAA;EACf,KAAA;EACA,UAAA;AAAA;AAAA,UAGQ,UAAA;EACR,SAAA;EACA,UAAA;AAAA;AAAA,cAGW,mBAAA;EAAA,iBACM,KAAA;EAAA,iBACA,UAAA;EAAA,iBACA,OAAA;EAAA,QACT,YAAA;cAEI,OAAA,GAAU,mBAAA;EAAA,QAUd,GAAA;EAIR,KAAA,CAAM,WAAA,UAAqB,UAAA,uBAAiC,UAAA;EAmB5D,MAAA,CAAO,WAAA,UAAqB,UAAA,sBAAgC,UAAA;EAAA,QAiBpD,OAAA;EASR,OAAA,CAAA;AAAA"}

package/dist/backend/index.d.ts

@@ -1,7 +1,7 @@
 /**
  * @invect/webhooks — Backend Entry Point
  */
-export { webhooksPlugin } from './plugin';
+export { webhooks } from './plugin';
 export type { WebhooksPluginOptions } from './plugin';
 export { WebhookSignatureService, WEBHOOK_PROVIDER_SIGNATURES } from './webhook-signature.service';
 export type { WebhookProviderSignatureConfig } from './webhook-signature.service';

package/dist/backend/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,YAAY,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACnG,YAAY,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,YAAY,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AACnG,YAAY,EAAE,8BAA8B,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/backend/index.mjs

@@ -3249,7 +3249,16 @@ function generateWebhookPath() {
 	for (let i = 0; i < 24; i++) path += chars[Math.floor(Math.random() * 36)];
 	return path;
 }
-function webhooksPlugin(options) {
+function webhooks(options) {
+	const { frontend, ...backendOptions } = options ?? {};
+	return {
+		id: "webhooks",
+		name: "Webhooks",
+		backend: _webhooksBackendPlugin(backendOptions),
+		frontend
+	};
+}
+function _webhooksBackendPlugin(options) {
 	let state = null;
 	function createEndpoints() {
 		return [
@@ -3475,10 +3484,10 @@ function webhooksPlugin(options) {
 				state = null;
 			}
 		},
-		setupInstructions: "Run `npx invect generate` to generate the webhook_triggers table schema, then `npx invect migrate` to apply it."
+		setupInstructions: "Run `npx invect-cli generate` to generate the webhook_triggers table schema, then `npx invect-cli migrate` to apply it."
 	};
 }
 //#endregion
-export { WEBHOOK_PROVIDER_SIGNATURES, WebhookDedupService, WebhookRateLimiter, WebhookSignatureService, webhooksPlugin };
+export { WEBHOOK_PROVIDER_SIGNATURES, WebhookDedupService, WebhookRateLimiter, WebhookSignatureService, webhooks };
 
 //# sourceMappingURL=index.mjs.map