@kashdao/cli 0.1.0

package/dist/webhooks-PTVRKICZ.js

@@ -0,0 +1,680 @@
+#!/usr/bin/env node
+import {
+  formatDate,
+  shortId
+} from "./chunk-BRK7KJ4O.js";
+import {
+  buildClient
+} from "./chunk-QJMF73M5.js";
+import "./chunk-KMBMQIZ7.js";
+import "./chunk-YHCG2SUC.js";
+import "./chunk-BN2CUM42.js";
+import {
+  parsePositiveInt,
+  readGlobals
+} from "./chunk-LBIRQHX5.js";
+import {
+  log,
+  print,
+  printJson,
+  style,
+  writeNdjson
+} from "./chunk-VIADBYFY.js";
+import "./chunk-MIXOZU2S.js";
+import {
+  CliError,
+  CliValidationError,
+  toCliError
+} from "./chunk-UZNSYATZ.js";
+
+// src/commands/webhooks/index.ts
+import { Command as Command6 } from "commander";
+
+// src/commands/webhooks/list.ts
+import { Command } from "commander";
+var STATUS_VALUES = ["none", "pending", "delivered", "retrying", "failed"];
+var listWebhookEventsCommand = new Command("list").description("List recent webhook delivery events for the calling key.").option("-l, --limit <n>", "page size (1-100)", "20").option("-c, --cursor <cursor>", "opaque cursor from a previous response").option("-a, --all", "walk every page (subject to --limit per page)", false).option(
+  "--ndjson",
+  "stream results as newline-delimited JSON (one record per line); implies --all"
+).option(
+  "--status <status...>",
+  `filter by derived status (one of: ${STATUS_VALUES.join(", ")}); repeat or comma-separate`
+).addHelpText(
+  "after",
+  `
+Examples:
+  $ kash webhooks list
+  $ kash webhooks list --status failed --status retrying
+  $ kash webhooks list --status failed,retrying -l 100
+  $ kash webhooks list --all --json | jq '.[] | select(.status == "failed")'
+  $ kash webhooks list --ndjson | while read -r line; do echo "$line" | jq -r .id; done
+`
+).action(async (opts, cmd) => {
+  const globals = readGlobals(cmd);
+  const limit = opts.limit === void 0 ? 20 : parsePositiveInt(opts.limit, "limit");
+  if (limit < 1 || limit > 100) {
+    throw new CliValidationError("--limit must be between 1 and 100.", void 0, "limit");
+  }
+  const status = normaliseStatus(opts.status);
+  try {
+    const { client } = await buildClient({ requireAuth: true, globals });
+    const page = await client.webhooks.list({
+      limit,
+      ...opts.cursor === void 0 ? {} : { cursor: opts.cursor },
+      ...status === void 0 ? {} : { status }
+    });
+    if (opts.ndjson === true) {
+      for await (const event of page) {
+        writeNdjson(event);
+      }
+      return;
+    }
+    if (opts.all === true) {
+      const collected = [];
+      for await (const event of page) collected.push(event);
+      if (globals.json) {
+        printJson({
+          data: collected,
+          pagination: { hasMore: false, cursor: null },
+          count: collected.length
+        });
+        return;
+      }
+      renderRows(collected);
+      return;
+    }
+    if (globals.json) {
+      printJson({
+        data: page.data,
+        pagination: page.pagination,
+        count: page.data.length
+      });
+      return;
+    }
+    renderRows(page.data);
+    if (page.pagination.hasMore && page.pagination.cursor) {
+      log.detail("Next page", `--cursor ${page.pagination.cursor}`);
+    }
+  } catch (cause) {
+    throw toCliError(cause);
+  }
+});
+function renderRows(rows) {
+  if (rows.length === 0) {
+    print(style.dim("  (no webhook events)"));
+    return;
+  }
+  print("");
+  for (const row of rows) {
+    const statusBadge = renderStatus(row.status);
+    const tradeCol = row.tradeRequestId ? row.tradeRequestId.slice(0, 8) : style.dim("\u2014");
+    print(
+      `  ${statusBadge} ${style.dim(row.id.slice(0, 8))} ${row.eventType.padEnd(28)} trade=${tradeCol} attempts=${String(row.delivery.attempts).padStart(2)} ${style.dim(row.emittedAt)}`
+    );
+  }
+  print("");
+}
+function normaliseStatus(raw) {
+  if (!raw || raw.length === 0) return void 0;
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of raw) {
+    for (const piece of entry.split(",")) {
+      const trimmed = piece.trim();
+      if (trimmed.length === 0) continue;
+      if (!STATUS_VALUES.includes(trimmed)) {
+        throw new CliValidationError(
+          `Unknown --status "${trimmed}".`,
+          `Allowed: ${STATUS_VALUES.join(", ")}.`,
+          "status"
+        );
+      }
+      seen.add(trimmed);
+    }
+  }
+  return seen.size === 0 ? void 0 : [...seen];
+}
+function renderStatus(status) {
+  switch (status) {
+    case "delivered":
+      return style.success("\u2713 delivered");
+    case "failed":
+      return style.error("\u2717 failed   ");
+    case "retrying":
+      return style.warn("\u27F3 retrying ");
+    case "pending":
+      return style.dim("\u2026 pending  ");
+    case "none":
+      return style.dim("\xB7 none     ");
+    default: {
+      const _exhaustive = status;
+      return _exhaustive;
+    }
+  }
+}
+
+// src/commands/webhooks/redeliver.ts
+import { Command as Command2 } from "commander";
+var EVENT_ID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var redeliverCommand = new Command2("redeliver").description("Re-queue a webhook event for delivery.").argument("<eventId>", "webhook event UUID").addHelpText(
+  "after",
+  `
+Examples:
+  $ kash webhooks redeliver 99999999-9999-9999-9999-999999999999
+  $ kash webhooks redeliver "$(kash webhooks list --json --quiet | jq -r '.data[0].id')"
+`
+).action(async (eventId, _opts, cmd) => {
+  const globals = readGlobals(cmd);
+  if (!EVENT_ID_REGEX.test(eventId)) {
+    throw new CliValidationError(
+      `<eventId> must be a UUID.`,
+      `Got "${eventId}". Look up the id in \`kash webhooks list --json --quiet | jq -r '.data[].id'\`.`,
+      "eventId"
+    );
+  }
+  let event;
+  try {
+    const { client } = await buildClient({ requireAuth: true, globals });
+    event = await client.webhooks.redeliver(eventId);
+  } catch (cause) {
+    throw toCliError(cause);
+  }
+  if (globals.json) {
+    printJson(event);
+    return;
+  }
+  log.success(`Re-delivery queued for ${event.id}.`);
+  print(`  ${style.dim("Event id        ")} ${event.id}`);
+  print(`  ${style.dim("Event type      ")} ${event.eventType}`);
+  print(`  ${style.dim("Emitted at      ")} ${formatDate(event.emittedAt)}`);
+  print(`  ${style.dim("Attempts        ")} ${String(event.deliveryAttempts)}`);
+  if (event.lastDeliveredAt) {
+    print(`  ${style.dim("Last delivered  ")} ${formatDate(event.lastDeliveredAt)}`);
+  }
+  log.detail("Short id", shortId(event.id));
+});
+
+// src/commands/webhooks/replay.ts
+import { createHmac } from "crypto";
+import { readFile } from "fs/promises";
+import { Command as Command3 } from "commander";
+var SIGNATURE_HEADER_DEFAULT = "X-Kash-Signature";
+var replayWebhookCommand = new Command3("replay").description("Re-sign a captured webhook payload and POST it to a target URL.").argument("[body]", 'path to a JSON body file (omit or pass "-" for stdin)').requiredOption("-t, --target <url>", "destination URL (e.g. ngrok tunnel or localhost endpoint)").option("-s, --secret <secret>", "webhook signing secret (overrides KASH_WEBHOOK_SECRET)").option(
+  "--secret-file <path>",
+  "read the signing secret from a file (preferred \u2014 keeps the value out of argv and env)"
+).option(
+  "--secret-env <name>",
+  "read the signing secret from this environment variable (default: KASH_WEBHOOK_SECRET)"
+).option(
+  "--timestamp-ms <ms>",
+  "unix-ms timestamp for the signature header (default: current time)"
+).option(
+  "--signature-header <name>",
+  `override the signature header name (default: ${SIGNATURE_HEADER_DEFAULT})`
+).option("--timeout-ms <ms>", "fetch timeout (default 10000)").option(
+  "--dry-run",
+  "compute the signature header and inspect the would-be POST without sending it"
+).option(
+  "--refuse-private-addresses",
+  "hard-fail (instead of warning) when --target is a loopback / private / link-local address \u2014 recommended for CI"
+).addHelpText(
+  "after",
+  `
+Examples:
+  # Auto-reads KASH_WEBHOOK_SECRET (matches \`kash webhooks verify\`).
+  $ KASH_WEBHOOK_SECRET=whsec_\u2026 kash webhooks replay payload.json -t http://localhost:3000/webhook
+
+  # Explicit secret file (preferred \u2014 keeps the value out of argv/env).
+  $ kash webhooks replay payload.json -t http://localhost:3000/webhook --secret-file ~/.kash/webhook.secret
+
+  # Pipe captured payload from stdin.
+  $ cat payload.json | kash webhooks replay - -t \u2026 -s whsec_\u2026
+
+  # CI guardrails: refuse private targets + inspect the signed bytes
+  # before sending.
+  $ kash webhooks replay payload.json -t https://api.example.com --secret-file s.txt --refuse-private-addresses
+  $ kash webhooks replay payload.json -t https://api.example.com --secret-file s.txt --dry-run --json
+
+Notes:
+  - The signature format is \`t=<unix-ms>,v1=<hex-hmac-sha256>\` \u2014
+    Stripe-compatible. The receiver verifies via \`kash webhooks verify\`
+    or the SDK's \`webhooks.verifySignature\`.
+  - Defaults the timestamp to \`Date.now()\`. Pass \`--timestamp-ms\`
+    with an old timestamp to test the receiver's replay-window
+    rejection (the SDK's default is 5 min).
+  - Secret resolution order: --secret > --secret-file > --secret-env
+    > KASH_WEBHOOK_SECRET. --secret-file is preferred \u2014 it keeps the
+    value out of argv (where \`ps\` could see it) and out of env (where
+    a child process would inherit it).
+  - --dry-run is safe to run anywhere \u2014 it never opens a network
+    socket. Use it to inspect the signature header before pointing
+    a fresh receiver at production traffic.
+`
+).action(async (body, options, cmd) => {
+  const globals = readGlobals(cmd);
+  try {
+    const secret = await resolveSecret(options);
+    const targetUrl = validateTarget(options.target, {
+      refusePrivate: options.refusePrivateAddresses === true
+    });
+    const rawBody = await readBody(body);
+    const timestampMs = options.timestampMs ? parsePositiveInt(options.timestampMs, "timestamp-ms") : Date.now();
+    const timeoutMs = options.timeoutMs ? parsePositiveInt(options.timeoutMs, "timeout-ms") : 1e4;
+    const headerName = options.signatureHeader ?? SIGNATURE_HEADER_DEFAULT;
+    const headerValue = computeSignatureHeader(rawBody, secret, timestampMs);
+    if (options.dryRun === true) {
+      if (globals.json) {
+        printJson({
+          targetUrl,
+          headerName,
+          headerValue,
+          timestampMs,
+          bodyBytes: Buffer.byteLength(rawBody, "utf8"),
+          dryRun: true
+        });
+        return;
+      }
+      print("");
+      log.success("Dry run \u2014 signature computed, no request sent.");
+      print(`  ${style.dim("Target  ")} ${targetUrl}`);
+      print(`  ${style.dim("Header  ")} ${headerName}: ${headerValue}`);
+      print(`  ${style.dim("Body    ")} ${String(Buffer.byteLength(rawBody, "utf8"))} bytes`);
+      log.info("Re-run without --dry-run to send.");
+      return;
+    }
+    const result = await deliver({
+      targetUrl,
+      body: rawBody,
+      headerName,
+      headerValue,
+      timeoutMs
+    });
+    if (globals.json) {
+      printJson({
+        targetUrl,
+        headerName,
+        headerValue,
+        timestampMs,
+        status: result.status,
+        ok: result.ok,
+        durationMs: result.durationMs,
+        responseBody: result.body
+      });
+      return;
+    }
+    print("");
+    if (result.ok) {
+      log.success(`Delivered in ${String(result.durationMs)}ms \u2014 HTTP ${String(result.status)}.`);
+    } else {
+      log.error(
+        `Receiver returned HTTP ${String(result.status)} (after ${String(result.durationMs)}ms).`
+      );
+    }
+    print(`  ${style.dim("Target  ")} ${targetUrl}`);
+    print(`  ${style.dim("Header  ")} ${headerName}: ${headerValue}`);
+    if (result.body.length > 0) {
+      print("");
+      print(style.dim("--- Response body ---"));
+      print(result.body);
+    }
+  } catch (cause) {
+    throw toCliError(cause);
+  }
+});
+async function resolveSecret(options) {
+  if (options.secret !== void 0) return options.secret;
+  if (options.secretFile !== void 0) {
+    try {
+      const raw = await readFile(options.secretFile, "utf8");
+      return raw.trim();
+    } catch {
+      throw new CliValidationError(
+        `--secret-file: failed to read ${options.secretFile}.`,
+        "Verify the file exists and is readable.",
+        "secret-file"
+      );
+    }
+  }
+  if (options.secretEnv !== void 0) {
+    const value = process.env[options.secretEnv];
+    if (!value || value.length === 0) {
+      throw new CliError(`--secret-env ${options.secretEnv} is not set or empty.`, {
+        code: "INVALID_INPUT",
+        recoverable: true,
+        suggestion: `Set ${options.secretEnv}=<webhook-secret> before re-running.`
+      });
+    }
+    return value;
+  }
+  const fromEnv = process.env["KASH_WEBHOOK_SECRET"];
+  if (fromEnv !== void 0 && fromEnv.length > 0) return fromEnv;
+  throw new CliValidationError(
+    "A signing secret is required.",
+    "Pass --secret-file (preferred), --secret, --secret-env <NAME>, or set KASH_WEBHOOK_SECRET.",
+    "secret"
+  );
+}
+function validateTarget(raw, policy) {
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new CliValidationError(
+      "--target must be a valid URL.",
+      `Got "${raw}". Include the scheme (http:// or https://).`,
+      "target"
+    );
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    throw new CliValidationError(
+      `--target must use http:// or https:// (got "${url.protocol}").`,
+      void 0,
+      "target"
+    );
+  }
+  if (policy.refusePrivate && isPrivateAddress(url)) {
+    throw new CliValidationError(
+      `--target points at a private address (${url.hostname}) and --refuse-private-addresses is set.`,
+      "Drop the flag to allow private targets, or change --target to a public URL.",
+      "target"
+    );
+  }
+  warnIfPrivateAddress(url);
+  return url.toString();
+}
+function warnIfPrivateAddress(url) {
+  const rawHost = url.hostname;
+  const host = rawHost.startsWith("[") && rawHost.endsWith("]") ? rawHost.slice(1, -1) : rawHost;
+  if (host === "::1") {
+    emitPrivateWarning(rawHost);
+    return;
+  }
+  if (host === "localhost" || host.endsWith(".localhost")) return;
+  if (/^fe[89ab][0-9a-f]{0,2}:/i.test(host)) {
+    emitLinkLocalWarning(rawHost);
+    return;
+  }
+  if (/^f[cd][0-9a-f]{0,2}:/i.test(host)) {
+    emitPrivateWarning(rawHost);
+    return;
+  }
+  const ipv4 = /^(25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\.(25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\.(25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\.(25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)$/.exec(
+    host
+  );
+  if (!ipv4) return;
+  const [, a, b] = ipv4;
+  const oct1 = Number.parseInt(a, 10);
+  const oct2 = Number.parseInt(b, 10);
+  if (oct1 === 127) return;
+  if (oct1 === 10) {
+    emitPrivateWarning(host);
+    return;
+  }
+  if (oct1 === 172 && oct2 >= 16 && oct2 <= 31) {
+    emitPrivateWarning(host);
+    return;
+  }
+  if (oct1 === 192 && oct2 === 168) {
+    emitPrivateWarning(host);
+    return;
+  }
+  if (oct1 === 169 && oct2 === 254) {
+    emitLinkLocalWarning(host);
+    return;
+  }
+}
+function isPrivateAddress(url) {
+  const rawHost = url.hostname;
+  const host = rawHost.startsWith("[") && rawHost.endsWith("]") ? rawHost.slice(1, -1) : rawHost;
+  if (host === "::1") return true;
+  if (host === "localhost" || host.endsWith(".localhost")) return true;
+  if (/^fe[89ab][0-9a-f]{0,2}:/i.test(host)) return true;
+  if (/^f[cd][0-9a-f]{0,2}:/i.test(host)) return true;
+  const ipv4 = /^(25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\.(25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\.(25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)\.(25[0-5]|2[0-4]\d|1\d{2}|[1-9]?\d)$/.exec(
+    host
+  );
+  if (!ipv4) return false;
+  const oct1 = Number.parseInt(ipv4[1], 10);
+  const oct2 = Number.parseInt(ipv4[2], 10);
+  if (oct1 === 127) return true;
+  if (oct1 === 10) return true;
+  if (oct1 === 172 && oct2 >= 16 && oct2 <= 31) return true;
+  if (oct1 === 192 && oct2 === 168) return true;
+  if (oct1 === 169 && oct2 === 254) return true;
+  return false;
+}
+function emitLinkLocalWarning(host) {
+  process.stderr.write(
+    `\u26A0  --target points at a link-local address (${host}). This range hosts cloud metadata services. Verify the target is intentional.
+`
+  );
+}
+function emitPrivateWarning(host) {
+  process.stderr.write(
+    `\u26A0  --target points at a private address (${host}). Verify this is your dev tunnel and not an internal service.
+`
+  );
+}
+async function readBody(file) {
+  if (file !== void 0 && file !== "-") {
+    let raw;
+    try {
+      raw = await readFile(file, "utf8");
+    } catch (cause) {
+      throw new CliError(`Failed to read ${file}.`, {
+        code: "CONFIGURATION",
+        recoverable: true,
+        suggestion: "Verify the path exists and is readable.",
+        cause
+      });
+    }
+    const { stripBom: stripBom2 } = await import("./stdin-YW2CEQXU.js");
+    return stripBom2(raw);
+  }
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    if (typeof chunk === "string") chunks.push(Buffer.from(chunk));
+    else if (chunk instanceof Buffer) chunks.push(chunk);
+    else chunks.push(Buffer.from(chunk));
+  }
+  if (chunks.length === 0) {
+    throw new CliValidationError(
+      "No input received on stdin.",
+      "Pass a file path or pipe a webhook body into stdin."
+    );
+  }
+  const { stripBom } = await import("./stdin-YW2CEQXU.js");
+  return stripBom(Buffer.concat(chunks).toString("utf8"));
+}
+function computeSignatureHeader(body, secret, timestampMs) {
+  const payload = `${String(timestampMs)}.${body}`;
+  const hex = createHmac("sha256", secret).update(payload).digest("hex");
+  return `t=${String(timestampMs)},v1=${hex}`;
+}
+async function deliver(args) {
+  const start = Date.now();
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), args.timeoutMs);
+  try {
+    const response = await /* eslint-disable-line @kashdao/no-bare-fetch */
+    fetch(args.targetUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        [args.headerName]: args.headerValue
+      },
+      body: args.body,
+      signal: controller.signal
+    });
+    const responseBody = await response.text();
+    return {
+      status: response.status,
+      ok: response.ok,
+      body: responseBody,
+      durationMs: Date.now() - start
+    };
+  } catch (cause) {
+    const wasAborted = controller.signal.aborted;
+    const looksLikeAbort = cause instanceof Error && cause.name === "AbortError";
+    if (wasAborted || looksLikeAbort) {
+      throw new CliError(`Delivery timed out after ${String(args.timeoutMs)}ms.`, {
+        code: "TIMEOUT",
+        recoverable: true,
+        suggestion: "Raise --timeout-ms or check the target endpoint is responsive.",
+        cause
+      });
+    }
+    throw new CliError(
+      `Delivery failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+      {
+        code: "NETWORK",
+        recoverable: true,
+        suggestion: "Verify the target URL is reachable from this machine.",
+        cause
+      }
+    );
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/commands/webhooks/rotate-secret.ts
+import readline from "readline/promises";
+import { Command as Command4 } from "commander";
+var rotateSecretCommand = new Command4("rotate-secret").description("Rotate the webhook signing secret for the current API key.").option("-y, --yes", "skip the interactive confirmation (required for --json --quiet)").addHelpText(
+  "after",
+  `
+Examples:
+  $ kash webhooks rotate-secret                        # interactive confirm
+  $ kash webhooks rotate-secret --yes                  # skip confirm
+  $ kash webhooks rotate-secret --yes --json --quiet | jq -r '.secret' > new-secret.txt
+
+Notes:
+  This invalidates your current webhook secret immediately. Receivers
+  that haven't been updated will start failing signature verification
+  on the next event. Have your secret-store update plan ready before
+  confirming.
+`
+).action(async (options, cmd) => {
+  const globals = readGlobals(cmd);
+  const interactive = process.stdin.isTTY && !globals.quiet && !globals.json;
+  const confirmed = options.yes === true || !interactive ? true : await confirm();
+  if (!confirmed) {
+    log.info("Aborted.");
+    return;
+  }
+  let secret;
+  try {
+    const { client } = await buildClient({ requireAuth: true, globals });
+    secret = await client.webhooks.rotateSecret();
+  } catch (cause) {
+    throw toCliError(cause);
+  }
+  if (globals.json) {
+    printJson(secret);
+    return;
+  }
+  log.warn("Webhook secret rotated. The new secret is shown ONCE.");
+  print("");
+  print(`  ${style.bold("Secret")}: ${secret.secret}`);
+  print(`  ${style.dim("Rotated at        ")}: ${formatDate(secret.rotatedAt)}`);
+  print(`  ${style.dim("Previous valid until")}: ${formatDate(secret.previousRetainedUntil)}`);
+  print("");
+  log.info("Store this secret in your webhook receiver immediately.");
+});
+async function confirm() {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    const answer = await rl.question(
+      "This will invalidate your current webhook secret. Continue? [y/N] "
+    );
+    return answer.trim().toLowerCase().startsWith("y");
+  } finally {
+    rl.close();
+  }
+}
+
+// src/commands/webhooks/verify.ts
+import { readFile as readFile2 } from "fs/promises";
+import { Command as Command5 } from "commander";
+var verifyWebhookCommand = new Command5("verify").description("Verify a captured X-Kash-Signature against the raw body and secret.").requiredOption("-s, --signature <header>", 'the X-Kash-Signature header value (e.g. "t=\u2026,v1=\u2026")').option("--body <string>", "raw request body as a string (use --body-file for binary-safe input)").option("--body-file <path>", "path to a file containing the raw request body").option("--secret <value>", "webhook signing secret (overrides KASH_WEBHOOK_SECRET)").option(
+  "--secret-file <path>",
+  "read secret from a file (preferred over --secret on shared shells)"
+).option(
+  "--tolerance-ms <n>",
+  "replay-window tolerance in milliseconds (default 300000 = 5 minutes)"
+).addHelpText(
+  "after",
+  `
+Examples:
+  $ kash webhooks verify --signature "t=\u2026,v1=\u2026" --body-file event.json
+  $ kash webhooks verify -s "$SIG" --body "$BODY" --secret-file ~/.kash/webhook.secret --json
+`
+).action(async (options, cmd) => {
+  const globals = readGlobals(cmd);
+  if (options.body !== void 0 && options.bodyFile !== void 0) {
+    throw new CliValidationError("Pass exactly one of --body or --body-file.", void 0, "body");
+  }
+  if (options.body === void 0 && options.bodyFile === void 0) {
+    throw new CliValidationError("--body or --body-file is required.", void 0, "body");
+  }
+  if (options.secret !== void 0 && options.secretFile !== void 0) {
+    throw new CliValidationError(
+      "Pass at most one of --secret or --secret-file.",
+      void 0,
+      "secret"
+    );
+  }
+  const body = options.body !== void 0 ? options.body : await readFileChecked(options.bodyFile, "body-file");
+  const secret = await resolveSecret2(options);
+  const toleranceMs = options.toleranceMs === void 0 ? void 0 : parsePositiveInt(options.toleranceMs, "tolerance-ms");
+  let result;
+  try {
+    const { client } = await buildClient({ globals });
+    result = await client.webhooks.verifySignature(body, options.signature, secret, {
+      ...toleranceMs === void 0 ? {} : { toleranceMs }
+    });
+  } catch (cause) {
+    throw toCliError(cause);
+  }
+  if (globals.json) {
+    printJson(result);
+    return;
+  }
+  if (result.valid) {
+    print(`${style.success("\u2713")} Signature is valid.`);
+  } else {
+    log.error(`Signature is INVALID: ${result.reason}`);
+  }
+});
+async function readFileChecked(path, flag) {
+  try {
+    return await readFile2(path, "utf8");
+  } catch (cause) {
+    throw new CliValidationError(
+      `Failed to read ${flag} ${path}: ${cause.message}`,
+      "Verify the path exists and is readable.",
+      flag
+    );
+  }
+}
+async function resolveSecret2(options) {
+  if (options.secret !== void 0) return options.secret;
+  if (options.secretFile !== void 0) {
+    const raw = await readFileChecked(options.secretFile, "secret-file");
+    return raw.trim();
+  }
+  const fromEnv = process.env["KASH_WEBHOOK_SECRET"];
+  if (fromEnv !== void 0 && fromEnv.length > 0) return fromEnv;
+  throw new CliValidationError(
+    "Webhook secret not provided.",
+    "Pass --secret-file (preferred), --secret, or set KASH_WEBHOOK_SECRET.",
+    "secret"
+  );
+}
+
+// src/commands/webhooks/index.ts
+var webhooksCommand = new Command6("webhooks").description("Manage webhook delivery, signing secrets, and signature verification.").addCommand(listWebhookEventsCommand).addCommand(rotateSecretCommand).addCommand(redeliverCommand).addCommand(verifyWebhookCommand).addCommand(replayWebhookCommand);
+export {
+  webhooksCommand
+};
+//# sourceMappingURL=webhooks-PTVRKICZ.js.map