@mulmobridge/line 1.0.1 → 1.0.3

package/dist/index.js

@@ -95,8 +95,8 @@ async function pushMessage(userId, text) {
 const app = createWebhookApp();
 const webhookRateLimit = createWebhookRateLimit();
 app.post("/webhook", webhookRateLimit, async (req, res) => {
-    const signature = req.headers["x-line-signature"];
-    const bodyStr = req.body;
+    const signature = typeof req.headers["x-line-signature"] === "string" ? req.headers["x-line-signature"] : "";
+    const bodyStr = typeof req.body === "string" ? req.body : "";
     if (!signature || !verifyHmacSignature(bodyStr, signature, channelSecret)) {
         res.status(401).send("Invalid signature");
         return;

package/dist/parse.d.ts

@@ -41,5 +41,7 @@ export type IncomingLineMessage = {
  * unsupported media). Pure — no side effects, no allowlist check.
  */
 export declare function extractIncomingLineMessage(event: LineEvent): IncomingLineMessage | null;
-/** Best-effort JSON parse for the webhook body — null on malformed input. */
+/** Best-effort JSON parse for the webhook body — null on malformed input.
+ *  Events that don't match `LineEvent` are dropped rather than handed on as if
+ *  they did: a `null` element used to throw inside the delivery loop. */
 export declare function parseLineWebhookBody(raw: string): LineWebhookBody | null;

package/dist/parse.js

@@ -24,14 +24,46 @@ export function extractIncomingLineMessage(event) {
     }
     return null;
 }
-/** Best-effort JSON parse for the webhook body — null on malformed input. */
+const isOptionalString = (value) => value === undefined || typeof value === "string";
+function isLineEventSource(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    if ("userId" in value && !isOptionalString(value.userId))
+        return false;
+    return !("type" in value) || isOptionalString(value.type);
+}
+function isLineMessage(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    if (!("type" in value) || typeof value.type !== "string")
+        return false;
+    if ("text" in value && !isOptionalString(value.text))
+        return false;
+    return !("id" in value) || isOptionalString(value.id);
+}
+/** True only when every field `LineEvent` declares is present in the shape it
+ *  declares. Extra platform fields we don't model are left untouched. */
+function isLineEvent(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    if (!("type" in value) || typeof value.type !== "string")
+        return false;
+    if ("replyToken" in value && !isOptionalString(value.replyToken))
+        return false;
+    if ("source" in value && value.source !== undefined && !isLineEventSource(value.source))
+        return false;
+    return !("message" in value) || value.message === undefined || isLineMessage(value.message);
+}
+/** Best-effort JSON parse for the webhook body — null on malformed input.
+ *  Events that don't match `LineEvent` are dropped rather than handed on as if
+ *  they did: a `null` element used to throw inside the delivery loop. */
 export function parseLineWebhookBody(raw) {
     try {
         const parsed = JSON.parse(raw);
-        if (!parsed || typeof parsed !== "object" || !Array.isArray(parsed.events)) {
+        if (typeof parsed !== "object" || parsed === null || !("events" in parsed))
             return null;
-        }
-        return parsed;
+        const { events } = parsed;
+        return Array.isArray(events) ? { events: events.filter(isLineEvent) } : null;
     }
     catch {
         return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mulmobridge/line",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "LINE bridge for MulmoBridge — connect a LINE bot to MulmoClaude",
   "type": "module",
   "main": "./dist/index.js",
@@ -24,14 +24,14 @@
   "dependencies": {
     "@mulmobridge/client": "^1.0.1",
     "@mulmobridge/protocol": "^1.0.1",
-    "@mulmobridge/webhook-runtime": "^1.0.2",
+    "@mulmobridge/webhook-runtime": "^1.0.3",
     "dotenv": "^17.0.0",
     "express": "^5.1.0",
-    "express-rate-limit": "^8.6.0"
+    "express-rate-limit": "^8.6.1"
   },
   "devDependencies": {
     "@types/express": "^5.0.0",
-    "@types/node": "^26.1.1",
+    "@types/node": "^26.1.2",
     "tsx": "^4.23.1",
     "typescript": "^6.0.3"
   },