@multiplier-labs/stepflow 0.3.1 → 0.3.4

package/src/utils/retry.test.ts

@@ -1,30 +1,23 @@
-import { describe, it, expect, vi } from "vitest";
-import {
-  sleep,
-  withRetry,
-  calculateRetryDelay,
-  DEFAULT_RETRY_OPTIONS,
-} from "./retry";
-import { WorkflowCanceledError } from "./errors";
-
-describe("sleep", () => {
-  it("should resolve after the given time", async () => {
+import { describe, it, expect, vi } from 'vitest';
+import { sleep, withRetry, calculateRetryDelay, DEFAULT_RETRY_OPTIONS } from './retry';
+import { WorkflowCanceledError } from './errors';
+
+describe('sleep', () => {
+  it('should resolve after the given time', async () => {
     const start = Date.now();
     await sleep(50);
     const elapsed = Date.now() - start;
     expect(elapsed).toBeGreaterThanOrEqual(40);
   });
 
-  it("should reject immediately if signal is already aborted", async () => {
+  it('should reject immediately if signal is already aborted', async () => {
     const controller = new AbortController();
     controller.abort();
 
-    await expect(sleep(1000, controller.signal)).rejects.toThrow(
-      WorkflowCanceledError,
-    );
+    await expect(sleep(1000, controller.signal)).rejects.toThrow(WorkflowCanceledError);
   });
 
-  it("should reject when signal is aborted during sleep", async () => {
+  it('should reject when signal is aborted during sleep', async () => {
     const controller = new AbortController();
 
     const promise = sleep(5000, controller.signal);
@@ -34,79 +27,71 @@ describe("sleep", () => {
   });
 });
 
-describe("calculateRetryDelay", () => {
-  it("should return base delay for first attempt", () => {
+describe('calculateRetryDelay', () => {
+  it('should return base delay for first attempt', () => {
     expect(calculateRetryDelay(1, 1000, 2)).toBe(1000);
   });
 
-  it("should apply backoff multiplier", () => {
+  it('should apply backoff multiplier', () => {
     expect(calculateRetryDelay(2, 1000, 2)).toBe(2000);
     expect(calculateRetryDelay(3, 1000, 2)).toBe(4000);
   });
 
-  it("should work with non-integer backoff", () => {
+  it('should work with non-integer backoff', () => {
     expect(calculateRetryDelay(2, 100, 1.5)).toBe(150);
   });
 });
 
-describe("DEFAULT_RETRY_OPTIONS", () => {
-  it("should have expected defaults", () => {
+describe('DEFAULT_RETRY_OPTIONS', () => {
+  it('should have expected defaults', () => {
     expect(DEFAULT_RETRY_OPTIONS.maxRetries).toBe(3);
     expect(DEFAULT_RETRY_OPTIONS.delay).toBe(1000);
     expect(DEFAULT_RETRY_OPTIONS.backoff).toBe(2);
   });
 });
 
-describe("withRetry", () => {
-  it("should return result on first success", async () => {
-    const fn = vi.fn().mockResolvedValue("ok");
-    const result = await withRetry(fn, {
-      maxRetries: 3,
-      delay: 10,
-      backoff: 1,
-    });
+describe('withRetry', () => {
+  it('should return result on first success', async () => {
+    const fn = vi.fn().mockResolvedValue('ok');
+    const result = await withRetry(fn, { maxRetries: 3, delay: 10, backoff: 1 });
 
-    expect(result).toBe("ok");
+    expect(result).toBe('ok');
     expect(fn).toHaveBeenCalledTimes(1);
   });
 
-  it("should retry on failure and succeed", async () => {
+  it('should retry on failure and succeed', async () => {
     let attempt = 0;
     const fn = vi.fn(async () => {
       attempt++;
       if (attempt < 3) throw new Error(`fail ${attempt}`);
-      return "success";
+      return 'success';
     });
 
-    const result = await withRetry(fn, {
-      maxRetries: 3,
-      delay: 10,
-      backoff: 1,
-    });
+    const result = await withRetry(fn, { maxRetries: 3, delay: 10, backoff: 1 });
 
-    expect(result).toBe("success");
+    expect(result).toBe('success');
     expect(fn).toHaveBeenCalledTimes(3);
   });
 
-  it("should throw after exhausting retries", async () => {
-    const fn = vi.fn().mockRejectedValue(new Error("always fails"));
+  it('should throw after exhausting retries', async () => {
+    const fn = vi.fn().mockRejectedValue(new Error('always fails'));
 
     await expect(
-      withRetry(fn, { maxRetries: 2, delay: 10, backoff: 1 }),
-    ).rejects.toThrow("always fails");
+      withRetry(fn, { maxRetries: 2, delay: 10, backoff: 1 })
+    ).rejects.toThrow('always fails');
 
     // 1 initial + 2 retries = 3 calls
     expect(fn).toHaveBeenCalledTimes(3);
   });
 
-  it("should call onRetry callback", async () => {
+  it('should call onRetry callback', async () => {
     let attempt = 0;
     const onRetryCalls: Array<{ attempt: number; delay: number }> = [];
 
     const fn = vi.fn(async () => {
       attempt++;
-      if (attempt < 3) throw new Error("fail");
-      return "ok";
+      if (attempt < 3) throw new Error('fail');
+      return 'ok';
     });
 
     await withRetry(fn, {
@@ -121,28 +106,23 @@ describe("withRetry", () => {
     expect(onRetryCalls[1]).toEqual({ attempt: 2, delay: 200 });
   });
 
-  it("should respect abort signal before first attempt", async () => {
+  it('should respect abort signal before first attempt', async () => {
     const controller = new AbortController();
     controller.abort();
 
-    const fn = vi.fn().mockResolvedValue("ok");
+    const fn = vi.fn().mockResolvedValue('ok');
 
     await expect(
-      withRetry(fn, {
-        maxRetries: 3,
-        delay: 10,
-        backoff: 1,
-        signal: controller.signal,
-      }),
-    ).rejects.toThrow("Aborted");
+      withRetry(fn, { maxRetries: 3, delay: 10, backoff: 1, signal: controller.signal })
+    ).rejects.toThrow('canceled');
 
     expect(fn).not.toHaveBeenCalled();
   });
 
-  it("should respect abort signal during retry wait", async () => {
+  it('should respect abort signal during retry wait', async () => {
     const controller = new AbortController();
 
-    const fn = vi.fn().mockRejectedValue(new Error("fail"));
+    const fn = vi.fn().mockRejectedValue(new Error('fail'));
 
     const promise = withRetry(fn, {
       maxRetries: 5,
@@ -157,15 +137,15 @@ describe("withRetry", () => {
     await expect(promise).rejects.toThrow(WorkflowCanceledError);
   });
 
-  it("should apply backoff between retries", async () => {
+  it('should apply backoff between retries', async () => {
     const timestamps: number[] = [];
     let attempt = 0;
 
     const fn = vi.fn(async () => {
       timestamps.push(Date.now());
       attempt++;
-      if (attempt <= 2) throw new Error("fail");
-      return "ok";
+      if (attempt <= 2) throw new Error('fail');
+      return 'ok';
     });
 
     await withRetry(fn, { maxRetries: 3, delay: 50, backoff: 2 });
@@ -178,20 +158,20 @@ describe("withRetry", () => {
     expect(gap2).toBeGreaterThanOrEqual(80); // ~100ms second delay (50*2)
   });
 
-  it("should convert non-Error throws to Error", async () => {
+  it('should convert non-Error throws to Error', async () => {
     const fn = vi.fn(async () => {
-      throw "string error";
+      throw 'string error';
     });
 
     await expect(
-      withRetry(fn, { maxRetries: 0, delay: 10, backoff: 1 }),
-    ).rejects.toThrow("string error");
+      withRetry(fn, { maxRetries: 0, delay: 10, backoff: 1 })
+    ).rejects.toThrow('string error');
   });
 
-  it("should use default options when none provided", async () => {
-    const fn = vi.fn().mockResolvedValue("ok");
+  it('should use default options when none provided', async () => {
+    const fn = vi.fn().mockResolvedValue('ok');
     const result = await withRetry(fn);
 
-    expect(result).toBe("ok");
+    expect(result).toBe('ok');
   });
 });

package/src/utils/retry.ts

@@ -2,7 +2,7 @@
  * Retry utilities for the workflow engine.
  */
 
-import { WorkflowCanceledError } from "./errors";
+import { WorkflowCanceledError } from './errors';
 
 /**
  * Options for retry behavior.
@@ -36,13 +36,13 @@ export const DEFAULT_RETRY_OPTIONS: RetryOptions = {
 export function sleep(ms: number, signal?: AbortSignal): Promise<void> {
   return new Promise((resolve, reject) => {
     if (signal?.aborted) {
-      reject(new WorkflowCanceledError("run"));
+      reject(new WorkflowCanceledError('run'));
       return;
     }
 
     const cleanup = () => {
       clearTimeout(timeoutId);
-      if (onAbort) signal?.removeEventListener("abort", onAbort);
+      if (onAbort) signal?.removeEventListener('abort', onAbort);
     };
 
     let onAbort: (() => void) | undefined;
@@ -55,9 +55,9 @@ export function sleep(ms: number, signal?: AbortSignal): Promise<void> {
     if (signal) {
       onAbort = () => {
         cleanup();
-        reject(new WorkflowCanceledError("run"));
+        reject(new WorkflowCanceledError('run'));
       };
-      signal.addEventListener("abort", onAbort, { once: true });
+      signal.addEventListener('abort', onAbort, { once: true });
     }
   });
 }
@@ -72,7 +72,7 @@ export function sleep(ms: number, signal?: AbortSignal): Promise<void> {
  */
 export async function withRetry<T>(
   fn: () => Promise<T>,
-  options: Partial<RetryOptions> = {},
+  options: Partial<RetryOptions> = {}
 ): Promise<T> {
   const opts: RetryOptions = { ...DEFAULT_RETRY_OPTIONS, ...options };
   let lastError: Error | undefined;
@@ -81,7 +81,7 @@ export async function withRetry<T>(
   for (let attempt = 1; attempt <= opts.maxRetries + 1; attempt++) {
     // Check if aborted before attempting
     if (opts.signal?.aborted) {
-      throw new Error("Aborted");
+      throw new WorkflowCanceledError('run');
     }
 
     try {
@@ -106,7 +106,7 @@ export async function withRetry<T>(
   }
 
   // This should never be reached, but TypeScript needs it
-  throw lastError ?? new Error("Retry failed");
+  throw lastError ?? new Error('Retry failed');
 }
 
 /**
@@ -115,7 +115,7 @@ export async function withRetry<T>(
 export function calculateRetryDelay(
   attempt: number,
   baseDelay: number,
-  backoff: number,
+  backoff: number
 ): number {
   return Math.round(baseDelay * Math.pow(backoff, attempt - 1));
 }

package/src/utils/safe-json.test.ts

@@ -0,0 +1,166 @@
+/**
+ * Tests for safeJsonParse — audit findings L3 + M2.
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import {
+  safeJsonParse,
+  safeParseField,
+  safeParseOptionalField,
+  getJsonParseCorruptionCount,
+  resetJsonParseCorruptionCount,
+} from './safe-json';
+
+function makeLogger() {
+  return {
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+  };
+}
+
+describe('safeJsonParse', () => {
+  beforeEach(() => {
+    resetJsonParseCorruptionCount();
+  });
+
+  it('returns parsed value for valid JSON without logging', () => {
+    const logger = makeLogger();
+    const result = safeJsonParse('{"a":1}', null, { component: 'X', logger });
+    expect(result).toEqual({ a: 1 });
+    expect(logger.warn).not.toHaveBeenCalled();
+    expect(getJsonParseCorruptionCount()).toBe(0);
+  });
+
+  it('returns fallback on SyntaxError and increments the corruption counter', () => {
+    const logger = makeLogger();
+    const result = safeJsonParse('not-json', { fallback: true }, {
+      component: 'TestAdapter',
+      rowId: 'run-123',
+      column: 'input_json',
+      logger,
+    });
+    expect(result).toEqual({ fallback: true });
+    expect(getJsonParseCorruptionCount()).toBe(1);
+    expect(logger.warn).toHaveBeenCalledTimes(1);
+  });
+
+  it('emits row id, column, length, type — but never the raw value', () => {
+    const logger = makeLogger();
+    const sensitive = '{"sensitive":"PII-DATA-IN-DATABASE"]';
+    safeJsonParse(sensitive, undefined, {
+      component: 'TestAdapter',
+      rowId: 'run-456',
+      column: 'metadata_json',
+      logger,
+    });
+
+    expect(logger.warn).toHaveBeenCalledTimes(1);
+    const [message, meta] = logger.warn.mock.calls[0];
+    expect(message).toContain('TestAdapter');
+    expect(message).toContain('Corrupted JSON');
+    // Critical: do not leak raw payload via message OR metadata.
+    const serialized = JSON.stringify([message, meta]);
+    expect(serialized).not.toContain('PII-DATA-IN-DATABASE');
+
+    expect(meta).toMatchObject({
+      rowId: 'run-456',
+      column: 'metadata_json',
+      length: sensitive.length,
+      type: 'string',
+    });
+    expect(meta.error).toEqual(expect.any(String));
+    expect(meta.corruptionCount).toBe(1);
+  });
+
+  it('does not call console.warn or console.error directly', () => {
+    const consoleWarn = vi.spyOn(console, 'warn').mockImplementation(() => {});
+    const consoleError = vi.spyOn(console, 'error').mockImplementation(() => {});
+    try {
+      safeJsonParse('garbage{', null, { component: 'TestAdapter' });
+      expect(consoleWarn).not.toHaveBeenCalled();
+      expect(consoleError).not.toHaveBeenCalled();
+    } finally {
+      consoleWarn.mockRestore();
+      consoleError.mockRestore();
+    }
+  });
+
+  it('rethrows non-syntax errors', () => {
+    // SyntaxError-only catch — make JSON.parse throw something else and
+    // confirm it propagates instead of being swallowed.
+    const original = JSON.parse;
+    (JSON as any).parse = () => {
+      throw new TypeError('boom');
+    };
+    try {
+      expect(() =>
+        safeJsonParse('{}', null, { component: 'X' })
+      ).toThrowError(TypeError);
+    } finally {
+      (JSON as any).parse = original;
+    }
+    expect(getJsonParseCorruptionCount()).toBe(0);
+  });
+
+  it('counts corruption events across multiple calls', () => {
+    safeJsonParse('bad-1{', null, { component: 'A' });
+    safeJsonParse('bad-2{', null, { component: 'B' });
+    safeJsonParse('{"ok":1}', null, { component: 'C' });
+    expect(getJsonParseCorruptionCount()).toBe(2);
+  });
+});
+
+describe('safeParseField', () => {
+  beforeEach(() => {
+    resetJsonParseCorruptionCount();
+  });
+
+  it('parses string values', () => {
+    const result = safeParseField('{"x":1}', {}, { component: 'X' });
+    expect(result).toEqual({ x: 1 });
+  });
+
+  it('passes non-string values through unchanged', () => {
+    const obj = { x: 1 };
+    expect(safeParseField(obj, {}, { component: 'X' })).toBe(obj);
+    expect(safeParseField(42, {}, { component: 'X' })).toBe(42);
+  });
+
+  it('returns fallback on syntax error', () => {
+    const result = safeParseField('garbage{', { fallback: 1 }, { component: 'X' });
+    expect(result).toEqual({ fallback: 1 });
+    expect(getJsonParseCorruptionCount()).toBe(1);
+  });
+});
+
+describe('safeParseOptionalField', () => {
+  beforeEach(() => {
+    resetJsonParseCorruptionCount();
+  });
+
+  it('returns undefined for falsy values', () => {
+    expect(safeParseOptionalField(null, { component: 'X' })).toBeUndefined();
+    expect(safeParseOptionalField(undefined, { component: 'X' })).toBeUndefined();
+    expect(safeParseOptionalField('', { component: 'X' })).toBeUndefined();
+    expect(safeParseOptionalField(0, { component: 'X' })).toBeUndefined();
+  });
+
+  it('parses string values', () => {
+    expect(
+      safeParseOptionalField('{"a":1}', { component: 'X' })
+    ).toEqual({ a: 1 });
+  });
+
+  it('passes non-string truthy values through unchanged', () => {
+    const obj = { a: 1 };
+    expect(safeParseOptionalField(obj, { component: 'X' })).toBe(obj);
+  });
+
+  it('returns undefined on syntax error and increments counter', () => {
+    const result = safeParseOptionalField('garbage{', { component: 'X' });
+    expect(result).toBeUndefined();
+    expect(getJsonParseCorruptionCount()).toBe(1);
+  });
+});

package/src/utils/safe-json.ts

@@ -0,0 +1,107 @@
+/**
+ * Safe JSON-parse helpers shared by storage and scheduler adapters.
+ *
+ * When a stored JSON column is corrupted, we want to surface the problem
+ * operationally — structured log + counter — instead of silently degrading.
+ * The logger payload is restricted to safe metadata (component, row id,
+ * column, payload length, payload type, parser error message). The raw
+ * value is intentionally never logged because it may contain user-provided
+ * run / step input.
+ *
+ * Audit: 2026-04-27 findings L3 (corruption visibility) and M2 (do not
+ * bypass the configured `Logger` or leak the raw value via `console`).
+ */
+
+import type { Logger } from '../core/types';
+
+let corruptionCount = 0;
+
+/** Cumulative number of `safeJsonParse` failures since process start. */
+export function getJsonParseCorruptionCount(): number {
+  return corruptionCount;
+}
+
+/** Reset the corruption counter. Tests only. */
+export function resetJsonParseCorruptionCount(): void {
+  corruptionCount = 0;
+}
+
+export interface SafeJsonParseContext {
+  /** Component label, e.g. `SQLiteStorageAdapter`. */
+  component: string;
+  /** Optional database row id, surfaced in the warning so operators can locate the bad row. */
+  rowId?: string;
+  /** Optional column name for additional context. */
+  column?: string;
+  /** Optional structured logger; without one, only the counter is bumped. */
+  logger?: Logger;
+}
+
+/**
+ * Storage-adapter-level slice of `SafeJsonParseContext` — the part each
+ * adapter binds once (its component label + optional logger). Row mappers
+ * extend this with `rowId` and `column` per field, so corruption logs always
+ * identify the bad row.
+ *
+ * Shared between `src/storage/postgres-core.ts` and
+ * `src/storage/sqlite-core.ts` so all storage adapters use one mapper-context
+ * shape regardless of backend.
+ */
+export type MapperContext = Pick<SafeJsonParseContext, 'component' | 'logger'>;
+
+/**
+ * Parse a JSON string; on `SyntaxError` return `fallback`, increment the
+ * corruption counter, and emit a structured warn log via `ctx.logger` (if
+ * supplied). Non-syntax errors propagate so unexpected runtime issues are
+ * still loud.
+ */
+export function safeJsonParse<T = unknown>(
+  json: string,
+  fallback: T,
+  ctx: SafeJsonParseContext
+): T | unknown {
+  try {
+    return JSON.parse(json);
+  } catch (error) {
+    if (error instanceof SyntaxError) {
+      corruptionCount++;
+      ctx.logger?.warn(
+        `[${ctx.component}] Corrupted JSON in database row, using fallback`,
+        {
+          rowId: ctx.rowId,
+          column: ctx.column,
+          length: typeof json === 'string' ? json.length : undefined,
+          type: typeof json,
+          error: error.message,
+          corruptionCount,
+        }
+      );
+      return fallback;
+    }
+    throw error;
+  }
+}
+
+/** Parse a column value if it's still a JSON string; pass through otherwise. */
+export function safeParseField(
+  value: unknown,
+  fallback: unknown,
+  ctx: SafeJsonParseContext
+): unknown {
+  if (typeof value === 'string') {
+    return safeJsonParse(value, fallback, ctx);
+  }
+  return value;
+}
+
+/** Same as `safeParseField` but returns `undefined` for falsy/missing values. */
+export function safeParseOptionalField(
+  value: unknown,
+  ctx: SafeJsonParseContext
+): unknown {
+  if (!value) return undefined;
+  if (typeof value === 'string') {
+    return safeJsonParse(value, undefined, ctx);
+  }
+  return value;
+}

package/src/utils/webhook-signature.test.ts

@@ -0,0 +1,111 @@
+/**
+ * Tests for verifyWebhookSignature / signWebhookPayload — audit finding L2.
+ *
+ * Round-trips against the WebCrypto-based signer used by `WebhookEventTransport`
+ * to confirm both implementations agree on the wire format.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { signWebhookPayload, verifyWebhookSignature } from './webhook-signature';
+
+async function signWithWebCrypto(payload: string, secret: string): Promise<string> {
+  const encoder = new TextEncoder();
+  const key = await crypto.subtle.importKey(
+    'raw',
+    encoder.encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  );
+  const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(payload));
+  const hex = Array.from(new Uint8Array(signature))
+    .map((b) => b.toString(16).padStart(2, '0'))
+    .join('');
+  return `sha256=${hex}`;
+}
+
+describe('signWebhookPayload', () => {
+  it('produces a sha256= prefixed lowercase hex digest', () => {
+    const sig = signWebhookPayload('hello', 'shhh');
+    expect(sig).toMatch(/^sha256=[0-9a-f]{64}$/);
+  });
+
+  it('matches the WebCrypto signer used by WebhookEventTransport', async () => {
+    const payload = JSON.stringify({ id: 'evt_1', type: 'run.completed' });
+    const secret = 'whsec_test';
+    const fromHelper = signWebhookPayload(payload, secret);
+    const fromWebCrypto = await signWithWebCrypto(payload, secret);
+    expect(fromHelper).toBe(fromWebCrypto);
+  });
+});
+
+describe('verifyWebhookSignature', () => {
+  const secret = 'whsec_test';
+  const payload = '{"event":"ping"}';
+
+  it('verifies a signature produced by the helper', () => {
+    const sig = signWebhookPayload(payload, secret);
+    expect(verifyWebhookSignature(payload, sig, secret)).toBe(true);
+  });
+
+  it('verifies a signature produced by the WebCrypto signer (cross-impl)', async () => {
+    const sig = await signWithWebCrypto(payload, secret);
+    expect(verifyWebhookSignature(payload, sig, secret)).toBe(true);
+  });
+
+  it('accepts the digest with or without the sha256= prefix', () => {
+    const sig = signWebhookPayload(payload, secret);
+    const bare = sig.slice('sha256='.length);
+    expect(verifyWebhookSignature(payload, bare, secret)).toBe(true);
+  });
+
+  it('rejects a tampered body', () => {
+    const sig = signWebhookPayload(payload, secret);
+    expect(verifyWebhookSignature(payload + 'X', sig, secret)).toBe(false);
+  });
+
+  it('rejects a tampered signature', () => {
+    const sig = signWebhookPayload(payload, secret);
+    const flipped = `sha256=${'0'.repeat(64)}`;
+    expect(verifyWebhookSignature(payload, flipped, secret)).toBe(false);
+    const tweaked = sig.slice(0, -1) + (sig.endsWith('a') ? 'b' : 'a');
+    expect(verifyWebhookSignature(payload, tweaked, secret)).toBe(false);
+  });
+
+  it('rejects when the secret is wrong', () => {
+    const sig = signWebhookPayload(payload, secret);
+    expect(verifyWebhookSignature(payload, sig, 'other-secret')).toBe(false);
+  });
+
+  it('rejects empty / missing inputs', () => {
+    const sig = signWebhookPayload(payload, secret);
+    expect(verifyWebhookSignature(payload, undefined, secret)).toBe(false);
+    expect(verifyWebhookSignature(payload, null, secret)).toBe(false);
+    expect(verifyWebhookSignature(payload, '', secret)).toBe(false);
+    expect(verifyWebhookSignature(payload, sig, '')).toBe(false);
+  });
+
+  it('rejects non-hex signature strings without throwing', () => {
+    expect(verifyWebhookSignature(payload, 'sha256=not-hex-content', secret)).toBe(false);
+    expect(verifyWebhookSignature(payload, 'sha256=zzzz', secret)).toBe(false);
+  });
+
+  it('rejects digests of the wrong length without throwing', () => {
+    expect(verifyWebhookSignature(payload, 'sha256=abcd', secret)).toBe(false);
+    expect(verifyWebhookSignature(payload, `sha256=${'a'.repeat(63)}`, secret)).toBe(false);
+    expect(verifyWebhookSignature(payload, `sha256=${'a'.repeat(65)}`, secret)).toBe(false);
+  });
+
+  it('treats the digest case-insensitively', () => {
+    const sig = signWebhookPayload(payload, secret);
+    const upper = `sha256=${sig.slice('sha256='.length).toUpperCase()}`;
+    expect(verifyWebhookSignature(payload, upper, secret)).toBe(true);
+  });
+
+  it('handles Uint8Array bodies', () => {
+    const body = new TextEncoder().encode(payload);
+    const sig = signWebhookPayload(body, secret);
+    expect(verifyWebhookSignature(body, sig, secret)).toBe(true);
+    expect(signWebhookPayload(body, secret)).toBe(signWebhookPayload(payload, secret));
+  });
+});