@oomol-lab/open-connector 1.9.1 → 1.9.2

package/src/triggers/sources/feishu-demands.js

@@ -0,0 +1,24 @@
+import { feishuResourceKind } from "../../providers/feishu_app_bot/trigger-config.js";
+import { PermanentIntegrationError } from "../common/integration.js";
+import { isJsonObject } from "../common/json.js";
+export function feishuSubscriptions(config, provider) {
+    if (config.resource == null)
+        return [];
+    if (!isJsonObject(config.resource))
+        throw new PermanentIntegrationError("Invalid Feishu resource.");
+    const { kind, id, documentType } = config.resource;
+    if (typeof id != "string" || id.length == 0 || kind != feishuResourceKind(config.eventTypes))
+        throw new PermanentIntegrationError("Invalid resource subscription.");
+    if (kind == "document") {
+        if (typeof documentType != "string" ||
+            !["doc", "docx", "sheet", "bitable", "file", "folder", "slides"].includes(documentType))
+            throw new PermanentIntegrationError("A supported document type is required.");
+        return config.eventTypes.map((eventType) => ({
+            key: JSON.stringify(["document", documentType, id, eventType]),
+            config: { ...config, eventTypes: [eventType] },
+        }));
+    }
+    if (kind == "calendar" || (kind == "approval" && provider == "feishu_app_bot"))
+        return [{ key: JSON.stringify([kind, id]), config }];
+    throw new PermanentIntegrationError("Unsupported Feishu resource subscription.");
+}

package/src/triggers/sources/feishu-events.d.ts

@@ -0,0 +1,19 @@
+import type { JsonValue } from "../common/types.ts";
+export interface FeishuEvent {
+    readonly id: string;
+    readonly type: string;
+    readonly appId: string;
+    readonly tenantKey: string;
+    readonly occurredAt: string | null;
+    readonly body: Readonly<Record<string, JsonValue>>;
+}
+export declare function receiveFeishuEvent(rawBody: Uint8Array, headers: Headers, source: {
+    readonly appId: string;
+    readonly verificationToken: string;
+    readonly encryptKey: string;
+}, now: number): Promise<{
+    readonly challenge: string;
+} | {
+    readonly event: FeishuEvent;
+}>;
+export declare function matchesFeishuEvent(config: Readonly<Record<string, JsonValue>>, event: Pick<FeishuEvent, "type" | "body">): boolean;

package/src/triggers/sources/feishu-events.js

@@ -0,0 +1,108 @@
+import { isJsonObject } from "../common/json.js";
+const encoder = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+export async function receiveFeishuEvent(rawBody, headers, source, now) {
+    const envelope = JSON.parse(decoder.decode(rawBody));
+    if (!isJsonObject(envelope) ||
+        typeof envelope.encrypt != "string" ||
+        !/^[A-Za-z0-9+/]+={0,2}$/.test(envelope.encrypt)) {
+        throw new TypeError("An encrypted Feishu envelope is required.");
+    }
+    const bytes = Uint8Array.from(atob(envelope.encrypt), (character) => character.charCodeAt(0));
+    if (bytes.length < 32 || bytes.length % 16 != 0)
+        throw new TypeError("Invalid encrypted Feishu envelope.");
+    const key = await crypto.subtle.importKey("raw", await crypto.subtle.digest("SHA-256", encoder.encode(source.encryptKey)), "AES-CBC", false, ["decrypt"]);
+    const value = JSON.parse(decoder.decode(await crypto.subtle.decrypt({ name: "AES-CBC", iv: bytes.slice(0, 16) }, key, bytes.slice(16))));
+    if (!isJsonObject(value))
+        throw new TypeError("Invalid Feishu event.");
+    const header = isJsonObject(value.header) ? value.header : undefined;
+    if (!sameSecret(header?.token ?? value.token, source.verificationToken))
+        throw new TypeError("Invalid Feishu verification token.");
+    if (value.type == "url_verification") {
+        if (typeof value.challenge != "string" || value.challenge.length == 0 || value.challenge.length > 1024)
+            throw new TypeError("Invalid challenge.");
+        return { challenge: value.challenge };
+    }
+    const timestamp = headers.get("x-lark-request-timestamp") ?? "";
+    const nonce = headers.get("x-lark-request-nonce") ?? "";
+    const signature = headers.get("x-lark-signature") ?? "";
+    if (!/^\d{10}$/.test(timestamp) ||
+        Math.abs(now - Number(timestamp) * 1000) > 86_400_000 ||
+        nonce.length == 0 ||
+        nonce.length > 256) {
+        throw new TypeError("Invalid Feishu request identity.");
+    }
+    const prefix = encoder.encode(timestamp + nonce + source.encryptKey);
+    const signed = new Uint8Array(prefix.length + rawBody.length);
+    signed.set(prefix);
+    signed.set(rawBody, prefix.length);
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", signed));
+    const hex = Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("");
+    if (!sameSecret(signature, hex))
+        throw new TypeError("Invalid Feishu signature.");
+    const body = value.event;
+    if (!isJsonObject(body))
+        throw new TypeError("Missing Feishu event body.");
+    if (value.schema != null && value.schema != "2.0")
+        throw new TypeError("Unsupported Feishu event schema.");
+    const type = header?.event_type ?? body.type;
+    const appId = header?.app_id ?? body.app_id ?? value.app_id;
+    const tenantKey = header?.tenant_key ?? body.tenant_key ?? value.tenant_key;
+    let id = header?.event_id ?? value.uuid;
+    if (type == "im.message.receive_v1" && isJsonObject(body.message))
+        id = body.message.message_id;
+    if (typeof id != "string" ||
+        id.length == 0 ||
+        id.length > 256 ||
+        typeof type != "string" ||
+        !/^[a-z][a-z0-9_.]{0,127}$/.test(type)) {
+        throw new TypeError("Missing Feishu event identity.");
+    }
+    if (appId != source.appId)
+        throw new TypeError("Feishu event source does not match.");
+    if (typeof tenantKey != "string" || tenantKey.length == 0 || tenantKey.length > 256)
+        throw new TypeError("Invalid Feishu event tenant.");
+    if (type == "card.action.trigger" || type == "app_ticket")
+        throw new TypeError("This callback is not an asynchronous business event.");
+    const { token: _token, ...business } = body;
+    const occurredAt = header?.create_time ?? value.ts;
+    return {
+        event: {
+            id: `${type}:${id}`,
+            type,
+            appId: source.appId,
+            tenantKey,
+            occurredAt: typeof occurredAt == "string" ? occurredAt : null,
+            body: business,
+        },
+    };
+}
+function sameSecret(value, expected) {
+    if (typeof value != "string" || value.length != expected.length)
+        return false;
+    let difference = 0;
+    for (let index = 0; index < expected.length; index += 1)
+        difference |= value.charCodeAt(index) ^ expected.charCodeAt(index);
+    return difference == 0;
+}
+export function matchesFeishuEvent(config, event) {
+    if (!Array.isArray(config.eventTypes) || !config.eventTypes.includes(event.type))
+        return false;
+    const chatIds = config.chatIds;
+    if (Array.isArray(chatIds) && chatIds.length > 0) {
+        const chatId = isJsonObject(event.body.message) ? event.body.message.chat_id : event.body.chat_id;
+        if (typeof chatId != "string" || !chatIds.includes(chatId))
+            return false;
+    }
+    const resource = config.resource;
+    if (isJsonObject(resource)) {
+        const id = resource.kind == "document"
+            ? event.body.file_token
+            : resource.kind == "calendar"
+                ? event.body.calendar_id
+                : event.body.approval_code;
+        if (id != resource.id)
+            return false;
+    }
+    return true;
+}

package/src/triggers/sources/feishu.d.ts

@@ -0,0 +1,3 @@
+import type { CreateEventSource, EventSource, UpdateEventSource } from "./configuration.ts";
+import type { EventSourceDefinition } from "./definition.ts";
+export declare const feishuApplication: EventSourceDefinition<CreateEventSource, UpdateEventSource, Pick<EventSource, "appId" | "manageSubscriptions" | "verificationTokenConfigured" | "encryptKeyConfigured" | "verifiedAt">>;

package/src/triggers/sources/feishu.js

@@ -0,0 +1,85 @@
+import { PermanentIntegrationError } from "../common/integration.js";
+import { SourceIdentityError } from "./definition.js";
+import { feishuSubscriptions } from "./feishu-demands.js";
+import { receiveFeishuEvent, matchesFeishuEvent } from "./feishu-events.js";
+export const feishuApplication = {
+    kind: "feishu",
+    provider: "feishu_app_bot",
+    maximumBodyBytes: 64 * 1024,
+    initialize(input, accountId) {
+        if (input.kind != null && input.kind !== "feishu")
+            throw new SourceIdentityError("Expected a Feishu source.");
+        if (accountId == null || !/^cli_[a-zA-Z0-9]+$/.test(accountId))
+            throw new SourceIdentityError("Connector must provide the verified application identity.");
+        return {
+            identity: accountId,
+            eventTypes: input.eventTypes,
+            config: { manageSubscriptions: input.manageSubscriptions },
+            secrets: { verificationToken: input.verificationToken, encryptKey: input.encryptKey },
+            state: {},
+        };
+    },
+    update(source, input) {
+        const secrets = {
+            verificationToken: input.verificationToken ?? source.secrets.verificationToken,
+            encryptKey: input.encryptKey ?? source.secrets.encryptKey,
+        };
+        const changed = secrets.verificationToken != source.secrets.verificationToken || secrets.encryptKey != source.secrets.encryptKey;
+        return {
+            identity: source.identity,
+            eventTypes: input.eventTypes,
+            config: source.config,
+            secrets,
+            state: changed ? {} : source.state,
+        };
+    },
+    view(source) {
+        return {
+            appId: source.identity,
+            manageSubscriptions: source.config.manageSubscriptions === true,
+            verificationTokenConfigured: true,
+            encryptKeyConfigured: true,
+            verifiedAt: typeof source.state.verifiedAt == "number" ? new Date(source.state.verifiedAt).toISOString() : null,
+        };
+    },
+    ready: (source) => typeof source.state.verifiedAt == "number",
+    async receive(source, bytes, headers, now) {
+        const received = await receiveFeishuEvent(bytes, headers, {
+            appId: source.identity,
+            verificationToken: source.secrets.verificationToken,
+            encryptKey: source.secrets.encryptKey,
+        }, now);
+        if ("challenge" in received)
+            return { response: Response.json(received), state: { ...source.state, verifiedAt: now } };
+        const event = received.event;
+        return {
+            event: {
+                id: event.id,
+                type: event.type,
+                payload: {
+                    event: event.type,
+                    deliveryId: event.id,
+                    appId: event.appId,
+                    tenantKey: event.tenantKey,
+                    occurredAt: event.occurredAt,
+                    body: event.body,
+                },
+            },
+        };
+    },
+    matches(config, event) {
+        return matchesFeishuEvent(config, {
+            type: event.type,
+            body: event.payload.body,
+        });
+    },
+    resources: {
+        triggerId: "feishu_app_bot.on_event",
+        requests(source, provider, config) {
+            const subscriptions = feishuSubscriptions(config, provider);
+            if (subscriptions.length > 0 && source.config.manageSubscriptions !== true)
+                throw new PermanentIntegrationError("This source does not manage resource subscriptions.");
+            return subscriptions;
+        },
+    },
+};

package/src/triggers/sources/fireflies.d.ts

@@ -0,0 +1,3 @@
+import type { CreateEventSource, EventSource, UpdateEventSource } from "./configuration.ts";
+import type { EventSourceDefinition } from "./definition.ts";
+export declare const firefliesAccount: EventSourceDefinition<CreateEventSource, UpdateEventSource, Pick<EventSource, "appId" | "manageSubscriptions" | "verificationTokenConfigured" | "encryptKeyConfigured" | "signingSecretConfigured" | "verifiedAt">>;

package/src/triggers/sources/fireflies.js

@@ -0,0 +1,100 @@
+import { isJsonObject } from "../common/json.js";
+import { SourceIdentityError } from "./definition.js";
+import { verifySourceHmac } from "./signature.js";
+const events = new Set(["meeting.transcribed", "meeting.summarized"]);
+export const firefliesAccount = {
+    kind: "fireflies",
+    provider: "fireflies",
+    maximumBodyBytes: 64 * 1024,
+    initialize(input, accountId) {
+        if (input.kind !== "fireflies" || !accountId)
+            throw new SourceIdentityError("Connector must provide the verified Fireflies account identity.");
+        if (input.eventTypes.some((event) => !events.has(event)))
+            throw new SourceIdentityError("Unsupported Fireflies event.");
+        return {
+            identity: JSON.stringify([input.teamId, input.connectionId, accountId]),
+            eventTypes: input.eventTypes,
+            config: { appId: accountId, accountId },
+            secrets: { signingSecret: input.signingSecret },
+            state: {},
+        };
+    },
+    update(source, input) {
+        if (input.verificationToken != null || input.encryptKey != null)
+            throw new SourceIdentityError("Fireflies uses the Webhooks V2 Signing Secret.");
+        if (input.eventTypes.some((event) => !events.has(event)))
+            throw new SourceIdentityError("Unsupported Fireflies event.");
+        const signingSecret = input.signingSecret ?? source.secrets.signingSecret;
+        return {
+            ...source,
+            eventTypes: input.eventTypes,
+            secrets: { signingSecret },
+            state: signingSecret === source.secrets.signingSecret ? source.state : {},
+        };
+    },
+    view(source) {
+        return {
+            appId: String(source.config.appId),
+            manageSubscriptions: false,
+            verificationTokenConfigured: false,
+            encryptKeyConfigured: false,
+            signingSecretConfigured: true,
+            verifiedAt: typeof source.state.verifiedAt === "number" ? new Date(source.state.verifiedAt).toISOString() : null,
+        };
+    },
+    ready: (source) => typeof source.state.verifiedAt === "number",
+    async receive(source, bytes, headers, now, execute) {
+        const signature = headers.get("x-hub-signature") ?? "";
+        if (!signature.startsWith("sha256=") ||
+            !(await verifySourceHmac(bytes, signature.slice(7), String(source.secrets.signingSecret))))
+            throw new TypeError("Invalid Fireflies signature.");
+        const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        if (!isJsonObject(payload) || typeof payload.event !== "string")
+            throw new TypeError("Invalid Fireflies envelope.");
+        if (!events.has(payload.event))
+            return { response: Response.json({}), state: source.state };
+        if (typeof payload.meeting_id !== "string" ||
+            !payload.meeting_id ||
+            payload.meeting_id.length > 256 ||
+            !Number.isSafeInteger(payload.timestamp) ||
+            Number(payload.timestamp) < 0 ||
+            (payload.reprocessed_at != null &&
+                (!Number.isSafeInteger(payload.reprocessed_at) || Number(payload.reprocessed_at) <= 0)))
+            throw new TypeError("Incomplete Fireflies event.");
+        if (execute == null)
+            throw new SourceIdentityError("Fireflies meeting verification is unavailable.");
+        const identity = await execute({ operation: "sourceIdentity", config: { meetingId: payload.meeting_id } });
+        if (!isJsonObject(identity) ||
+            identity.accountId !== source.config.accountId ||
+            identity.meetingId !== payload.meeting_id ||
+            typeof identity.accessible !== "boolean")
+            throw new SourceIdentityError("Fireflies returned an invalid meeting access result.");
+        if (!identity.accessible)
+            return { response: Response.json({}), state: source.state };
+        const version = Number(payload.reprocessed_at ?? 0);
+        const stream = JSON.stringify([payload.event, payload.meeting_id]);
+        const deliveryId = JSON.stringify([payload.event, payload.meeting_id, version]);
+        return {
+            state: { ...source.state, verifiedAt: now },
+            event: {
+                id: deliveryId,
+                type: payload.event,
+                ordering: { key: stream, version },
+                payload: {
+                    event: payload.event,
+                    deliveryId,
+                    accountId: source.config.accountId,
+                    meetingId: payload.meeting_id,
+                    body: {
+                        event: payload.event,
+                        meeting_id: payload.meeting_id,
+                        reprocessed_at: payload.reprocessed_at ?? null,
+                        client_reference_id: typeof payload.client_reference_id === "string" ? payload.client_reference_id : null,
+                    },
+                },
+            },
+        };
+    },
+    matches: (config, event) => Array.isArray(config.eventTypes) && config.eventTypes.includes(event.type),
+    resources: { triggerId: "fireflies.on_meeting_ready", requests: () => [] },
+};

package/src/triggers/sources/intercom.d.ts

@@ -0,0 +1,3 @@
+import type { CreateEventSource, EventSource, UpdateEventSource } from "./configuration.ts";
+import type { EventSourceDefinition } from "./definition.ts";
+export declare const intercomApplication: EventSourceDefinition<CreateEventSource, UpdateEventSource, Pick<EventSource, "appId" | "workspaceId" | "manageSubscriptions" | "verificationTokenConfigured" | "encryptKeyConfigured" | "signingSecretConfigured" | "verifiedAt">>;

package/src/triggers/sources/intercom.js

@@ -0,0 +1,86 @@
+import { isJsonObject } from "../common/json.js";
+import { SourceIdentityError } from "./definition.js";
+import { verifySourceHmac } from "./signature.js";
+const events = new Set(["conversation.user.created", "conversation.user.replied", "ticket.created"]);
+export const intercomApplication = {
+    kind: "intercom",
+    provider: "intercom",
+    applicationIngress: true,
+    maximumBodyBytes: 64 * 1024,
+    initialize(input, accountId) {
+        if (input.kind !== "intercom" || accountId == null || !/^[^:]+:[^:]+$/.test(accountId))
+            throw new SourceIdentityError("Connector must provide the verified Intercom workspace and administrator identity.");
+        if (input.eventTypes.some((event) => !events.has(event)))
+            throw new SourceIdentityError("Unsupported Intercom event type.");
+        const workspaceId = accountId.split(":")[0];
+        return {
+            identity: JSON.stringify([input.teamId, input.connectionId, input.appId, accountId]),
+            eventTypes: input.eventTypes,
+            config: { appId: input.appId, workspaceId, accountId },
+            secrets: { signingSecret: input.signingSecret },
+            state: {},
+        };
+    },
+    update(source, input) {
+        if (input.verificationToken != null || input.encryptKey != null)
+            throw new SourceIdentityError("Intercom uses the application Client Secret.");
+        if (input.eventTypes.some((event) => !events.has(event)))
+            throw new SourceIdentityError("Unsupported Intercom event type.");
+        const signingSecret = input.signingSecret ?? source.secrets.signingSecret;
+        return {
+            ...source,
+            eventTypes: input.eventTypes,
+            secrets: { signingSecret },
+            state: signingSecret === source.secrets.signingSecret ? source.state : {},
+        };
+    },
+    view(source) {
+        return {
+            appId: String(source.config.appId),
+            workspaceId: String(source.config.workspaceId),
+            manageSubscriptions: false,
+            verificationTokenConfigured: false,
+            encryptKeyConfigured: false,
+            signingSecretConfigured: true,
+            verifiedAt: typeof source.state.verifiedAt === "number" ? new Date(source.state.verifiedAt).toISOString() : null,
+        };
+    },
+    ready: (source) => typeof source.state.verifiedAt === "number",
+    async receive(source, bytes, headers, now) {
+        const signature = headers.get("x-hub-signature") ?? "";
+        if (!/^sha1=[0-9a-f]{40}$/.test(signature))
+            throw new TypeError("Invalid Intercom signature.");
+        if (!(await verifySourceHmac(bytes, signature.slice(5), String(source.secrets.signingSecret), "SHA-1")))
+            throw new TypeError("Invalid Intercom signature.");
+        const payload = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+        if (!isJsonObject(payload) || payload.type !== "notification_event")
+            throw new TypeError("Invalid Intercom notification.");
+        if (payload.app_id !== source.config.workspaceId)
+            return { response: Response.json({}), state: source.state };
+        if (payload.topic === "ping")
+            return { response: Response.json({}), state: { ...source.state, verifiedAt: now } };
+        if (typeof payload.topic !== "string" || !events.has(payload.topic))
+            return { response: Response.json({}), state: source.state };
+        if (typeof payload.id !== "string" ||
+            !payload.id ||
+            !isJsonObject(payload.data) ||
+            !isJsonObject(payload.data.item) ||
+            typeof payload.data.item.id !== "string")
+            throw new TypeError("Incomplete Intercom notification.");
+        return {
+            event: {
+                id: payload.id,
+                type: payload.topic,
+                payload: {
+                    event: payload.topic,
+                    deliveryId: payload.id,
+                    workspaceId: payload.app_id,
+                    objectId: payload.data.item.id,
+                    body: payload.data.item,
+                },
+            },
+        };
+    },
+    matches: (config, event) => Array.isArray(config.eventTypes) && config.eventTypes.includes(event.type),
+    resources: { triggerId: "intercom.on_conversation_event", requests: () => [] },
+};

package/src/triggers/sources/jira.d.ts

@@ -0,0 +1,3 @@
+import type { CreateEventSource, EventSource, UpdateEventSource } from "./configuration.ts";
+import type { EventSourceDefinition } from "./definition.ts";
+export declare const jiraProject: EventSourceDefinition<CreateEventSource, UpdateEventSource, Pick<EventSource, "appId" | "projectId" | "projectKey" | "subscriptionStatus" | "lastError" | "manageSubscriptions" | "verificationTokenConfigured" | "encryptKeyConfigured" | "verifiedAt">>;

package/src/triggers/sources/jira.js

@@ -0,0 +1,120 @@
+import { isJsonObject } from "../common/json.js";
+import { SourceIdentityError } from "./definition.js";
+const events = new Set(["jira:issue_created", "jira:issue_updated", "comment_created"]);
+export const jiraProject = {
+    kind: "jira",
+    provider: "jira",
+    maximumBodyBytes: 64 * 1024,
+    initialize(input, accountId) {
+        if (input.kind !== "jira" || !accountId?.startsWith("jira:"))
+            throw new SourceIdentityError("Choose a verified Jira Cloud OAuth connection.");
+        if (input.eventTypes.some((event) => !events.has(event)))
+            throw new SourceIdentityError("Unsupported Jira event.");
+        return {
+            identity: JSON.stringify([input.teamId, input.connectionId, accountId]),
+            eventTypes: input.eventTypes,
+            config: { accountId, project: input.project },
+            secrets: {},
+            state: {},
+        };
+    },
+    async verifyIdentity(source, read) {
+        const identity = await read(source.config);
+        if (!isJsonObject(identity) ||
+            identity.accountId !== source.config.accountId ||
+            typeof identity.cloudId !== "string" ||
+            typeof identity.userId !== "string" ||
+            typeof identity.projectId !== "string" ||
+            !/^\d+$/.test(identity.projectId) ||
+            typeof identity.projectKey !== "string" ||
+            typeof identity.siteUrl !== "string")
+            throw new SourceIdentityError("Jira did not return the selected project and site identity.");
+        if (source.config.projectId != null &&
+            (source.config.cloudId !== identity.cloudId ||
+                source.config.projectId !== identity.projectId ||
+                source.config.userId !== identity.userId))
+            throw new SourceIdentityError("The Jira project, site or user changed. Recreate the event source.");
+        return {
+            ...source,
+            identity: source.config.projectId == null
+                ? JSON.stringify([source.identity, identity.cloudId, identity.projectId, identity.userId])
+                : source.identity,
+            config: { ...source.config, ...identity },
+        };
+    },
+    update(source, input) {
+        if (input.verificationToken != null || input.encryptKey != null || input.signingSecret != null)
+            throw new SourceIdentityError("Jira OAuth callback verification is owned by Connector.");
+        if (input.eventTypes.some((event) => !events.has(event)))
+            throw new SourceIdentityError("Unsupported Jira event.");
+        return { ...source, eventTypes: input.eventTypes };
+    },
+    view(source, now = Date.now()) {
+        const expired = isJsonObject(source.state.resource) &&
+            typeof source.state.resource.expiresAt === "number" &&
+            source.state.resource.expiresAt <= now;
+        const status = expired ? "error" : source.state.resourceStatus;
+        return {
+            appId: String(source.config.cloudId),
+            projectId: String(source.config.projectId),
+            projectKey: String(source.config.projectKey),
+            subscriptionStatus: status === "pending" || status === "ready" || status === "error" ? status : "idle",
+            lastError: expired
+                ? "The Jira webhook expired. Restore Connector access and retry publication."
+                : typeof source.state.lastError === "string"
+                    ? source.state.lastError
+                    : undefined,
+            manageSubscriptions: true,
+            verificationTokenConfigured: false,
+            encryptKeyConfigured: false,
+            verifiedAt: typeof source.state.verifiedAt === "number" ? new Date(source.state.verifiedAt).toISOString() : null,
+        };
+    },
+    expiresAt: (source) => isJsonObject(source.state.resource) && typeof source.state.resource.expiresAt === "number"
+        ? source.state.resource.expiresAt
+        : undefined,
+    ready: (source, now = Date.now()) => source.state.resourceStatus === "ready" &&
+        isJsonObject(source.state.resource) &&
+        typeof source.state.resource.expiresAt === "number" &&
+        source.state.resource.expiresAt > now,
+    async receive(source, bytes, headers, _now, execute) {
+        if (!isJsonObject(source.state.resource) ||
+            typeof source.state.resource.webhookId !== "number" ||
+            source.state.resourceStatus !== "ready")
+            return { response: new Response(null, { status: 503 }), state: source.state };
+        if (execute == null)
+            throw new SourceIdentityError("Jira callback verification is unavailable.");
+        const result = await execute({
+            operation: "sourceReceive",
+            config: { ...source.config, webhookId: source.state.resource.webhookId },
+            headers: {
+                authorization: headers.get("authorization") ?? "",
+                "x-atlassian-webhook-identifier": headers.get("x-atlassian-webhook-identifier") ?? "",
+            },
+            rawBody: new TextDecoder("utf-8", { fatal: true }).decode(bytes),
+        });
+        if (!isJsonObject(result))
+            throw new SourceIdentityError("Invalid Jira verification response.");
+        if (result.outcome === "unauthorized")
+            return { response: new Response(null, { status: 401 }), state: source.state };
+        if (result.outcome === "ignored")
+            return { response: Response.json({}), state: source.state };
+        if (result.outcome !== "event" ||
+            typeof result.id !== "string" ||
+            typeof result.type !== "string" ||
+            !events.has(result.type) ||
+            !isJsonObject(result.payload))
+            throw new SourceIdentityError("Invalid Jira verified event.");
+        return { event: { id: result.id, type: result.type, payload: result.payload } };
+    },
+    matches: (config, event) => Array.isArray(config.eventTypes) && config.eventTypes.includes(event.type),
+    resources: {
+        triggerId: "jira.on_issue_event",
+        managed: true,
+        requests(source, _provider, _config, endpointUrl) {
+            if (!endpointUrl)
+                throw new SourceIdentityError("Jira requires a public callback URL.");
+            return [{ key: "project", config: { projectId: source.config.projectId, endpointUrl } }];
+        },
+    },
+};

package/src/triggers/sources/operation.d.ts

@@ -0,0 +1,42 @@
+import type { IntegrationDefinition } from "../common/integration.ts";
+import type { ConnectorProxy } from "../common/proxy.ts";
+import type { JsonValue } from "../common/types.ts";
+import type { SourceConfiguration } from "./definition.ts";
+import { z } from "zod";
+export declare const sourceOperationSchema: z.ZodType<SourceOperation>;
+export type SourceOperation = {
+    readonly action: "initialize";
+    readonly input: Readonly<Record<string, JsonValue>>;
+} | {
+    readonly action: "update";
+    readonly source: SourceConfiguration;
+    readonly input: Readonly<Record<string, JsonValue>>;
+} | {
+    readonly action: "inspect";
+    readonly source: SourceConfiguration;
+} | {
+    readonly action: "prepare";
+    readonly source: SourceConfiguration;
+    readonly config: Readonly<Record<string, JsonValue>>;
+    readonly endpointUrl?: string;
+} | {
+    readonly action: "receive";
+    readonly source: SourceConfiguration;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly rawBody: string;
+    readonly consumers: readonly {
+        readonly id: string;
+        readonly config: Readonly<Record<string, JsonValue>>;
+    }[];
+};
+export declare function sourceMetadata(definition: IntegrationDefinition): {
+    kind: string;
+    provider: string;
+    triggerId: string;
+    maximumBodyBytes: number;
+    applicationIngress: boolean;
+    managed: boolean;
+    createSchema: Record<string, unknown>;
+    updateSchema: Record<string, unknown>;
+} | undefined;
+export declare function executeSourceOperation(definition: IntegrationDefinition, request: SourceOperation, connector: ConnectorProxy, signal: AbortSignal, now?: number): Promise<unknown>;