@particle-academy/fancy-connector-core 0.12.0 → 0.13.0

package/dist/index.cjs

@@ -43,9 +43,13 @@ __export(src_exports, {
   FAKE_EPOCH: () => FAKE_EPOCH,
   FORM_FIELD_JSON_REASONS: () => FORM_FIELD_JSON_REASONS,
   FormFieldJsonError: () => FormFieldJsonError,
+  JWT_ALGORITHMS: () => JWT_ALGORITHMS,
   MAX_IDEMPOTENCY_KEY_LENGTH: () => MAX_IDEMPOTENCY_KEY_LENGTH,
   NO_IDEMPOTENCY_KEY_WARNING: () => NO_IDEMPOTENCY_KEY_WARNING,
+  OIDC_JWT_SCHEME_KIND: () => OIDC_JWT_SCHEME_KIND,
   PROBLEM_SEVERITIES: () => PROBLEM_SEVERITIES,
+  PUBSUB_PUSH_REASONS: () => PUBSUB_PUSH_REASONS,
+  PubSubPushError: () => PubSubPushError,
   RENDERER_VERSION: () => RENDERER_VERSION,
   REVIEW_STALE_DAYS: () => REVIEW_STALE_DAYS,
   SANDBOX_KINDS: () => SANDBOX_KINDS,
@@ -66,6 +70,7 @@ __export(src_exports, {
   constantTimeEquals: () => constantTimeEquals,
   decodeDelivery: () => decodeDelivery,
   decodeFormFieldJson: () => decodeFormFieldJson,
+  decodePubSubPush: () => decodePubSubPush,
   deliver: () => deliver,
   fakeRequest: () => fakeRequest,
   fakeValues: () => fakeValues,
@@ -77,6 +82,8 @@ __export(src_exports, {
   httpFailure: () => httpFailure,
   idempotencyKeyFor: () => idempotencyKeyFor,
   isEmptyPayload: () => isEmptyPayload,
+  isOidcJwtScheme: () => isOidcJwtScheme,
+  isOidcJwtSpec: () => isOidcJwtSpec,
   isRemote: () => isRemote,
   isSharedTokenScheme: () => isSharedTokenScheme,
   isSharedTokenSpec: () => isSharedTokenSpec,
@@ -123,6 +130,8 @@ __export(src_exports, {
   utf8Length: () => utf8Length,
   verifyDelivery: () => verifyDelivery,
   verifyHmac: () => verifyHmac,
+  verifyJwt: () => verifyJwt,
+  verifyOidcDelivery: () => verifyOidcDelivery,
   verifySharedToken: () => verifySharedToken,
   withResolvedLimit: () => withResolvedLimit
 });
@@ -1362,6 +1371,88 @@ function fnv1a(value) {
   return hash.toString(16).padStart(8, "0");
 }
 
+// src/jwt.ts
+var JWT_ALGORITHMS = ["RS256"];
+var fail = (reason) => ({ ok: false, reason });
+async function verifyJwt(token, options) {
+  const parts = typeof token === "string" ? token.split(".") : [];
+  if (parts.length !== 3 || parts.some((p2, i) => p2 === "" && i < 2)) {
+    return fail("token is not a JWS compact serialization");
+  }
+  const [h, p, s] = parts;
+  const header3 = jsonSegment(h);
+  if (!header3) return fail("token header is not base64url JSON");
+  if (!JWT_ALGORITHMS.includes(header3.alg)) {
+    return fail(`alg ${JSON.stringify(header3.alg)} is not accepted`);
+  }
+  const key = selectKey(options.keys, header3.kid);
+  if ("reason" in key) return fail(key.reason);
+  const signature = base64urlBytes(s);
+  if (!signature) return fail("signature is not base64url");
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) return fail("no WebCrypto in this runtime");
+  let valid;
+  try {
+    const imported = await subtle.importKey(
+      "jwk",
+      { kty: "RSA", n: key.jwk.n, e: key.jwk.e, alg: "RS256", ext: true },
+      { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+      false,
+      ["verify"]
+    );
+    valid = await subtle.verify("RSASSA-PKCS1-v1_5", imported, signature, new TextEncoder().encode(`${h}.${p}`));
+  } catch {
+    return fail("the key could not be used to verify");
+  }
+  if (!valid) return fail("signature did not match");
+  const claims = jsonSegment(p);
+  if (!claims) return fail("token payload is not base64url JSON");
+  const now = options.now ?? Math.floor(Date.now() / 1e3);
+  const leeway = options.leeway ?? 60;
+  if (typeof claims.exp !== "number") return fail("token has no exp");
+  if (now > claims.exp + leeway) return fail("token has expired");
+  if (typeof claims.nbf === "number" && now + leeway < claims.nbf) return fail("token is not valid yet");
+  if (options.issuer !== void 0) {
+    const issuers = typeof options.issuer === "string" ? [options.issuer] : options.issuer;
+    if (typeof claims.iss !== "string" || !issuers.includes(claims.iss)) return fail("token issuer is not accepted");
+  }
+  if (options.audience !== null) {
+    const wanted = typeof options.audience === "string" ? [options.audience] : options.audience;
+    const offered = typeof claims.aud === "string" ? [claims.aud] : Array.isArray(claims.aud) ? claims.aud : [];
+    if (!offered.some((a) => typeof a === "string" && wanted.includes(a))) return fail("token audience is not accepted");
+  }
+  return { ok: true, header: header3, claims };
+}
+function selectKey(keys, kid) {
+  const rsa = keys.filter((k) => k.kty === "RSA" && typeof k.n === "string" && typeof k.e === "string");
+  if (typeof kid === "string") {
+    const match = rsa.find((k) => k.kid === kid);
+    return match ? { jwk: match } : { reason: `no key for kid ${JSON.stringify(kid)}` };
+  }
+  const [only] = rsa;
+  return rsa.length === 1 && only ? { jwk: only } : { reason: "token names no kid and the key is ambiguous" };
+}
+function jsonSegment(segment) {
+  const bytes = base64urlBytes(segment);
+  if (!bytes) return null;
+  try {
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function base64urlBytes(segment) {
+  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) return null;
+  const standard = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = standard + "=".repeat((4 - standard.length % 4) % 4);
+  try {
+    return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+  } catch {
+    return null;
+  }
+}
+
 // src/lease.ts
 var EXPIRES_AT_UNITS = ["rfc3339", "epoch-ms"];
 var INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})$/;
@@ -1796,6 +1887,65 @@ function parseMime(raw) {
   };
 }
 
+// src/pubsub-push.ts
+var PUBSUB_PUSH_REASONS = ["not-json", "missing-message", "missing-data", "bad-encoding", "data-not-json"];
+var PubSubPushError = class extends Error {
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+    this.name = "PubSubPushError";
+  }
+  reason;
+};
+var UTF8 = new TextDecoder("utf-8", { fatal: true });
+function decodePubSubPush(raw) {
+  let body;
+  try {
+    body = JSON.parse(typeof raw === "string" ? raw : UTF8.decode(raw));
+  } catch {
+    throw new PubSubPushError("not-json", "the push body is not JSON");
+  }
+  if (!isObject(body)) throw new PubSubPushError("not-json", "the push body is not a JSON object");
+  const message = body.message;
+  if (!isObject(message)) throw new PubSubPushError("missing-message", "the push body has no message");
+  const data = message.data;
+  if (typeof data !== "string" || data === "") {
+    throw new PubSubPushError("missing-data", "the message carries no data");
+  }
+  let text;
+  try {
+    text = UTF8.decode(base64Bytes2(data));
+  } catch {
+    throw new PubSubPushError("bad-encoding", "the message data is not base64 of UTF-8 text");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    throw new PubSubPushError("data-not-json", `the message data is not JSON: ${error.message}`);
+  }
+  return {
+    subscription: stringOrNull(body.subscription),
+    messageId: stringOrNull(message.messageId) ?? stringOrNull(message.message_id),
+    publishTime: stringOrNull(message.publishTime) ?? stringOrNull(message.publish_time),
+    attributes: isObject(message.attributes) ? message.attributes : {},
+    deliveryAttempt: Number.isInteger(body.deliveryAttempt) ? body.deliveryAttempt : null,
+    data: parsed
+  };
+}
+function base64Bytes2(data) {
+  const unpadded = data.replace(/={1,2}$/, "");
+  if (!/^[A-Za-z0-9+/_-]*$/.test(unpadded) || unpadded.length % 4 === 1) throw new Error("not base64");
+  const standard = unpadded.replace(/-/g, "+").replace(/_/g, "/");
+  return Uint8Array.from(atob(standard + "=".repeat((4 - standard.length % 4) % 4)), (c) => c.charCodeAt(0));
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringOrNull(value) {
+  return typeof value === "string" ? value : null;
+}
+
 // src/form-field-json.ts
 var FORM_FIELD_JSON_REASONS = ["missing-field", "duplicate-field", "bad-encoding", "not-json"];
 var FormFieldJsonError = class extends Error {
@@ -1808,7 +1958,7 @@ var FormFieldJsonError = class extends Error {
   reason;
   field;
 };
-var UTF8 = new TextDecoder("utf-8", { fatal: true });
+var UTF82 = new TextDecoder("utf-8", { fatal: true });
 var HEX = /^[0-9A-Fa-f]{2}$/;
 function decodeFormFieldJson(raw, field) {
   const text = typeof raw === "string" ? raw : latin12(raw);
@@ -1851,14 +2001,15 @@ function component(encoded, field) {
     }
   }
   try {
-    return UTF8.decode(new Uint8Array(bytes));
+    return UTF82.decode(new Uint8Array(bytes));
   } catch {
     throw new FormFieldJsonError("bad-encoding", field, "the decoded bytes are not valid UTF-8");
   }
 }
-var DELIVERY_DECODE_KINDS = ["form-field-json"];
+var DELIVERY_DECODE_KINDS = ["form-field-json", "pubsub-push"];
 function decodeDelivery(decode, raw) {
   if (decode.kind === "form-field-json") return decodeFormFieldJson(raw, decode.field);
+  if (decode.kind === "pubsub-push") return decodePubSubPush(raw);
   throw new Error(`unknown decode kind ${JSON.stringify(decode.kind)}`);
 }
 function latin12(bytes) {
@@ -1867,6 +2018,202 @@ function latin12(bytes) {
   return out;
 }
 
+// src/webhook.ts
+var SIGNED_URI_RULES = ["hubspot-v3"];
+var HUBSPOT_V3_DECODE = {
+  "%3A": ":",
+  "%2F": "/",
+  "%3F": "?",
+  "%40": "@",
+  "%21": "!",
+  "%24": "$",
+  "%27": "'",
+  "%28": "(",
+  "%29": ")",
+  "%2A": "*",
+  "%2C": ",",
+  "%3B": ";"
+};
+function normaliseSignedUri(url, rule) {
+  if (rule !== "hubspot-v3") throw new Error(`unknown signed-uri rule ${JSON.stringify(rule)}`);
+  const withoutFragment = url.split("#", 1)[0] ?? "";
+  const q = withoutFragment.indexOf("?");
+  if (q === -1) return withoutFragment;
+  const query = withoutFragment.slice(q + 1).replace(/%[0-9A-Fa-f]{2}/g, (e) => HUBSPOT_V3_DECODE[e.toUpperCase()] ?? e);
+  return `${withoutFragment.slice(0, q)}?${query}`;
+}
+function secretKeyBytes(secret, options = {}) {
+  let material = secret;
+  if (options.secretPrefix !== void 0) {
+    if (!material.startsWith(options.secretPrefix)) {
+      return { reason: `signing secret does not start with ${JSON.stringify(options.secretPrefix)}` };
+    }
+    material = material.slice(options.secretPrefix.length);
+  }
+  if ((options.secretEncoding ?? "utf8") === "base64") {
+    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(material) || material.length % 4 !== 0) {
+      return { reason: "signing secret is not valid base64" };
+    }
+    try {
+      return { bytes: Uint8Array.from(atob(material), (c) => c.charCodeAt(0)) };
+    } catch {
+      return { reason: "signing secret is not valid base64" };
+    }
+  }
+  return { bytes: new TextEncoder().encode(material) };
+}
+async function verifyHmac(options) {
+  const { raw, secret, scheme, timestamp, id } = options;
+  const signatures = (Array.isArray(options.signature) ? options.signature : [options.signature]).filter(
+    (s) => typeof s === "string" && s !== ""
+  );
+  if (!secret) {
+    return { ok: false, reason: "no signing secret configured for this trigger" };
+  }
+  if (signatures.length === 0) return { ok: false, reason: "delivery carried no signature header" };
+  if (scheme.tolerance !== void 0) {
+    if (!timestamp) return { ok: false, reason: "delivery carried no timestamp header" };
+    const sent = Number(timestamp);
+    if (!Number.isFinite(sent)) return { ok: false, reason: "timestamp header is not a number" };
+    const now = options.now ?? Math.floor(Date.now() / 1e3);
+    const sentSeconds = scheme.timestampUnit === "ms" ? sent / 1e3 : sent;
+    if (Math.abs(now - sentSeconds) > scheme.tolerance) {
+      return { ok: false, reason: `delivery is outside the ${scheme.tolerance}s replay window` };
+    }
+  }
+  const key = secretKeyBytes(secret, scheme);
+  if ("reason" in key) return { ok: false, reason: key.reason };
+  let line;
+  if (scheme.signsRequestLine) {
+    const { method, url } = options.request ?? {};
+    if (!method || !url) return { ok: false, reason: "delivery carried no request method or url" };
+    line = { method, uri: scheme.uri ? normaliseSignedUri(url, scheme.uri) : url };
+  }
+  const expected = await hmac(
+    secret,
+    scheme.payload(raw, timestamp, id, line),
+    scheme.algorithm,
+    scheme.encoding ?? "hex",
+    scheme
+  );
+  return signatures.some((candidate) => constantTimeEquals(expected, candidate)) ? { ok: true } : { ok: false, reason: "signature did not match" };
+}
+async function hmac(secret, payload, algorithm, encoding = "hex", options = {}) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new Error(
+      "WebCrypto is not available in this runtime, so webhook signatures cannot be verified. Refusing to accept deliveries unverified."
+    );
+  }
+  const material = secretKeyBytes(secret, options);
+  if ("reason" in material) throw new Error(material.reason);
+  const encoder2 = new TextEncoder();
+  const key = await subtle.importKey(
+    "raw",
+    material.bytes,
+    { name: "HMAC", hash: algorithm },
+    false,
+    ["sign"]
+  );
+  const bytes = new Uint8Array(await subtle.sign("HMAC", key, encoder2.encode(payload)));
+  if (encoding === "base64") {
+    let binary = "";
+    bytes.forEach((byte) => {
+      binary += String.fromCharCode(byte);
+    });
+    return btoa(binary);
+  }
+  return Array.from(bytes).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function constantTimeEquals(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function isSharedTokenScheme(scheme) {
+  return "kind" in scheme && scheme.kind === "shared-token";
+}
+function verifySharedToken(options) {
+  const { raw, headers, secret, scheme } = options;
+  if (!secret) {
+    return { ok: false, reason: "no shared token configured for this trigger" };
+  }
+  let tokens;
+  if (scheme.in === "header") {
+    tokens = [header2(headers, scheme.name)];
+  } else {
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return { ok: false, reason: "delivery body is not JSON" };
+    }
+    tokens = readTokens(parsed, scheme.path.split("."));
+  }
+  const present = tokens.filter((t) => t !== void 0 && t !== null && t !== "");
+  if (present.length === 0) return { ok: false, reason: "delivery carried no token" };
+  let matched = present.length === tokens.length;
+  for (const token of present) {
+    matched = typeof token === "string" && constantTimeEquals(secret, token) && matched;
+  }
+  return matched ? { ok: true } : { ok: false, reason: "token did not match" };
+}
+function readTokens(value, segments) {
+  if (segments.length === 0) return [value];
+  const [head, ...rest] = segments;
+  const eachElement = head.endsWith("[]");
+  const key = eachElement ? head.slice(0, -2) : head;
+  if (value === null || typeof value !== "object") return [void 0];
+  const next = value[key];
+  if (!eachElement) return readTokens(next, rest);
+  if (!Array.isArray(next)) return [void 0];
+  return next.flatMap((element) => readTokens(element, rest));
+}
+function handshakeResponse(handshake, query) {
+  if (!handshake) return void 0;
+  const raw = query[handshake.param];
+  const token = Array.isArray(raw) ? raw[0] : raw;
+  if (!token) return void 0;
+  return { status: 200, contentType: handshake.contentType ?? "text/plain", body: token };
+}
+function header2(headers, name) {
+  const wanted = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== wanted) continue;
+    return Array.isArray(value) ? value[0] : value;
+  }
+  return void 0;
+}
+
+// src/oidc-delivery.ts
+var OIDC_JWT_SCHEME_KIND = "oidc-jwt";
+function isOidcJwtScheme(scheme) {
+  return typeof scheme === "object" && scheme !== null && scheme.kind === OIDC_JWT_SCHEME_KIND;
+}
+var fail2 = (reason) => ({ ok: false, reason });
+var BEARER = /^bearer +(\S+)$/i;
+async function verifyOidcDelivery(options) {
+  const { headers, scheme, expected } = options;
+  if (!expected || expected.keys.length === 0) return fail2("no signing keys supplied for this trigger");
+  if (!expected.audience) return fail2("no audience configured for this trigger");
+  if (!expected.principal) return fail2("no principal configured for this trigger");
+  const token = BEARER.exec(header2(headers, scheme.header) ?? "")?.[1];
+  if (!token) return fail2("delivery carried no bearer token");
+  const verified = await verifyJwt(token, {
+    keys: expected.keys,
+    audience: expected.audience,
+    issuer: scheme.issuers,
+    ...options.now === void 0 ? {} : { now: options.now }
+  });
+  if (!verified.ok) return fail2(verified.reason);
+  if (verified.claims[scheme.principalClaim] !== expected.principal) return fail2("token principal is not accepted");
+  if (scheme.verifiedClaim !== void 0 && verified.claims[scheme.verifiedClaim] !== true) {
+    return fail2("token principal is not verified");
+  }
+  return { ok: true };
+}
+
 // src/probe.ts
 async function probe(spec) {
   let response;
@@ -2082,179 +2429,14 @@ var CREDENTIAL_SCOPES = ["provider", "account"];
 var PROBLEM_SEVERITIES = ["block", "warn"];
 var CANONICAL_METRICS = ["like", "share", "reply", "quote", "view"];
 
-// src/webhook.ts
-var SIGNED_URI_RULES = ["hubspot-v3"];
-var HUBSPOT_V3_DECODE = {
-  "%3A": ":",
-  "%2F": "/",
-  "%3F": "?",
-  "%40": "@",
-  "%21": "!",
-  "%24": "$",
-  "%27": "'",
-  "%28": "(",
-  "%29": ")",
-  "%2A": "*",
-  "%2C": ",",
-  "%3B": ";"
-};
-function normaliseSignedUri(url, rule) {
-  if (rule !== "hubspot-v3") throw new Error(`unknown signed-uri rule ${JSON.stringify(rule)}`);
-  const withoutFragment = url.split("#", 1)[0] ?? "";
-  const q = withoutFragment.indexOf("?");
-  if (q === -1) return withoutFragment;
-  const query = withoutFragment.slice(q + 1).replace(/%[0-9A-Fa-f]{2}/g, (e) => HUBSPOT_V3_DECODE[e.toUpperCase()] ?? e);
-  return `${withoutFragment.slice(0, q)}?${query}`;
-}
-function secretKeyBytes(secret, options = {}) {
-  let material = secret;
-  if (options.secretPrefix !== void 0) {
-    if (!material.startsWith(options.secretPrefix)) {
-      return { reason: `signing secret does not start with ${JSON.stringify(options.secretPrefix)}` };
-    }
-    material = material.slice(options.secretPrefix.length);
-  }
-  if ((options.secretEncoding ?? "utf8") === "base64") {
-    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(material) || material.length % 4 !== 0) {
-      return { reason: "signing secret is not valid base64" };
-    }
-    try {
-      return { bytes: Uint8Array.from(atob(material), (c) => c.charCodeAt(0)) };
-    } catch {
-      return { reason: "signing secret is not valid base64" };
-    }
-  }
-  return { bytes: new TextEncoder().encode(material) };
-}
-async function verifyHmac(options) {
-  const { raw, secret, scheme, timestamp, id } = options;
-  const signatures = (Array.isArray(options.signature) ? options.signature : [options.signature]).filter(
-    (s) => typeof s === "string" && s !== ""
-  );
-  if (!secret) {
-    return { ok: false, reason: "no signing secret configured for this trigger" };
-  }
-  if (signatures.length === 0) return { ok: false, reason: "delivery carried no signature header" };
-  if (scheme.tolerance !== void 0) {
-    if (!timestamp) return { ok: false, reason: "delivery carried no timestamp header" };
-    const sent = Number(timestamp);
-    if (!Number.isFinite(sent)) return { ok: false, reason: "timestamp header is not a number" };
-    const now = options.now ?? Math.floor(Date.now() / 1e3);
-    const sentSeconds = scheme.timestampUnit === "ms" ? sent / 1e3 : sent;
-    if (Math.abs(now - sentSeconds) > scheme.tolerance) {
-      return { ok: false, reason: `delivery is outside the ${scheme.tolerance}s replay window` };
-    }
-  }
-  const key = secretKeyBytes(secret, scheme);
-  if ("reason" in key) return { ok: false, reason: key.reason };
-  let line;
-  if (scheme.signsRequestLine) {
-    const { method, url } = options.request ?? {};
-    if (!method || !url) return { ok: false, reason: "delivery carried no request method or url" };
-    line = { method, uri: scheme.uri ? normaliseSignedUri(url, scheme.uri) : url };
-  }
-  const expected = await hmac(
-    secret,
-    scheme.payload(raw, timestamp, id, line),
-    scheme.algorithm,
-    scheme.encoding ?? "hex",
-    scheme
-  );
-  return signatures.some((candidate) => constantTimeEquals(expected, candidate)) ? { ok: true } : { ok: false, reason: "signature did not match" };
-}
-async function hmac(secret, payload, algorithm, encoding = "hex", options = {}) {
-  const subtle = globalThis.crypto?.subtle;
-  if (!subtle) {
-    throw new Error(
-      "WebCrypto is not available in this runtime, so webhook signatures cannot be verified. Refusing to accept deliveries unverified."
-    );
-  }
-  const material = secretKeyBytes(secret, options);
-  if ("reason" in material) throw new Error(material.reason);
-  const encoder2 = new TextEncoder();
-  const key = await subtle.importKey(
-    "raw",
-    material.bytes,
-    { name: "HMAC", hash: algorithm },
-    false,
-    ["sign"]
-  );
-  const bytes = new Uint8Array(await subtle.sign("HMAC", key, encoder2.encode(payload)));
-  if (encoding === "base64") {
-    let binary = "";
-    bytes.forEach((byte) => {
-      binary += String.fromCharCode(byte);
-    });
-    return btoa(binary);
-  }
-  return Array.from(bytes).map((byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function constantTimeEquals(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-function isSharedTokenScheme(scheme) {
-  return "kind" in scheme && scheme.kind === "shared-token";
-}
-function verifySharedToken(options) {
-  const { raw, headers, secret, scheme } = options;
-  if (!secret) {
-    return { ok: false, reason: "no shared token configured for this trigger" };
-  }
-  let tokens;
-  if (scheme.in === "header") {
-    tokens = [header2(headers, scheme.name)];
-  } else {
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch {
-      return { ok: false, reason: "delivery body is not JSON" };
-    }
-    tokens = readTokens(parsed, scheme.path.split("."));
-  }
-  const present = tokens.filter((t) => t !== void 0 && t !== null && t !== "");
-  if (present.length === 0) return { ok: false, reason: "delivery carried no token" };
-  let matched = present.length === tokens.length;
-  for (const token of present) {
-    matched = typeof token === "string" && constantTimeEquals(secret, token) && matched;
-  }
-  return matched ? { ok: true } : { ok: false, reason: "token did not match" };
-}
-function readTokens(value, segments) {
-  if (segments.length === 0) return [value];
-  const [head, ...rest] = segments;
-  const eachElement = head.endsWith("[]");
-  const key = eachElement ? head.slice(0, -2) : head;
-  if (value === null || typeof value !== "object") return [void 0];
-  const next = value[key];
-  if (!eachElement) return readTokens(next, rest);
-  if (!Array.isArray(next)) return [void 0];
-  return next.flatMap((element) => readTokens(element, rest));
-}
-function handshakeResponse(handshake, query) {
-  if (!handshake) return void 0;
-  const raw = query[handshake.param];
-  const token = Array.isArray(raw) ? raw[0] : raw;
-  if (!token) return void 0;
-  return { status: 200, contentType: handshake.contentType ?? "text/plain", body: token };
-}
-function header2(headers, name) {
-  const wanted = name.toLowerCase();
-  for (const [key, value] of Object.entries(headers)) {
-    if (key.toLowerCase() !== wanted) continue;
-    return Array.isArray(value) ? value[0] : value;
-  }
-  return void 0;
-}
-
 // src/trigger.ts
+function isOidcJwtSpec(spec) {
+  return isOidcJwtScheme(spec.scheme);
+}
 function isSharedTokenSpec(spec) {
   return isSharedTokenScheme(spec.scheme);
 }
-async function verifyDelivery(trigger, delivery, secret, now) {
+async function verifyDelivery(trigger, delivery, secret, now, oidc) {
   const spec = trigger.verification;
   if (!spec) {
     return {
@@ -2265,6 +2447,14 @@ async function verifyDelivery(trigger, delivery, secret, now) {
   if (isSharedTokenSpec(spec)) {
     return verifySharedToken({ raw: delivery.raw, headers: delivery.headers, secret, scheme: spec.scheme });
   }
+  if (isOidcJwtSpec(spec)) {
+    return verifyOidcDelivery({
+      headers: delivery.headers,
+      scheme: spec.scheme,
+      expected: oidc,
+      ...now === void 0 ? {} : { now }
+    });
+  }
   const kind = spec.scheme.kind ?? "hmac";
   if (kind !== "hmac") {
     return {
@@ -2331,9 +2521,13 @@ function hasDelivery(value) {
   FAKE_EPOCH,
   FORM_FIELD_JSON_REASONS,
   FormFieldJsonError,
+  JWT_ALGORITHMS,
   MAX_IDEMPOTENCY_KEY_LENGTH,
   NO_IDEMPOTENCY_KEY_WARNING,
+  OIDC_JWT_SCHEME_KIND,
   PROBLEM_SEVERITIES,
+  PUBSUB_PUSH_REASONS,
+  PubSubPushError,
   RENDERER_VERSION,
   REVIEW_STALE_DAYS,
   SANDBOX_KINDS,
@@ -2354,6 +2548,7 @@ function hasDelivery(value) {
   constantTimeEquals,
   decodeDelivery,
   decodeFormFieldJson,
+  decodePubSubPush,
   deliver,
   fakeRequest,
   fakeValues,
@@ -2365,6 +2560,8 @@ function hasDelivery(value) {
   httpFailure,
   idempotencyKeyFor,
   isEmptyPayload,
+  isOidcJwtScheme,
+  isOidcJwtSpec,
   isRemote,
   isSharedTokenScheme,
   isSharedTokenSpec,
@@ -2411,6 +2608,8 @@ function hasDelivery(value) {
   utf8Length,
   verifyDelivery,
   verifyHmac,
+  verifyJwt,
+  verifyOidcDelivery,
   verifySharedToken,
   withResolvedLimit
 });