@particle-academy/fancy-connector-core 0.12.0 → 0.14.0

package/dist/index.cjs

@@ -25,6 +25,7 @@ __export(src_exports, {
   CONNECTOR_API_VERSION: () => CONNECTOR_API_VERSION,
   CONNECTOR_MODES: () => CONNECTOR_MODES,
   CREDENTIAL_SCOPES: () => CREDENTIAL_SCOPES,
+  CURSOR_READ_REASONS: () => CURSOR_READ_REASONS,
   ConnectorAmbiguous: () => ConnectorAmbiguous,
   ConnectorApiMismatch: () => ConnectorApiMismatch,
   ConnectorAuthError: () => ConnectorAuthError,
@@ -36,6 +37,7 @@ __export(src_exports, {
   ConnectorRequestError: () => ConnectorRequestError,
   ConnectorTransient: () => ConnectorTransient,
   ConnectorUnreachable: () => ConnectorUnreachable,
+  CursorReadError: () => CursorReadError,
   DEFAULT_IDEMPOTENCY_WINDOW_SECONDS: () => DEFAULT_IDEMPOTENCY_WINDOW_SECONDS,
   DEFAULT_RETRY: () => DEFAULT_RETRY,
   DELIVERY_DECODE_KINDS: () => DELIVERY_DECODE_KINDS,
@@ -43,9 +45,13 @@ __export(src_exports, {
   FAKE_EPOCH: () => FAKE_EPOCH,
   FORM_FIELD_JSON_REASONS: () => FORM_FIELD_JSON_REASONS,
   FormFieldJsonError: () => FormFieldJsonError,
+  JWT_ALGORITHMS: () => JWT_ALGORITHMS,
   MAX_IDEMPOTENCY_KEY_LENGTH: () => MAX_IDEMPOTENCY_KEY_LENGTH,
   NO_IDEMPOTENCY_KEY_WARNING: () => NO_IDEMPOTENCY_KEY_WARNING,
+  OIDC_JWT_SCHEME_KIND: () => OIDC_JWT_SCHEME_KIND,
   PROBLEM_SEVERITIES: () => PROBLEM_SEVERITIES,
+  PUBSUB_PUSH_REASONS: () => PUBSUB_PUSH_REASONS,
+  PubSubPushError: () => PubSubPushError,
   RENDERER_VERSION: () => RENDERER_VERSION,
   REVIEW_STALE_DAYS: () => REVIEW_STALE_DAYS,
   SANDBOX_KINDS: () => SANDBOX_KINDS,
@@ -66,6 +72,7 @@ __export(src_exports, {
   constantTimeEquals: () => constantTimeEquals,
   decodeDelivery: () => decodeDelivery,
   decodeFormFieldJson: () => decodeFormFieldJson,
+  decodePubSubPush: () => decodePubSubPush,
   deliver: () => deliver,
   fakeRequest: () => fakeRequest,
   fakeValues: () => fakeValues,
@@ -77,6 +84,8 @@ __export(src_exports, {
   httpFailure: () => httpFailure,
   idempotencyKeyFor: () => idempotencyKeyFor,
   isEmptyPayload: () => isEmptyPayload,
+  isOidcJwtScheme: () => isOidcJwtScheme,
+  isOidcJwtSpec: () => isOidcJwtSpec,
   isRemote: () => isRemote,
   isSharedTokenScheme: () => isSharedTokenScheme,
   isSharedTokenSpec: () => isSharedTokenSpec,
@@ -97,6 +106,7 @@ __export(src_exports, {
   probe: () => probe,
   providerProblems: () => providerProblems,
   providerSandboxIsSelectable: () => providerSandboxIsSelectable,
+  readWithCursor: () => readWithCursor,
   registerConnectionHost: () => registerConnectionHost,
   registerTransport: () => registerTransport,
   render: () => render,
@@ -123,6 +133,8 @@ __export(src_exports, {
   utf8Length: () => utf8Length,
   verifyDelivery: () => verifyDelivery,
   verifyHmac: () => verifyHmac,
+  verifyJwt: () => verifyJwt,
+  verifyOidcDelivery: () => verifyOidcDelivery,
   verifySharedToken: () => verifySharedToken,
   withResolvedLimit: () => withResolvedLimit
 });
@@ -293,10 +305,10 @@ var lastCallAt = /* @__PURE__ */ new Map();
 async function respectRate(channel, minIntervalMs, now = () => Date.now(), sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms))) {
   if (minIntervalMs <= 0) return { waitedMs: 0 };
   const previous = lastCallAt.get(channel);
-  const at = now();
-  const waitedMs = previous === void 0 ? 0 : Math.max(0, previous + minIntervalMs - at);
+  const at2 = now();
+  const waitedMs = previous === void 0 ? 0 : Math.max(0, previous + minIntervalMs - at2);
   if (waitedMs > 0) await sleep(waitedMs);
-  lastCallAt.set(channel, at + waitedMs);
+  lastCallAt.set(channel, at2 + waitedMs);
   return { waitedMs };
 }
 function resetRateState() {
@@ -794,6 +806,71 @@ function readString(config, key) {
   return typeof value === "string" && value.trim() !== "" ? value.trim() : null;
 }
 
+// src/cursor-read.ts
+var CURSOR_READ_REASONS = ["cursor-missing", "cursor-expired", "cursor-overflow", "bad-page"];
+var CursorReadError = class extends Error {
+  constructor(reason, message, resyncQuery) {
+    super(message);
+    this.reason = reason;
+    this.resyncQuery = resyncQuery;
+    this.name = "CursorReadError";
+  }
+  reason;
+  resyncQuery;
+};
+async function readWithCursor(spec, cursor, call, options = {}) {
+  const refuse = (reason, message) => new CursorReadError(reason, message, options.resyncQuery);
+  const used = asCursor(cursor);
+  if (used === null) throw refuse("cursor-missing", `no stored ${spec.param}: the host seeds one before the first read`);
+  const collected = [];
+  let last;
+  let token = null;
+  let pages = 0;
+  for (; ; ) {
+    if (spec.page && pages === spec.page.maxPages) {
+      throw refuse("cursor-overflow", `more than ${spec.page.maxPages} pages since ${spec.param} ${used}`);
+    }
+    const params = { [spec.param]: used };
+    if (spec.page && token !== null) params[spec.page.param] = token;
+    try {
+      last = await call(params);
+    } catch (error) {
+      const status = error?.status;
+      if (spec.expiredStatus !== void 0 && status === spec.expiredStatus) {
+        throw refuse("cursor-expired", `${spec.param} ${used} is out of the provider's range (${status})`);
+      }
+      throw error;
+    }
+    pages++;
+    if (!spec.page) break;
+    const items = at(last, spec.page.collect);
+    if (items !== void 0 && !Array.isArray(items)) {
+      throw refuse("bad-page", `${spec.page.collect} is not a list`);
+    }
+    if (items) collected.push(...items);
+    token = asCursor(at(last, spec.page.from));
+    if (token === null) break;
+  }
+  const data = spec.page ? withList(last, spec.page.collect, collected) : last;
+  return { data, cursor: { used, next: asCursor(at(last, spec.advanceFrom)) } };
+}
+function asCursor(value) {
+  if (typeof value === "string") return value === "" ? null : value;
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  return null;
+}
+function at(value, path) {
+  return path.split(".").reduce(
+    (v, key) => v !== null && typeof v === "object" && !Array.isArray(v) ? v[key] : void 0,
+    value
+  );
+}
+function withList(data, path, list) {
+  const [head, ...rest] = path.split(".");
+  const base = data !== null && typeof data === "object" && !Array.isArray(data) ? data : {};
+  return { ...base, [head]: rest.length ? withList(base[head], rest.join("."), list) : list };
+}
+
 // src/drift.ts
 function resolveRef(document, node, depth = 0) {
   if (depth > 8 || node === null || typeof node !== "object") return node;
@@ -1362,36 +1439,118 @@ function fnv1a(value) {
   return hash.toString(16).padStart(8, "0");
 }
 
+// src/jwt.ts
+var JWT_ALGORITHMS = ["RS256"];
+var fail = (reason) => ({ ok: false, reason });
+async function verifyJwt(token, options) {
+  const parts = typeof token === "string" ? token.split(".") : [];
+  if (parts.length !== 3 || parts.some((p2, i) => p2 === "" && i < 2)) {
+    return fail("token is not a JWS compact serialization");
+  }
+  const [h, p, s] = parts;
+  const header3 = jsonSegment(h);
+  if (!header3) return fail("token header is not base64url JSON");
+  if (!JWT_ALGORITHMS.includes(header3.alg)) {
+    return fail(`alg ${JSON.stringify(header3.alg)} is not accepted`);
+  }
+  const key = selectKey(options.keys, header3.kid);
+  if ("reason" in key) return fail(key.reason);
+  const signature = base64urlBytes(s);
+  if (!signature) return fail("signature is not base64url");
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) return fail("no WebCrypto in this runtime");
+  let valid;
+  try {
+    const imported = await subtle.importKey(
+      "jwk",
+      { kty: "RSA", n: key.jwk.n, e: key.jwk.e, alg: "RS256", ext: true },
+      { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" },
+      false,
+      ["verify"]
+    );
+    valid = await subtle.verify("RSASSA-PKCS1-v1_5", imported, signature, new TextEncoder().encode(`${h}.${p}`));
+  } catch {
+    return fail("the key could not be used to verify");
+  }
+  if (!valid) return fail("signature did not match");
+  const claims = jsonSegment(p);
+  if (!claims) return fail("token payload is not base64url JSON");
+  const now = options.now ?? Math.floor(Date.now() / 1e3);
+  const leeway = options.leeway ?? 60;
+  if (typeof claims.exp !== "number") return fail("token has no exp");
+  if (now > claims.exp + leeway) return fail("token has expired");
+  if (typeof claims.nbf === "number" && now + leeway < claims.nbf) return fail("token is not valid yet");
+  if (options.issuer !== void 0) {
+    const issuers = typeof options.issuer === "string" ? [options.issuer] : options.issuer;
+    if (typeof claims.iss !== "string" || !issuers.includes(claims.iss)) return fail("token issuer is not accepted");
+  }
+  if (options.audience !== null) {
+    const wanted = typeof options.audience === "string" ? [options.audience] : options.audience;
+    const offered = typeof claims.aud === "string" ? [claims.aud] : Array.isArray(claims.aud) ? claims.aud : [];
+    if (!offered.some((a) => typeof a === "string" && wanted.includes(a))) return fail("token audience is not accepted");
+  }
+  return { ok: true, header: header3, claims };
+}
+function selectKey(keys, kid) {
+  const rsa = keys.filter((k) => k.kty === "RSA" && typeof k.n === "string" && typeof k.e === "string");
+  if (typeof kid === "string") {
+    const match = rsa.find((k) => k.kid === kid);
+    return match ? { jwk: match } : { reason: `no key for kid ${JSON.stringify(kid)}` };
+  }
+  const [only] = rsa;
+  return rsa.length === 1 && only ? { jwk: only } : { reason: "token names no kid and the key is ambiguous" };
+}
+function jsonSegment(segment) {
+  const bytes = base64urlBytes(segment);
+  if (!bytes) return null;
+  try {
+    const value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function base64urlBytes(segment) {
+  if (!/^[A-Za-z0-9_-]*$/.test(segment) || segment.length % 4 === 1) return null;
+  const standard = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = standard + "=".repeat((4 - standard.length % 4) % 4);
+  try {
+    return Uint8Array.from(atob(padded), (c) => c.charCodeAt(0));
+  } catch {
+    return null;
+  }
+}
+
 // src/lease.ts
 var EXPIRES_AT_UNITS = ["rfc3339", "epoch-ms"];
 var INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})$/;
 var DEFAULT_CONTEXT = { service: "", operation: "subscription" };
-function instantMs(value, field, at) {
+function instantMs(value, field, at2) {
   if (typeof value !== "string" || !INSTANT.test(value)) {
     throw new ConnectorConfigError(
       `${field} must be an RFC 3339 instant such as "2026-09-22T00:00:00Z", got ${JSON.stringify(value)}. A provider's own shape \u2014 Google's epoch milliseconds, say \u2014 is converted by the connector, never guessed at here.`,
-      at
+      at2
     );
   }
   const ms = Date.parse(value.replace(/(\.\d{3})\d+/, "$1"));
   if (Number.isNaN(ms)) {
-    throw new ConnectorConfigError(`${field} is not a real instant: ${JSON.stringify(value)}`, at);
+    throw new ConnectorConfigError(`${field} is not a real instant: ${JSON.stringify(value)}`, at2);
   }
   return ms;
 }
-function leaseFromResponse(declaration, response, at = DEFAULT_CONTEXT) {
+function leaseFromResponse(declaration, response, at2 = DEFAULT_CONTEXT) {
   const { expiresAtFrom: path, expiresAtUnit: unit } = declaration;
   if (!EXPIRES_AT_UNITS.includes(unit)) {
     throw new ConnectorConfigError(
       `expiresAtUnit must be one of ${EXPIRES_AT_UNITS.join(" | ")}, got ${JSON.stringify(unit)}.`,
-      at
+      at2
     );
   }
   const value = readPath(response, path);
   if (value === void 0 || value === null) {
     throw new ConnectorConfigError(
       `${path} is not present in the response, so no lease can be built \u2014 a subscription with no known expiry is one nobody renews.`,
-      at
+      at2
     );
   }
   let expiresAt;
@@ -1400,7 +1559,7 @@ function leaseFromResponse(declaration, response, at = DEFAULT_CONTEXT) {
     if (!Number.isSafeInteger(ms)) {
       throw new ConnectorConfigError(
         `${path} must be epoch milliseconds as digits under "epoch-ms", got ${JSON.stringify(value)}.`,
-        at
+        at2
       );
     }
     expiresAt = new Date(ms).toISOString();
@@ -1408,14 +1567,14 @@ function leaseFromResponse(declaration, response, at = DEFAULT_CONTEXT) {
     if (typeof value !== "string" || !INSTANT.test(value)) {
       throw new ConnectorConfigError(
         `${path} must be an RFC 3339 instant under "rfc3339", got ${JSON.stringify(value)}.`,
-        at
+        at2
       );
     }
-    expiresAt = new Date(instantMs(value, path, at)).toISOString();
+    expiresAt = new Date(instantMs(value, path, at2)).toISOString();
   }
   return subscriptionLease(
     { expiresAt, renewBeforeSeconds: declaration.renewBeforeSeconds, renewOperation: declaration.renewOperation },
-    at
+    at2
   );
 }
 function readPath(value, path) {
@@ -1426,18 +1585,18 @@ function readPath(value, path) {
   }
   return current;
 }
-function subscriptionLease(input, at = DEFAULT_CONTEXT) {
-  instantMs(input.expiresAt, "expiresAt", at);
+function subscriptionLease(input, at2 = DEFAULT_CONTEXT) {
+  instantMs(input.expiresAt, "expiresAt", at2);
   if (!Number.isInteger(input.renewBeforeSeconds) || input.renewBeforeSeconds <= 0) {
     throw new ConnectorConfigError(
       `renewBeforeSeconds must be a positive whole number of seconds, got ${JSON.stringify(input.renewBeforeSeconds)}. Zero would make the lease due only at the instant it expires, which is a lease nobody renews.`,
-      at
+      at2
     );
   }
   if (typeof input.renewOperation !== "string" || input.renewOperation.trim() === "") {
     throw new ConnectorConfigError(
       "renewOperation must name the operation the host calls when the lease is due; a due lease with nothing to call is one nobody renews.",
-      at
+      at2
     );
   }
   return { expiresAt: input.expiresAt, renewBeforeSeconds: input.renewBeforeSeconds, renewOperation: input.renewOperation };
@@ -1446,10 +1605,10 @@ function leaseRenewAt(lease) {
   return new Date(instantMs(lease.expiresAt, "expiresAt", DEFAULT_CONTEXT) - lease.renewBeforeSeconds * 1e3).toISOString();
 }
 function leaseState(lease, now) {
-  const at = now instanceof Date ? now.getTime() : instantMs(now, "now", DEFAULT_CONTEXT);
+  const at2 = now instanceof Date ? now.getTime() : instantMs(now, "now", DEFAULT_CONTEXT);
   const expires = instantMs(lease.expiresAt, "expiresAt", DEFAULT_CONTEXT);
-  if (at >= expires) return "expired";
-  if (at >= expires - lease.renewBeforeSeconds * 1e3) return "due";
+  if (at2 >= expires) return "expired";
+  if (at2 >= expires - lease.renewBeforeSeconds * 1e3) return "due";
   return "active";
 }
 function leaseAction(lease, now) {
@@ -1769,8 +1928,8 @@ function splitMultipart(body, boundary) {
   if (partStart >= 0 && partStart <= body.length) children.push(body.subarray(partStart));
   return children;
 }
-function startsWith(haystack, at, needle) {
-  for (let k = 0; k < needle.length; k++) if (haystack[at + k] !== needle[k]) return false;
+function startsWith(haystack, at2, needle) {
+  for (let k = 0; k < needle.length; k++) if (haystack[at2 + k] !== needle[k]) return false;
   return true;
 }
 function parseMime(raw) {
@@ -1796,6 +1955,65 @@ function parseMime(raw) {
   };
 }
 
+// src/pubsub-push.ts
+var PUBSUB_PUSH_REASONS = ["not-json", "missing-message", "missing-data", "bad-encoding", "data-not-json"];
+var PubSubPushError = class extends Error {
+  constructor(reason, message) {
+    super(message);
+    this.reason = reason;
+    this.name = "PubSubPushError";
+  }
+  reason;
+};
+var UTF8 = new TextDecoder("utf-8", { fatal: true });
+function decodePubSubPush(raw) {
+  let body;
+  try {
+    body = JSON.parse(typeof raw === "string" ? raw : UTF8.decode(raw));
+  } catch {
+    throw new PubSubPushError("not-json", "the push body is not JSON");
+  }
+  if (!isObject(body)) throw new PubSubPushError("not-json", "the push body is not a JSON object");
+  const message = body.message;
+  if (!isObject(message)) throw new PubSubPushError("missing-message", "the push body has no message");
+  const data = message.data;
+  if (typeof data !== "string" || data === "") {
+    throw new PubSubPushError("missing-data", "the message carries no data");
+  }
+  let text;
+  try {
+    text = UTF8.decode(base64Bytes2(data));
+  } catch {
+    throw new PubSubPushError("bad-encoding", "the message data is not base64 of UTF-8 text");
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    throw new PubSubPushError("data-not-json", `the message data is not JSON: ${error.message}`);
+  }
+  return {
+    subscription: stringOrNull(body.subscription),
+    messageId: stringOrNull(message.messageId) ?? stringOrNull(message.message_id),
+    publishTime: stringOrNull(message.publishTime) ?? stringOrNull(message.publish_time),
+    attributes: isObject(message.attributes) ? message.attributes : {},
+    deliveryAttempt: Number.isInteger(body.deliveryAttempt) ? body.deliveryAttempt : null,
+    data: parsed
+  };
+}
+function base64Bytes2(data) {
+  const unpadded = data.replace(/={1,2}$/, "");
+  if (!/^[A-Za-z0-9+/_-]*$/.test(unpadded) || unpadded.length % 4 === 1) throw new Error("not base64");
+  const standard = unpadded.replace(/-/g, "+").replace(/_/g, "/");
+  return Uint8Array.from(atob(standard + "=".repeat((4 - standard.length % 4) % 4)), (c) => c.charCodeAt(0));
+}
+function isObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringOrNull(value) {
+  return typeof value === "string" ? value : null;
+}
+
 // src/form-field-json.ts
 var FORM_FIELD_JSON_REASONS = ["missing-field", "duplicate-field", "bad-encoding", "not-json"];
 var FormFieldJsonError = class extends Error {
@@ -1808,7 +2026,7 @@ var FormFieldJsonError = class extends Error {
   reason;
   field;
 };
-var UTF8 = new TextDecoder("utf-8", { fatal: true });
+var UTF82 = new TextDecoder("utf-8", { fatal: true });
 var HEX = /^[0-9A-Fa-f]{2}$/;
 function decodeFormFieldJson(raw, field) {
   const text = typeof raw === "string" ? raw : latin12(raw);
@@ -1851,14 +2069,15 @@ function component(encoded, field) {
     }
   }
   try {
-    return UTF8.decode(new Uint8Array(bytes));
+    return UTF82.decode(new Uint8Array(bytes));
   } catch {
     throw new FormFieldJsonError("bad-encoding", field, "the decoded bytes are not valid UTF-8");
   }
 }
-var DELIVERY_DECODE_KINDS = ["form-field-json"];
+var DELIVERY_DECODE_KINDS = ["form-field-json", "pubsub-push"];
 function decodeDelivery(decode, raw) {
   if (decode.kind === "form-field-json") return decodeFormFieldJson(raw, decode.field);
+  if (decode.kind === "pubsub-push") return decodePubSubPush(raw);
   throw new Error(`unknown decode kind ${JSON.stringify(decode.kind)}`);
 }
 function latin12(bytes) {
@@ -1867,6 +2086,202 @@ function latin12(bytes) {
   return out;
 }
 
+// src/webhook.ts
+var SIGNED_URI_RULES = ["hubspot-v3"];
+var HUBSPOT_V3_DECODE = {
+  "%3A": ":",
+  "%2F": "/",
+  "%3F": "?",
+  "%40": "@",
+  "%21": "!",
+  "%24": "$",
+  "%27": "'",
+  "%28": "(",
+  "%29": ")",
+  "%2A": "*",
+  "%2C": ",",
+  "%3B": ";"
+};
+function normaliseSignedUri(url, rule) {
+  if (rule !== "hubspot-v3") throw new Error(`unknown signed-uri rule ${JSON.stringify(rule)}`);
+  const withoutFragment = url.split("#", 1)[0] ?? "";
+  const q = withoutFragment.indexOf("?");
+  if (q === -1) return withoutFragment;
+  const query = withoutFragment.slice(q + 1).replace(/%[0-9A-Fa-f]{2}/g, (e) => HUBSPOT_V3_DECODE[e.toUpperCase()] ?? e);
+  return `${withoutFragment.slice(0, q)}?${query}`;
+}
+function secretKeyBytes(secret, options = {}) {
+  let material = secret;
+  if (options.secretPrefix !== void 0) {
+    if (!material.startsWith(options.secretPrefix)) {
+      return { reason: `signing secret does not start with ${JSON.stringify(options.secretPrefix)}` };
+    }
+    material = material.slice(options.secretPrefix.length);
+  }
+  if ((options.secretEncoding ?? "utf8") === "base64") {
+    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(material) || material.length % 4 !== 0) {
+      return { reason: "signing secret is not valid base64" };
+    }
+    try {
+      return { bytes: Uint8Array.from(atob(material), (c) => c.charCodeAt(0)) };
+    } catch {
+      return { reason: "signing secret is not valid base64" };
+    }
+  }
+  return { bytes: new TextEncoder().encode(material) };
+}
+async function verifyHmac(options) {
+  const { raw, secret, scheme, timestamp, id } = options;
+  const signatures = (Array.isArray(options.signature) ? options.signature : [options.signature]).filter(
+    (s) => typeof s === "string" && s !== ""
+  );
+  if (!secret) {
+    return { ok: false, reason: "no signing secret configured for this trigger" };
+  }
+  if (signatures.length === 0) return { ok: false, reason: "delivery carried no signature header" };
+  if (scheme.tolerance !== void 0) {
+    if (!timestamp) return { ok: false, reason: "delivery carried no timestamp header" };
+    const sent = Number(timestamp);
+    if (!Number.isFinite(sent)) return { ok: false, reason: "timestamp header is not a number" };
+    const now = options.now ?? Math.floor(Date.now() / 1e3);
+    const sentSeconds = scheme.timestampUnit === "ms" ? sent / 1e3 : sent;
+    if (Math.abs(now - sentSeconds) > scheme.tolerance) {
+      return { ok: false, reason: `delivery is outside the ${scheme.tolerance}s replay window` };
+    }
+  }
+  const key = secretKeyBytes(secret, scheme);
+  if ("reason" in key) return { ok: false, reason: key.reason };
+  let line;
+  if (scheme.signsRequestLine) {
+    const { method, url } = options.request ?? {};
+    if (!method || !url) return { ok: false, reason: "delivery carried no request method or url" };
+    line = { method, uri: scheme.uri ? normaliseSignedUri(url, scheme.uri) : url };
+  }
+  const expected = await hmac(
+    secret,
+    scheme.payload(raw, timestamp, id, line),
+    scheme.algorithm,
+    scheme.encoding ?? "hex",
+    scheme
+  );
+  return signatures.some((candidate) => constantTimeEquals(expected, candidate)) ? { ok: true } : { ok: false, reason: "signature did not match" };
+}
+async function hmac(secret, payload, algorithm, encoding = "hex", options = {}) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new Error(
+      "WebCrypto is not available in this runtime, so webhook signatures cannot be verified. Refusing to accept deliveries unverified."
+    );
+  }
+  const material = secretKeyBytes(secret, options);
+  if ("reason" in material) throw new Error(material.reason);
+  const encoder2 = new TextEncoder();
+  const key = await subtle.importKey(
+    "raw",
+    material.bytes,
+    { name: "HMAC", hash: algorithm },
+    false,
+    ["sign"]
+  );
+  const bytes = new Uint8Array(await subtle.sign("HMAC", key, encoder2.encode(payload)));
+  if (encoding === "base64") {
+    let binary = "";
+    bytes.forEach((byte) => {
+      binary += String.fromCharCode(byte);
+    });
+    return btoa(binary);
+  }
+  return Array.from(bytes).map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function constantTimeEquals(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function isSharedTokenScheme(scheme) {
+  return "kind" in scheme && scheme.kind === "shared-token";
+}
+function verifySharedToken(options) {
+  const { raw, headers, secret, scheme } = options;
+  if (!secret) {
+    return { ok: false, reason: "no shared token configured for this trigger" };
+  }
+  let tokens;
+  if (scheme.in === "header") {
+    tokens = [header2(headers, scheme.name)];
+  } else {
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return { ok: false, reason: "delivery body is not JSON" };
+    }
+    tokens = readTokens(parsed, scheme.path.split("."));
+  }
+  const present = tokens.filter((t) => t !== void 0 && t !== null && t !== "");
+  if (present.length === 0) return { ok: false, reason: "delivery carried no token" };
+  let matched = present.length === tokens.length;
+  for (const token of present) {
+    matched = typeof token === "string" && constantTimeEquals(secret, token) && matched;
+  }
+  return matched ? { ok: true } : { ok: false, reason: "token did not match" };
+}
+function readTokens(value, segments) {
+  if (segments.length === 0) return [value];
+  const [head, ...rest] = segments;
+  const eachElement = head.endsWith("[]");
+  const key = eachElement ? head.slice(0, -2) : head;
+  if (value === null || typeof value !== "object") return [void 0];
+  const next = value[key];
+  if (!eachElement) return readTokens(next, rest);
+  if (!Array.isArray(next)) return [void 0];
+  return next.flatMap((element) => readTokens(element, rest));
+}
+function handshakeResponse(handshake, query) {
+  if (!handshake) return void 0;
+  const raw = query[handshake.param];
+  const token = Array.isArray(raw) ? raw[0] : raw;
+  if (!token) return void 0;
+  return { status: 200, contentType: handshake.contentType ?? "text/plain", body: token };
+}
+function header2(headers, name) {
+  const wanted = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== wanted) continue;
+    return Array.isArray(value) ? value[0] : value;
+  }
+  return void 0;
+}
+
+// src/oidc-delivery.ts
+var OIDC_JWT_SCHEME_KIND = "oidc-jwt";
+function isOidcJwtScheme(scheme) {
+  return typeof scheme === "object" && scheme !== null && scheme.kind === OIDC_JWT_SCHEME_KIND;
+}
+var fail2 = (reason) => ({ ok: false, reason });
+var BEARER = /^bearer +(\S+)$/i;
+async function verifyOidcDelivery(options) {
+  const { headers, scheme, expected } = options;
+  if (!expected || expected.keys.length === 0) return fail2("no signing keys supplied for this trigger");
+  if (!expected.audience) return fail2("no audience configured for this trigger");
+  if (!expected.principal) return fail2("no principal configured for this trigger");
+  const token = BEARER.exec(header2(headers, scheme.header) ?? "")?.[1];
+  if (!token) return fail2("delivery carried no bearer token");
+  const verified = await verifyJwt(token, {
+    keys: expected.keys,
+    audience: expected.audience,
+    issuer: scheme.issuers,
+    ...options.now === void 0 ? {} : { now: options.now }
+  });
+  if (!verified.ok) return fail2(verified.reason);
+  if (verified.claims[scheme.principalClaim] !== expected.principal) return fail2("token principal is not accepted");
+  if (scheme.verifiedClaim !== void 0 && verified.claims[scheme.verifiedClaim] !== true) {
+    return fail2("token principal is not verified");
+  }
+  return { ok: true };
+}
+
 // src/probe.ts
 async function probe(spec) {
   let response;
@@ -2082,179 +2497,14 @@ var CREDENTIAL_SCOPES = ["provider", "account"];
 var PROBLEM_SEVERITIES = ["block", "warn"];
 var CANONICAL_METRICS = ["like", "share", "reply", "quote", "view"];
 
-// src/webhook.ts
-var SIGNED_URI_RULES = ["hubspot-v3"];
-var HUBSPOT_V3_DECODE = {
-  "%3A": ":",
-  "%2F": "/",
-  "%3F": "?",
-  "%40": "@",
-  "%21": "!",
-  "%24": "$",
-  "%27": "'",
-  "%28": "(",
-  "%29": ")",
-  "%2A": "*",
-  "%2C": ",",
-  "%3B": ";"
-};
-function normaliseSignedUri(url, rule) {
-  if (rule !== "hubspot-v3") throw new Error(`unknown signed-uri rule ${JSON.stringify(rule)}`);
-  const withoutFragment = url.split("#", 1)[0] ?? "";
-  const q = withoutFragment.indexOf("?");
-  if (q === -1) return withoutFragment;
-  const query = withoutFragment.slice(q + 1).replace(/%[0-9A-Fa-f]{2}/g, (e) => HUBSPOT_V3_DECODE[e.toUpperCase()] ?? e);
-  return `${withoutFragment.slice(0, q)}?${query}`;
-}
-function secretKeyBytes(secret, options = {}) {
-  let material = secret;
-  if (options.secretPrefix !== void 0) {
-    if (!material.startsWith(options.secretPrefix)) {
-      return { reason: `signing secret does not start with ${JSON.stringify(options.secretPrefix)}` };
-    }
-    material = material.slice(options.secretPrefix.length);
-  }
-  if ((options.secretEncoding ?? "utf8") === "base64") {
-    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(material) || material.length % 4 !== 0) {
-      return { reason: "signing secret is not valid base64" };
-    }
-    try {
-      return { bytes: Uint8Array.from(atob(material), (c) => c.charCodeAt(0)) };
-    } catch {
-      return { reason: "signing secret is not valid base64" };
-    }
-  }
-  return { bytes: new TextEncoder().encode(material) };
-}
-async function verifyHmac(options) {
-  const { raw, secret, scheme, timestamp, id } = options;
-  const signatures = (Array.isArray(options.signature) ? options.signature : [options.signature]).filter(
-    (s) => typeof s === "string" && s !== ""
-  );
-  if (!secret) {
-    return { ok: false, reason: "no signing secret configured for this trigger" };
-  }
-  if (signatures.length === 0) return { ok: false, reason: "delivery carried no signature header" };
-  if (scheme.tolerance !== void 0) {
-    if (!timestamp) return { ok: false, reason: "delivery carried no timestamp header" };
-    const sent = Number(timestamp);
-    if (!Number.isFinite(sent)) return { ok: false, reason: "timestamp header is not a number" };
-    const now = options.now ?? Math.floor(Date.now() / 1e3);
-    const sentSeconds = scheme.timestampUnit === "ms" ? sent / 1e3 : sent;
-    if (Math.abs(now - sentSeconds) > scheme.tolerance) {
-      return { ok: false, reason: `delivery is outside the ${scheme.tolerance}s replay window` };
-    }
-  }
-  const key = secretKeyBytes(secret, scheme);
-  if ("reason" in key) return { ok: false, reason: key.reason };
-  let line;
-  if (scheme.signsRequestLine) {
-    const { method, url } = options.request ?? {};
-    if (!method || !url) return { ok: false, reason: "delivery carried no request method or url" };
-    line = { method, uri: scheme.uri ? normaliseSignedUri(url, scheme.uri) : url };
-  }
-  const expected = await hmac(
-    secret,
-    scheme.payload(raw, timestamp, id, line),
-    scheme.algorithm,
-    scheme.encoding ?? "hex",
-    scheme
-  );
-  return signatures.some((candidate) => constantTimeEquals(expected, candidate)) ? { ok: true } : { ok: false, reason: "signature did not match" };
-}
-async function hmac(secret, payload, algorithm, encoding = "hex", options = {}) {
-  const subtle = globalThis.crypto?.subtle;
-  if (!subtle) {
-    throw new Error(
-      "WebCrypto is not available in this runtime, so webhook signatures cannot be verified. Refusing to accept deliveries unverified."
-    );
-  }
-  const material = secretKeyBytes(secret, options);
-  if ("reason" in material) throw new Error(material.reason);
-  const encoder2 = new TextEncoder();
-  const key = await subtle.importKey(
-    "raw",
-    material.bytes,
-    { name: "HMAC", hash: algorithm },
-    false,
-    ["sign"]
-  );
-  const bytes = new Uint8Array(await subtle.sign("HMAC", key, encoder2.encode(payload)));
-  if (encoding === "base64") {
-    let binary = "";
-    bytes.forEach((byte) => {
-      binary += String.fromCharCode(byte);
-    });
-    return btoa(binary);
-  }
-  return Array.from(bytes).map((byte) => byte.toString(16).padStart(2, "0")).join("");
-}
-function constantTimeEquals(a, b) {
-  if (a.length !== b.length) return false;
-  let diff = 0;
-  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
-  return diff === 0;
-}
-function isSharedTokenScheme(scheme) {
-  return "kind" in scheme && scheme.kind === "shared-token";
-}
-function verifySharedToken(options) {
-  const { raw, headers, secret, scheme } = options;
-  if (!secret) {
-    return { ok: false, reason: "no shared token configured for this trigger" };
-  }
-  let tokens;
-  if (scheme.in === "header") {
-    tokens = [header2(headers, scheme.name)];
-  } else {
-    let parsed;
-    try {
-      parsed = JSON.parse(raw);
-    } catch {
-      return { ok: false, reason: "delivery body is not JSON" };
-    }
-    tokens = readTokens(parsed, scheme.path.split("."));
-  }
-  const present = tokens.filter((t) => t !== void 0 && t !== null && t !== "");
-  if (present.length === 0) return { ok: false, reason: "delivery carried no token" };
-  let matched = present.length === tokens.length;
-  for (const token of present) {
-    matched = typeof token === "string" && constantTimeEquals(secret, token) && matched;
-  }
-  return matched ? { ok: true } : { ok: false, reason: "token did not match" };
-}
-function readTokens(value, segments) {
-  if (segments.length === 0) return [value];
-  const [head, ...rest] = segments;
-  const eachElement = head.endsWith("[]");
-  const key = eachElement ? head.slice(0, -2) : head;
-  if (value === null || typeof value !== "object") return [void 0];
-  const next = value[key];
-  if (!eachElement) return readTokens(next, rest);
-  if (!Array.isArray(next)) return [void 0];
-  return next.flatMap((element) => readTokens(element, rest));
-}
-function handshakeResponse(handshake, query) {
-  if (!handshake) return void 0;
-  const raw = query[handshake.param];
-  const token = Array.isArray(raw) ? raw[0] : raw;
-  if (!token) return void 0;
-  return { status: 200, contentType: handshake.contentType ?? "text/plain", body: token };
-}
-function header2(headers, name) {
-  const wanted = name.toLowerCase();
-  for (const [key, value] of Object.entries(headers)) {
-    if (key.toLowerCase() !== wanted) continue;
-    return Array.isArray(value) ? value[0] : value;
-  }
-  return void 0;
-}
-
 // src/trigger.ts
+function isOidcJwtSpec(spec) {
+  return isOidcJwtScheme(spec.scheme);
+}
 function isSharedTokenSpec(spec) {
   return isSharedTokenScheme(spec.scheme);
 }
-async function verifyDelivery(trigger, delivery, secret, now) {
+async function verifyDelivery(trigger, delivery, secret, now, oidc) {
   const spec = trigger.verification;
   if (!spec) {
     return {
@@ -2265,6 +2515,14 @@ async function verifyDelivery(trigger, delivery, secret, now) {
   if (isSharedTokenSpec(spec)) {
     return verifySharedToken({ raw: delivery.raw, headers: delivery.headers, secret, scheme: spec.scheme });
   }
+  if (isOidcJwtSpec(spec)) {
+    return verifyOidcDelivery({
+      headers: delivery.headers,
+      scheme: spec.scheme,
+      expected: oidc,
+      ...now === void 0 ? {} : { now }
+    });
+  }
   const kind = spec.scheme.kind ?? "hmac";
   if (kind !== "hmac") {
     return {
@@ -2313,6 +2571,7 @@ function hasDelivery(value) {
   CONNECTOR_API_VERSION,
   CONNECTOR_MODES,
   CREDENTIAL_SCOPES,
+  CURSOR_READ_REASONS,
   ConnectorAmbiguous,
   ConnectorApiMismatch,
   ConnectorAuthError,
@@ -2324,6 +2583,7 @@ function hasDelivery(value) {
   ConnectorRequestError,
   ConnectorTransient,
   ConnectorUnreachable,
+  CursorReadError,
   DEFAULT_IDEMPOTENCY_WINDOW_SECONDS,
   DEFAULT_RETRY,
   DELIVERY_DECODE_KINDS,
@@ -2331,9 +2591,13 @@ function hasDelivery(value) {
   FAKE_EPOCH,
   FORM_FIELD_JSON_REASONS,
   FormFieldJsonError,
+  JWT_ALGORITHMS,
   MAX_IDEMPOTENCY_KEY_LENGTH,
   NO_IDEMPOTENCY_KEY_WARNING,
+  OIDC_JWT_SCHEME_KIND,
   PROBLEM_SEVERITIES,
+  PUBSUB_PUSH_REASONS,
+  PubSubPushError,
   RENDERER_VERSION,
   REVIEW_STALE_DAYS,
   SANDBOX_KINDS,
@@ -2354,6 +2618,7 @@ function hasDelivery(value) {
   constantTimeEquals,
   decodeDelivery,
   decodeFormFieldJson,
+  decodePubSubPush,
   deliver,
   fakeRequest,
   fakeValues,
@@ -2365,6 +2630,8 @@ function hasDelivery(value) {
   httpFailure,
   idempotencyKeyFor,
   isEmptyPayload,
+  isOidcJwtScheme,
+  isOidcJwtSpec,
   isRemote,
   isSharedTokenScheme,
   isSharedTokenSpec,
@@ -2385,6 +2652,7 @@ function hasDelivery(value) {
   probe,
   providerProblems,
   providerSandboxIsSelectable,
+  readWithCursor,
   registerConnectionHost,
   registerTransport,
   render,
@@ -2411,6 +2679,8 @@ function hasDelivery(value) {
   utf8Length,
   verifyDelivery,
   verifyHmac,
+  verifyJwt,
+  verifyOidcDelivery,
   verifySharedToken,
   withResolvedLimit
 });