@particle-academy/fancy-connector-core 0.8.0 → 0.8.1

package/dist/index.d.cts

@@ -2333,6 +2333,15 @@ type WebhookVerification = {
     reason: string;
 };
 type HmacScheme = {
+    /**
+     * Optional and always `"hmac"`: every scheme written before 0.8.0 omits it
+     * and still means HMAC. It exists so `verifyDelivery` dispatches on a NAMED
+     * kind — `"shared-token"`, `"hmac"` or absent — and refuses any other value
+     * by name, rather than treating "has no kind" as HMAC forever. (Fancy's
+     * alignment review of 0.8.0: a third scheme that forgot its kind would
+     * otherwise be verified as HMAC, silently.)
+     */
+    kind?: "hmac";
     /** Hash to use. */
     algorithm: "SHA-256" | "SHA-1" | "SHA-512";
     /**

package/dist/index.d.ts

@@ -2333,6 +2333,15 @@ type WebhookVerification = {
     reason: string;
 };
 type HmacScheme = {
+    /**
+     * Optional and always `"hmac"`: every scheme written before 0.8.0 omits it
+     * and still means HMAC. It exists so `verifyDelivery` dispatches on a NAMED
+     * kind — `"shared-token"`, `"hmac"` or absent — and refuses any other value
+     * by name, rather than treating "has no kind" as HMAC forever. (Fancy's
+     * alignment review of 0.8.0: a third scheme that forgot its kind would
+     * otherwise be verified as HMAC, silently.)
+     */
+    kind?: "hmac";
     /** Hash to use. */
     algorithm: "SHA-256" | "SHA-1" | "SHA-512";
     /**

package/dist/index.js

@@ -1676,6 +1676,13 @@ async function verifyDelivery(trigger, delivery, secret, now) {
   if (isSharedTokenSpec(spec)) {
     return verifySharedToken({ raw: delivery.raw, headers: delivery.headers, secret, scheme: spec.scheme });
   }
+  const kind = spec.scheme.kind ?? "hmac";
+  if (kind !== "hmac") {
+    return {
+      ok: false,
+      reason: `${trigger.service}.${trigger.operation} declares a verification scheme "${kind}" this runtime does not know \u2014 refusing rather than guessing.`
+    };
+  }
   const rawHeader = header2(delivery.headers, spec.signatureHeader);
   const parsed = spec.parse && rawHeader ? spec.parse(rawHeader) : { signature: rawHeader };
   const timestamp = parsed.timestamp ?? (spec.timestampHeader ? header2(delivery.headers, spec.timestampHeader) : void 0);